# Systemd homed **URL:** https://discuss.privacyguides.net/t/systemd-homed/17059 **Category:** Questions **Tags:** software **Created:** 2024-02-24T20:55:29Z **Posts:** 9 ## Post 1 by @qwq — 2024-02-24T20:55:29Z Hello. I’ve read in some GNOME’s developer’s blog that they plan to implement Systemd homed support in GNOME. From what I’ve read online, homed allows for portable encrypted home directories. I’m not very familiar with it, so I wanted to ask if this would be a good replacement for full disk encryption. I’m asking this because currently full disk encryption makes it so that you have to type in your password when your computer restarts to apply automatic updates via PackageKit. Not a huge deal, but it would be nice if automatic updates were actually automatic. I’ve also watched [Lennart Poettering’s talk at DevConf 2020](https://youtu.be/RG9rE1pcMcU) about it, where he says this has some security advantages but to be honest, most of it went over my head, I’m neither a developer or a sysadmin. Opinions? --- ## Post 2 by @exaCORE — 2024-02-24T21:54:24Z I think the issue is that having only an encrypted home dir means that many of your system files are accessible. Also, encrypted home dir can already br implemented fairly easily with LUKS, fscrypt, etc. I could be wrong though, so feel free to correct me if anyone here has better information. --- ## Post 3 by @qwq — 2024-02-24T22:18:10Z > [@exaCORE](#): > > having only an encrypted home dir means that many of your system files are accessible Is this a problem though? I don’t store any personal information outside of my home directory. The main advantage of homed is that it apparently discards the keys used to decrypt your data when you suspend your device (unlike LUKS that keeps them in ram). I’m not sure how exactly it works or if I’m describing it correctly, that’s why I created this topic. --- ## Post 4 by @privacycarrot — 2024-02-25T14:36:20Z It’s not a replacement for FDE but an addition. It’d be pretty useful for the Secure Boot scenario where you have FDE with your key stored in TPM/on FIDO2 key: when you turn your PC on decryption of the drive happens automatically without you having to provide FDE password (after ensuring your UKI is not tampered with), but your home directory will still be encrypted until you login. > [@qwq](#): > > Is this a problem though? I don’t store any personal information outside of my home directory. It is because otherwise anyone with physical access to your drive will be able to plant a backdoor and leak your personal stuff from your home directory after you unlock it. Even a simple systemd service will do. --- ## Post 5 by @anon73250778 — 2024-02-25T14:51:53Z I have gaming as a use case in my Linux machines. Right now FDE with LUKS is the faster option when it comes to read/writes. Other encryption method seems to be slower, particularly the ones that just encrypt the /home partition. --- ## Post 6 by @dngray — 2024-02-26T00:45:55Z I have been using this, and it works really well. There is a thread on the fedora forums: > **[Building a new home with systemd-homed on fedora](https://discussion.fedoraproject.org/t/building-a-new-home-with-systemd-homed-on-fedora/72690)** > > Introduction Secure Home Project: systemd-homed - Home Area/User Account Manager The concept of systemd-homed was implemented in 2019. It was merged into systemd v245, and is still in active developement today. It aims to fix the following... and SELinux policy which should land for F40 > > > ### Testing > > Enable homed features on Fedora > ```sh > sudo authselect enable-f…eature \ > with-systemd-homed > ``` > ```sh > sudo systemctl enable --now \ > systemd-homed > ``` > Relabel homed context > ```sh > sudo restorecon -v \ > /usr/lib/systemd/systemd-homed \ > /usr/lib/systemd/systemd-homework \ > /usr/lib/systemd/system/systemd-homed-activate.service \ > /usr/lib/systemd/system/systemd-homed.service \ > /var/lib/systemd/home/ > ``` > Create a testuser for homed > ```sh > sudo homectl create testuser > ``` --- ## Post 7 by @Regime6045 — 2024-02-27T14:09:08Z I think there are two main downsides compared to full disk encryption: 1. Sensitive data outside your /home folder that you may not be aware of, e.g. in /tmp, is unencrypted 2. Someone with physical access to your machine could modify the system in a malicious way, e.g. installing a keylogger, which would not be possible if the full disk were encrypted. --- ## Post 8 by @dngray — 2024-03-04T05:40:21Z > [@Regime6045](#): > > Someone with physical access to your machine could modify the system in a malicious way, e.g. installing a keylogger, which would not be possible if the full disk were encrypted. There is no reason systemd-homed can’t be used in conjunction with normal FDE. There are no downsides. --- ## Post 9 by @anon73250778 — 2024-03-04T12:44:11Z > [@dngray](#): > > There are no downsides Wont it slow down the system even more? If the machine is not meant for high performance task (gaming, ML, rendering, etc), then it should be fine but its now 2 layers of encryption and I bet its gonna use a lot of CPU cycles for a few tasks.