On Wed, Dec 8, 2021 at 7:52 AM Lennart Poettering <mzerqung(a)0pointer.de> wrote:
On Di, 07.12.21 15:39, Zbigniew Jędrzejewski-Szmek (zbyszek(a)in.waw.pl) wrote:
> Latest systemd versions have been getting some support for the low-level
> parts, i.e. the low-level encrypted-secret storage. But we're missing the
> upper parts, i.e. how to actually use and update the passwords. I didn't
> even mention this, because we don't have a comprehensive story yet.
> I think it'd be necessary to write some pam module and/or authentication
> helper from scratch. It's probably not too much work, but nobody has
> signed up to do this.
So here's what I'd suggest: let's define a group (my suggestion: let's
repurpose "wheel" for that) that has the effect that the passwords of
any user in it are also accepted as password for the root user,
implicitly. We'd have to add some small infra to collect these
passwords, and encrypt/sign them with TPM2, then propagate to the ESP
or to some EFI var or so, so that they can be honoured already in the
initrd.
I'm skeptical of any TPM2 dependency because systems still do not come
with them, in particular the significant minority of systems that are
not part of the "made for Windows" marketing program that compels
manufacturers to follow the Windows Hardware Compatibility Program.
And yes you can install Windows 11 without a TPM, it just won't be
preinstalled, and that make/model doesn't qualify for whatever Windows
marketing programs OEM's get for having certified hardware. That's
aside from the fact there's TPM 2.0 in hardware today that the kernel
doesn't support and likely won't ever support.
--
Chris Murphy