root device / filesystem with TLS protection
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 50
- Forks
- 36
- Avg merge
- 3d 22h
- Merged PRs (30d)
- 2
Description
Ultimately we would like to extend TLS protection to the root filesystem, for instance by supporting NFSROOT with TLS, or by supporting a root filesystem that resides on an NVMe that is protected with TLS. This goal has some special challenges when tlshd uses files that live on the root filesystem that is protected by TLS.
To work around these challenges, it might be possible to place tlshd and authentication material in the initrd, or the AM could placed in non-root storage, such as a TPM. The details need to be worked out, so parking this issue here for further thought and comment.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Start by mapping how tlshd and its authentication material are accessed during root-filesystem setup, then compare the proposed NFSROOT-with-TLS and TLS-protected NVMe paths. Done means resolving the bootstrapping challenge, including whether tlshd belongs in the initrd or authentication material belongs in a TPM.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100