Difference between pages "Rootfs over encrypted lvm" and "Building a Kernel from Source"

From Funtoo
(Difference between pages)
Jump to: navigation, search
m (Reverted edits by 91.67.69.14 (talk) to last revision by Duncan.Britton)
 
m
 
Line 1: Line 1:
This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive
+
Setting up a proper kernel yourself - lean, mean and tailored to your hardware,  is the challenge by which a linux user can graduate to becoming a Funtoo knight ;-)
  
= Prepare the hard drive and partitions =
+
Even though many of us are using enterprise-ready kernels in datacenters, there is almost nobody who hasn't at least considered building a kernel for his laptop / PC.
This is an example partition scheme, you may want to choose differently.
+
We are showing here how an intermediate Linux user can use an alternative to the standard beginners "genkernel" approach, to compile a custom kernel,  in a relatively still speedy and easy set up.
<code>/dev/sda1</code> used as <code>/boot</code>. <code>/dev/sda2</code> will be encrypted drive with LVM.
+
  
* <code>/dev/sda1</code> -- <code>/boot</code> partition.  
+
=== Minimum Requirements ===
* <code>/dev/sda2</code> -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [http://www.funtoo.org/Funtoo_Linux_Installation#Prepare_Hard_Disk] for more information on GPT and MBR.  
+
You should understand the way how things work in a terminal and how to use an editor and tweak config files. This is crucial.
* <code>/dev/sda3</code> -- <code>/</code> partition, will be the drive with LUKS and LVM.
+
You don't need much knowledge about the linux kernel and it's internals. Nevertheless, you have to know at least where the files are located, how they are used and what is the file logic behind the overall structure. Otherwise you should consider using a non source based linux distribution.
 +
If you are scared now, don't worry - we are going to build a kernel the Funtoo way and you will pick up everthing necessary to accomplish this challenge, step by step, so the next time you do it yourself and become a real Funtoo knight!
 +
 
 +
=== Assumptions ===
 +
You start from an installed Funtoo system on the disk, or at least, you are on stage3 in a chrooted environment from a live cd, following somehow the Funto [[Installation (Tutorial)|Installation Tutorial]].
 +
 
 +
In this case we are building a kernel that is booting root in LVM over encrypted LUKS container.
 +
If you don't have this setup, don't worry, you just don't need all the modules, but everything else is similar.
 +
 
 +
 
 +
= Getting everything in order to start =
 +
 
 +
First there is the decision which linux kernel sources we need.
 +
There are plenty of them in the repositories around, often it is not easy to distinguish between them.
 +
 
 +
I would always trust my distribution of choice and take what is has to offer - and funtoo has a lot to offer!
 +
 
 +
I really do recommend (especially if it is your first time) to build a debian-sourced genkernel like described in chapter 5 "Using Debian-Sources with Genkernel" in the [[Funtoo_Linux_Kernels| Funtoo Kernels Tutorial]].
 +
 
 +
From there you should have a running system booting nicely from your own build (just little bit bloated) kernel. This is more than you can expect from any other ready to go distribution.
 +
 
 +
'''Attention'''
 +
We are using RedHat's dracut in order to build a nice initramfs (containing all the necessary tools and extra drivers our kernel might need to start the system).
 +
 
 +
Although dracut is the way to go, more sophisticated and not as buggy as gentoo's genkernel approach, more and more funtoo geeks start using slashbeast's better-initramfs, which we will cover at the end of this howto!
 +
 
 +
So after having set up a genkernel from debian or gentoo sources we are going to build a kernel with either (or both) dracut or/and better-initramfs.
 +
So gentoo sources with genkernel is always my backup if anything is not working correctly on my system. For the slightly more geeky approach with my own initram I am using pf-sources, ck-sources or any other more or less heavily patched sources.
 +
 
 +
Let's go!
 +
 
 +
== Kernel Sources ==
 +
We are going to use the kernel sources from the funtoo git repository.
 +
 
 +
The source you use on your system is up to you and your needs.
 +
For a laptop or desktop system, we recommend the following:
 +
 
 +
* '''sys-kernel/pf-sources'''
 +
* '''sys-kernel/ck-sources'''
 +
* '''sys-kernel/gentoo-sources'''
 +
* '''sys-kernel/git-sources'''
 +
* '''sys-kernel/sysrescue-std-sources'''
 +
* '''sys-kernel/debian-sources'''
 +
 
 +
Please, have a look in the ebuild description, look onto their homepage and take the one that suits you best!
 +
If you are unsure for now, use sys-kernel/gentoo-sources. That's always a safe bet for a general system.
 +
 
 +
It is not a problem to have various kernels installed parallel, so go on with any one of them.
 +
 
 +
I am going to use the sys-kernel/pf-sources now, as I already had the gentoo-sources installed.
 +
 
 +
== Prerequisites ==
 +
 
 +
I don't know which tools you have already installed, so some information here might be redundant.
 +
It doesn't harm to just copy and paste and do some steps again.
 +
 
 +
First, we look into our <code>/etc/make.conf</code>:
  
