I’m a somewhat intermediate linux user and i’m interested in getting an answer to a specific scenario which i couldn’t find by searching. Any help you can provide or light you can shed on this subject is immensely appreciated.
Consider an installation with TWO partitions:
vFAT partition for ESP/UEFI
LUKS encrypted volume with a BTRFS partition for the system (including /boot). This will include multiple subvolumes but /boot will remain on the root subvolume, so i don’t think the other details change my question.
Now, since /boot is encrypted, we set grub to cryptomount it which will ask the user to enter the passphrase to find initramfs and continue. In order to avoid having to enter the passphrase twice, we enroll the key in TPM so that grub can continue mounting / unhindered.
My question is this, if someone gains physical access to the device. Is there a way they can circumvent the initial passphrase request (possibly using usb boot media, or a crafted initramfs) and still get TPM to release the key anyway? My understanding of how TPM physically works is limited, so pardon me if this obvious.
Why in the world would anyone want to encrypt /boot as well as having it within btrfs?
That simply adds a lot of complexity to the boot and system operation that IMHO is totally unnecessary. /boot only contains the kernel and other files necessary to load the kernel, but with / encrypted it is still necessary to unlock the root file system before the machine can be booted.
AFAIK absolutely nothing that is in /boot or /boot/efi is an any way security related, unlike your question about TPM which may be accessible when booting from USB.
The points you raise are completely valid. However, encrypting /boot isn’t the goal here, it’s a by-product of including it in the root subvolume. I need it set up that way to ensure /boot contents are included in system roll-backs.
I don’t think you’ve understood all attack vectors against which encryption can help. By your reasoning, secure boot would be pointless, too.
Encrypting root without encrypting /boot protects your data against the attack vector “loss” (theft etc). It does not protect you against the attack vector “tamper” (device left unattended) where someone tampering with /boot can circumvent everything on your next boot and login.
Indeed, if “tamper” is your only concern, then there’s not much point in encrypting root unless you encrypt /boot as well.