[Support] System Encryption DM-Crypt with LUKS

[Zmyrgel]

I would love to have the LVM support incorporated into this. As far as I know the only thing necessary would be copy the lvm, vgchange and lviopversion files to /initramfs/sbin and then add the 'lvm vgscan' && 'lvm vgchange -a y' on the init script and to modify the other entries to point to correct devices.

Just planning on installing gentoo again and I'd love to put it on encrypted lvm-partitions. It works nicely on Arch and Debian so why not getting it to work with Gentoo too.

I'll try to get it working today and if I'm succesfull I'll post the results here and perhaps add them to wiki.

[Zmyrgel]

Ok, I didn't install gentoo then... My internet died yesterday, appearantly the local link mast is out of power or something. Gotta wait it to come back up before continuing the process.

I managed to check the init file a little as well as the lvm in general.
I think the init file needs only minor tweak to get it to work with LVM, after quick

Init mods:

Code: Select all

# Modify do_root to use lvm:

shell_checkpoint 4
	echo "Partition: root"
	exec_cryptsetup "${gv_root_device}" "${uv_root_mapping}" 
# Add the LVM stuff in here after the 'root' partition is decrypted:
echo "Scanning LVM Volume Groups..."        
        lvm vgscan --ignorelockingfailure --mknodes 2>/dev/null || true
echo "Activating LVM Volume Groups..."
        lvm vgchange -a y --ignorelockingfailure 2>/dev/null
# Some check here to see which to use
       if  [ test LVM= true ]; then # Need to modify so this works :D
                 mount -o "${gv_root_mode}" "/dev/$gv_vg_name/$gv_lv_root" /new-root
       else
	mount -o "${gv_root_mode}" "/dev/mapper/${uv_root_mapping}" /new-root
        fi
        if [ "$?" -ne 0 ]; then
		cryptsetup luksClose "${uv_root_mapping}" 2>/dev/null || cryptsetup remove "${uv_root_mapping}" 	
        	die "Error: mount root failed, dm-crypt mapping closed."
        fi
	shell_checkpoint 5



# Add following to get the proper parameters for lvm:

for param in $CMDLINE; do
    		case "${param}" in
			rescue)
				gv_shell_checkpoint=1
				;;
			root=*)
				gv_root_device="`echo "${param}" | cut -d'=' -f2`"
				;;
			lv_root=*)
				gv_lv_root="`echo "${param}" | cut -d'=' -f2`"
				;;
                                                vg_name=*)
				gv_vg_name="`echo "${param}" | cut -d'=' -f2`"
				;;

vg_name=vg-crypt
lv_root=root

The above is hastly made but it should be working.

Also the initramfs needs to have the program to scan and activate the lvm's. I checked and the lvm in Gentoo 2006.1 livecd is staticly compiled so just copy that to build_initramfs/sbin and the above should be working... possibly. I'll test it if I have my internet back today and if I have the time. I'll be busy for few days but after that I'll test it to see if this works.

Note that the above is just quickly made and I haven't checked how it will affect for example if swap is on the lvm and user is using the suspend2.

[Zmyrgel]

Ok, just finished installing and first boot was a failure as expected.

I got the ascii message and after that it gave:
"Error: root missing"

This is curious as I passed the "root=/dev/sda3" parameter at boot


do_root_work() {
[ -n "${gv_root_device}" ] || die "Error: root missing."

Edit:
Other things to do. The initramfs needs a proper lvm.conf file. Just copy the one you're using and add the line
type = [ "device-mapper", 16 ]

I try again by adding the config file and removing the root check from init

[irf4n]

Hi ppl

I've got some problems with the initrd image...
The Image can't find my HHDs and drops me into minimal shell. When I look into the /dev folder, i can't find any hdX device-files.
I've tried to add the device-files manually into the image, but after reboot the're vanished

Where is the problem? I hope someone can help me...


Greetz irf4n

[rainbow flag]

@irf4n

where do you add the hdX devices manually? in your minimal shell? then it's hardly surprising, that the files vanish with reboot. they are only on the ram-disk which will be newly created from your initrd-image at each reboot.
you'll just have to create them in the initrd.


[...and just to mention it: the problem i posted on oct 1st is gone. i forgot to copy /lib (which is of course deadly for the functionality of any program). very funny. took me more than a month to realize the mistake.]

[hadees]

I am trying to get Suspend2 to work with the init script but I keep getting the error "Error: suspend2 requires iswap argument." even though the iswap argument is there. I am not sure what is wrong, I basicly copied the example grub entries. This happens when I try to boot with either entry in my grub.conf file.