 
<console>
 
<console>
# ##i##dd if=/dev/zero of=/dev/sda3 bs=100M
+
##i### nano /etc/make.conf
# ##i##dd if=/dev/urandom of=/dev/sda3 bs=100M
+
#These compiler flags are just tweaking (optimazation) and NOT necessary:
 +
CFLAGS="-O2 -pipe -march=native -ftracer -fforce-addr"
 +
CXXFLAGS="${CFLAGS} -fpermissive -fomit-frame-pointer"
 +
KDIR=/usr/src/linux
 +
KERNEL="symlink build"
 +
USE="$KERNEL ....here are your use flags...."
 +
## These modules are available:
 +
## DRACUT_MODULES="dracut_modules_biosdevname dracut_modules_btrfs dracut_modules_caps dracut_modules_crypt dracut_modules_crypt-gpg dracut_modules_dmraid dracut_modules_dmsquash-live dracut_modules_gensplash dracut_modules_iscsi dracut_modules_livenet dracut_modules_lvm dracut_modules_mdraid dracut_modules_multipath dracut_modules_nbd dracut_modules_nfs dracut_modules_plymouth dracut_modules_ssh-client dracut_modules_syslog"
 +
## We will use these modules for LVM / LUKS:
 +
DRACUT_MODULES="crypt lvm plymouth biosdevname dmraid crypt-gpg dmsquash-live ssh-client syslog"
 
</console>
 
</console>
The <code>dd</code> part is optional, and the command only needs to be run for security reasons (i.e only if you had top secret files on your drive). The command overwrites the lingering data on the device with random data. It takes around 6 hours to complete for a 200GB drive.
 
  
{{Note}} You will get a message about reaching the end of the device when the <code>dd</code> command has finished. This behavior is intended.
+
Next, we set the package keywords:
 
+
= Encrypting the drive =
+
 
<console>
 
<console>
# ##i##cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
+
/etc/portage/package.use/dracut:
# ##i##cryptsetup luksOpen /dev/sda3 dmcrypt_root
+
sys-kernel/dracut dm net device-mapper crypt lvm
 
</console>
 
</console>
  
There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.
+
{{Note}} If you don't have lvm over encrypted LUKS you probably just add the "net" keyword here, or "selinux".
 +
 
  
= Create logical volumes =
+
After that we are going to build our packages:
 
<console>
 
<console>
# ##i##pvcreate /dev/mapper/dmcrypt_root
+
# ##i##emerge -av app-portage/gentoolkit sys-kernel/pf-sources sys-kernel/dracut sys-boot/plymouth sys-boot/plymouth-openrc-plugin
# ##i##vgcreate vg /dev/mapper/dmcrypt_root
+
# ##i##lvcreate -L10G --name root vg         
+
# ##i##lvcreate -L2G --name swap vg
+
# ##i##lvcreate -L5G --name portage vg
+
# ##i##lvcreate -l 100%FREE -nhome vg
+
 
</console>
 
</console>
Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.
 
  
= Create a filesystem on volumes =
+
Finished? Well, then let's go on and
 +
 
 +
== Preparing the kernel ==
 +
 
 +
We go now to the sources directory and enter the following commands to update the kernel's  .config  file:
 
<console>
 
<console>
# ##i##mkfs.ext2 /dev/sda1
+
##i### cd /usr/src/linux/
# ##i##mkswap /dev/mapper/vg-swap
+
##i### make clean
# ##i##mkfs.ext4 /dev/mapper/vg-root
+
  CLEAN  .
# ##i##mkfs.ext4 /dev/mapper/vg-portage
+
  CLEAN  arch/x86/kernel/acpi/realmode
# ##i##mkfs.ext4 /dev/mapper/vg-home
+
  CLEAN  arch/x86/kernel/cpu
 +
  CLEAN  arch/x86/kernel
 +
  CLEAN  arch/x86/vdso
 +
  CLEAN  arch/x86/lib
 +
  CLEAN  drivers/gpu/drm/radeon
 +
  CLEAN  drivers/net/wan
 +
  CLEAN  drivers/scsi/aic7xxx
 +
  CLEAN  drivers/tty/vt
 +
  CLEAN  drivers/video/logo
 +
  CLEAN  firmware
 +
  CLEAN  kernel
 +
  CLEAN  lib/raid6
 +
  CLEAN  lib
 +
  CLEAN  security/apparmor
 +
  CLEAN  security/selinux
 +
  CLEAN  usr
 +
  CLEAN  arch/x86/boot/compressed
 +
  CLEAN  arch/x86/boot
 +
  CLEAN  .tmp_versions
 +
  CLEAN  vmlinux System.map .tmp_kallsyms2.S .tmp_kallsyms1.o .tmp_kallsyms2.o .tmp_kallsyms1.S .tmp_vmlinux1 .tmp_vmlinux2 .tmp_System.map
 +
##i### zcat /proc/config.gz > /usr/src/linux/.config
 
</console>
 
</console>
  
= Basic system setup =
 
 
<console>
 
<console>
# ##i##swapon /dev/mapper/vg-swap
+
##i### make localmodconfig
# ##i##mkdir /mnt/funtoo
+
# ##i##mount /dev/mapper/vg-root /mnt/funtoo
+
# ##i##mkdir -p /mnt/funtoo/{boot,usr/portage,home}
+
# ##i##mount /dev/sda1 /mnt/funtoo/boot
+
# ##i##mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
+
# ##i##mount /dev/mapper/vg-home /mnt/funtoo/home
+
 
</console>
 
</console>
Now perform all the steps required for basic system install, please follow [http://docs.funtoo.org/wiki/Funtoo_Linux_Installation]
 
don't forget to emerge the following before your install is finished:
 
  
* '''cryptsetup'''
+
You will get some questions which you can answer mostly with either M (compiled as a module) or Y (compiled directly into the kernel).
* '''lvm2'''
+
* '''a bootloader (grub recommended)'''
+
* '''kernel sources (gentoo-sources recommended)'''
+
 
