Okay, good morning and welcome to my talk about silver blue with disc
encryption and with spicy side story or yeah the main story how I almost lost
everything but going much with them now and the side story about the map tool
and the DDSQ and why you shouldn't be using the DDSQ that's about me I
joined coaching class year and they're working on embedded Linux stuff lately and
using fedora til liplug as a daily driver since I think about five years
okay so what happened you know just casual morning
kind of hacking around with some embedded stuff
have this fancy routes carok 5b board which can boot from all kinds of stuff so you're
imaging scenes back and forth to various devices USB and NVMe wow embedded has NVMe
now as well not fancy stuff anyway somehow you know not fully awake yet I typed
to do the DDSQ of the NVMe but in the wrong terminal which well yeah and at first I
thought well not a big deal that image it's an embedded image just like eight
gigabytes no big deal my SSD's like two terabytes I mean who cares about eight
gigabytes I hope you guys learn something today because if you're not prepared that
can be basically the end of your two terabytes that's what this is basically so
I mean if you look at the default kind of setup if you install silver blue or
I guess any other destroyer usually does it similar you have some kind of some boot
partition stuff if I probably another partition boot where you have the kernel and
things like that in silver blue this is special as you basically have your deployment
there not so you can have multiple things you can have multiple kernels and you can go
back and forth and stuff like that and all atomic but yeah so what happens basically
if eight terabytes you override this whole boot chain and then you have like your
system partition which nowadays you have it encrypted of course because who knows
somebody stills your notebook you don't want all your confidential data to be gone so
it has a looks partition there and of course the first part of that also got wiped
but let's first look because I have the journal of this really nice event not so it's
kind of funny to look at that I mean I did a lot of yoga and stuff so I'm over it
now so I can I could talk about it now it's fine so basically you can see it was
October 2 930 I just docked in because that I had some USB message so then yeah I
was playing with this image stuff I like I said so I actually even was also looking at
some of this disk image so I did some LL set up stuff just to look at this disk
images of these embedded devices and kind of poke those I mounted some loop
mounted some stuff things like that and then I plugged in a USB stick not
because I wanted to basically that was what I wanted to write to not so very nice
and then yeah I don't know whether you also do this 30 trick stuff I usually kind of
hate when you have all these convoluted pseudo stuff and then it it asks you about
the password in the middle there so I just kind of prime my terminal to be a pseudo
terminal by just doing like pseudo LS or something I don't know maybe not a good idea
about it and then just kind of copy paste it casually is on command but yeah I was in
the wrong terminal of course yeah and then it's kind of cool you can see that yeah
you this team and immediately kind of woo so if it is happening not know this
is pretty quick but yeah and then I even flush the stuff but I actually flush the USB
stick which doesn't really do much because I didn't write that one but yeah what else
is going on yeah I mean I removed the USB stick and of course I tried it then and
I better device but somehow what what Schlock I mean yeah didn't boot I so it was stupid
thing bad morning no so I actually read tried it again very good didn't kind of I don't
know blurry vision or something flush it again very good remove it again and then I kind
of got mad about the USB stick you know USB sticks they just kind of sock not I don't
know I have so many go bad meanwhile if you're like I don't know 30 years in the carrier
I have an even collector I don't know what you do with broken USB sticks anyway so
I blocked in another one could be Sam these Casabad day try Kingston okay but then
okay wait a minute I started to look into the mask you never know something doesn't
feel right not okay you undo it let's look further I looked at my partitions and kind
of start to realize what happened and then actually it's kind of fun not it's a
rife like half an hour with that but then it had boot partition when started to go bad not
and then that's just a kind of life not in the background it's even doing some updates of course
you want to be up to date doesn't really help in that case because that partition is not too
healthy anymore so yeah a few minutes later the system partition also kind of goes bad
and you know I wear it and the kernel is doing the right thing not remounting it read only
and that's the end of the channel because you don't write any channels to read only drives
yeah that's basically it so how about this description now but imagine at that point in time I
thought well I still thought well not a big deal 8 gigabyte of two terabytes I will just reboot
with some life thing not and just kind of get it going again I mean not a big deal just a
casual morning of some Linux guy not that basically you have around a little bit no problem
but then yeah during installation it sounds really easy not you check this on
crypto system checkbox automatic partitioning anyway lazy not I mean hopefully all the other
guys working on it have chosen good defaults for me not how ever so how does it work
block device encryption not it transparently and creeps the creeps all your stuff and so the
underlying block device only is encrypted data so if you have that data you cannot do anything with it
not until you need the passphrase to mount it and of course it's nice if you get stolen nobody
can decrypt it without the passphrase and now it's basically DM creep looks not a Linux unified keys
it up it's basically specification for this whole encryption things and it specifies on this format
of this and also has the passphrase key management policy all this kind of stuff and
underneath it uses the kernel device map so the subsystem via DM creeped and basically handles
