#dailyreport #secureboot #encyption #dracut #linux #boot
#gentoo #grub #dm-crypt
I installed Gentoo GNU/Linux with full encypted root with
deattached LUKS2 header by GPG encrypted key file at
USB. :-) If you don't understand - it is perfect.
I almost gave up, but suddenly found complete guide from
"Screenager" with hack to Dracut.
It is Grub -> Dracut -> decrupt, mount -> Root.
"plymouth quit" - that is how to get access to Dracut
rd.shell.
I know three ways to boot kernel:
- kexec and chroot from installCD
- Legacy BIOS - MBR record
- UEFI - EFI stub, makes installation even more harder.
Why so much effor? 1) Because this is Ring 0 level of
security. 2) Actually, I have a very good GPG
encryption for a single file with GPG prompt outside of
Windows. I just prove to myself that I can do it.
蠡