Installing Trisquel GNU/Linux with full disk encryption (including /boot)

+ Because GRUB is installed directly as a payload of libreboot (or coreboot), you don't need an unencrypted /boot partition + when setting up an encrypted system. This means that your machine can really secure data while powered off. +

+ This works in Trisquel 7, and probably Trisquel 6. Boot the 'net installer' (Install Trisquel in Text Mode). How to boot a GNU/Linux installer. +

+ Set a strong user password (ideally above 40 characters, of lowercase/uppercase, numbers and symbols) and when the installer asks you to setup + encryption (ecryptfs) for your home directory, select 'Yes'. +

+ + Your user password should be different than the LUKS password which you will set later on. + Your LUKS password should, like the user password, be secure. + +

Partitioning

Further partitioning

+ Now you are back at the main partitioning screen. You will simply set mountpoints and filesystems to use. +

Kernel

Tasksel

+ Just continue here, without selecting anything. You can install everything later (it's really easy). +

Install the GRUB boot loader to the master boot record

+ Choose 'Yes'. It will fail, but don't worry. Then at the main menu, choose 'Continue without a bootloader'. +

+ You do not need to install GRUB at all, since in libreboot you are using the GRUB payload (for libreboot) to boot your system directly. +

Clock UTC

+ Booting your system +

+ At this point, you will have finished the installation. At your GRUB payload, press C to get to the command line. +

+ Do that:
+ grub> cryptomount -a (ahci0,msdos1)
+ grub> set root='lvm/buzz-distro'
+ grub> linux /vmlinuz root=/dev/mapper/buzz-distro cryptdevice=/dev/mapper/buzz-distro:root quiet splash ro
+ grub> initrd /initrd.img
+ grub> boot +

+ ecryptfs +

+ Immediately after logging in, do that:
+ $ sudo ecryptfs-unwrap-passphrase +

+ This will be needed in the future if you ever need to recover your home directory from another system, so write it down and keep the note + somewhere secret. Ideally, you should memorize it and then burn the note (or not even write it down, and memorize it still)> +

+ Modify grub.cfg (CBFS) +

+ Now you need to set it up so that the system will automatically boot, without having to type a bunch of commands. +

+ Modify your grub.cfg (in the firmware) using this tutorial; + just change the default menu entry 'Load Operating System' to say this inside: +

+ cryptomount -a (ahci0,msdos1)
+ set root='lvm/buzz-distro'
+ linux /vmlinuz root=/dev/mapper/buzz-distro cryptdevice=/dev/mapper/buzz-distro:root quiet splash ro
+ initrd /initrd.img +

+ Additionally, you should set a GRUB password. This is not your LUKS password, but it's a password that you have to enter to see + GRUB. This protects your system from an attacker simply booting a live USB and re-flashing your firmware. This should be different than your LUKS passphrase and user password. +

+ Give it a password (remember, it has to be secure) and it'll output something like:
+ grub.pbkdf2.sha512.10000.711F186347156BC105CD83A2ED7AF1EB971AA2B1EB2640172F34B0DEFFC97E654AF48E5F0C3B7622502B76458DA494270CC0EA6504411D676E6752FD1651E749.8DD11178EB8D1F633308FD8FCC64D0B243F949B9B99CCEADE2ECA11657A757D22025986B0FA116F1D5191E0A22677674C994EDBFADE62240E9D161688266A711 +

+ Put that in the grub.cfg (the one for CBFS inside the ROM) before the 'Load Operating System' menu entry like so (example):
+

+ Obviously, replace it with the correct hash that you actually got for the password that you entered. Meaning, not the hash that you see above! +

+ After this, you will have a modified ROM with the menu entry for cryptomount, and the entry before that for the GRUB password. Flash the modified ROM + using this tutorial. +

+ Update Trisquel +

+ At the time of writing, Trisquel 7 had this + bug from upstream. The workaround identified in this page + was as follows:
+ $ sudo apt-get remove libpam-smbpass +

+ Install a desktop (optional) +

+ Next time you boot, it'll start lightdm and you can login. To start lightdm now, do:
+ $ sudo service lightdm start +