Here is my grub.conf

Code: Select all

default 0
timeout 30
splashimage=(hd0,0)/boot/grub/splash.xpm.gz

title=Gentoo s2 2.6.16-suspend2-r8 resume
kernel /boot/kernel-2.6.16-suspend2-r8 is2 iswap=/dev/sda2 \
resume2=swap:/dev/mapper/swap \
vga=0x318 video=vesafb:ywrap,mtrr:3 splash=verbose,theme:emergence \
quiet CONSOLE=/dev/tty1
initrd /boot/initramfs-gentoo-crypt

title=Gentoo s2 2.6.16-suspend2-r8 noresume
kernel /boot/kernel-2.6.16-suspend2-r8 is2 root=/dev/sda3 iswap=/dev/sda2 \
noresume2 resume2=swap:/dev/mapper/swap \
vga=0x318 video=vesafb:ywrap,mtrr:3 splash=verbose,theme:emergence \
quiet CONSOLE=/dev/tty1
initrd /boot/initramfs-gentoo-crypt

[hadees]

I am trying to get Suspend2 to work with the init script but I keep getting the error "Error: suspend2 requires iswap argument." even though the iswap argument is there. I am not sure what is wrong, I basicly copied the example grub entries. This happens when I try to boot with either entry in my grub.conf file.

Here is my grub.conf

Code: Select all

default 0
timeout 30
splashimage=(hd0,0)/boot/grub/splash.xpm.gz

title=Gentoo s2 2.6.16-suspend2-r8 resume
kernel /boot/kernel-2.6.16-suspend2-r8 is2 iswap=/dev/sda2 \
resume2=swap:/dev/mapper/swap \
vga=0x318 video=vesafb:ywrap,mtrr:3 splash=verbose,theme:emergence \
quiet CONSOLE=/dev/tty1
initrd /boot/initramfs-gentoo-crypt

title=Gentoo s2 2.6.16-suspend2-r8 noresume
kernel /boot/kernel-2.6.16-suspend2-r8 is2 root=/dev/sda3 iswap=/dev/sda2 \
noresume2 resume2=swap:/dev/mapper/swap \
vga=0x318 video=vesafb:ywrap,mtrr:3 splash=verbose,theme:emergence \
quiet CONSOLE=/dev/tty1
initrd /boot/initramfs-gentoo-crypt

So I tired removing the Suspend2 stuff just to see if I could get it to boot fully and I got this error "Error: root missing."

This is the grub entry that result in that error

Code: Select all

title=Gentoo 2.6.16-suspend2-r8
kernel /boot/kernel-2.6.16-suspend2-r8 root=/dev/sda3 \
vga=0x318 video=vesafb:ywrap,mtrr:3 splash=verbose,theme:emergence \
quiet CONSOLE=/dev/tty1
initrd /boot/initramfs-gentoo-crypt

Now I am really not sure what is going on. The init must either be broken or something is up with my busybox I guess but I am not sure what. I could really use some help.

[Obi-Lan]

When I boot into my new kernel and initramfs image, I get msg message ok but then I get error:

Code: Select all

Error: root missing

Dropping you into a minimal shell
/bin/ash: can't access tty; job control turned off
/$

I got line root=/dev/hda3 in my grub.conf

I can mount /dev/hda3 with cryptsetup in this console with no problem. But the init script refuses to work, any ideas?

[hadees]

So rereading this topic I noticed the error "Error: root missing" has happend to a few people. I am wondering if someone edited the guides init script because it doesn't seem like this was a problem before but so many people getting that error now makes me think something must have changed. I wish there was some way to get in contact with the author but his website is lacking contact information.

[Brad1213]

Hi

When I booted the initramfs, I got the same "Error: root missing" error message.

It seems the init script is not getting the parameters pased from the bootloader into the variables it uses.
I hard coded mine into the init script (at the end of parse_cmdl_args() ), rebuilt the initramfs, rebooted and things work ok.

I printed the variables from the init script, to screen when booting and all of them are not set.
The for loop in parse_cmdl_args() works ok, I think the case statement is not working right, or I missed something from the busybox config.


Brad

[some_guy]

First off, thanks to Reikinio and everyone else that has worked on this - it's great stuff (writing this from an encrypted box, with gpg-encrypted key stored on usb stick).

Now for my small contribution.

