diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 7 |
1 files changed, 2 insertions, 5 deletions
@@ -57,12 +57,10 @@ The following notes are for myself so I can remember what hardening features to - Blacklist unnecessary/unused modules for security (Auto detect required modules during install?) - FDE with LUKS (TPM) - [Research needed] User password/separately encrypted home directory (Android-like) (Also TPM?) -- User packages in /opt/yerba-pkg instead of modifying the atomic stuff directly with OverlayFS - Atomic updates with dm-verity - Wayland by default - Chimera userland (chimerautils/FreeBSD ported) -- XBPS package manager -- XBPS config directories on their own separate non-verity (Verity mentioned??) partition +- Homebrew as the default package manager (no system-wide packages! Security™) - Runit init system (minimal attack surface) - Might be changed to OpenRC - Secure Boot (TPM) - Decoy/duress PIN - PAM module, wipe all user-controlled partitions and reboot immediately @@ -78,14 +76,13 @@ The following notes are for myself so I can remember what hardening features to - UKI (Unified Kernel Image) - rootfs - Bootloader entry +- Transient /etc (copied from rootfs on boot to tmpfs and mounted) ### Partitions - **efi** (1GB) | N/A | FAT32 | `/efi` | Stores EFI bootloader files - **boot** (1GB) | N/A | ext4 | `/boot` | Boot, kernels, initramfs, etc. - **nvram** (128MB) | LUKS | FAT32 | `/nvram` | NVRAM for root flags and selected slot -- **pkgconf** (256MB) | LUKS | btrfs + subvol | `/etc/xbps.d`, `/etc/xbps`, `/var/db/xbps`, `/var/cache/xbps` | XBPS configuration and database files -- **yerbapkg** (8GB) | LUKS | ext4 | `/opt/yerba-pkg` | User-installed system-wide packages - **rootfs_A** (15GB) | LUKS + dm-verity (atomic) | btrfs | `/` (if selected slot) | Root filesystem — Slot A - **rootfs_B** (15GB) | LUKS + dm-verity (atomic) | btrfs | `/` (if selected slot) | Root filesystem — Slot B - **userdata** (Rest of disk) | LUKS | btrfs | `/home` | User files |