+ Since you installed using net install and you only installed the base system, network-manager isn't controlling + your eth0 but instead /etc/network/interfaces is. Comment out the eth0 lines in that file, and then do:
+ $ sudo /etc/init.d/networking stop
+ $ sudo service network-manager restart +

+ Conclusion +

+ If you followed all that correctly, you should now have a fully encrypted system. +

+ Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
+ This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt. +

+ This document is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See ../license.txt for more information. +

Troubleshooting

debian-installer (trisquel net install) graphical corruption in text-mode

+ When using the ROM images that use coreboot's "text mode" instead of the coreboot framebuffer, + booting the Trisquel net installer results in graphical corruption because it is trying to switch to a framebuffer which doesn't + exist. Use that kernel parameter on the 'linux' line when booting it:
+ vga=normal fb=false +

+ Tested in Trisquel 6 (and 7). This forces debian-installer to start in text-mode, instead of trying to switch to a framebuffer. +

+ If selecting text-mode from a GRUB menu created using the ISOLINUX parser, you can press E on the menu entry to add this. + Or, if you are booting manually (from GRUB terminal) then just add the parameters. +

+ This workaround was found on the page: https://www.debian.org/releases/stable/i386/ch05s04.html. + It should also work for gNewSense, Debian and any other apt-get distro that provides debian-installer (text mode) net install method. +

- Copyright © 2014 Francis Rowe, All Rights Reserved.
- See ../license.html for license conditions. + Copyright © 2014 Francis Rowe <info@gluglug.org.uk>
+ This document is released under the Creative Commons Attribution-ShareAlike 4.0 International Public License and all future versions. + A copy of the license can be found at ../license.txt.

Download libreboot_src.tar.gz or libreboot_bin.tar.gz from http://libreboot.org/ -
If you downloaded libreboot_meta.tar.gz, refer to ../index.html#build_meta before continuing. +
If you downloaded libreboot from git, refer to ../index.html#build_meta before continuing.

- On apt-get distributions such as Trisquel you can install the build dependency (GCC) by running:
- $ sudo apt-get install build-essential + First, install the build dependencies.

+ If you currently have flashed a ROM image from an older version, it is recommended to update first: basically, modify one of the latest ROM's + and then flash it. +

- The libreboot_usqwerty.rom file contains your grub.cfg. + The libreboot_usqwerty.rom file contains your grub.cfg, along with a copy called grubtest.cfg. + You should extract, modify and re-insert the copy first. grub.cfg will load first, but it has a menu entry for switching to the copy (grubtest.cfg). + This reduces your chance of making a mistake that could make your machine unbootable (or very hard to boot).

Extract grub.cfg from the ROM:
- $ ./cbfstool libreboot_usqwerty.rom extract -n grub.cfg -f grub.cfg + $ ./cbfstool libreboot_usqwerty.rom extract -n grubtest.cfg -f grubtest.cfg

- Now you have a grub.cfg in cbfstool directory. Edit it however you wish. + Now you have a grubtest.cfg in cbfstool directory. Edit it however you wish. +

+ +

Example modification (Trisquel GNU/Linux, can also be adapted, or copied, for other apt-get distros)

+ +

+ Look at the 3 lines under the menu entry 'Load Operating System'; these are all you need to change. +

+ +

+ As an example, on my test system in /boot/grub/grub.cfg I see for the main menu entry: + linux /boot/vmlinuz-3.15.1-gnu.nonpae root=UUID=3a008e14-4871-497b-95e5-fb180f277951 ro crashkernel=384M-2G:64M,2G-:128M quiet splash $vt_handoff + initrd /boot/initrd.img-3.15.1-gnu.nonpae +

+ +

+ crashkernel=384M-2G:64M,2G-:128M and $vt_handoff can be safely ignored. +

+ +

+ I use this to get my partition layout:
+ $ lsblk +

+ +

+ In my case, I have no /boot partition, instead /boot is on the same partition as / on sda1. Yours might be different. + In GRUB terms, sda means ahci0. 1 means msdos1, or gpt1, depending on whether I am using MBR or GPT partitioning. + Thus, /dev/sda1 is GRUB is (ahci0,msdos1) or (ahci0,gpt1). In my case, I use MBR partitioning so it's (ahci0,msdos1). + 'msdos' is GRUB's name simply because this partitioning type is traditionally used by MS-DOS. It doesn't mean you have a + proprietary OS. +

