Difference between pages "Welcome" and "Rootfs over encrypted lvm"

From Funtoo
(Difference between pages)
Jump to navigation Jump to search
m (add help document section with links to requested-documents)
 
 
Line 1: Line 1:
{{MainPageSidebar|1=
This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the [[Funtoo Linux Installation]] Guide.  
{{fancyimportant|1=
[[Support Funtoo]] to help our project grow! '''Donate $15 per month and get a free [[Funtoo Hosting|Funtoo Virtual Container]].'''}}


== Resources ==
== Prepare the hard drive and partitions ==
This is an example partition scheme, you may want to choose differently.
<code>/dev/sda1</code> used as <code>/boot</code>. <code>/dev/sda2</code> will be encrypted drive with LVM.
* <code>/dev/sda1</code> -- <code>/boot</code> partition.
* <code>/dev/sda2</code> -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [http://www.funtoo.org/Funtoo_Linux_Installation#Prepare_Hard_Disk] for more information on GPT and MBR.
* <code>/dev/sda3</code> -- <code>/</code> partition, will be the drive with LUKS and LVM.


Our community has a number of excellent resources for communication and collaboration:
With UEFI:
* <code>/dev/sda1</code> -- <tt>/boot</tt>
* <code>/dev/sda2</code> -- <tt>/</tt> partition


* '''{{CreateAccount}}''' to log in to the wiki, forums and bug tracker. See [[Funtoo Authentication FAQ]].
=== Wipe the hard drive ===
* '''[http://forums.funtoo.org forums.funtoo.org]''' - our new forums!
<console>
* [https://groups.google.com/forum/#!forum/funtoo-dev funtoo-dev] mailing list
# ##i##gdisk /dev/sda
* '''[http://bugs.funtoo.org bugs.funtoo.org]''', our bug tracker ([[Reporting Bugs|Instructions]]).
 
* [http://larrythecow.org larrythecow.org], our Gentoo blog aggregation service.
Command: ##i##x ↵
* [http://kernel-seeds.org kernel-seeds.org], resources for building your kernel from scratch.
Expert command: ##i##z ↵
* [http://git.funtoo.org git.funtoo.org], our cgit repository browser.
About to wipe out GPT on /dev/sda. Proceed?: ##i##y ↵
* '''[[Support Funtoo]]''' to help our project grow.
GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
* '''[[Funtoo Hosting|Get a Funtoo Virtual Container]]'''.
Blank out MBR?: ##i##y ↵
</console>
{{Fancywarning|This action will destroy all data on the disk.}}
 
== Encrypting the drive ==
Read more about different cipher options here: [http://blog.wpkg.org/2009/04/23/cipher-benchmark-for-dm-crypt-luks/]
<console>
# ##i##cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
# ##i##cryptsetup luksOpen /dev/sda3 dmcrypt_root
</console>
There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.
{{Fancywarning|The default keymap at boot time is '''us'''. If you enter your passphrase using a different keymap, you won't be able to unlock your crypt volume if the passphrase contains any characters that are located elsewere on your keyboard layout that with the us layout.}}
= Create logical volumes =
<console>
# ##i##pvcreate /dev/mapper/dmcrypt_root
# ##i##vgcreate vg /dev/mapper/dmcrypt_root
# ##i##lvcreate -L10G --name root vg         
# ##i##lvcreate -L2G --name swap vg
# ##i##lvcreate -L5G --name portage vg
# ##i##lvcreate -l 100%FREE -nhome vg
</console>
Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.
{{fancynote| Please, notice that above mentioned partitioning scheme is an example and not a default recommendation, change it accordingly to desired scheme.}}
 
= Create a filesystem on volumes =
<console>
# ##i##mkfs.ext2 /dev/sda1
# ##i##mkswap /dev/mapper/vg-swap
# ##i##mkfs.ext4 /dev/mapper/vg-root
# ##i##mkfs.ext4 /dev/mapper/vg-portage
# ##i##mkfs.ext4 /dev/mapper/vg-home
</console>
 
= Basic system setup =
<console>
# ##i##swapon /dev/mapper/vg-swap
# ##i##mkdir /mnt/funtoo
# ##i##mount /dev/mapper/vg-root /mnt/funtoo
# ##i##mkdir -p /mnt/funtoo/{boot,usr/portage,home}
# ##i##mount /dev/sda1 /mnt/funtoo/boot
# ##i##mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
# ##i##mount /dev/mapper/vg-home /mnt/funtoo/home
</console>
Now perform all the steps required for basic system install, please follow [http://docs.funtoo.org/wiki/Funtoo_Linux_Installation]
don't forget to emerge the following before your install is finished:
 
