diff options
| author | Sean Whitton <spwhitton@spwhitton.name> | 2018-02-14 13:03:29 -0700 |
|---|---|---|
| committer | Sean Whitton <spwhitton@spwhitton.name> | 2018-02-14 13:03:29 -0700 |
| commit | 0bf5e55fc6587ff26433b594e1d07d08cd3a5685 (patch) | |
| tree | 9772c2e3cd08a0a768e259f6f4508e1da473927c /blog/entry/evilmaid.mdwn | |
| parent | 4b15efccb4c1bba2bcc0a7c7a3cdbb4e72428d57 (diff) | |
| download | wiki-0bf5e55fc6587ff26433b594e1d07d08cd3a5685.tar.gz | |
note about MBR/GPT
Diffstat (limited to 'blog/entry/evilmaid.mdwn')
| -rw-r--r-- | blog/entry/evilmaid.mdwn | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/blog/entry/evilmaid.mdwn b/blog/entry/evilmaid.mdwn index dda548d..0864173 100644 --- a/blog/entry/evilmaid.mdwn +++ b/blog/entry/evilmaid.mdwn @@ -106,10 +106,12 @@ always be mounted. If we are using BIOS, the evil maid reoccurs since it is not that much harder to modify the code in the post-MBR gap or the BIOS boot partition. -My proposed solution, pending UEFI Secure Boot, is to use BIOS boot, -keep `/boot` in the encrypted root partition and `grub-install` to the -USB drive. Then set the laptop's boot order to never try to boot from -the HDD, only from USB. +My proposed solution, pending UEFI Secure Boot, is to use BIOS boot +with a MBR partition table, keep `/boot` in the encrypted root +partition and `grub-install` to the USB drive. Then set the laptop's +boot order to never try to boot from the HDD, only from USB. (There's +no real advantage of GPT with my simple partitioning setup but I think +that would also work fine.) How does this solve the various issues I've raised? Well, the amount of code on the USB drive is very small (less than 1MiB) so it is much |