The Funtoo Linux project has transitioned to "Hobby Mode" and this wiki is now read-only.
Rootfs over encrypted lvm
This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive
Prepare the hard drive and partitions
This is an example partition scheme, you may want to choose differently.
/dev/sda1 used as /boot. /dev/sda2 will be encrypted drive with LVM.
/dev/sda1--/bootpartition./dev/sda2-- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [1] for more information on GPT and MBR./dev/sda3--/partition, will be the drive with LUKS and LVM.
root # dd if=/dev/zero of=/dev/sda3 bs=100M root # dd if=/dev/urandom of=/dev/sda3 bs=100M
The dd part is optional, and the command only needs to be run for security reasons (i.e only if you had top secret files on your drive). The command overwrites the lingering data on the device with random data. It takes around 6 hours to complete for a 200GB drive.
{{{1}}}
You will get a message about reaching the end of the device when the dd command has finished. This behavior is intended.
Encrypting the drive
root # cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3 root # cryptsetup luksOpen /dev/sda3 dmcrypt_root
There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.
Create logical volumes
root # pvcreate /dev/mapper/dmcrypt_root root # vgcreate vg /dev/mapper/dmcrypt_root root # lvcreate -L10G --name root vg root # lvcreate -L2G --name swap vg root # lvcreate -L5G --name portage vg root # lvcreate -l 100%FREE -nhome vg
Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.
Create a filesystem on volumes
root # mkfs.ext2 /dev/sda1 root # mkswap /dev/mapper/vg-swap root # mkfs.ext4 /dev/mapper/vg-root root # mkfs.ext4 /dev/mapper/vg-portage root # mkfs.ext4 /dev/mapper/vg-home
Basic system setup
root # swapon /dev/mapper/vg-swap root # mkdir /mnt/funtoo root # mount /dev/mapper/vg-root /mnt/funtoo root # mkdir -p /mnt/funtoo/{boot,usr/portage,home} root # mount /dev/sda1 /mnt/funtoo/boot root # mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage root # mount /dev/mapper/vg-home /mnt/funtoo/home
Now perform all the steps required for basic system install, please follow [2] don't forget to emerge the following before your install is finished:
- cryptsetup
- lvm2
- a bootloader (grub recommended)
- kernel sources (gentoo-sources recommended)
Editing the fstab
Fire up your favorite text editor to edit /etc/fstab. You want to put the following in the file:
# <fs> <mountpoint> <type> <opts> <dump/pass> /dev/sda1 /boot ext2 noauto,noatime 1 2 /dev/mapper/vg-swap none swap sw 0 0 /dev/mapper/vg-root / ext4 noatime,nodiratime,defaults 0 1 /dev/sr0 /mnt/cdrom auto noauto,ro 0 0 /dev/mapper/vg-portage /usr/portage ext4 noatime,nodiratime 0 0 /dev/mapper/vg-home /home ext4 noatime,nodiratime 0 0
Kernel options
{{{1}}}
This part is particularly important: pay close attention.
Initramfs setup and configuration
Better-initramfs
Build your initramfs with better-initramfs project.
{{{1}}}
better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices.
root # cd /opt root # git clone git://github.com/slashbeast/better-initramfs.git root # cd better-initramfs root # less README.rst root # bootstrap/bootstrap-all root # make prepare root # make image
Copy resulting initramfs.cpio.gz to /boot:
root # cp output/initramfs.cpio.gz /boot
Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads
root # wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2 root # tar xf release-x86_64-v0.5.tar.bz2 root # cd release* root # gzip initramfs.cpio root # cp initramfs.cpio.gz /boot
Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with git. Go to the better-initramfs source dir and follow:
root # cd /opt/better-initramfs root # git pull root # less ChangeLog
{{{1}}}
Please read the ChangeLog carefuly and perform necessary updates to /etc/boot.conf. Also, please backup the working /boot/initramfs.cpio.gz and /etc/boot.conf before updating better-initramfs.
Genkernel
Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:
root # genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all
Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing /etc/boot.conf:
boot {
generate grub
default "Funtoo Linux"
timeout 3
}
"Funtoo Linux" {
kernel kernel-genkernel-x86_64-2.6.39
initrd initramfs-genkernel-x86_64-2.6.39
params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
Bootloader Configuration
Grub2 configuration
An example of /etc/boot.conf for better-initramfs:
boot {
generate grub
default "Funtoo Linux"
timeout 3
}
"Funtoo Linux" {
kernel bzImage[-v]
initrd /initramfs.cpio.gz
params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
Now, run boot-update to write the configuration files to /boot/grub/grub.cfg
Lilo configuration
For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support
root # echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo root # emerge lilo
Example /etc/lilo.conf:
append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root" boot=/dev/sda compact default=funtoo lba32 prompt read-only timeout=50 image=/boot/kernel-genkernel-x86_64-2.6.39 initrd=/boot/initramfs-genkernel-x86_64-2.6.39 label=funtoo
Syslinux bootloader setup
Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.
root # emerge syslinux root # mkdir /boot/extlinux root # extlinux --install /boot/extlinux root # dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda - or - root # sgdisk /dev/sda --attributes=1:set:2 root # dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition
Example /boot/extlinux/extlinux.conf:
LABEL kernel1_bzImage-3.2.1 MENU LABEL Funtoo Linux bzImage-3.2.1 LINUX /bzImage-3.2.1 INITRD /initramfs.cpio.gz APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root
Final steps
Umount everything, close encrypted drive and reboot
root # umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot} root # vgchange -a n root # cryptsetup luksClose /dev/sda2 dmcrypt_root
After reboot you will get the following:
>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10 >>> Create all the symlinks to /bin/busybox. >>> Initiating /dev/dir >>> Getting LVM volumes up (if any) Reding all physical volumes. This make take awhile... No volume group found No volume group found >>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root Enter passphrase fore /dev/sda2:
Type your password
>>> Again, getting LVM volumes up (if any, after map dmcrypt). Reading all physical volumes. This may take a while... Found volume group "vg" using metadata type lvm2 4 logical volume(s) in volume group "vg" now active >>> Mounting rootfs to /newroot >>> Umounting /sys and /proc. >>> Switching root to /newroot and executing /sbin/init. INIT: version 2.88 booting Loading /libexec/rc/console/keymap OpenRC 0.6.1 is starting up Funtoo Linux (x86_64) ...boot messages omitted for clarity orion login: oleg Password: Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1 oleg@orion ~ %