Difference between pages "Rootfs over encrypted lvm" and "Make.conf"

From Funtoo
(Difference between pages)
Jump to navigation Jump to search
 
m
 
Line 1: Line 1:
This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the [[Funtoo Linux Installation]] Guide.  
== What is the make.conf file? ==
Make.conf is portage's and Funtoo's main configuration file. It contains many variables that define how a package will installed in a Funtoo system. You can customize portage internal variables, such as, portage tree location, sources tarball location, overlays, to name a few. You can customize hardware specs, such as TMPFS, disk limits, GCC compilation flags to achieve best performance, etc. A great deal of this customization is done through the make.conf file. This page will attempt to explain the uses of the make.conf file, different variables that can be added to it, and their uses.  


== Prepare the hard drive and partitions ==
== Where is make.conf located? ==
This is an example partition scheme, you may want to choose differently.
{{f|make.conf}} can be found in two different places:
<code>/dev/sda1</code> used as <code>/boot</code>. <code>/dev/sda2</code> will be encrypted drive with LVM.
# As a text file at {{f|/etc/portage/make.conf}}
* <code>/dev/sda1</code> -- <code>/boot</code> partition.
# As a symbolic link to the above text file, located at {{f|/etc/make.conf}} (this is now deprecated).
* <code>/dev/sda2</code> -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [http://www.funtoo.org/Funtoo_Linux_Installation#Prepare_Hard_Disk] for more information on GPT and MBR.
* <code>/dev/sda3</code> -- <code>/</code> partition, will be the drive with LUKS and LVM.


With UEFI:
No special tool is required to edit {{f|/etc/portage/make.conf}}, besides your favorite text editor, of course:
* <code>/dev/sda1</code> -- <tt>/boot</tt>
{{console|body=
* <code>/dev/sda2</code> -- <tt>/</tt> partition
###i## nano /etc/portage/make.conf
}}
== Variables ==
Portage is very cutomizable. Because of this, many variables are available to configure {{f|/etc/portage/make.conf}}. Below is an example {{f|make.conf}} file showing some of the variables that can be used to customize portage. The format of a line of this file is usually <code>VARIABLENAME="variable arguments"</code>.
{{file|name=/etc/portage/make.conf|lang=|desc=example make.conf variables|body=
CFLAGS="-march=amdfam10 -O2 -pipe"
CXXFLAGS="-march=amdfam10 -O2 -pipe"
INPUT_DEVICES="evdev"
VIDEO_CARDS="vesa nouveau"
MAKEOPTS="-j2"
USE="mmx sse"
PYTHON_ABIS="2.7 3.3"
PYTHON_TARGETS="2.7 3.3"
RUBY_TARGETS="ruby21"
ACCEPT_LICENSE="*"
}}


=== Wipe the hard drive ===
Below is a list of variables that can be used in {{f|make.conf}}, along with a description of what they do. For more information on these and other variables, read {{c|man make.conf}}.
<console>
# ##i##gdisk /dev/sda


Command: ##i##x ↵
=== Accept All Licenses ===
Expert command: ##i##z ↵
{{file|name=/etc/portage/make.conf|lang=|desc=accept all licenses|body=
About to wipe out GPT on /dev/sda. Proceed?: ##i##y ↵
ACCEPT_LICENSE="*"
GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
}}
Blank out MBR?: ##i##y ↵
</console>
{{Fancywarning|This action will destroy all data on the disk.}}


== Encrypting the drive ==
=== Relocate Source Compile Directory ===
Read more about different cipher options here: [http://blog.wpkg.org/2009/04/23/cipher-benchmark-for-dm-crypt-luks/]
<console>
# ##i##cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
# ##i##cryptsetup luksOpen /dev/sda3 dmcrypt_root
</console>
There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.
{{Fancywarning|The default keymap at boot time is '''us'''. If you enter your passphrase using a different keymap, you won't be able to unlock your crypt volume if the passphrase contains any characters that are located elsewere on your keyboard layout that with the us layout.}}
= Create logical volumes =
<console>
# ##i##pvcreate /dev/mapper/dmcrypt_root
# ##i##vgcreate vg /dev/mapper/dmcrypt_root
# ##i##lvcreate -L10G --name root vg         
# ##i##lvcreate -L2G --name swap vg
# ##i##lvcreate -L5G --name portage vg
# ##i##lvcreate -l 100%FREE -nhome vg
</console>
Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.
{{fancynote| Please, notice that above mentioned partitioning scheme is an example and not a default recommendation, change it accordingly to desired scheme.}}


