1
1
Fork
You've already forked bootc
1

Security: Setup encrypted swap partition #50

Open
opened 2025年02月01日 21:01:41 +01:00 by boredsquirrel · 2 comments

I just learned about this, it is very simple and secure.

Swap is only there to store overflow memory during boot. A reboot should not keep any swap. Aka, swap needs to be encrypted.

If it isnt, even if you dont encrypt your disk, stuff like decrypted password databases stored in memory could overflow to swap and cause data leaks.

The setup

  • format a swap partition with a simple linux filesystem. It should have no CoW, checksumming, journaling etc, as these cause slowdowns and make no sense for swap
  • examples: EXT2, maybe F2FS too. Others work too but are less performant.
  • encrypt swap with dm-crypt on every boot, using a random key from /dev/urandom. This ensures password strength and avoids cracking the swap in the future, as the key always changes!

It is so easy.

Use such a file, in /etc/dmcrypt

https://codeberg.org/Inferencium/cfg/src/branch/stable/aa000-0/dmcrypt

# Inferencium - aa000-0
# dm-crypt - Configuration
# Version: 3.0.0
# Copyright 2023 Jake Winters
# SPDX-License-Identifier: BSD-3-Clause
# Global
## How long to wait for each timeout (in seconds)
dmcrypt_key_timeout="1"
## Max number of checks to perform (see dmcrypt_key_timeout)
#dmcrypt_max_timeout="300"
# Number of password retries
dmcrypt_retries="5"
# swap
## These should come first so no keys make their way into unencrypted swap.
swap="swap"
source="PARTUUID=[REDACTED]"
options="--offset 2048 --cipher aes-xts-plain64 --key-size 512 --key-file /dev/urandom"

In /etc/fstab, the linux partition should be registered as swap. zram (zstd compressed swap) should also work. This will ensure that the partition is mounted to be used as swap.


I am not sure about the implementation yet, but it is a simple and important fix

I just learned about this, it is very simple and secure. Swap is only there to store overflow memory during boot. A reboot should not keep any swap. Aka, swap needs to be encrypted. If it isnt, even if you dont encrypt your disk, stuff like decrypted password databases stored in memory could overflow to swap and cause data leaks. ### The setup - format a swap partition with a simple linux filesystem. It should have no CoW, checksumming, journaling etc, as these cause slowdowns and make no sense for swap - examples: EXT2, maybe F2FS too. Others work too but are less performant. - encrypt swap with dm-crypt on every boot, using a random key from /dev/urandom. This ensures password strength and avoids cracking the swap in the future, as the key always changes! It is so easy. Use such a file, in `/etc/dmcrypt` https://codeberg.org/Inferencium/cfg/src/branch/stable/aa000-0/dmcrypt ``` # Inferencium - aa000-0 # dm-crypt - Configuration # Version: 3.0.0 # Copyright 2023 Jake Winters # SPDX-License-Identifier: BSD-3-Clause # Global ## How long to wait for each timeout (in seconds) dmcrypt_key_timeout="1" ## Max number of checks to perform (see dmcrypt_key_timeout) #dmcrypt_max_timeout="300" # Number of password retries dmcrypt_retries="5" # swap ## These should come first so no keys make their way into unencrypted swap. swap="swap" source="PARTUUID=[REDACTED]" options="--offset 2048 --cipher aes-xts-plain64 --key-size 512 --key-file /dev/urandom" ``` In /etc/fstab, the linux partition should be registered as swap. zram (zstd compressed swap) should also work. This will ensure that the partition is mounted to be used as swap. --- I am not sure about the implementation yet, but it is a simple and important fix
Owner
Copy link

Swap encryption is great. My main concern is that it should be enabled or disabled with a single script for each.

If we're modifying /etc/fstab, be careful and use a pattern similar to:

sed -i 's,# .bashrc,# .bashrc\nsource /usr/share/heliumos/feature/homebrew/env.sh # heliumos-homebrew DO NOT MODIFY\n,g' $HOME/.bashrc
sed -i '/heliumos-homebrew/d' $HOME/.bashrc
Swap encryption is great. My main concern is that it should be enabled or disabled with a single script for each. If we're modifying /etc/fstab, be careful and use a pattern similar to: https://codeberg.org/HeliumOS/bootc/src/commit/cf769bd3555e12383feaaa9d9f44162a95a7dcda/10/system_root/usr/bin/heliumos-homebrew-enable#L9 https://codeberg.org/HeliumOS/bootc/src/commit/cf769bd3555e12383feaaa9d9f44162a95a7dcda/10/system_root/usr/bin/heliumos-homebrew-disable#L6

@imbev absolutely! I did the script with the help of a friend and ask them to help with that

@imbev absolutely! I did the script with the help of a friend and ask them to help with that
Sign in to join this conversation.
No Branch/Tag specified
dev
release
No results found.
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
HeliumOS/bootc#50
Reference in a new issue
HeliumOS/bootc
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?