+
= Editing the fstab =
+
Fire up your favorite text editor to edit <code>/etc/fstab</code>. You want to put the following in the file:
+
 
<pre>
 
<pre>
# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
+
Enable different security models (SECURITY) [Y/n/?] y
/dev/sda1              /boot        ext2      noauto,noatime                  1 2
+
Enable the securityfs filesystem (SECURITYFS) [Y/?] y
/dev/mapper/vg-swap    none          swap      sw                              0 0
+
Socket and Networking Security Hooks (SECURITY_NETWORK) [Y/?] y
/dev/mapper/vg-root    /             ext4      noatime,nodiratime,defaults    0 1
+
Security hooks for pathname based access control (SECURITY_PATH) [Y/?] y
/dev/sr0                /mnt/cdrom    auto      noauto,ro                      0 0
+
Low address space for LSM to protect from user allocation (LSM_MMAP_MIN_ADDR) [65536] 65536
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
+
NSA SELinux Support (SECURITY_SELINUX) [Y/n/?] y
/dev/mapper/vg-home    /home        ext4      noatime,nodiratime              0 0
+
  NSA SELinux boot parameter (SECURITY_SELINUX_BOOTPARAM) [N/y/?] n
 +
  NSA SELinux runtime disable (SECURITY_SELINUX_DISABLE) [N/y/?] n
 +
  NSA SELinux Development Support (SECURITY_SELINUX_DEVELOP) [Y/n/?] y
 +
  NSA SELinux AVC Statistics (SECURITY_SELINUX_AVC_STATS) [Y/n/?] y
 +
  NSA SELinux checkreqprot default value (SECURITY_SELINUX_CHECKREQPROT_VALUE) [1] 1
 +
  NSA SELinux maximum supported policy format version (SECURITY_SELINUX_POLICYDB_VERSION_MAX) [Y/n/?] y
 +
    NSA SELinux maximum supported policy format version value (SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE) [19] 19
 +
TOMOYO Linux Support (SECURITY_TOMOYO) [Y/n/?] y
 +
  Default maximal count for learning mode (SECURITY_TOMOYO_MAX_ACCEPT_ENTRY) [2048] 2048
 +
  Default maximal count for audit log (SECURITY_TOMOYO_MAX_AUDIT_LOG) [1024] 1024
 +
  Activate without calling userspace policy loader. (SECURITY_TOMOYO_OMIT_USERSPACE_LOADER) [Y/n/?] y
 +
AppArmor support (SECURITY_APPARMOR) [Y/n/?] y
 +
  AppArmor boot parameter default value (SECURITY_APPARMOR_BOOTPARAM_VALUE) [1] 1
 +
Integrity Measurement Architecture(IMA) (IMA) [Y/n/?] y
 +
EVM support (EVM) [N/y/?] (NEW)
 +
Default security module
 +
  1. SELinux (DEFAULT_SECURITY_SELINUX)
 +
  2. TOMOYO (DEFAULT_SECURITY_TOMOYO)
 +
  3. AppArmor (DEFAULT_SECURITY_APPARMOR)
 +
> 4. Unix Discretionary Access Controls (DEFAULT_SECURITY_DAC)
 +
choice[1-4?]: 4
 +
warning: (ACPI_HOTPLUG_CPU) selects ACPI_CONTAINER which has unmet direct dependencies (ACPI && EXPERIMENTAL)
 +
warning: (MEDIA_TUNER) selects MEDIA_TUNER_TEA5761 which has unmet direct dependencies (MEDIA_SUPPORT && VIDEO_MEDIA && I2C && EXPERIMENTAL)
 +
#
 +
# configuration written to .config
 +
#
 +
warning: (GFS2_FS) selects DLM which has unmet direct dependencies (EXPERIMENTAL && INET && SYSFS && CONFIGFS_FS && (IPV6 || IPV6=n))
 +
warning: (IMA) selects TCG_TPM which has unmet direct dependencies (HAS_IOMEM && EXPERIMENTAL)
 +
warning: (MEDIA_TUNER) selects MEDIA_TUNER_TEA5761 which has unmet direct dependencies (MEDIA_SUPPORT && VIDEO_MEDIA && I2C && EXPERIMENTAL)
 +
warning: (ACPI_HOTPLUG_CPU) selects ACPI_CONTAINER which has unmet direct dependencies (ACPI && EXPERIMENTAL)
 +
root@[~src/linux] #
 +
 
 
</pre>
 
</pre>
  
= Kernel options =
+
Now comes the most adventurous part!
{{Note}}This part is particularly important: pay close attention.
+
{{kernelop
+
|'''General setup --->'''
+
|'''[*] Initial RAM filesystem and RAM disk (initramfs/initrd) support'''
+
}}
+
  
{{kernelop
+
= Building the Kernel =
|'''Device Drivers --->''' <br> '''Generic Driver Options --->'''
+
<console>
|'''[*] Maintain a devtmpfs filesystem to mount at /dev''' <br>
+
##i### make -j8  bzImage
}}
+
##i### make -j8 modules
 +
##i### make modules_install
 +
##i### make install
 +
</console>
  
{{kernelop
 
|'''Device Drivers --->''' <br> '''[*] Multiple devices driver support --->'''
 
|'''<*>Device Mapper Support''' <br> '''<*> Crypt target support'''
 
}}
 
  
{{kernelop
+
'''Building an initramfs or not?'''
|'''Cryptographic API --->'''
+
|'''-*-AES cipher algorithms''' <br> '''<*> XTS support'''
+
}}
+
  