= Create a filesystem on volumes =
By default portage unpacks and compiles sources in {{f|/var/tmp/}}  it appends {{f|portage/pkg-cat/pkg}} to compile a package elsewhere. For example, if portage compiles a package in {{f|/tmp}}, it will be built at: {{f|/tmp/portage/pkg-cat/pkg}}. If you have Funtoo installed on an SSD, it may be a wise decision to mount {{f|/tmp}} in RAM or on a HDD so that you can minimize the number of writes to your SSD and extend its lifetime. After {{f|/tmp}} has been mounted off of your SSD, you can tell portage to compile future packages in {{f|/tmp}}, instead of in {{f|/var/tmp}}. To do this, add the following line to your {{f|/etc/portage/make.conf}}:
<console>
# ##i##mkfs.ext2 /dev/sda1
# ##i##mkswap /dev/mapper/vg-swap
# ##i##mkfs.ext4 /dev/mapper/vg-root
# ##i##mkfs.ext4 /dev/mapper/vg-portage
# ##i##mkfs.ext4 /dev/mapper/vg-home
</console>


= Basic system setup =
{{file|name=/etc/portage/make.conf|lang=|desc= |body=
<console>
PORTAGE_TMPDIR="/tmp"
# ##i##swapon /dev/mapper/vg-swap
}}
# ##i##mkdir /mnt/funtoo
# ##i##mount /dev/mapper/vg-root /mnt/funtoo
# ##i##mkdir -p /mnt/funtoo/{boot,usr/portage,home}
# ##i##mount /dev/sda1 /mnt/funtoo/boot
# ##i##mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
# ##i##mount /dev/mapper/vg-home /mnt/funtoo/home
</console>
Now perform all the steps required for basic system install, please follow [http://docs.funtoo.org/wiki/Funtoo_Linux_Installation]
don't forget to emerge the following before your install is finished:


* '''cryptsetup'''
=== Video_Cards ===
* '''lvm2'''
* '''a bootloader (grub recommended)'''
* '''kernel sources '''


= Editing the fstab =
The {{c|VIDEO_CARDS}} variable tells portage which video drivers you wish to use on your system. To see the different options that exist for this variable, see [[Video]].
Fire up your favorite text editor to edit <code>/etc/fstab</code>. You want to put the following in the file:


{{file|name=/etc/fstab|desc= |body=
=== Makeopts ===
# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
MAKEOPTS can be used to define how many parallel compilations should occur when you compile a package, which can speed up compilation ''significantly''. A rule of thumb is the number of CPUs (or CPU threads) in your system plus one. If for example you have a dual core processor without [[wikipedia:Hyper-threading|hyper-threading]], then you would set MAKEOPTS to 3:
/dev/sda1              /boot        ext2      noauto,noatime                  1 2
 
/dev/mapper/vg-swap    none          swap      sw                              0 0
{{file|name=/etc/portage/make.conf|lang=|desc=set portage to use 3 threads|body=
/dev/mapper/vg-root    /            ext4      noatime,nodiratime,defaults    0 1
MAKEOPTS="-j3"
/dev/sr0                /mnt/cdrom    auto      noauto,ro                      0 0
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
/dev/mapper/vg-home    /home        ext4      noatime,nodiratime              0 0
}}
}}