* '''cryptsetup'''
* '''lvm2'''
* '''a bootloader (grub recommended)'''
* '''kernel sources '''
 
= Editing the fstab =
Fire up your favorite text editor to edit <code>/etc/fstab</code>. You want to put the following in the file:
 
{{file|name=/etc/fstab|desc= |body=
# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
/dev/sda1              /boot        ext2      noauto,noatime                  1 2
/dev/mapper/vg-swap    none          swap      sw                              0 0
/dev/mapper/vg-root    /            ext4      noatime,nodiratime,defaults    0 1
/dev/sr0                /mnt/cdrom    auto      noauto,ro                      0 0
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
/dev/mapper/vg-home    /home        ext4      noatime,nodiratime              0 0
}}
 
== Kernel options ==
{{fancynote| This part is particularly important: pay close attention. }}<br>
{{kernelop
|title=
|desc=
General setup --->
      [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support
}}
{{kernelop
|title=
|desc=
Device Drivers --->
      Generic Driver Options --->
      [*] Maintain a devtmpfs filesystem to mount at /dev
}}
}}
{{MainPageSidebar|1=
{{kernelop
== UserMap ==
|title=
{{#ask:[[Category:People]]
|desc=
|?Geoloc
Device Drivers --->
|format=googlemaps3|height=300|limit=999|zoom=1|minzoom=1|markercluster=on}}
      [*] Multiple devices driver support --->
[[Usermap|View Larger version]]
      <*>Device Mapper Support
        <*> Crypt target support
}}
{{kernelop
|title=
|desc=
Cryptographic API --->
      <*> XTS support
      -*-AES cipher algorithms
}}
}}
== Welcome to Funtoo Linux ==
Funtoo Linux is a Linux-based operating system that is a variant of [http://www.gentoo.org Gentoo Linux]. Funtoo Linux is:
* ...'''fun!''' Our priority is to create a ''great, supportive and responsive'' user community.
* ...'''user-centric and collaborative'''. Everyone is considered a '''user''' of Funtoo, first and foremost. You don't need any special privileges to collaborate with us.
* ...'''production-oriented''': Our goal is to have Funtoo be useful for ''real-world tasks''. We use Funtoo to do stuff, like host our infrastructure. It needs to work.__NOTOC__
* ...'''creative''': We seek creative, elegant and maintainable solutions to problems of all kinds.


'''View the [[Funtoo Linux FAQ]] for answers to common questions.'''
= Initramfs setup and configuration =
== Better-initramfs ==
'''Build your initramfs with [https://bitbucket.org/piotrkarbowski/better-initramfs better-initramfs] project.'''


== Getting Started ==
{{fancynote| better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices and file system support.}}


We encourage you to [[Funtoo Linux Installation|install Funtoo Linux]], and get involved in our user community. Get to know fellow Funtoo Linux users on our [http://forums.funtoo.org forums]. If you have any improvements or find any bugs in Funtoo Linux, you are strongly encouraged to report them on our [http://bugs.funtoo.org bug tracker]. We take all bugs seriously, and all work performed on Funtoo Linux is tracked on our bug tracker, for purposes of transparency.
<console>
# ##i##cd /opt
# ##i##git clone git://github.com/slashbeast/better-initramfs.git
# ##i##cd better-initramfs
# ##i##less README.rst
# ##i##bootstrap/bootstrap-all
# ##i##make prepare
# ##i##make image
</console>


Funtoo Linux has a very active [http://en.wikipedia.org/wiki/IRC IRC] community on Freenode, in the <code>#funtoo</code> channel, and you are encouraged to hang out online with us.
Copy resulting <code>initramfs.cpio.gz</code> to <code>/boot</code>:
<console># ##i##cp output/initramfs.cpio.gz /boot</console>


== Project Structure ==
Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads
<console>
# ##i##wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
# ##i##tar xf release-x86_64-v0.5.tar.bz2
# ##i##cd release*
# ##i##gzip initramfs.cpio
# ##i##cp initramfs.cpio.gz /boot
</console>