+ +

+ Trisquel doesn't keep the filenames of kernels consistent, instead it keeps old kernels and new kernel updates are provided + with the version in the filename. This can make GRUB payload a bit tricky. Fortunately, there are symlinks /vmlinuz and /initrd.img + so if your /boot and / are on the same partition, you can set GRUB to boot from that. These are also updated automatically when + installing kernel updates from your distributions apt-get repositories. + NOte: when using jxself.org/linux-libre kernels, these are not updated at all and you have to update them manually. +

+ +

+ For the GRUB payload's grub.cfg (in 'Load Operating System' menu entry), we therefore have (in this example):
+ set root='ahci0,msdos1'
+ linux /vmlinuz root=UUID=3a008e14-4871-497b-95e5-fb180f277951 ro quiet splash
+ initrd /initrd.img +

+ +

+ Optionally, you can convert the UUID to it's real device name, for example /dev/sda1 in this case. + sdX naming isn't very reliable, though, which is why UUID is used for most distributions. +

+ +

+ Alternatively, if your /boot is on a separate partition then you cannot rely on the /vmlinuz and /initrd.img symlinks. + Instead, go into /boot and create your own symlinks (update them manually when you install a new kernel update).
+ $ sudo -s
+ # cd /boot/
+ # rm -rf vmlinuz initrd.img
+ # ln -s kernel ksym
+ # ln -s initrd isym
+ # exit +

+ +

+ Replace the underlined kernel and initrd filenames above with the actual filenames, of course. +

+ +

+ Then your grub.cfg menu entry (for payload) becomes like that, for example if / was on sda2 and /boot was on sda1:
+ set root='ahci0,msdos1'
+ linux /ksym root=/dev/sda2 ro quiet splash
+ initrd /isym +

+ +

+ There are lots of possible variations so please try to adapt. +

+ +

Parabola GNU/Linux-libre

+ +

+ You can basically adapt the above. Note however that Parabola does not keep old kernels still installed, and the file names + are always consistent, so you don't need to boot from symlinks, you can just use the real thing directly. +

+ +

+ Delete the grubtest.cfg that remained inside the ROM:
+ $ ./cbfstool libreboot_usqwerty.rom remove -n grubtest.cfg +

+ Display ROM contents and now you see grubtest.cfg no longer exists there:
+ $ ./cbfstool libreboot_usqwerty.rom print +

+ Add the modified version that you just made:
+ $ ./cbfstool libreboot_usqwerty.rom add -n grubtest.cfg -f grubtest.cfg -t raw +

+ Now display ROM contents again and see that it exists again:
+ $ ./cbfstool libreboot_usqwerty.rom print +

+ Now you have a modified ROM. Refer back to ../index.html#flashrom for information + on how to flash it. +

+ Choose (in GRUB) the menu entry that switches to grubtest.cfg. If it works, then your config is safe and you can continue below. +

Anecdotally, a user reported that segmentation faults occur with cbfstool when using this procedure depending on the size of the grub.cfg being re-insterted. In his case, a minimum size of 857 bytes was required. This could (at the time of this release) be a bug in cbfstool that should be investigated with the coreboot community. If cbfstool segfaults, then keep this in mind. 'strace' (or gdb? clang?) could be used for debugging. This was in libreboot 5th release (based on coreboot from late 2013). Not sure if the issue perists in the 6th release (based on coreboot from June 1st, 2014 at the time of writing); I have never personally encountered the bug. strace (from that user) is here: cbfstool_libreboot5_strace. The issue has been reported by a few users, so does not happen all the time: this bug (if it still exists) could (should) be reproduced.

+ Further reading material (software security) +

References

[1] physical access

+ Further reading material (software security) +

References

[1] physical access