== Kernel options ==
If you are unsure about how many processors/threads you have then use /proc/cpuinfo to help you.
{{fancynote| This part is particularly important: pay close attention. }}<br>
{{console|body=
{{kernelop
(chroot) # ##i##grep "processor" /proc/cpuinfo | wc -l
|title=
16
|desc=
General setup --->
      [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support
}}
{{kernelop
|title=
|desc=
Device Drivers --->
      Generic Driver Options --->
      [*] Maintain a devtmpfs filesystem to mount at /dev
}}
{{kernelop
|title=
|desc=
Device Drivers --->
      [*] Multiple devices driver support --->
      <*>Device Mapper Support
        <*> Crypt target support
}}
{{kernelop
|title=
|desc=
Cryptographic API --->
      <*> XTS support
      -*-AES cipher algorithms
}}
}}


= Initramfs setup and configuration =
Set MAKEOPTS to this number plus one:
== Better-initramfs ==
'''Build your initramfs with [https://bitbucket.org/piotrkarbowski/better-initramfs better-initramfs] project.'''


{{fancynote| better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices and file system support.}}
{{file|name=/etc/portage/make.conf|lang=|desc=set portage to use 17 threads|body=
MAKEOPTS="-j17"
}}


<console>
# ##i##cd /opt
# ##i##git clone git://github.com/slashbeast/better-initramfs.git
# ##i##cd better-initramfs
# ##i##less README.rst
# ##i##bootstrap/bootstrap-all
# ##i##make prepare
# ##i##make image
</console>


Copy resulting <code>initramfs.cpio.gz</code> to <code>/boot</code>:
{{important|Use processors +1 if you use [https://en.wikipedia.org/wiki/CFQ Completely Fair Queuing] I/O scheduler. If you use [http://ck.kolivas.org/patches/bfs/bfs-faq.txt BFQ] use only as many jobs as you have CPUs. However chances are that you use CFQ.}}
<console># ##i##cp output/initramfs.cpio.gz /boot</console>


Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads
<console>
# ##i##wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
# ##i##tar xf release-x86_64-v0.5.tar.bz2
# ##i##cd release*
# ##i##gzip initramfs.cpio
# ##i##cp initramfs.cpio.gz /boot
</console>


Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with <code>git</code>. Go to the better-initramfs source dir and follow:
=== USE flags ===
<console>
# ##i##cd /opt/better-initramfs
# ##i##git pull
# ##i##less ChangeLog
</console>
{{fancynote| Please read the ChangeLog carefuly and perform necessary updates to <code>/etc/boot.conf</code>. Also, please backup the working <code>/boot/initramfs.cpio.gz</code> and <code>/etc/boot.conf</code> before updating better-initramfs.}}
Alternatively and much faster is to install better-initramfs-bin package, recently added to Funtoo's portage tree:
<console>
# ##i##emerge better-initramfs-bin
</console>


== Genkernel ==
USE flags define what functionality is enabled when packages are built. It is not recommended to add a lot of them during installation; you should wait until you have a working, bootable system before changing your USE flags. A USE flag prefixed with a minus (" - ") sign tells Portage not to use the flag when compiling.  Through use flags we generate more secure stripped down binaries with reduced attack surface & (slightly) better performance.  A Funtoo guide to USE flags will be available in the future. For now, you can find out more information about USE flags in the [https://wiki.gentoo.org/wiki/Handbook:AMD64/Working/USE Gentoo Handbook].
Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:
<console>
# ##i##genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all </console>


== Bootloader Configuration ==
Some hardware options should be turned on if they're not already. To see what your hardware supports:
=== Grub2 configuration ===
==== better-initramfs ====
An example <code>/etc/boot.conf</code> for better-initramfs:


<pre>
{{console|body=
boot {
###i## cat /proc/cpuinfo
  generate grub
}}
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
  kernel vmlinuz[-v]
  initrd /initramfs.cpio.gz
  params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
}
</pre>


Now, run <code>boot-update</code> to write the configuration files to <code>/boot/grub/grub.cfg</code>
see [[CPU_FLAGS]] & [[Subarches]] for further information.


