warn against superadmin / superroot in grub boot menu or initramfs

[phabricator-migrator]

Information

ID: 952
PHID: PHID-TASK-ns5rcspq2hdb534ueays
Author: Patrick
Status at Migration Time: open
Priority at Migration Time: Normal

Description

AppArmor for Complete System - Including init, PID1, Systemd, Everything! - Full System MAC policy

It seems like decryption actually happens in the initramfs. I initially thought it happened in grub due to the need for a cryptdevice boot parameter but looking into it more, it looks like the cryptroot initramfs hook does it. That hook seems to use the cryptsetup_message function in /lib/cryptsetup/functions for messages and the source code of that function is: cryptsetup_message() { local IFS=' ' if [ "${0#/scripts/}" != "$0" ] && [ -x /bin/plymouth ] && plymouth --ping; then …

Comments