= Initramfs setup and configuration =
+
The reason to build a kernel with an initramfs is mostly for interoperability (e.g. live-cd's) and special features like an included busybox, ssh, etc.  But mostly, and that's why we are doing this here now, to have a proper kernel up and running quick'n dirty in a reasonable time without fighting hours and days until a more or less exotic hardware is perfectly run by the kernel.
== Better-initramfs ==
+
After having a proper basic kernel running with the help of an initramfs, I really recommend you to go a step further and build a true kernel with all features includes without an initramfs. But this could be pain in the ass and very time consuming - so we do it the funtoo way here - at least in the second example when we stick to better-initramfs instead of Red-Hat's ''dracut''.
'''Build your initramfs with [https://bitbucket.org/piotrkarbowski/better-initramfs better-initramfs] project.'''
+
  
{{note}}better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices.
+
= Option one: Initrd with dracut =
  
<console>
+
To build the initrd we just execute
# ##i##cd /opt
+
# ##i##git clone git://github.com/slashbeast/better-initramfs.git
+
# ##i##cd better-initramfs
+
# ##i##less README.rst
+
# ##i##bootstrap/bootstrap-all
+
# ##i##make prepare
+
# ##i##make image
+
</console>
+
 
+
Copy resulting <code>initramfs.cpio.gz</code> to <code>/boot</code>:
+
<console># ##i##cp output/initramfs.cpio.gz /boot</console>
+
  
Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads
 
 
<console>
 
<console>
# ##i##wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
+
# ##i##dracut -f --fstab --xz /boot/initramfs-3.2.6-pf.img  3.2.6-pf
# ##i##tar xf release-x86_64-v0.5.tar.bz2
+
# ##i##cd release*
+
# ##i##gzip initramfs.cpio
+
# ##i##cp initramfs.cpio.gz /boot
+
 
</console>
 
</console>
  
Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with <code>git</code>. Go to the better-initramfs source dir and follow:
+
Generally, this really should be enough!
<console>
+
If you experience booting problems like missing modules / drivers then just boot from the genkernel section and fix the initrd building. You can look into the man page to tweak the command a bit (e.g. --add-drivers "xz dm_crypt" etc...).
# ##i##cd /opt/better-initramfs
+
# ##i##git pull
+
# ##i##less ChangeLog
+
</console>
+
{{Note}}Please read the ChangeLog carefuly and perform necessary updates to <code>/etc/boot.conf</code>. Also, please backup the working <code>/boot/initramfs.cpio.gz</code> and <code>/etc/boot.conf</code> before updating better-initramfs.
+
  
== Genkernel ==
+
Ok let's go on and finish the taks, we are going to tell now grub how to boot off correctly!
Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:
+
<console>
+
# ##i##genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all </console>
+
Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing <code>/etc/boot.conf</code>:
+
  
 
<pre>
 
<pre>
 +
root@[~src/linux] # nano /etc/boot.conf
 +
 
boot {
 
boot {
  generate grub
+
        generate grub
  default "Funtoo Linux"
+
        default "Funtoo Linux dracut"
  timeout 3
+
        timeout 3
 
}
 
}
"Funtoo Linux" {
 
  kernel kernel-genkernel-x86_64-2.6.39
 
  initrd initramfs-genkernel-x86_64-2.6.39
 
  params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
 
</pre>
 
  
= Bootloader Configuration =
+
"Funtoo Linux genkernel" {
== Grub2 configuration ==
+
        kernel kernel-genkernel[-v]
An example of <code>/etc/boot.conf</code> for better-initramfs:
+
        initrd initramfs-genkernel[-v]
 +
        params = quiet rootfstype=ext4
 +
        params += luks enc_root=/dev/sda3
 +
        params += lvm root=/dev/mapper/vg-root
 +
}
  
<pre>
+
"Funtoo Linux dracut" {
boot {
+
        kernel vmlinuz[-v]
  generate grub
+
## this is the better-initramfs generated initrd
  default "Funtoo Linux"
+
        initrd initramfs[-v].img
  timeout 3
+
        params  = quiet rootfstype=ext4
 +
        params += luks enc_root=/dev/sda3
 +
        params += lvm root=/dev/mapper/vg-root
 
}
 
}
"Funtoo Linux" {
+
 
  kernel bzImage[-v]
+
  initrd /initramfs.cpio.gz
+
  params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
+
 
</pre>
 
</pre>
  
Now, run <code>boot-update</code> to write the configuration files to <code>/boot/grub/grub.cfg</code>
+
That's it almost!
  
== Lilo configuration ==
+
Now write to the grub.cfg with the new handy boot-update script from funtoo:
For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support
+
 
<console>
 
<console>
# ##i##echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
+
root@[~src/linux] # boot-update -v
# ##i##emerge lilo
+
 
</console>
 
</console>
 +
<pre>
 +
root@[~src/linux] # sudo boot-update -v
 +
 +
boot-update 1.5.2 / Copyright 2009-2011 Funtoo Technologies
 +
 +
[use option "-l" for license info, "-h" for help]
 +
 +
* Generating config for grub...
 +
 +
DEFAULT > Funtoo Linux - vmlinuz-3.2.6-pf
 +
          Funtoo Linux genkernel - kernel-genkernel-x86_64-3.2.6-pf
 +
 +
* Completed successfully.
 +
</pre>
 +
 +
Okay,... here you go..! :)
 +
 +
Reboot and see how it works!
 +
 +
= Option two: using better-initramfs =
 +
 +
Piotr's better-initramfs is another approach that is tiny, nice and shiny and seems to become more and more a favourite among funtoo'ers. The biggest plus is that, once built it is kernel version independant.
  