the low level stuff not and for user level operations there are the creep setup utilities
and the op I guess you guys who have no uses it as well that system startup you get kind of presented
with passphrase prompt you entered it and then it's continuous regular good
looks at encryption type block device and it protects content so even if you would remove the storage
device or have a removable storage device you can use it on there and basically it doesn't care about
what data you then put not it transparently just encrypted so you can also use it for swap
that way not not even something can leak if you kind of suspend it and have a swap
partitioners of like that even that is then also encrypted you can also use it for special data like
if you have data bases that use their own you know special format block device whatever
because it transparently encrypts it's underneath and device map are the good thing about that
it's well proven tested subsystem not because also for example LBM uses it and it also has passphrase
strengthening and some protection against dictionary attacks and stuff like that and you can
have multiple key slots so you can have like backup keys or stuff like that however it's not
sweet that you would kind of use that for multiple uses or something like that to have all
their keys not it doesn't really usually only have eight slots of this key passphrase stuff
also not sweet but for kind of file-level encryption things there are other tools for that
the tooling creeps that up and usually the way to reboot and stuff it's handled it's with system
the creep set up so you don't really have to do anything it's all transparently not integrated
into these rows so fedora silver blue less in slurned basically yeah if you wipe your
looks better you're basically gone so you can not really decorate I mean yeah I could wait I still
have a backup of that two terabyte is not maybe with some quantum computer you could
decrypt it in the future but if you don't have the header it's basically just really random
and creep the data you can not do anything that's what I learned and then one thing that I
now did and recommend to do anyway the default boot partition one gigabyte is anyway way too small
if you want to keep multiple deployments in silver blue not I usually keep some deployments of every
kernel version so if I want to try something or things like that I can easily go back not
and then over the years you have fedora version updates and you can capture three
ly go back and decily boot again into whatever old version not so this one gigabyte default just limits
amount of deployments and also in such a disaster case it is rather small so you override the
whole thing and into your system partition so I now did the bigger one I suggest using at least
like 16 gigabytes and then of course the most important thing is backup your loop setter
because I mean honestly that one goes corrupt or whatever you saw it we found that you can not
decrypt your thing it's just come basically there is no way to you to decrypt you this without this header
and it would be only 16 megabyte in size not too big but it's crucial
and of course also backup your keys usually one also does that but and I did and even
printed them but that they're useless without the header you can hang it up on the wall
together with the two terabyte SSD now it's too expensive I'm still using that one
it didn't hurt the SSD basically not it doesn't care using it as a daily driver for the
one of the other blue of course you get used to you just do your things in a with flat pack or in
a toolbox or I think you got denying to two px just relax usually it works not with flat
pack if you have some weirdo issues usually flat seal might help so you can open some things like
at times I have some printing doesn't work or things like that just hack around with
flat seal usually that helps and then of course as a embedded guy you have some kind of
system tools that yeah you basically one problem is if you're in a toolbox of course it's
this root less stuff not so you cannot do real root things on your real system from a toolbox
so there I'm just usually lazy and copy the tool out and just run it like that not I will also show
that later in the in the B map usage that kind of hurts fine because you could also lay your
stuff but I usually avoid doing that too much I mean you could RPM always really lay it not you could
can also install some tools there but it's just I don't know it's not worth it for me
can for tight and stuff with the anyway just use a VM not and then that's another thing I don't know
my ice get worse so and I think it still doesn't default to these fractional scaling stuff but
that's one of the commands I usually enable this and then you can scale it whatever you like not
and with flat tap I usually use an upstream flat top I don't know why fedora
does it their own thing with flat pack or why right as everybody have to do that just use I don't get it
why would you use that anyway so I just flat pack remove everything when I do a new install
and delete this fedora I think feed and just install it from flat up I don't know
then of course silver blue lipohestry previously just called oestry 3ly nice not
from pro check that topic for those guys that's still remember not I also run it on the server
by the way there it's called nowadays core OS where it's fine so you can look at the status of
the early deployments you can look at the oestry lock you can deploy one of the you know available
things and you can look at remote refs and you can basically replace so that's how you
basically change between fedora versions you just do a RPMOS 3 rebase not until reboot and you can
just switch between fedora versions like this nap not and then you can even pin them that way they don't get
basically removed with a further future update not so you can pin and unpin deployments
and yeah it's basically deed for operating system behind it is not so you have versioned
updates for limit space operating system one thing of course I'm also kind of a network I
playing with open WRT a lot and one thing you install wire shark with flat pack and then
you're wondering but how do you now do that because it doesn't show you any interfaces or anything
