Stay Protected with Librem 14’s Latest Pureboot Feature

General Announcements
1
1 Like
2

This new option to hash /root will not work, unfortunatelly, on an encrypted filesystem

3

sure it does, you just supply the LUKS password prior to the check. All Purism Librems ship with an encrypted root filesystem, and we designed this feature with that in mind.

2 Likes
4

I thought this is the case as when I want to create root hashed I receive this:
No valid root disk found

I have Qubes installed. Is it there something I can do to have root hashes?

5

that’s odd, will have to test here and see why that’s happening

6

can I help with something?

7

Same situation on my end for both the Release 19 & Release 20 PureBoot versions. IIRC the error, it stated there was no valid root disk (qubes_dom0-root). Maybe something to do with how Qubes uses LVM?

I haven’t yet troubleshooted this, nor have I read the source for the root FS check in PureBoot yet, so I might be completely off.

Edit:

To spit ball, maybe a temporary fix could be an additional check so to specifically check for qubes_dom0-root in this function:

# check $CONFIG_ROOT_DEV if set/valid
  if [ -e "$CONFIG_ROOT_DEV" ]; then
    if cryptsetup isLuks $CONFIG_ROOT_DEV >/dev/null 2>&1; then
      if cryptsetup luksOpen $CONFIG_ROOT_DEV rootdisk; then
        if mount -o ro /dev/mapper/rootdisk $ROOT_MOUNT >/dev/null 2>&1; then
          if cd $ROOT_MOUNT && ls -d $CONFIG_ROOT_DIRLIST >/dev/null 2>&1; then # CONFIG_ROOT_DEV is valid device and contains an installed OS
            return 0
          fi
        fi
      fi
    fi
  fi
8

Hello, I have problems with the new feature too.
I am using qubes os on a librem 14. When I try to find the root hash I get the error response:
“No valid root disk found”.
Has someone an idea what I can do?

9

wait for me to fix it? In the mean time, disable the feature

10

@ComprehensiveAddict @dallas87 the issue is that Pureboot is using an older version of cryptsetup, which was unable to unlock the LUKS2 encrypted root used by Qubes. I’ll update Pureboot with a fix shortly

4 Likes
11

I’m getting the same error. Not sure how to fix it

12

Thank you @MrChromebox
Waiting to use this new feature

1 Like
13

@dallas87 @ComprehensiveAddict @jlariviere @deutschlaender please test out new Pureboot release 20.1 for your respective devices: https://source.puri.sm/firmware/releases/-/tree/Pureboot-Release-20.1

If all good, will merge/release. TIA

1 Like
14

@MrChromebox :::(((
Unfortunately for me doesn’t work

  1. It is asking 2 times for luks pass
  2. After that it will say: unable to locate /root files on any mounted disk
15

Yes, after flashing the BIOS I get exactly the same error.

16

ok, digging further here

edit: looks like it’s an issue with the partition being used as a thin-provisioned LVM, so additional handling will be needed. this will take some time.

17

@MrChromebox any updates on this :frowning: ?

18

I’ve been busy with other tasks and haven’t had time to investigate further. It’s still on my to-do list though

19

Hi @MrChromebox is there any update with this fix for root file check in pureboot for Qubesos?

20

unfortunately not, the issue is a bit more complicated than original thought