Example <code>/etc/lilo.conf</code>:
+
For using this you just do the following steps:
 
<pre>
 
<pre>
append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"
+
1. download sources
boot=/dev/sda
+
2. build kernel with "make bzImage"
compact
+
3. download better-initramfs
default=funtoo
+
4. run better-initramfs
lba32
+
5. adjust /etc/boot.conf
prompt
+
read-only
+
timeout=50
+
image=/boot/kernel-genkernel-x86_64-2.6.39
+
initrd=/boot/initramfs-genkernel-x86_64-2.6.39
+
label=funtoo
+
 
</pre>
 
</pre>
  
== Syslinux bootloader setup ==
+
Here is how in detail:
Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.
+
 
 +
Assuming you did install already a genkernel backup or at least you have a working bzImage + modules installed, we rush forward to step 3:
 +
 
 +
=== download better-initramfs ===
 +
 
 
<console>
 
<console>
# ##i##emerge syslinux
+
# cd /usr/src/;
# ##i##mkdir /boot/extlinux
+
# git clone https://github.com/slashbeast/better-initramfs.git
# ##i##extlinux --install /boot/extlinux
+
 
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
+
# /src # cd better-initramfs
- or -
+
# better-initramfs git:(master) ls
# ##i##sgdisk /dev/sda --attributes=1:set:2
+
AUTHORS    LICENSE  README.rst  bootstrap  output  sourceroot
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition
+
ChangeLog  Makefile  TODO        examples  scripts
 
</console>
 
</console>
Example <code>/boot/extlinux/extlinux.conf</code>:
+
 
 +
=== build the better-initramfs ===
 +
<console>
 +
➜ # better-initramfs git:(master) sudo bootstrap/bootstrap-all
 +
Passwort: xxx
 +
# from here go and grab a coffee
 +
➜ # sudo make prepare
 +
➜ # sudo make image
 +
➜ # sudo mv output/initramfs.cpio.gz /boot
 +
</console>
 +
 
 +
=== adjust grub ===
 +
 
 +
Taking the above setup we edit the /etc/boot.conf
 +
as I installed genkernel first, and dracut after - you see this setup:
 +
 
 
<pre>
 
<pre>
LABEL kernel1_bzImage-3.2.1
+
boot {
MENU LABEL Funtoo Linux bzImage-3.2.1
+
        generate grub
LINUX /bzImage-3.2.1
+
        default "Funtoo Linux"
INITRD /initramfs.cpio.gz
+
        timeout 3
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root
+
}
 +
 
 +
# Rootfs over lvm over luks
 +
# /dev/sda3 - encrypted lvm's pv
 +
# /dev/mapper/vg-root - rootfs's lv
 +
 
 +
"Funtoo Linux" {
 +
        kernel bzImage[-v]
 +
## this is the better-initramfs generated initrd
 +
        initrd initramfs.cpio.gz
 +
        params  = quiet rootfstype=ext4
 +
        params += luks enc_root=/dev/sda3
 +
        params += lvm root=/dev/mapper/vg-root
 +
}
 +
 
 +
"Funtoo Linux dracut" {
 +
        kernel vmlinuz[-v]
 +
## this is the dracut generated initrd
 +
        initrd initramfs[-v].img
 +
        params  = quiet rootfstype=ext4
 +
        params += luks enc_root=/dev/sda3
 +
        params += lvm root=/dev/mapper/vg-root
 +
}
 +
 
 +
 
 +
"Funtoo Linux genkernel" {
 +
        kernel kernel-genkernel[-v]
 +
        initrd initramfs-genkernel[-v]
 +
        params = quiet rootfstype=ext4
 +
        params += luks enc_root=/dev/sda3
 +
        params += lvm root=/dev/mapper/vg-root
 +
}
 
</pre>
 
</pre>
 +
Okay,... here you go..! :)
 +
 +
update the grub.cfg, then reboot and see how it works!
  
= Final steps =
 
Umount everything, close encrypted drive and reboot
 
 
<console>
 
<console>
# ##i##umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot}
+
root@[~src/linux-3.2.6-pf] # boot-update -v   
# ##i##vgchange -a n
+
# ##i##cryptsetup luksClose /dev/sda2 dmcrypt_root
+
</console>
+
After reboot you will get the following:
+
<pre>>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
+
>>> Create all the symlinks to /bin/busybox.
+
>>> Initiating /dev/dir
+
>>> Getting LVM volumes up (if any)
+
Reding all physical volumes. This make take awhile...
+
No volume group found
+
No volume group found
+
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
+
Enter passphrase fore /dev/sda2:</pre>
+
Type your password
+
  
<pre>>>> Again, getting LVM volumes up (if any, after map dmcrypt).
+
  boot-update 1.5.2 / Copyright 2009-2011 Funtoo Technologies
  Reading all physical volumes. This may take a while...
+
 
  Found volume group "vg" using metadata type lvm2
+
[use option "-l" for license info, "-h" for help]
  4 logical volume(s) in volume group "vg" now active
+
 
>>> Mounting rootfs to /newroot
+
* Generating config for grub...
>>> Umounting /sys and /proc.
+
 
>>> Switching root to /newroot and executing /sbin/init.
+
DEFAULT > Funtoo Linux better-initramfs - vmlinuz-3.2.6-pf
INIT: version 2.88 booting
+
          Funtoo Linux dracut - vmlinuz-3.2.6-pf
Loading /libexec/rc/console/keymap
+
          Funtoo Linux genkernel - kernel-genkernel-x86_64-3.2.6-ck
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
+
 
...boot messages omitted for clarity
+
* Completed successfully.
 