Funtoo Linux is led by [http://en.wikipedia.org/wiki/Daniel_Robbins_(computer_programmer) Daniel Robbins], the creator and former Chief Architect of [http://en.wikipedia.org/wiki/Gentoo_Linux Gentoo Linux], who serves as benevolent dictator for life (BDFL) of the project. Our organizational structure consists of BDFL and a small number of support staff, as well as members of our user community who are involved in improving Funtoo Linux. Development efforts are driven by the BDFL as well as our users, and efforts are under way to implement various mechanisms to allow supporters of Funtoo Linux to chart the future direction of the project.
Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with <code>git</code>. Go to the better-initramfs source dir and follow:
<console>
# ##i##cd /opt/better-initramfs
# ##i##git pull
# ##i##less ChangeLog
</console>
{{fancynote| Please read the ChangeLog carefuly and perform necessary updates to <code>/etc/boot.conf</code>. Also, please backup the working <code>/boot/initramfs.cpio.gz</code> and <code>/etc/boot.conf</code> before updating better-initramfs.}}
Alternatively and much faster is to install better-initramfs-bin package, recently added to Funtoo's portage tree:
<console>
# ##i##emerge better-initramfs-bin
</console>


'''Learn more about Funtoo Linux's [[staff]] and [[Funtoo Linux Vision|development vision]].'''
== Genkernel ==
Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:
<console>
# ##i##genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all </console>


== Distinctives ==
== Bootloader Configuration ==
=== Grub2 configuration ===
==== better-initramfs ====
An example <code>/etc/boot.conf</code> for better-initramfs:


Funtoo Linux packages are installed from source code, automatically, thanks to the [http://en.wikipedia.org/wiki/Portage_(software) Portage ports system.], inspired by the FreeBSD ports system, but written in Python and with full advanced package management functionality. Funtoo Linux is a meta-distribution, which means it is built (fully automatically) with the functionality and optimizations that ''you'' want, not what some distro maintainer thought was best for you.
<pre>
boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
  kernel vmlinuz[-v]
  initrd /initramfs.cpio.gz
  params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
</pre>


We use [http://en.wikipedia.org/wiki/Git_(software) Git] for all our development, and we also use Git to deliver our ports tree to you.
Now, run <code>boot-update</code> to write the configuration files to <code>/boot/grub/grub.cfg</code>


In contrast to Gentoo Linux, we offer a number of innovations, including our extensive use of git, [[Funtoo 1.0 Profile|our profile system]], [[Package:Boot-Update|boot-update]] boot management tool, our incredibly flexible [[Funtoo Linux Networking|template-based networking scripts]], [[Metro Quick Start Tutorial|Metro]] distribution build system, support of Debian, RHEL and other kernels, [[Creating_Python-related_Ebuilds|enhanced Python support]], Portage mini-manifests, user-centric distribution model, and a large number of community infrastructure improvements.
==== genkernel ====
Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing <code>/etc/boot.conf</code>:


== Help Document Ebuilds! ==
<pre>
boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
  kernel kernel-genkernel-x86_64-3.13.0
  initrd initramfs-genkernel-x86_64-3.13.0
  params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
</pre>


We need help adding documentation for ebuilds to our wiki. See below for a list of pages:
== Lilo configuration ==
For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support
<console>
# ##i##echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
# ##i##emerge lilo
</console>


This page lists all ebuilds with pages on the Funtoo Linux wiki.
Example <code>/etc/lilo.conf</code>:


{{#ask:[[Category:Ebuilds]] [[CatPkg::+]]
<pre>
|?CatPkg=
append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"
|?Repository=
boot=/dev/sda
|?Summary=
compact
|format=listwidget
default=funtoo
|link=all
lba32
|headers=show
prompt
|searchlabel=… further results
read-only
|class=sortable wikitable smwtable
timeout=50
|limit=9999
image=/boot/kernel-genkernel-x86_64-3.13.0
}}
initrd=/boot/initramfs-genkernel-x86_64-3.13.0
label=funtoo
</pre>
 
== Syslinux bootloader setup ==
Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.
<console>
# ##i##emerge syslinux
# ##i##mkdir /boot/extlinux
# ##i##extlinux --install /boot/extlinux
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
- or -
# ##i##sgdisk /dev/sda --attributes=1:set:2
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition
</console>
 
Example <code>/boot/extlinux/extlinux.conf</code>:


'''Add an Ebuild page:''' (see [[Adding an Ebuild to the Wiki]] for instructions)
<pre>
LABEL kernel1_bzImage-3.2.1
MENU LABEL Funtoo Linux bzImage-3.2.1
LINUX /bzImage-3.2.1
INITRD /initramfs.cpio.gz
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root
</pre>