turns out it's works fairly easily you just separately do your TCP don't match it and then type it into
your flat pack via shark and that you just need to have a cheat sheet how you do that of course
but that works beautifully and yeah you basically missed my USB talk if you're wondering how that works
not I showed it there life with an embedded system and another tour for example melt I use a lot
you know you review code you defeat and you can also do that you just do an ally yes that
basically runs the flat pack stuff underneath yeah watch my other talks with some of this
tips not and this is the bonus track how you do for example the HCPTFTP for embedded use on a silver
where you don't really you know want to kind of lay here some other tools or whatever not it's
actually all ready there you just you have network miniature usually I use some intelligent switch with
wheel hands not and you just have your developer network not wheel and definite you create that
you must create that you add your in the firewall you open the HCP DNS TFP whatever other stuff
and then you just do the meta chair that means it will share that Milan to your regular
so it shares your regular interconnect connections so the embedded device even also can get to the
internet button and then for key of the people you create some folder where you put your stuff
make sure you have to write access stuff as well and then basically with network miniature DNS
mask is integrated not and you can just have this confile and you just in there you say enable TFTP
then it also does TFTP you can give it that folder that you have prepared and you can say what
file it by default should serve and you can even give you know if you know the MAC address of
your embedded devices you can give them their IP addresses and basically do that statically not
works very well okay let's have a look at the side story b map tool
pretty cool it's a generic tool it basically creates block maps for a file and then it allows you
copying files using that block map and of course that is then much faster and more reliable for
large files or such raw system image files that you encounter in embedded use not
original it was created for the ties navi project and it's written in Python of course faster
depends on various factors not the right speed image size and of course how full an image is the so-called
sparseness but in general it proves around 5 to 7 times faster how about integrity usability of it
it verifies data while flashing and it also note this is a possible corruption immediately
and the usability it reads directly also allows directly reading from remote service or you
wouldn't have to copy them locally they images and use the data is protected because it kind of
yeah protect you from such stupidity that I did because it wronged it block device names or
things like that it checks whether a device is mounted and would then you know warn you to really
want to do that not because usually you don't that's how you can use it like I said I just usually
copied out from a regular thing I mean from a toolbox where I installed it and then you can easily
also use that from your regular not toolbox thing where you can run as route which you'd have to
if you want to access a block device not and you can just specify the Python path and run it like that
and it has basically two commands to create to basically take us at a raw image and
investigate it and find out what its sparseness is not and it generates the block map and the copy is then to
actually write once you have the image and the block map right it to a block device
from concept point of view it's the spars files so file system maps blocks of file data to these
sectors not and usually there is a disk index that points to this map blocks and of course if you
have free area that is not mapped yet you basically have holes not in your files and they don't occupy space
and the block map is just an XML file that contains a list of these map area and the raw image is
I mean if you have for embedded systems actually skimiches they hardly ever are fully mapped not
that usually there you might have much bigger storage device than actual data not
and spars files so they have help safety space and when you read from such a file it returns
zeros and when you write to it basically you destroy the whole and sectors get all okay to then not
and notice that some not all tooling handle spars files one of the tools is for example
SCP so if you SCP file it allocates also the whole basically and sparseness is gone and some other tools
require that you explicitly specify that you want to use or keep the sparseness for example
if tar and the arsenic and underneath there are multiple implementations how that is handled in
Linux there are two iocontrols for to find map and on map areas there is the old FIP map
but that requires root privilege so it's not too well-seeded depending on what you want to do
then as there is the newer FIE map and there is also lcc has the vents argument you can use c-call
or c-data that's how you can basically position in the file to the next whole or the next
map area of a file there is also FLK there you can do an FLK default punch-o and that basically
allows on mapping area in the file but one thing you have to also know is not all files system
support all of these variants or even one of the variants there are files systems that basically don't
have a concept of spars files so if you copy a file onto such a file system the whole sparseness
is also gone and even the holes are basically occupying space and it really writes every zero
and everything then not that's basically the real world so depending on some tooling you have to be
really careful DDSQ that is basically when you use it to read stuff I recommend using that because
if you ever have some problems errors then that helps because it automatically does the
writing and reads all the blocks that are still good and then it also has a you have a lock file and
you can do further passes on it and don't use DD because I think you saw that very good time is up
don't know any questions so far and live them or we skip that but basically that is the
life them or not thank you very much