+
 
orion login: oleg
+
root@[~src/linux-3.2.6-pf] #
Password:
+
 
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
+
root@[~src/linux-3.2.6-pf] # reboot
oleg@orion ~ %</pre>
+
 
 +
System going down for reboot!
 +
 
 +
</console>
  
= Additional links and information =
 
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
 
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]
 
* [http://en.wikipedia.org/wiki/Logical_volume_management Wikipedia article on LVM]
 
* [https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS Arch Wiki article]
 
  
 
[[Category:HOWTO]]
 
[[Category:HOWTO]]
 +
[[Category:Featured]]
 +
[[Category:Kernel]]

Revision as of 15:14, 9 January 2014

Setting up a proper kernel yourself - lean, mean and tailored to your hardware, is the challenge by which a linux user can graduate to becoming a Funtoo knight ;-)

Even though many of us are using enterprise-ready kernels in datacenters, there is almost nobody who hasn't at least considered building a kernel for his laptop / PC. We are showing here how an intermediate Linux user can use an alternative to the standard beginners "genkernel" approach, to compile a custom kernel, in a relatively still speedy and easy set up.

Contents

Minimum Requirements

You should understand the way how things work in a terminal and how to use an editor and tweak config files. This is crucial. You don't need much knowledge about the linux kernel and it's internals. Nevertheless, you have to know at least where the files are located, how they are used and what is the file logic behind the overall structure. Otherwise you should consider using a non source based linux distribution. If you are scared now, don't worry - we are going to build a kernel the Funtoo way and you will pick up everthing necessary to accomplish this challenge, step by step, so the next time you do it yourself and become a real Funtoo knight!

Assumptions

You start from an installed Funtoo system on the disk, or at least, you are on stage3 in a chrooted environment from a live cd, following somehow the Funto Installation Tutorial.

In this case we are building a kernel that is booting root in LVM over encrypted LUKS container. If you don't have this setup, don't worry, you just don't need all the modules, but everything else is similar.


Getting everything in order to start

First there is the decision which linux kernel sources we need. There are plenty of them in the repositories around, often it is not easy to distinguish between them.

I would always trust my distribution of choice and take what is has to offer - and funtoo has a lot to offer!

I really do recommend (especially if it is your first time) to build a debian-sourced genkernel like described in chapter 5 "Using Debian-Sources with Genkernel" in the Funtoo Kernels Tutorial.

From there you should have a running system booting nicely from your own build (just little bit bloated) kernel. This is more than you can expect from any other ready to go distribution.

Attention We are using RedHat's dracut in order to build a nice initramfs (containing all the necessary tools and extra drivers our kernel might need to start the system).

Although dracut is the way to go, more sophisticated and not as buggy as gentoo's genkernel approach, more and more funtoo geeks start using slashbeast's better-initramfs, which we will cover at the end of this howto!

So after having set up a genkernel from debian or gentoo sources we are going to build a kernel with either (or both) dracut or/and better-initramfs. So gentoo sources with genkernel is always my backup if anything is not working correctly on my system. For the slightly more geeky approach with my own initram I am using pf-sources, ck-sources or any other more or less heavily patched sources.

Let's go!

Kernel Sources

We are going to use the kernel sources from the funtoo git repository.

The source you use on your system is up to you and your needs. For a laptop or desktop system, we recommend the following:

  • sys-kernel/pf-sources
  • sys-kernel/ck-sources
  • sys-kernel/gentoo-sources
  • sys-kernel/git-sources
  • sys-kernel/sysrescue-std-sources
  • sys-kernel/debian-sources

Please, have a look in the ebuild description, look onto their homepage and take the one that suits you best! If you are unsure for now, use sys-kernel/gentoo-sources. That's always a safe bet for a general system.

It is not a problem to have various kernels installed parallel, so go on with any one of them.

I am going to use the sys-kernel/pf-sources now, as I already had the gentoo-sources installed.

Prerequisites

I don't know which tools you have already installed, so some information here might be redundant. It doesn't harm to just copy and paste and do some steps again.

First, we look into our /etc/make.conf:

# nano /etc/make.conf
#These compiler flags are just tweaking (optimazation) and NOT necessary:
CFLAGS="-O2 -pipe -march=native -ftracer -fforce-addr"
CXXFLAGS="${CFLAGS} -fpermissive -fomit-frame-pointer"
KDIR=/usr/src/linux
KERNEL="symlink build"
USE="$KERNEL ....here are your use flags...."
## These modules are available:
## DRACUT_MODULES="dracut_modules_biosdevname dracut_modules_btrfs dracut_modules_caps dracut_modules_crypt dracut_modules_crypt-gpg dracut_modules_dmraid dracut_modules_dmsquash-live dracut_modules_gensplash dracut_modules_iscsi dracut_modules_livenet dracut_modules_lvm dracut_modules_mdraid dracut_modules_multipath dracut_modules_nbd dracut_modules_nfs dracut_modules_plymouth dracut_modules_ssh-client dracut_modules_syslog"
## We will use these modules for LVM / LUKS:
DRACUT_MODULES="crypt lvm plymouth biosdevname dmraid crypt-gpg dmsquash-live ssh-client syslog"

Next, we set the package keywords:

/etc/portage/package.use/dracut:
sys-kernel/dracut dm net device-mapper crypt lvm

Note Note: If you don't have lvm over encrypted LUKS you probably just add the "net" keyword here, or "selinux".