To everyone that is getting a seemingly inexplicable Error: root missing error message, please check your version of BusyBox.

I did similar troubleshooting to Brad1213 with the same results - variables seemed to stay empty. To cut a long story short, it seems that settings variables using the result of commands (eg. gv_root_device="`echo "${param}" | cut -d'=' -f2`") causes the variable to be empty in recent versions of BusyBox.

Solution: Use BusyBox version 1.2.1.

Worked for me (I just grabbed the latest version, it looks like others did too), so I hope it helps others.


Thanks again for the great guide.

(Time to go and bug BusyBox devs)

[BarbedWire]

I also got the Error: root missing error. I changed from busybox 1.2.2 to 1.2.1 following some_guy's advice. Now I'm getting an error too. Now and before there were no hdX files to be found in /dev. The exact error I get now is:

Code: Select all

Partition: root
Command failed: Error opening device: No such file or directory
Error: e2 failed to decrypt /dev/hdb1.

Can anyone give me some advice?
Brad1213 maybe you could post where in the script to set which variables?
Cryptsetup doesnt work from the minimal shell since no hdX devices can be found. I tried to create them in minimal shell with busybox 1.2.2 before but no matter what parameters I tried it didn't work. Maybe I should mention that using the livecd and a downloaded cryptsetup binary decrypting root is no problem at all. I also tried to copy my /dev directory when booted from livecd to my initramfs but that didnt help either.

There's one more thing to know : I'm trying to boot from a cdrom using isolinux but I don't believe thats the problem.

ps. If someone of you knows who to tell, the cryptsetup binary shipped with the minimal gentoo install cd for x86 is broken and gives segmentation-faults.

[Brad1213]

BarbedWire, near the end of the init script is a function called parse_cmdl_args(). Just before the closing } I added this:

Code: Select all

gv_key_swap_mode="gpg"
gv_key_swap_device="/dev/hda1"
gv_key_swap_filepath="swapkey.gpg"

gv_key_root_mode="gpg"
gv_key_root_device="/dev/hda1"
gv_key_root_filepath="rootkey.gpg"

gv_root_device="/dev/hda5"
gv_swap_device="/dev/hda2"

I'm using a suspend2 kernel so my swap is encrypted the same way as my root.

[Mr. Pointy]

BarbedWire Not much help, but I had similiar problems when I was trying with suspend2. I couldn't get it to work until I switched to a regular kernel.

Brad1213 How do you create and set up the swap partition for suspend? I'm booting from a usb stick with a gpg key. Trying with a suspend2-kernel it would just ask for my passphrase over and over. I think I created/opened/activated the partition incorrectly.

P.S. I'd like to see anyones extlinux.conf. I'm not clear on the syntax. I don't think caps (KERNEL, APPEND) etc. work. I'll test that later. How do I get a menu (just text based- the nice framebuffer stuff later) for multiple kernels?

P.P.S In all my trial and errors I could only get my kernel to build with the initramfs when I specified the file location. It was always overwritten when placed in /usr/src/linux/.../.. Currently it's working well externally.

Has the init script been fixed yet? I know I read the note about /bin/sh v. /bin/ash but it was forgotten when I really needed it. About that, I really didn't know if the script was otherwise intended to work as is, or if it needed to be tailored to each setup.

Thanks all. I'll try and think of something BarbedWire

[BarbedWire]

Thanks Brad1213. I'll check that. But I don't really believe this will help since the needed hdX files don't exist. I thought there was something in the init file that creates the needed device files. As I said before I tried to create them myself in the shell with something like

Code: Select all

mknod /dev/hdb 64 0

and I tried several parameters as the "right ones" didn't work. But it didn't help. Strangely the box recognizes my usb drives as /dev/sda1 and so on. Im a bit puzzled there .

Hi Mr. Pointy. Here's my isolinux.cfg.

Code: Select all

DEFAULT menu.c32
PROMPT 0
TIMEOUT 100

LABEL Gentoo
	MENU LABEL Gentoo
	MENU DEFAULT
	KERNEL bzImage
	APPEND root=/dev/hdb1 initrd=initramfs CONSOLE=/dev/tty1

I don't think that there is a big difference between isolinux.cfg and extlinux.conf if there's any. As much as I understand PROMPT gives different types of menus at startup. "PROMPT 0" gives me a simple menu with ascii letters only. No fancy Splash images or such stuff. You might want to simply check other numbers there. TIMEOUT sets time to wait for user response before loading default kernel. With LABEL you define a subsection in which you describe one of your kernel and/or partitions to load. Of course you can define more than one. MENU LABEL sets the name to appear in the menu for this kernel. MENU DEFAULT specifies this section to be loaded by default if the user chooses no other in the boot menu. KERNEL should be the name of your kernel. After APPEND follow your kernel parameters. I don't really know about the first line. I guess it's somethink like a "bootblock" to be executed first of all other stuff but as I said I'm not sure about that. Hope that I didn't state the obvious here and that this was helpfull.

