On Fri, Dec 07, 2018 at 12:25:30PM -0600, mcatanzaro(a)gnome.org wrote:
But most of / is not sensitive data on Workstation. We are only
concerned with encrypting possibly-sensitive data. That's /home,
/tmp (tmpfs, no worries there), portions of /var, maybe bits of
/etc, and swap. We don't necessarily need to encrypt the whole thing
with a passphrase like our current LUKS setup. Giving up on /etc is
probably reasonable as we don't need to have perfect security, just
good enough security. But stuff like system journal in /var could be
problematic.
One possible problem with this is "whole disk encryption" as a checkbox in
corporate BYOD security policies.
--
Matthew Miller
<mattdm(a)fedoraproject.org>
Fedora Project Leader