After that we are going to build our packages:

# emerge -av app-portage/gentoolkit sys-kernel/pf-sources sys-kernel/dracut sys-boot/plymouth sys-boot/plymouth-openrc-plugin

Finished? Well, then let's go on and

Preparing the kernel

We go now to the sources directory and enter the following commands to update the kernel's .config file:

# cd /usr/src/linux/
# make clean
  CLEAN   .
  CLEAN   arch/x86/kernel/acpi/realmode
  CLEAN   arch/x86/kernel/cpu
  CLEAN   arch/x86/kernel
  CLEAN   arch/x86/vdso
  CLEAN   arch/x86/lib
  CLEAN   drivers/gpu/drm/radeon
  CLEAN   drivers/net/wan
  CLEAN   drivers/scsi/aic7xxx
  CLEAN   drivers/tty/vt
  CLEAN   drivers/video/logo
  CLEAN   firmware
  CLEAN   kernel
  CLEAN   lib/raid6
  CLEAN   lib
  CLEAN   security/apparmor
  CLEAN   security/selinux
  CLEAN   usr
  CLEAN   arch/x86/boot/compressed
  CLEAN   arch/x86/boot
  CLEAN   .tmp_versions
  CLEAN   vmlinux System.map .tmp_kallsyms2.S .tmp_kallsyms1.o .tmp_kallsyms2.o .tmp_kallsyms1.S .tmp_vmlinux1 .tmp_vmlinux2 .tmp_System.map
# zcat /proc/config.gz > /usr/src/linux/.config
# make localmodconfig

You will get some questions which you can answer mostly with either M (compiled as a module) or Y (compiled directly into the kernel).

Enable different security models (SECURITY) [Y/n/?] y
Enable the securityfs filesystem (SECURITYFS) [Y/?] y
Socket and Networking Security Hooks (SECURITY_NETWORK) [Y/?] y
Security hooks for pathname based access control (SECURITY_PATH) [Y/?] y
Low address space for LSM to protect from user allocation (LSM_MMAP_MIN_ADDR) [65536] 65536
NSA SELinux Support (SECURITY_SELINUX) [Y/n/?] y
  NSA SELinux boot parameter (SECURITY_SELINUX_BOOTPARAM) [N/y/?] n
  NSA SELinux runtime disable (SECURITY_SELINUX_DISABLE) [N/y/?] n
  NSA SELinux Development Support (SECURITY_SELINUX_DEVELOP) [Y/n/?] y
  NSA SELinux AVC Statistics (SECURITY_SELINUX_AVC_STATS) [Y/n/?] y
  NSA SELinux checkreqprot default value (SECURITY_SELINUX_CHECKREQPROT_VALUE) [1] 1
  NSA SELinux maximum supported policy format version (SECURITY_SELINUX_POLICYDB_VERSION_MAX) [Y/n/?] y
    NSA SELinux maximum supported policy format version value (SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE) [19] 19
TOMOYO Linux Support (SECURITY_TOMOYO) [Y/n/?] y
  Default maximal count for learning mode (SECURITY_TOMOYO_MAX_ACCEPT_ENTRY) [2048] 2048
  Default maximal count for audit log (SECURITY_TOMOYO_MAX_AUDIT_LOG) [1024] 1024
  Activate without calling userspace policy loader. (SECURITY_TOMOYO_OMIT_USERSPACE_LOADER) [Y/n/?] y
AppArmor support (SECURITY_APPARMOR) [Y/n/?] y
  AppArmor boot parameter default value (SECURITY_APPARMOR_BOOTPARAM_VALUE) [1] 1
Integrity Measurement Architecture(IMA) (IMA) [Y/n/?] y
EVM support (EVM) [N/y/?] (NEW)
Default security module
  1. SELinux (DEFAULT_SECURITY_SELINUX)
  2. TOMOYO (DEFAULT_SECURITY_TOMOYO)
  3. AppArmor (DEFAULT_SECURITY_APPARMOR)
> 4. Unix Discretionary Access Controls (DEFAULT_SECURITY_DAC)
choice[1-4?]: 4
warning: (ACPI_HOTPLUG_CPU) selects ACPI_CONTAINER which has unmet direct dependencies (ACPI && EXPERIMENTAL)
warning: (MEDIA_TUNER) selects MEDIA_TUNER_TEA5761 which has unmet direct dependencies (MEDIA_SUPPORT && VIDEO_MEDIA && I2C && EXPERIMENTAL)
#
# configuration written to .config
#
warning: (GFS2_FS) selects DLM which has unmet direct dependencies (EXPERIMENTAL && INET && SYSFS && CONFIGFS_FS && (IPV6 || IPV6=n))
warning: (IMA) selects TCG_TPM which has unmet direct dependencies (HAS_IOMEM && EXPERIMENTAL)
warning: (MEDIA_TUNER) selects MEDIA_TUNER_TEA5761 which has unmet direct dependencies (MEDIA_SUPPORT && VIDEO_MEDIA && I2C && EXPERIMENTAL)
warning: (ACPI_HOTPLUG_CPU) selects ACPI_CONTAINER which has unmet direct dependencies (ACPI && EXPERIMENTAL)
root@[~src/linux] #

Now comes the most adventurous part!