==== genkernel ====
{{file|name=/etc/portage/make.conf|lang=|desc=Example of Turning On Hardware Optimizations|body=
Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing <code>/etc/boot.conf</code>:
USE="mmx, sse, sse2, sse3, 3dnow, 3dnowext"}}


<pre>
=== Input ===
boot {
some devices need defined such as {{package|x11-drivers/xf86-input-synaptics}} for touch pads.
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
  kernel kernel-genkernel-x86_64-3.13.0
  initrd initramfs-genkernel-x86_64-3.13.0
  params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
}
</pre>


=== Lilo configuration ===
{{file|name=/etc/portage/make.conf|lang=|desc=synaptics example|body=
For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support
INPUT_DEVICES="synaptics evdev"
<console>
}}
# ##i##echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
# ##i##emerge lilo
</console>


Example <code>/etc/lilo.conf</code> for genkernel:
=== Linguas ===
LINGUAS tells Portage which local language to compile the system and applications in (those who use LINGUAS variable like OpenOffice). It is not usually necessary to set this if you use English. If you want another language such as French (fr) or German (de), set LINGUAS appropriately:


<pre>
{{file|name=/etc/portage/make.conf|lang=|desc=set system language to french|body=
append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"
LINGUAS="fr"
boot=/dev/sda
}}
compact
default=funtoo
lba32
prompt
read-only
timeout=50
image=/boot/kernel-genkernel-x86_64-3.13.0
initrd=/boot/initramfs-genkernel-x86_64-3.13.0
label=funtoo
</pre>
 
=== Syslinux bootloader setup ===
Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.
<console>
# ##i##emerge syslinux
# ##i##mkdir /boot/extlinux
# ##i##extlinux --install /boot/extlinux
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
- or -
# ##i##sgdisk /dev/sda --attributes=1:set:2
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition
</console>
 
Example <code>/boot/extlinux/extlinux.conf</code> for better-initramfs:
 
<pre>
LABEL kernel1_bzImage-3.2.1
MENU LABEL Funtoo Linux bzImage-3.2.1
LINUX /bzImage-3.2.1
INITRD /initramfs.cpio.gz
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root
</pre>
 
== Final steps ==
Umount everything, close encrypted drive and reboot
<console>
# ##i##umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot}
# ##i##vgchange -a n
# ##i##cryptsetup luksClose /dev/sda2 dmcrypt_root
</console>
After reboot you will get the following:
<console>
>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
>>> Create all the symlinks to /bin/busybox.
>>> Initiating /dev/dir
>>> Getting LVM volumes up (if any)
Reding all physical volumes. This make take awhile...
No volume group found
No volume group found
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
Enter passphrase fore /dev/sda2:
</console>
Type your password
 
<console>
>>> Again, getting LVM volumes up (if any, after map dmcrypt).
  Reading all physical volumes.  This may take a while...
  Found volume group "vg" using metadata type lvm2
  4 logical volume(s) in volume group "vg" now active
>>> Mounting rootfs to /newroot
>>> Umounting /sys and /proc.
>>> Switching root to /newroot and executing /sbin/init.
INIT: version 2.88 booting
Loading /libexec/rc/console/keymap
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
...boot messages omitted for clarity
 
orion login: oleg
Password:
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
oleg@orion ~ %
</console>
 
== Additional links and information ==
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]
* [http://en.wikipedia.org/wiki/Logical_volume_management Wikipedia article on LVM]
* [https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS Arch Wiki article]


[[Category:HOWTO]]
{{PageNeedsUpdates}}
[[Category:System]]

Revision as of 11:46, March 27, 2015

What is the make.conf file?

Make.conf is portage's and Funtoo's main configuration file. It contains many variables that define how a package will installed in a Funtoo system. You can customize portage internal variables, such as, portage tree location, sources tarball location, overlays, to name a few. You can customize hardware specs, such as TMPFS, disk limits, GCC compilation flags to achieve best performance, etc. A great deal of this customization is done through the make.conf file. This page will attempt to explain the uses of the make.conf file, different variables that can be added to it, and their uses.

Where is make.conf located?

make.conf can be found in two different places:

  1. As a text file at /etc/portage/make.conf
  2. As a symbolic link to the above text file, located at /etc/make.conf (this is now deprecated).