[guero61]

FWIW, I added my own LVM support, trying best to keep within the script's style & minimize additions. You still have to add /sbin/lvm and the accompanying symlinks (cp -a /sbin/lv* /sbin/vg* /sbin/pv* /path/to/initramfs/sbin) to the initrd, but... YMMV.

Code: Select all

--- init	2006-12-05 12:42:33.000000000 -0600
+++ initramfs/init	2006-12-05 12:29:54.000000000 -0600
@@ -19,6 +19,7 @@
 #      * ichkpt=<n>                 Interrupts init and drops to shell.
 #      * ikey_root=<mode>:<device>:</path/to/file>  
 #      * ikey_swap=<mode>:<device>:</path/to/file>
+#      * dolvm2=</dev/[vg]/[lv]>    Activate LVM volumes post-decryption and use <device> as the real root
 #      
 #                      
 #        == About key files ==
@@ -427,6 +428,14 @@
 	shell_checkpoint 4
 	echo "Partition: root"
 	exec_cryptsetup "${gv_root_device}" "${uv_root_mapping}" 
+	if [ -n ${gv_root_lv} ]; then
+		echo "Activating LVM..."
+		/sbin/pvscan
+		/sbin/vgscan
+		/sbin/lvscan
+		/sbin/vgchange -ay
+		uv_root_mapping=$(echo $gv_root_lv | awk -F\/ '{printf "%s-%s", $3, $4}')
+	fi
 	mount -o "${gv_root_mode}" "/dev/mapper/${uv_root_mapping}" /new-root
         if [ "$?" -ne 0 ]; then
 		cryptsetup luksClose "${uv_root_mapping}" 2>/dev/null || cryptsetup remove "${uv_root_mapping}" 	
@@ -532,6 +541,9 @@
 			rescue)
 				gv_shell_checkpoint=1
 				;;
+			dolvm2=*)
+				gv_root_lv="`echo "${param}" | cut -d'=' -f2`"
+				;;
 			root=*)
 				gv_root_device="`echo "${param}" | cut -d'=' -f2`"
 				;;

PM me if you [really] need further help on this - I don't check back on the forums often enough.

[avx]

Someone already updated to kernel-2.6.19 and still has the system running?

I updated to 2.6.19 today (tried gentoo- and suspend2-sources) and didn't make any changes besides one new feature(support for my cardreader).
Now, when I reboot and want to decrypt my root, it spits the following error:

device-mapper: table: 254:0: crypt: Error allocating crypto tfm
Failed to setup dm-crypt key mapping.
Check kernel for support for the aes-cbc-plain cipher spec and verify that /dev/hda3 contains at least 258 sectors.
Failed to read from key storage

I tried this a few times, so it's not related to a misstyped password. Any clues about this?

Besides that, I had some problems getting einit to work; you can read about it here.

The fix is simple, just make the following modification in the init-script:

Before:

Code: Select all

mount -o "${gv_root_mode}" "/dev/mapper/${uv_root_mapping}" /new-root 
        if [ "$?" -ne 0 ]; then 
      cryptsetup luksClose "${uv_root_mapping}" 2>/dev/null || cryptsetup remove "${uv_root_mapping}"     
           die "Error: mount root failed, dm-crypt mapping closed." 
        fi

After:

Code: Select all

mount -o "${gv_root_mode}" "/dev/mapper/${uv_root_mapping}" /new-root 
        if [ "$?" -ne 0 ]; then 
      cryptsetup luksClose "${uv_root_mapping}" 2>/dev/null || cryptsetup remove "${uv_root_mapping}"     
           die "Error: mount root failed, dm-crypt mapping closed." 
        fi
cp -a "/dev/mapper/${uv_root_mapping}" /new-root/dev/mapper/

cheers,
ph

[BarbedWire]

Hi folks,
since there's nothing happening here so far,to make it easy I'd simply like to know if there's a way to boot my system from cdrom instead from usb. I tried that using the instructions from isolinux and some other places but as stated before the initscript doesn't create device-files for my harddrives so decrypting failes on boot. The system itself should be fine, installing went good and everything should work. Could someone plz post a usefull link or give a good advice?

