[Solved] dm-crypt without modules?

[thelordi]

Hello everyone, I wanted to increase the security of my computer by removing modules from the kernel. I have a configuration without modules that could boot, however, I still need an initramfs (and through it, modules) because I have an encrypted / partition and an encrypted /home partition. In the wiki section it says to enable loadable module support when using dm-crypt, even when including it in the kernel. So my question is: (How) can I get dm-crypt to work without needing to rely on kernel modules and to some extent dracut (because I have not yet tried to integrate the dm-crypt module in the kernel without an initramfs but as a module)?

[pietinger]

If you have an encrypted root partition you will need always an initramfs doing the job of decryption.

Which modules you will need depends also on your used cryptographic algorithms. Because I am using also a kernel without modules support, you might look at these settings when using aes-xts-plain64:
https://forums.gentoo.org/viewtopic-p-8457358.html#8457358

Another way to get all needed modules is a look into "lsmod" ...

If you want an UKI (unified kernel image) you can embed your external CPIO (initramfs) into your kernel, with this method:
https://wiki.gentoo.org/wiki/User:Pietinger/Tutorials/Initramfs_Overview#Special_Case:_Building_an_embedded_initramfs_with_a_CPIO_archive

[Hu]

When referring to a Wiki page, please link to it so we can check what you read. In this case, I can tell you that it is possible to have a kernel with (1) no module support, (2) dm-crypt support built-in, and (3) an initramfs that can unlock and mount an encrypted root filesystem. In almost all cases, the advice to make something a module when it is permanently used is because making it a module affects the order of when it activates, which can avoid the need to sequence components correctly and avoid the need to have the required components ready as early in the boot process. This advice most often comes up with firmware.

I cannot say whether dracut can handle this correctly, but I think it should be able to do so.

[NeddySeagoon]

thelordi,

The initrd need only contain the user space tools required to expose root and mount it.

See https://wiki.gentoo.org/wiki/PC_Boot_Process and https://wiki.gentoo.org/wiki/Initramfs_-_make_your_own
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[sublogic]

[thelordi]

Thank you very much for all the help!
After now understanding the initramfs and modules a fair bit better, I was able to get it working without modules, until I managed to screw a fair few things up with dmcrypt. I now use an unencrypted / but still an encrypted /home, so I no longer need the initramfs as well.
And thank you pietinger for your guide, that was actually very much what I was looking for!

[pietinger]