Building the Kernel

# make -j8  bzImage
# make -j8 modules
# make modules_install
# make install


Building an initramfs or not?

The reason to build a kernel with an initramfs is mostly for interoperability (e.g. live-cd's) and special features like an included busybox, ssh, etc. But mostly, and that's why we are doing this here now, to have a proper kernel up and running quick'n dirty in a reasonable time without fighting hours and days until a more or less exotic hardware is perfectly run by the kernel. After having a proper basic kernel running with the help of an initramfs, I really recommend you to go a step further and build a true kernel with all features includes without an initramfs. But this could be pain in the ass and very time consuming - so we do it the funtoo way here - at least in the second example when we stick to better-initramfs instead of Red-Hat's dracut.

Option one: Initrd with dracut

To build the initrd we just execute

# dracut -f --fstab --xz /boot/initramfs-3.2.6-pf.img  3.2.6-pf

Generally, this really should be enough! If you experience booting problems like missing modules / drivers then just boot from the genkernel section and fix the initrd building. You can look into the man page to tweak the command a bit (e.g. --add-drivers "xz dm_crypt" etc...).

Ok let's go on and finish the taks, we are going to tell now grub how to boot off correctly!

root@[~src/linux] # nano /etc/boot.conf

boot {
        generate grub
        default "Funtoo Linux dracut"
        timeout 3
}

"Funtoo Linux genkernel" {
        kernel kernel-genkernel[-v]
        initrd initramfs-genkernel[-v]
        params = quiet rootfstype=ext4
        params += luks enc_root=/dev/sda3
        params += lvm root=/dev/mapper/vg-root
}

"Funtoo Linux dracut" {
        kernel vmlinuz[-v]
## this is the better-initramfs generated initrd
        initrd initramfs[-v].img
        params  = quiet rootfstype=ext4
        params += luks enc_root=/dev/sda3
        params += lvm root=/dev/mapper/vg-root
}

That's it almost!

Now write to the grub.cfg with the new handy boot-update script from funtoo:

root@[~src/linux] # boot-update -v
root@[~src/linux] # sudo boot-update -v

 boot-update 1.5.2 / Copyright 2009-2011 Funtoo Technologies

 [use option "-l" for license info, "-h" for help]

 * Generating config for grub...

 DEFAULT > Funtoo Linux - vmlinuz-3.2.6-pf
           Funtoo Linux genkernel - kernel-genkernel-x86_64-3.2.6-pf

 * Completed successfully.

Okay,... here you go..! :)

Reboot and see how it works!

Option two: using better-initramfs

Piotr's better-initramfs is another approach that is tiny, nice and shiny and seems to become more and more a favourite among funtoo'ers. The biggest plus is that, once built it is kernel version independant.

For using this you just do the following steps:

1. download sources
2. build kernel with "make bzImage"
3. download better-initramfs
4. run better-initramfs
5. adjust /etc/boot.conf

Here is how in detail:

Assuming you did install already a genkernel backup or at least you have a working bzImage + modules installed, we rush forward to step 3:

download better-initramfs

➜ # cd /usr/src/;
➜ # git clone https://github.com/slashbeast/better-initramfs.git

➜ # /src #  cd better-initramfs
➜ # better-initramfs git:(master) ls
AUTHORS    LICENSE   README.rst  bootstrap  output   sourceroot
ChangeLog  Makefile  TODO        examples   scripts

build the better-initramfs

➜ # better-initramfs git:(master) sudo bootstrap/bootstrap-all
Passwort: xxx 
# from here go and grab a coffee
➜ # sudo make prepare
➜ # sudo make image
➜ # sudo mv output/initramfs.cpio.gz /boot

adjust grub

Taking the above setup we edit the /etc/boot.conf as I installed genkernel first, and dracut after - you see this setup:

boot {
        generate grub
        default "Funtoo Linux"
        timeout 3
}

# Rootfs over lvm over luks
# /dev/sda3 - encrypted lvm's pv
# /dev/mapper/vg-root - rootfs's lv

"Funtoo Linux" {
        kernel bzImage[-v]
## this is the better-initramfs generated initrd
        initrd initramfs.cpio.gz
        params  = quiet rootfstype=ext4
        params += luks enc_root=/dev/sda3
        params += lvm root=/dev/mapper/vg-root
}

"Funtoo Linux dracut" {
        kernel vmlinuz[-v]
## this is the dracut generated initrd
        initrd initramfs[-v].img
        params  = quiet rootfstype=ext4
        params += luks enc_root=/dev/sda3
        params += lvm root=/dev/mapper/vg-root
}


"Funtoo Linux genkernel" {
        kernel kernel-genkernel[-v]
        initrd initramfs-genkernel[-v]
        params = quiet rootfstype=ext4
        params += luks enc_root=/dev/sda3
        params += lvm root=/dev/mapper/vg-root
}

Okay,... here you go..! :)

update the grub.cfg, then reboot and see how it works!

root@[~src/linux-3.2.6-pf] # boot-update -v     

 boot-update 1.5.2 / Copyright 2009-2011 Funtoo Technologies

 [use option "-l" for license info, "-h" for help]

 * Generating config for grub...

 DEFAULT > Funtoo Linux better-initramfs - vmlinuz-3.2.6-pf
           Funtoo Linux dracut - vmlinuz-3.2.6-pf
           Funtoo Linux genkernel - kernel-genkernel-x86_64-3.2.6-ck

 * Completed successfully.

root@[~src/linux-3.2.6-pf] #

root@[~src/linux-3.2.6-pf] # reboot

System going down for reboot!