MAS

Two profiles

During install you can set up two complete MAS systems on one disk, Profile A and Profile B. They never run at the same time. You pick one at boot.

How they are kept apart

  • Each profile is its own encrypted volume with its own passphrase.
  • They share no keys, swap or LUKS headers.
  • Profile B starts as a copy of Profile A, then gets its own machine ID, hostname, keys and login details.
  • A small unencrypted partition holds only the bootloader menu.

After install they drift apart. Software you add in A does not appear in B.

Boot menu

GRUB shows MAS Profile A and MAS Profile B with no password. Choose one, and only that profile is unlocked. The other stays encrypted for the whole session.

Switching

From the running system, use one of these:

  • Application menu: open Switch to Profile B (or Switch to Profile A from B). It asks for your password, then reboots.
  • Login screen: choose the session Switch to Profile B (reboot) and log in. It reboots instead of starting a desktop.
  • Terminal: sudo mas-switch-profile a or sudo mas-switch-profile b.

Each one tells GRUB to boot the other profile once and restarts. You then enter that profile's passphrase. You can also just pick a profile in the GRUB menu at any boot.

Passphrases

There is no recovery if you forget a passphrase. Store each one somewhere safe. A blank passphrase works but leaves that profile unprotected.

Disk space

Two profiles need at least 80 GB.