Thx in advance!

[Fran]

Someone already updated to kernel-2.6.19 and still has the system running?

I updated to 2.6.19 today (tried gentoo- and suspend2-sources) and didn't make any changes besides one new feature(support for my cardreader).
Now, when I reboot and want to decrypt my root, it spits the following error:

device-mapper: table: 254:0: crypt: Error allocating crypto tfm
Failed to setup dm-crypt key mapping.
Check kernel for support for the aes-cbc-plain cipher spec and verify that /dev/hda3 contains at least 258 sectors.
Failed to read from key storage

I tried this a few times, so it's not related to a misstyped password. Any clues about this?

Same here. In 2.6.17.13 everything worked. In 2.6.19.1:

Code: Select all

$ sudo cryptsetup luksOpen /dev/hda8 crypt
Enter LUKS passphrase: 
Failed to setup dm-crypt key mapping.
Check kernel for support for the aes-cbc-plain cipher spec and verify that /dev/hda8 contains at least 261 sectors.
Failed to read from key storage

dmesg:

Code: Select all

device-mapper: ioctl: 4.10.0-ioctl (2006-09-14) initialised: dm-devel@redhat.com
device-mapper: table: 254:0: crypt: Error allocating crypto tfm
device-mapper: ioctl: error adding target to table
device-mapper: ioctl: device doesn't appear to be in the dev hash table.

[candrews]

You need to enable CBC support in the crypto options in the kernel. I had the same problem After that change, everything works as before.

[Fran]

You need to enable CBC support in the crypto options in the kernel. I had the same problem After that change, everything works as before.

Yep, that was the problem. Thanks

[bonnietyler]

hello,
yeah, just 2 hours and i found the bug. *g*
with the new linux-2.6.18-suspend2-r1 sources, image_exists and other files moved from /proc/suspend2 to /sys/power/suspend2
so you have to change the directories in the init script to the new ones, otherwise starting without resume it'll say: "permission denied to create /proc/suspend2/image_exists" or something similiar to that. hibernation works, but when you wanna resume it won't finde the image.

in the kernel under power managment -> suspend2 you got the new option:
"Replace swsusp by default " which
"CONFIG_SUSPEND2_REPLACE_SWSUSP:

Suspend2 can replace swsusp. This option makes that the default state,
requiring you to echo 0 > /sys/power/suspend2/replace_swsusp if you wan
to use the vanilla kernel functionality. Note that your initrd/ramfs wi
need to do this before trying to resume, too.
With overriding swsusp enabled, Suspend2 will use both the resume= and
noresume commandline options _and_ the resume2= and noresume2 ones (for
compatibility). resume= takes precedence over resume2=. Echoing disk
to /sys/power/state will start a Suspend2 cycle. If resume= doesn't
specify an allocator and both the swap and file allocators are compiled
the swap allocator will be used by default."

if first got this activated and thought that might be the prob, but obv not.
in my runnig conf i left this deactivated (not sure what it is really good for), not sure if things are still working with the stuff adding "echo 0 > /sys/power/suspend2/replace_swsusp" to the init script close to "echo 0 > /sys/power/suspend2/image_exists"

hope i could help ya save some time
greetz

[andrewy]

I followed the instructions and opted to place the GPG key on a usb drive and to boot from that drive.
I'm getting a "root missing" error.
The problem is that $gv_root_device is not being set in the case statement on line 531 (of http://waku.info/uploads/misc/crypt_guide/init ). The output of the echo and cut is correct, but the problem seems to be that the value is not being assigned to gv_root_device as it should be.
Any ideas what could be causing this?

EDIT: I was able to solve this by reverting to busybox-1.1.2. Both busybox-1.2.2.1 and busybox-1.3.1 did not work.

[nilo888]

hello i have a problem the system is configured and works well until in the init script it should run :

Code: Select all

  exec switch_root /new-root "${uv_init}"

ok with "exec" before nothing happend. And so i changed this line with

Code: Select all

  switch_root /new-root "${uv_init}"

and it answer:

Code: Select all

switch_root:not rootfs

I have modified the script at the beginning with #!/bin/sh -x

Ps: at this point I think the root is decrypted and mounted successfully

thank you in advance

[nilo888]

it was another problem.

however don't remove the exec word from switch_root's line

http://www.mail-archive.com/gentoo-embe ... 01161.html