No special tool is required to edit /etc/portage/make.conf, besides your favorite text editor, of course: 

root # nano /etc/portage/make.conf

Variables

Portage is very cutomizable. Because of this, many variables are available to configure /etc/portage/make.conf. Below is an example make.conf file showing some of the variables that can be used to customize portage. The format of a line of this file is usually VARIABLENAME="variable arguments".

   /etc/portage/make.conf - example make.conf variables
CFLAGS="-march=amdfam10 -O2 -pipe"
CXXFLAGS="-march=amdfam10 -O2 -pipe"
INPUT_DEVICES="evdev"
VIDEO_CARDS="vesa nouveau"
MAKEOPTS="-j2"
USE="mmx sse"
PYTHON_ABIS="2.7 3.3"
PYTHON_TARGETS="2.7 3.3"
RUBY_TARGETS="ruby21"
ACCEPT_LICENSE="*"

Below is a list of variables that can be used in make.conf, along with a description of what they do. For more information on these and other variables, read man make.conf.

Accept All Licenses

   /etc/portage/make.conf - accept all licenses
ACCEPT_LICENSE="*"

Relocate Source Compile Directory

By default portage unpacks and compiles sources in /var/tmp/ it appends portage/pkg-cat/pkg to compile a package elsewhere. For example, if portage compiles a package in /tmp, it will be built at: /tmp/portage/pkg-cat/pkg. If you have Funtoo installed on an SSD, it may be a wise decision to mount /tmp in RAM or on a HDD so that you can minimize the number of writes to your SSD and extend its lifetime. After /tmp has been mounted off of your SSD, you can tell portage to compile future packages in /tmp, instead of in /var/tmp. To do this, add the following line to your /etc/portage/make.conf:

   /etc/portage/make.conf 
PORTAGE_TMPDIR="/tmp"

Video_Cards

The VIDEO_CARDS variable tells portage which video drivers you wish to use on your system. To see the different options that exist for this variable, see Video.

Makeopts

MAKEOPTS can be used to define how many parallel compilations should occur when you compile a package, which can speed up compilation significantly. A rule of thumb is the number of CPUs (or CPU threads) in your system plus one. If for example you have a dual core processor without hyper-threading, then you would set MAKEOPTS to 3:

   /etc/portage/make.conf - set portage to use 3 threads
MAKEOPTS="-j3"

If you are unsure about how many processors/threads you have then use /proc/cpuinfo to help you. 

(chroot) # grep "processor" /proc/cpuinfo

Set MAKEOPTS to this number plus one:

   /etc/portage/make.conf - set portage to use 17 threads
MAKEOPTS="-j17"


   Important

Use processors +1 if you use Completely Fair Queuing I/O scheduler. If you use BFQ use only as many jobs as you have CPUs. However chances are that you use CFQ.


USE flags

USE flags define what functionality is enabled when packages are built. It is not recommended to add a lot of them during installation; you should wait until you have a working, bootable system before changing your USE flags. A USE flag prefixed with a minus (" - ") sign tells Portage not to use the flag when compiling. Through use flags we generate more secure stripped down binaries with reduced attack surface & (slightly) better performance. A Funtoo guide to USE flags will be available in the future. For now, you can find out more information about USE flags in the Gentoo Handbook.

Some hardware options should be turned on if they're not already. To see what your hardware supports: 

root # cat /proc/cpuinfo

see CPU_FLAGS & Subarches for further information.

   /etc/portage/make.conf - Example of Turning On Hardware Optimizations
USE="mmx, sse, sse2, sse3, 3dnow, 3dnowext"

Input

some devices need defined such as x11-drivers/xf86-input-synaptics for touch pads.

   /etc/portage/make.conf - synaptics example
INPUT_DEVICES="synaptics evdev"

Linguas

LINGUAS tells Portage which local language to compile the system and applications in (those who use LINGUAS variable like OpenOffice). It is not usually necessary to set this if you use English. If you want another language such as French (fr) or German (de), set LINGUAS appropriately:

   /etc/portage/make.conf - set system language to french
LINGUAS="fr"
Retrieved from "https://www.funtoo.org/index.php?title=Rootfs_over_encrypted_lvm&oldid=9431"