{{#forminput:form=Ebuild|size=|default value=|button text=Add Package|autocomplete on namespace=Package|remote autocompletion|placeholder=Descriptive name|query string=namespace=Package}}
== Final steps ==
Umount everything, close encrypted drive and reboot
<console>
# ##i##umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot}  
# ##i##vgchange -a n
# ##i##cryptsetup luksClose /dev/sda2 dmcrypt_root
</console>
After reboot you will get the following:
<console>
>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
>>> Create all the symlinks to /bin/busybox.
>>> Initiating /dev/dir
>>> Getting LVM volumes up (if any)
Reding all physical volumes. This make take awhile...
No volume group found
No volume group found
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
Enter passphrase fore /dev/sda2:
</console>
Type your password


== Help Document! ==
<console>
>>> Again, getting LVM volumes up (if any, after map dmcrypt).
  Reading all physical volumes.  This may take a while...
  Found volume group "vg" using metadata type lvm2
  4 logical volume(s) in volume group "vg" now active
>>> Mounting rootfs to /newroot
>>> Umounting /sys and /proc.
>>> Switching root to /newroot and executing /sbin/init.
INIT: version 2.88 booting
Loading /libexec/rc/console/keymap
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
...boot messages omitted for clarity
 
orion login: oleg
Password:
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
oleg@orion ~ %
</console>


The [[:Help:Funtoo_Editing_Guidelines | How to 'wiki']] sidebar link has several formatting examples. Have a look at [[Requested-Documents]] and [[:Category:Needs_Updates | pages that need to be updated.]]  Please search the wiki before creating pages to ensure that you are not duplicating efforts.
== Additional links and information ==
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]
* [http://en.wikipedia.org/wiki/Logical_volume_management Wikipedia article on LVM]
* [https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS Arch Wiki article]


__NOTITLE__
[[Category:HOWTO]]
__NOEDITSECTION__

Revision as of 12:16, September 13, 2014

This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the Funtoo Linux Installation Guide.

Prepare the hard drive and partitions

This is an example partition scheme, you may want to choose differently. /dev/sda1 used as /boot. /dev/sda2 will be encrypted drive with LVM.

  • /dev/sda1 -- /boot partition.
  • /dev/sda2 -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [1] for more information on GPT and MBR.
  • /dev/sda3 -- / partition, will be the drive with LUKS and LVM.

With UEFI:

  • /dev/sda1 -- /boot
  • /dev/sda2 -- / partition

Wipe the hard drive

root # gdisk /dev/sda

Command: x ↵
Expert command: z ↵
About to wipe out GPT on /dev/sda. Proceed?: y ↵
GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
Blank out MBR?: y ↵
   Warning

This action will destroy all data on the disk.

Encrypting the drive

Read more about different cipher options here: [2]

root # cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
root # cryptsetup luksOpen /dev/sda3 dmcrypt_root

There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.

   Warning

The default keymap at boot time is us. If you enter your passphrase using a different keymap, you won't be able to unlock your crypt volume if the passphrase contains any characters that are located elsewere on your keyboard layout that with the us layout.

Create logical volumes

root # pvcreate /dev/mapper/dmcrypt_root
root # vgcreate vg /dev/mapper/dmcrypt_root
root # lvcreate -L10G --name root vg           
root # lvcreate -L2G --name swap vg
root # lvcreate -L5G --name portage vg
root # lvcreate -l 100%FREE -nhome vg

Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.

   Note
Please, notice that above mentioned partitioning scheme is an example and not a default recommendation, change it accordingly to desired scheme.

Create a filesystem on volumes

root # mkfs.ext2 /dev/sda1
root # mkswap /dev/mapper/vg-swap
root # mkfs.ext4 /dev/mapper/vg-root
root # mkfs.ext4 /dev/mapper/vg-portage
root # mkfs.ext4 /dev/mapper/vg-home

Basic system setup

root # swapon /dev/mapper/vg-swap
root # mkdir /mnt/funtoo
root # mount /dev/mapper/vg-root /mnt/funtoo
root # mkdir -p /mnt/funtoo/{boot,usr/portage,home}
root # mount /dev/sda1 /mnt/funtoo/boot
root # mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
root # mount /dev/mapper/vg-home /mnt/funtoo/home

Now perform all the steps required for basic system install, please follow [3] don't forget to emerge the following before your install is finished:

  • cryptsetup
  • lvm2
  • a bootloader (grub recommended)
  • kernel sources

Editing the fstab

Fire up your favorite text editor to edit /etc/fstab. You want to put the following in the file:

   /etc/fstab
# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
/dev/sda1               /boot         ext2      noauto,noatime                  1 2
/dev/mapper/vg-swap     none          swap      sw                              0 0
/dev/mapper/vg-root     /             ext4      noatime,nodiratime,defaults     0 1
/dev/sr0                /mnt/cdrom    auto      noauto,ro                       0 0
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
/dev/mapper/vg-home     /home         ext4      noatime,nodiratime              0 0

Kernel options

   Note
This part is particularly important: pay close attention. 


