Rootfs over encrypted lvm

This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive

Prepare the hard drive and partitions

This is an example partition scheme, you may want to choose differently. /dev/sda1 used as /boot. /dev/sda2 will be encrypted drive with LVM.

• /dev/sda1 -- /boot partition.
• /dev/sda2 -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [1] for more information on GPT and MBR.
• /dev/sda3 -- / partition, will be the drive with LUKS and LVM.

root ##r### dd if=/dev/zero of=/dev/sda3 bs=100M 
root ##r### dd if=/dev/urandom of=/dev/sda3 bs=100M

The dd part is optional, only for security reason by overwriting the lingering data on the device with random data. It takes around 6 hours to complete for a 200GB drive.

Note that you will get a message about reaching the end of the device when the dd command has finished. This behavior is intended.

Encrypting the drive

root ##r### cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
root ##r### cryptsetup luksOpen /dev/sda3 dmcrypt_root

There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.

Create logical volumes

root ##r### pvcreate /dev/mapper/dmcrypt_root
root ##r### vgcreate vg /dev/mapper/dmcrypt_root
root ##r### lvcreate -L10G --name root vg           
root ##r### lvcreate -L2G --name swap vg
root ##r### lvcreate -L5G --name portage vg
root ##r### lvcreate -l 100%FREE -nhome vg

Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.

Create a filesystem on volumes

root ##r### mkfs.ext2 /dev/sda1
root ##r### mkswap /dev/mapper/vg-swap
root ##r### mkfs.ext4 /dev/mapper/vg-root
root ##r### mkfs.ext4 /dev/mapper/vg-portage
root ##r### mkfs.ext4 /dev/mapper/vg-home

Basic system setup

root ##r### swapon /dev/mapper/vg-swap
root ##r### mkdir /mnt/funtoo
root ##r### mount /dev/mapper/vg-root /mnt/funtoo
root ##r### mkdir /mnt/funtoo/boot
root ##r### mkdir -p /mnt/funtoo/usr/portage
root ##r### mkdir /mnt/funtoo/home
root ##r### mount /dev/sda1 /mnt/funtoo/boot
root ##r### mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
root ##r### mount /dev/mapper/vg-home /mnt/funtoo/home

Now perform all the steps required for basic system install, please follow [2] don't forget to emerge next packages:

# emerge cryptsetup lvm2 grub foo-sources

Re-emerge sys-apps/busybox and sys-fs/cryptsetup with the "static" USE flag

Kernel options

Important, do not miss this part. Under General setup --->

[*] Initial RAM filesystem and RAM disk (initramfs/initrd) support

Under Device Drivers --->

Generic Driver Options  --->
   [*] Maintain a devtmpfs filesystem to mount at /dev
[*] Multiple devices driver support  --->
   <*>Device Mapper Support
   <*> Crypt target support

Under Cryptographic API --->

-*-AES cipher algorithms

<*> XTS support (EXPERIMENTAL)

Initramfs setup and configuration

Build your initramfs with better-initramfs project.

   Note

better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices.

# git clone git@bitbucket.org:piotrkarbowski/better-initramfs.git
# cd better-initramfs
# less README.rst
# bootstrap/bootstrap-all
# make prepare
# make image

Copy resulting initramfs.cpio.gz to /boot.

# cp output/initramfs.cpio.gz /boot

Alternatively pre-compiled binary initramfs available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads

# wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
# tar xf release-x86_64-v0.5.tar.bz2
# cd release*
# gzip initramfs.cpio
# cp initramfs.cpio.gz /boot

Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with git. Go to the better-initramfs source dir and follow:

# git pull
# less ChangeLog

Please, read the ChangeLog carefuly and do necessary updates, to /etc/boot.conf, the example config below. Please, backup working initramfs.cpio.gz and /etc/boot.conf before updating initramfs.

Genkernel approach

Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:

genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all

Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2:

Grub2 configuration

An example of /etc/boot.conf for better-initramfs Template:Code

Lilo configuration

For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support

# echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
# emerge lilo

Syslinux bootloader setup

Syslinux is another advanced bootloader which you can find on all live CD's.

# emerge syslinux
# mkdir /boot/extlinux
# extlinux --install /boot/extlinux
# dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
- or -
# sgdisk /dev/sda --attributes=1:set:2
# dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition

Final steps

Umount everything, close encrypted drive and reboot

umount /mnt/funtoo/proc (/dev, /home, /usr/portage, /boot) 
vgchange -a n
cryptsetup luksClose /dev/sda2 dmcrypt_root

After reboot you will get the following:

>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
>>> Create all the symlinks to /bin/busybox.
>>> Initiating /dev/dir
>>> Getting LVM volumes up (if any)
Reding all physical volumes. This make take awhile...
No volume group found
No volume group found
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
Enter passphrase fore /dev/sda2:

Type your password

>>> Again, getting LVM volumes up (if any, after map dmcrypt).
  Reading all physical volumes.  This may take a while...
  Found volume group "vg" using metadata type lvm2
  4 logical volume(s) in volume group "vg" now active
>>> Mounting rootfs to /newroot
>>> Umounting /sys and /proc.
>>> Switching root to /newroot and executing /sbin/init.
INIT: version 2.88 booting
Loading /libexec/rc/console/keymap
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
...boot messages omitted for clarity
   
orion login: oleg
Password:
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
oleg@orion ~ %

Additional links

• Root filesystem over LVM2, DM-Crypt, and RAID
• System Encryption with LUKS for dm-crypt