4 ms·
The post is excellent. However, if one uses a UKI, is initrd as useful as it was? After all, you could ditch modules and compile directly to kernel, and there'
by yyyk 4y ago
The post is excellent.
However, if one uses a UKI, is initrd as useful as it was? After all, you could ditch modules and compile directly to kernel, and there'd be no space difference whatsoever. Perhaps we could make things simpler if initrd wasn't needed for most systems.
I've been booting initrd-less systems for a long time. It's quite doable but requires a different setup than the default.
- lmm 4y agoCan you do e.g. full disk encryption that way? (And, crucially, do you get a semi-graceful failure mode if the disk encryption fails somehow? Similarly for e.g. network filesystem as root). I can certainly see the value of simplification, but being able to run some kind of userland before you've got your main filesystem up and running has a lot of use cases.
- yyyk 4y agoI use fscrypt, my typical threat case won't be able to break it, and I think the failure mode is more graceful (you can set up alternate methods for decryption, I use a backup password). FDE should be possible with the right kernel support, but not sure this exists today.
- mixmastamyk 4y agoWould like to hear more.
- yyyk 4y agoBooting uses PARTUUID to find the right boot partition (there's a systemd standard for finding the right partition automatically if the right UUID is set, but nothing seems to actually use it? I did set up the right UUID from the standard just to document things). Encryption is via fscrypt, which isn't as good as FDE - not sure if FDE is impossible here, but I think this is enough security for the typical adversary. If a three-letter agency was a threat, I'd be toast anyway. Custom kernels: Module loading is disabled - I've enabled everything that a normal install would load and added some netfilter things. Firmware is compiled into kernel too. Of course custom key is used for secure boot.
- mixmastamyk 4y agoNeat thanks. Was just setting up a new system and was kinda dismayed initrd is still a thing.
- mjg59 4y agoYes - the idea is that modules can be pre-built into a set of add-on images that can be independently signed, and the UKI can pick those up. That way you still only install the module images that are required into the boot partition, rather than having to include all modules in the initramfs.
- goombacloud 4y agoBuilding into the kernel instead of using modules is not perfect because it increases RAM usage when you don't use certain modules compared to having them loaded on demand.
- patrakov 4y agoInitrd is as useful as it was before. It is just combined with the kernel image. You can still ignore the bits of advice from that blog post, and generate the initrd using whatever tool that you want, exactly as before. What is added is just one objcopy command to combine the kernel, the initrd, and the command line into one blob (UKI) that you can boot. You can even sign it with your own Secure Boot key, and it will still work, and be more useful than its components, because now your initrd (reminder: built according to whatever method you want) is cryptographically verified.