I have an unencrypted /boot partition with GRUB and an encrypted partition, where my Linux is located. An attacker, who wants to read my encrypted partition, could gain physical access to my computer and modify the unencrypted GRUB in such a way that, when I start my Linux the next time and type my encryption password, the password is directly uploaded to the internet or at least stored unencrypted to disk.

One way I thought about, how I could protect against such an attack: Before starting the computer, I could boot from a USB drive and check the integrity of the GRUB. However, this is not that simple because the GRUB changes from time to time and hence I cannot just compute a hash from the GRUB partition.

Can anyone provide other ideas?

  • 1
    This is also known as evil maid attack, to which almost all practical disk encryption software are vulnerable to in some form (including TPM based encryption schemes).
    – sebasth
    Sep 14, 2018 at 8:21
  • Yes, but in practice the likeliness of such an attack are low, unless you are a high-value target. Journalist Micah Lee of EFF carried with him a honeypot laptop during two years, leaving it unattended in stowed luggage and hotel rooms, and it was never tampered: theintercept.com/2018/04/28/computer-malware-tampering So I don't think the OP has anything to worry about.
    – dr_
    Sep 14, 2018 at 9:10

2 Answers 2


You could install the boot files in the USB drive and use it for regular boot every time. This would allow you to have the complete disk encrypted.

The USB drive can be unmounted after kernel is loaded. It would need to be mounted only during kernel updates (new kernel installed in the drive) or boot configuration changes. Alternatively you could maintain an encrypted boot partition in your system which you manually sync to the USB disk. This would also allow easy recovery in case the USB drive is damaged or lost.


If you are primarily interested in protecting data stored in files then why install an OS on your computer at all?

You could simply boot the PC from a USB drive with a known good image, and decrypt the files when needed by mounting the encrypted partition after booting.

If you are trying to protect your activity on the PC then perhaps robust network security is an additional layer of defense you need to consider. If you maintain a tightly managed outbound firewall policy on a device upstream in your network, then the chances of your PC being infected and phoning home are greatly diminished.

Either way, define your real security objectives and think about depth. Don't just focus on one security strategy, encryption for example and expect that to mitigate all the potential security issues.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .