[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
Re: Full Disk Encryption with cgd (well, almost)
Hi Alan, list,
On 21/03/2013 08:36, Alan Barrett wrote:
> On Thu, 21 Mar 2013, Pierre Pronchery wrote:
>> I have just managed to prototype a way to achieve (almost) full disk
>> encryption with cgd. I have tried to implement this while altering the
>> least amount of existing code and infrastructure that I could.
> All that sounds fine. My own setup is similar, but I don't use cgd.conf
> (I store the necessary parameters in a separate partition), and I parse
> dmesg to figure out the boot device, so it works with booting from an
> internal disk (wd0) and an external USB disk (sd0). We should probably
> add a sysctl for the booted device.
Can kern.root_device be useful for you there?
(on my setup it's simply "md0")
>> A few additional remarks:
>> - init really needs SMALLPROG disabled to handle the "init.root" sysctl
>> (took me a while to figure out...)
> I added SMALLPROG.init=no and the necessary changes to make that work,
> so there's no need to globally disable SMALLPROG.
This does not seem to work for me :(
Would you have more details?
>> - likewise, cgdconfig needs -lcrypto so I had to duplicate the libhack
> I did not need to do anything like that. I have this in the list.extra
> file for the ramdisk:
> PROG sbin/cgdconfig
> LIBS -lcrypto
This works fine, thank you.
>> - I guess cgdroot.kmod is not built automatically with these changes,
>> I'll welcome suggestions there
>> - I am not sure about the "right" way to generate cgdroot.kmod; I'm
>> afraid, as it is, that it will try to build before miniroot.kmod is
>> available (still have to test this)
>> - I guess I want the one in OBJDIR instead; what's the proper variable?
> This part should be easy.
I think I figured it out - I have created an extra
distrib/amd64/cgdroot/kmod directory, containing this Makefile:
=== BEGIN PASTE ===
=== END PASTE ===
With this I'm also pretty sure it'll build in the right order (but I'll
test a full build anyway).
>> Less important:
>> - I guess "/altroot" was not exactly meant for this, but I read it as
>> "alternate root" here and I find it adequate (?)
>> - the key is stored on the hard drive in this scenario, but that's not
>> worse than the current official cgd howto
>> - I think it wouldn't work as-is with a XEN3_DOM0 kernel (which would
>> require the ramdisk built in the kernel AFAICS)
> All that seems fine. The final step of building the ramdisk into the
> kernel instead of creating a miniroot.kmod will have to change for some
Certainly, but in the meantime this should work for i386 already. I'm
looking forward to testing this on evbarm with the Nokia N900 if at all
possible - that would be a very interesting feature there IMHO.
The next thing I'll welcome if my tests go well is a green flag to commit :)
Thank you for the helpful feedback already!
Main Index |
Thread Index |