General setup --->
      [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support
Device Drivers --->
      Generic Driver Options ---> 
      [*] Maintain a devtmpfs filesystem to mount at /dev
Device Drivers --->
      [*] Multiple devices driver support --->
      <*>Device Mapper Support
        <*> Crypt target support
Cryptographic API --->
      <*> XTS support
      -*-AES cipher algorithms

Initramfs setup and configuration

Better-initramfs

Build your initramfs with better-initramfs project.

   Note
better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices and file system support.
root # cd /opt
root # git clone git://github.com/slashbeast/better-initramfs.git
root # cd better-initramfs
root # less README.rst
root # bootstrap/bootstrap-all
root # make prepare
root # make image

Copy resulting initramfs.cpio.gz to /boot:

root # cp output/initramfs.cpio.gz /boot

Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads

root # wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
root # tar xf release-x86_64-v0.5.tar.bz2
root # cd release*
root # gzip initramfs.cpio
root # cp initramfs.cpio.gz /boot

Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with git. Go to the better-initramfs source dir and follow:

root # cd /opt/better-initramfs
root # git pull
root # less ChangeLog
   Note
Please read the ChangeLog carefuly and perform necessary updates to /etc/boot.conf. Also, please backup the working /boot/initramfs.cpio.gz and /etc/boot.conf before updating better-initramfs.

Alternatively and much faster is to install better-initramfs-bin package, recently added to Funtoo's portage tree:

root # emerge better-initramfs-bin

Genkernel

Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:

root # genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all 

Bootloader Configuration

Grub2 configuration

better-initramfs

An example /etc/boot.conf for better-initramfs:

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
  kernel vmlinuz[-v]
  initrd /initramfs.cpio.gz
  params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet

Now, run boot-update to write the configuration files to /boot/grub/grub.cfg

genkernel

Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing /etc/boot.conf:

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
  kernel kernel-genkernel-x86_64-3.13.0
  initrd initramfs-genkernel-x86_64-3.13.0
  params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet

Lilo configuration

For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support

root # echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
root # emerge lilo

Example /etc/lilo.conf:

append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"
boot=/dev/sda
compact
default=funtoo
lba32
prompt
read-only
timeout=50
image=/boot/kernel-genkernel-x86_64-3.13.0
initrd=/boot/initramfs-genkernel-x86_64-3.13.0
label=funtoo

Syslinux bootloader setup

Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.

root # emerge syslinux
root # mkdir /boot/extlinux
root # extlinux --install /boot/extlinux
root # dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
- or -
root # sgdisk /dev/sda --attributes=1:set:2
root # dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition

Example /boot/extlinux/extlinux.conf:

LABEL kernel1_bzImage-3.2.1
MENU LABEL Funtoo Linux bzImage-3.2.1
LINUX /bzImage-3.2.1
INITRD /initramfs.cpio.gz
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root

Final steps

Umount everything, close encrypted drive and reboot

root # umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot} 
root # vgchange -a n
root # cryptsetup luksClose /dev/sda2 dmcrypt_root

After reboot you will get the following:

>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
>>> Create all the symlinks to /bin/busybox.
>>> Initiating /dev/dir
>>> Getting LVM volumes up (if any)
Reding all physical volumes. This make take awhile...
No volume group found
No volume group found
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
Enter passphrase fore /dev/sda2:

Type your password

>>> Again, getting LVM volumes up (if any, after map dmcrypt).
  Reading all physical volumes.  This may take a while...
  Found volume group "vg" using metadata type lvm2
  4 logical volume(s) in volume group "vg" now active
>>> Mounting rootfs to /newroot
>>> Umounting /sys and /proc.
>>> Switching root to /newroot and executing /sbin/init.
INIT: version 2.88 booting
Loading /libexec/rc/console/keymap
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
...boot messages omitted for clarity
   
orion login: oleg
Password:
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
oleg@orion ~ %

Additional links and information