Rootfs over encrypted lvm

This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive

Prepare the hard drive and partitions

This is an example partition scheme, you may want to choose differently. /dev/sda1 used as /boot. /dev/sda2 will be encrypted drive with LVM.

• /dev/sda1 -- /boot partition.
• /dev/sda2 -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [1] for more information on GPT and MBR.
• /dev/sda3 -- / partition, will be the drive with LUKS and LVM.

root # dd if=/dev/zero of=/dev/sda3 bs=100M 
root # dd if=/dev/urandom of=/dev/sda3 bs=100M

The dd part is optional, and the command only needs to be run for security reasons (i.e only if you had top secret files on your drive). The command overwrites the lingering data on the device with random data. It takes around 6 hours to complete for a 200GB drive.

   Note

{{{1}}}

You will get a message about reaching the end of the device when the dd command has finished. This behavior is intended.

Encrypting the drive

root # cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
root # cryptsetup luksOpen /dev/sda3 dmcrypt_root

There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.

Create logical volumes

root # pvcreate /dev/mapper/dmcrypt_root
root # vgcreate vg /dev/mapper/dmcrypt_root
root # lvcreate -L10G --name root vg           
root # lvcreate -L2G --name swap vg
root # lvcreate -L5G --name portage vg
root # lvcreate -l 100%FREE -nhome vg

Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.

Create a filesystem on volumes

root # mkfs.ext2 /dev/sda1
root # mkswap /dev/mapper/vg-swap
root # mkfs.ext4 /dev/mapper/vg-root
root # mkfs.ext4 /dev/mapper/vg-portage
root # mkfs.ext4 /dev/mapper/vg-home

Basic system setup

root # swapon /dev/mapper/vg-swap
root # mkdir /mnt/funtoo
root # mount /dev/mapper/vg-root /mnt/funtoo
root # mkdir -p /mnt/funtoo/{boot,usr/portage,home}
root # mount /dev/sda1 /mnt/funtoo/boot
root # mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
root # mount /dev/mapper/vg-home /mnt/funtoo/home

Now perform all the steps required for basic system install, please follow [2] don't forget to emerge the following before your install is finished:

• cryptsetup
• lvm2
• a bootloader (grub recommended)
• kernel sources (gentoo-sources recommended)

Editing the fstab

Fire up your favorite text editor to edit /etc/fstab. You want to put the following in the file:

# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
/dev/sda1               /boot         ext2      noauto,noatime                  1 2
/dev/mapper/vg-swap     none          swap      sw                              0 0
/dev/mapper/vg-root     /             ext4      noatime,nodiratime,defaults     0 1
/dev/sr0                /mnt/cdrom    auto      noauto,ro                       0 0
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
/dev/mapper/vg-home     /home         ext4      noatime,nodiratime              0 0

Kernel options

   Note

{{{1}}}

This part is particularly important: pay close attention.

Initramfs setup and configuration

Better-initramfs

Build your initramfs with better-initramfs project.

   Note

{{{1}}}

better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices.

root # cd /opt
root # git clone git://github.com/slashbeast/better-initramfs.git
root # cd better-initramfs
root # less README.rst
root # bootstrap/bootstrap-all
root # make prepare
root # make image

Copy resulting initramfs.cpio.gz to /boot:

root # cp output/initramfs.cpio.gz /boot

Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads

root # wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
root # tar xf release-x86_64-v0.5.tar.bz2
root # cd release*
root # gzip initramfs.cpio
root # cp initramfs.cpio.gz /boot

Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with git. Go to the better-initramfs source dir and follow:

root # cd /opt/better-initramfs
root # git pull
root # less ChangeLog

   Note

{{{1}}}

Please read the ChangeLog carefuly and perform necessary updates to /etc/boot.conf. Also, please backup the working /boot/initramfs.cpio.gz and /etc/boot.conf before updating better-initramfs.

Genkernel

Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:

root # genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all 

Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2:

Bootloader Configuration

Grub2 configuration

An example of /etc/boot.conf for better-initramfs Template:Code

Now, run boot-update to write the configuration files to /boot/grub/grub.cfg

Lilo configuration

For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support

root # echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
root # emerge lilo

Syslinux bootloader setup

Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.

# emerge syslinux
# mkdir /boot/extlinux
# extlinux --install /boot/extlinux
# dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
- or -
# sgdisk /dev/sda --attributes=1:set:2
# dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition

Final steps

Umount everything, close encrypted drive and reboot

root # umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot} 
root # vgchange -a n
root # cryptsetup luksClose /dev/sda2 dmcrypt_root

After reboot you will get the following:

>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
>>> Create all the symlinks to /bin/busybox.
>>> Initiating /dev/dir
>>> Getting LVM volumes up (if any)
Reding all physical volumes. This make take awhile...
No volume group found
No volume group found
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
Enter passphrase fore /dev/sda2:

Type your password

>>> Again, getting LVM volumes up (if any, after map dmcrypt).
  Reading all physical volumes.  This may take a while...
  Found volume group "vg" using metadata type lvm2
  4 logical volume(s) in volume group "vg" now active
>>> Mounting rootfs to /newroot
>>> Umounting /sys and /proc.
>>> Switching root to /newroot and executing /sbin/init.
INIT: version 2.88 booting
Loading /libexec/rc/console/keymap
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
...boot messages omitted for clarity
   
orion login: oleg
Password:
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
oleg@orion ~ %

Additional links

• Root filesystem over LVM2, DM-Crypt, and RAID
• System Encryption with LUKS for dm-crypt
• Wikipedia article on LVM
• Arch Wiki article