Owen Taylor, creator of GNOME Shell and the Pango library, a member of the Fedora Workstation development group, has proposed a plan for default encryption of system partitions and user home directories in Fedora Workstation. The benefits of switching to default encryption include data protection in case of laptop theft, protection against attacks on unattended devices, and maintenance of privacy and integrity out of the box without the need for additional manipulations. <\/p>\n
According to the draft plan prepared for encryption, Btrfs fscrypt is planned to be used. For system partitions, the encryption keys are proposed to be stored in the TPM module and linked to digital signatures used to verify the integrity of the bootloader, kernel, and initrd (i.e., at the system boot stage, the user will not need to enter a password to decrypt the system partitions). When encrypting home directories, keys are planned to be generated based on the user's login and password (the connection to the encrypted home directory will be made at the time the user logs into the system). <\/p>\n
The timeline for implementing this initiative depends on the distribution's transition to a unified UKI (Unified Kernel Image), which combines a kernel boot handler from UEFI (UEFI boot stub), the Linux kernel image, and the initrd in memory. Without UKI support, it is impossible to guarantee the integrity of the initrd environment, where keys for decrypting the file system are determined (for example, an attacker can substitute initrd and simulate a password request; to avoid this, a verified boot of the entire chain is required before mounting the file system). <\/p>\n
V aktu\u00e1lnom stave m\u00e1 in\u0161tal\u00e1tor Fedora mo\u017enos\u0165 \u0161ifrova\u0165 partition na blokovej \u00farovni pomocou dm-crypt s pou\u017eit\u00edm samostatnej heslovej fr\u00e1zy, ktor\u00e1 nie je viazan\u00e1 na pou\u017e\u00edvate\u013esk\u00fd \u00fa\u010det. Toto rie\u0161enie sa pot\u00fdka s probl\u00e9mami, ako je nevhodnos\u0165 pre oddelen\u00e9 \u0161ifrovanie v multiu\u017e\u00edvate\u013esk\u00fdch syst\u00e9moch, absencia podpory internacionaliz\u00e1cie a prostriedkov pre \u013eud\u00ed so zrakov\u00fdm postihnut\u00edm, mo\u017enos\u0165 vykonania \u00fatokov podvodom s bootloaderom (nain\u0161talovan\u00fd \u00fato\u010dn\u00edkom m\u00f4\u017ee predstiera\u0165 origin\u00e1lny bootloader a po\u017eiada\u0165 o heslo na de\u0161ifrovanie), potreba podpory framebufferu v initrd na zobrazenie po\u017eiadavky na heslo. \u041e\u0443\u044d\u043d \u0422\u0435\u0439\u043b\u043e\u0440 (Owen Taylor), \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c GNOME Shell \u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 Pango, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0432 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0443 \u043f\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044e Fedora \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0441\u0442\u0430\u043d\u0446\u0438\u0439, \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u043b\u0430\u043d \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0440\u0430\u0437\u0434\u0435\u043b\u043e\u0432 \u0438 \u0434\u043e\u043c\u0430\u0448\u043d\u0438\u0445 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 Fedora Workstation. \u0418\u0437 \u043f\u043b\u044e\u0441\u043e\u0432 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0430 \u043a \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044e \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043d\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0437\u0430\u0449\u0438\u0442\u0430 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043a\u0440\u0430\u0436\u0438 \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u0430, \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u0430\u0442\u0430\u043a \u043d\u0430 \u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107724","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Fedora zva\u017euje mo\u017enos\u0165 pou\u017e\u00edvania predvolen\u00e9ho \u0161ifrovania FS | ProHoster","description":"Owen Taylor, tvorca GNOME Shell a kni\u017enice Pango, ktor\u00fd je \u010dlenom pracovnej skupiny pre rozvoj Fedora pre pracovn\u00e9 stanice, predlo\u017eil na diskusiu pl\u00e1n pre predvolen\u00e9 \u0161ifrovanie syst\u00e9mov\u00fdch partition a osobn\u00fdch prie\u010dinkov.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-fedora-rassmatrivayut-vozmozhnost-primeneniya-shifrovaniya-fs-po-umolchaniyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Fedora \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0424\u0421 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e | ProHoster","og:description":"\u041e\u0443\u044d\u043d \u0422\u0435\u0439\u043b\u043e\u0440 (Owen Taylor), \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c GNOME Shell \u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 Pango, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0432 \u0440\u0430\u0431\u043e\u0447\u0443\u044e \u0433\u0440\u0443\u043f\u043f\u0443 \u043f\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044e Fedora \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0441\u0442\u0430\u043d\u0446\u0438\u0439, \u0432\u044b\u0441\u0442\u0430\u0432\u0438\u043b \u043d\u0430 \u043e\u0431\u0441\u0443\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u043b\u0430\u043d \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0440\u0430\u0437\u0434\u0435\u043b\u043e\u0432 \u0438 \u0434\u043e\u043c\u0430\u0448\u043d\u0438\u0445.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/v-fedora-rassmatrivayut-vozmozhnost-primeneniya-shifrovaniya-fs-po-umolchaniyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-04-04T16:48:10+00:00","article:modified_time":"2023-04-04T17:05:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/107724","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=107724"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/107724\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=107724"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=107724"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=107724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"