On Wed, Dec 5, 2018, at 3:20 PM, Hans de Goede wrote:
This means that even if someone steals the entire laptop he cannot modify anything, the rootfs is crypted so it cannot be modified without the key and everything which comes before it is hashed so it cannot be replaced either.
Careful; if you're talking about a variant of LUKS then it only by default provides some level of confidentiality; integrity is a different thing.
https://security.stackexchange.com/questions/87367/does-luks-protect-the-fil...