2018-08-28 09:25:03 +02:00
|
|
|
# FedoraBook
|
|
|
|
|
|
2018-09-05 12:55:22 +02:00
|
|
|
Let's put all the fancy features together, we developed in the last years:
|
2018-09-05 12:56:52 +02:00
|
|
|
|
2018-09-05 12:55:22 +02:00
|
|
|
- Combined kernel+initramfs EFI binaries
|
|
|
|
|
- Secure Boot
|
|
|
|
|
- clevis with TPM2
|
|
|
|
|
- LUKS2
|
|
|
|
|
- dm-verity + squashfs root
|
|
|
|
|
- Flatpak
|
|
|
|
|
- flickerless boot
|
2018-09-05 12:56:52 +02:00
|
|
|
|
2018-09-05 12:55:22 +02:00
|
|
|
and build a Chromebook like Fedorabook, where you can install all software via Flatpak.
|
|
|
|
|
|
2018-09-05 13:14:58 +02:00
|
|
|
This is WIP. Please test and report issues, comments or missing components on https://pagure.io/Fedorabook/issues
|
2018-08-28 09:25:03 +02:00
|
|
|
|
2018-09-05 12:37:00 +02:00
|
|
|
## Goals
|
|
|
|
|
- secure boot to the login screen
|
2018-09-05 12:55:22 +02:00
|
|
|
- immutable /usr and maybe /etc
|
2018-09-05 12:37:00 +02:00
|
|
|
- ensured integrity to the login screen
|
|
|
|
|
- encrypted volatile data
|
|
|
|
|
- A/B boot switching for updates
|
|
|
|
|
- Flatpak
|
|
|
|
|
- basic desktop
|
|
|
|
|
- optional: bind encrypted data partition to TPM2
|
|
|
|
|
- optional: frequent reencryption of the data partition
|
|
|
|
|
|
|
|
|
|
## Non-Goals
|
|
|
|
|
- can't secure against someone writing anything to disk
|
|
|
|
|
- can't secure against someone scraping secret keys from the kernel
|
|
|
|
|
|
|
|
|
|
## TODO
|
|
|
|
|
- merge mkimage.sh and clonedisk
|
2018-09-05 12:55:22 +02:00
|
|
|
- change partition UUIDs for /data
|
2018-09-05 12:56:52 +02:00
|
|
|
* UUID for TPM LUKS
|
|
|
|
|
* UUID for LUKS
|
|
|
|
|
* UUID for unencrypted xfs
|
2018-09-05 13:14:58 +02:00
|
|
|
- ensure /data to be on same disk as root
|
|
|
|
|
- add "load=<efipath>" to kernel command line via efi stub
|
2018-09-05 12:37:00 +02:00
|
|
|
- update mechanism
|
2018-09-05 12:55:22 +02:00
|
|
|
- add proper EFI boot manager entries for A and B
|
|
|
|
|
- extend efi stub for recovery boot in the old image
|
2018-09-05 12:37:00 +02:00
|
|
|
- signing tools
|
2018-09-05 12:55:22 +02:00
|
|
|
- firmware update
|
|
|
|
|
- selinux?
|
|
|
|
|
|
|
|
|
|
## Known Failures
|
|
|
|
|
- gnome-software: can't update firmware repo
|
2018-09-05 13:16:05 +02:00
|
|
|
- systemd: failed to umount /var
|
2018-09-05 12:37:00 +02:00
|
|
|
|
2018-08-28 09:25:03 +02:00
|
|
|
## Create
|
|
|
|
|
|
|
|
|
|
```bash
|
|
|
|
|
$ sudo ./prepare-root.sh \
|
2018-09-05 12:30:39 +02:00
|
|
|
--releasever 29 \
|
2018-08-28 09:25:03 +02:00
|
|
|
--pkglist pkglist.txt \
|
|
|
|
|
--excludelist excludelist.txt \
|
|
|
|
|
--logo logo.bmp --name FEDORABOOK \
|
|
|
|
|
--outdir <IMGDIR>
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## QEMU disk image
|
|
|
|
|
```bash
|
2018-09-05 12:37:00 +02:00
|
|
|
$ sudo ./mkimage.sh <IMGDIR> image.raw
|
2018-08-28 09:25:03 +02:00
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## USB stick
|
|
|
|
|
```bash
|
2018-09-05 12:37:00 +02:00
|
|
|
$ sudo ./mkimage.sh <IMGDIR> /dev/disk/by-path/pci-…-usb…
|
2018-08-28 09:25:03 +02:00
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## Install from USB stick
|
|
|
|
|
|
|
|
|
|
- Enter BIOS
|
2018-09-05 12:57:41 +02:00
|
|
|
* turn on UEFI boot
|
|
|
|
|
* turn on TPM2
|
2018-08-28 09:25:03 +02:00
|
|
|
- Enter BIOS boot menu
|
|
|
|
|
- Select USB stick
|
|
|
|
|
- Login (user: admin, pw: admin)
|
|
|
|
|
- Start gnome-terminal
|
|
|
|
|
- sudo
|
|
|
|
|
- ```clonedisk <usb stick device> <harddisk device>```
|
|
|
|
|
- reboot
|
|
|
|
|
- remove stick
|
2018-09-05 12:55:22 +02:00
|
|
|
|
|
|
|
|
## Post Boot
|
|
|
|
|
|
|
|
|
|
### Persistent journal
|
|
|
|
|
```bash
|
|
|
|
|
$ sudo mkdir /var/log/journal
|
|
|
|
|
```
|
|
|
|
|
|
