• 1 Post
  • 4 Comments
Joined 3 months ago
cake
Cake day: June 29th, 2024

help-circle


  • The dual root partitions we described in Deepin 20.5 are gone, but version 23 still sets up a moderately complex partitioning scheme, including an EFI system partition, a 1.5 GB /boot partition, a swap partition, and a 15 GB root partition, and the rest of the disk given to a partition labeled _dde_data. All are in plain old ext4 format, but there’s some magic being done with the data partition that we didn’t have time to trace. It appears to be mounted at multiple places, including /home/var/opt, and a mount point called /persistent beneath them all. We’re not sure exactly how it’s been done, but the distro has some kind of atomic installation facility with rollback.

    Lack of proper documentation by Deepins Devs is enough of a red flag for me to never consider trying it.


  • It‘s not only about using the tpm to unlock the FDE, you should be able to do that on every distro with systemd-cryptenroll. The part that is new, is the the measuring of the systems integrity. It’s a way to ensure that the firmware has not been tampered with, the boot loader is the one that was installed and has not been replaced, that the kernel is exactly the one that comes from the distribution, that the kernel command line is the one that we expect, and that the initrd that is used does not contain any extra binary that we do not control.