Very Computer

by **root** » Mon, 03 Jul 2000 04:00:00

Hi,

im about to secure my linux box with the SecureFilesystem kernel patch
from kerneli.org.
Im wondering if its possible to run a whole linux on a sfs.
Eg. the kernel boots up asks for the password of the encrypted partition
(losetup -e blablah)
and than mounts the so created /dev/loopX device on / .
Only some etc scripts are needed to boot up and to run losetup and
mount.

My question is, is it possible to unmount / and mount something other on
it.

Bye
A. Rengstorf

by **Piotr Wilk** » Mon, 03 Jul 2000 04:00:00

>My question is, is it possible to unmount / and mount something other on
>it.

While you cannot remount (i.e. unmount and mount something else) the /
partition, you can (AFAIK) use initrd if you want to make your entire
filesystem sfs.

--
Piotr Wilkin

by **elle..** » Mon, 03 Jul 2000 04:00:00

> im about to secure my linux box with the SecureFilesystem kernel patch
> from kerneli.org.
> Im wondering if its possible to run a whole linux on a sfs.
> Eg. the kernel boots up asks for the password of the encrypted partition
> (losetup -e blablah)
> and than mounts the so created /dev/loopX device on / .
> Only some etc scripts are needed to boot up and to run losetup and
> mount.

I think you really want to rethink this plan. Even the fastest block
cipher can put a noticable dent in disk transfer speeds. Encrypting
your shared libraries is going to be alot of extra work for your
machine. Remember too, that Linux uses demand paged executables, so
the text segment is always stored on disk and not in swap.

Speaking of swap, you can't encrypt that, although you could turn it
off. There's also the problem of network connectivity and/or physical
security. Once the machine is booted, anyone will be able to read the
encrypted filesystems if they can access the machine.

I suspect anything you need to do can be done by encrypting /home,
possibly /tmp if you're paranoid. There are also some systems
specifically designed to encrypt home directories, and encrypted
network file systems.

--

Very Computer

Secure Filesystem

Secure Filesystem

Secure Filesystem

Secure Filesystem