Difference between pages "Building a Kernel from Source" and "Rootfs over encrypted lvm"

From Funtoo
(Difference between pages)
Jump to: navigation, search
m (what i just said in irc about initramfs)
 
(Create logical volumes)
 
Line 1: Line 1:
Setting up a proper kernel yourself - lean, mean and tailored to your hardware, is the challenge by which a linux user can graduate to becoming a Funtoo knight ;-)
+
This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the [[Funtoo Linux Installation]] Guide.
  
Even though many of us are using enterprise-ready kernels in datacenters, there is almost nobody who hasn't at least considered building a kernel for his laptop / PC.
+
== Prepare the hard drive and partitions ==
We are showing here how an intermediate Linux user can use an alternative to the standard beginners "genkernel" approach, to compile a custom kernel,  in a relatively speedy and easy set up.
+
This is an example partition scheme, you may want to choose differently.
 +
<code>/dev/sda1</code> used as <code>/boot</code>. <code>/dev/sda2</code> will be encrypted drive with LVM.
 +
* <code>/dev/sda1</code> -- <code>/boot</code> partition.
 +
* <code>/dev/sda2</code> -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [http://www.funtoo.org/Funtoo_Linux_Installation#Prepare_Hard_Disk] for more information on GPT and MBR.  
 +
* <code>/dev/sda3</code> -- <code>/</code> partition, will be the drive with LUKS and LVM.
  
== Minimum Requirements ==
+
With UEFI:
* '''Understand the command line'''
+
* <code>/dev/sda1</code> -- <tt>/boot</tt>
* '''Know where the kernel files are located'''
+
* <code>/dev/sda2</code> -- <tt>/</tt> partition
  
== Assumptions ==
+
=== Wipe the hard drive ===
You start from an installed Funtoo system on the disk, or at least, you are on stage3 in a chrooted environment from a live cd, following somehow the Funto [[Installation (Tutorial)|Installation Tutorial]].
+
<console>
 +
# ##i##gdisk /dev/sda
  
== Less advanced version ==
+
Command: ##i##x ↵
=== Emerging the kernel sources ===
+
Expert command: ##i##z ↵
To begin, we have to figure out which kernel sources we will use. If you are unsure about which sources are available and what their benefits and drawbacks are, check out the [[Funtoo_Linux_Kernels| Kernels]] page.
+
About to wipe out GPT on /dev/sda. Proceed?: ##i##y ↵
 
+
GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
After you have made a decsion as to which kernel you want to install, emerge it:
+
Blank out MBR?: ##i##y ↵
<console>
+
###i## emerge vanilla-sources
+
 
</console>
 
</console>
Portage will now go about installing the sources to ''/usr/src''. It will also symlink the kernel-version directory to a directory called ''linux''.
+
{{Fancywarning|This action will destroy all data on the disk.}}
  
=== Configuring the kernel ===
+
== Encrypting the drive ==
Now that the kernel sources are on your system, you should configure them. To do this, change your directory to ''/usr/src/linux''
+
Read more about different cipher options here: [http://blog.wpkg.org/2009/04/23/cipher-benchmark-for-dm-crypt-luks/]
 
<console>
 
<console>
###i## cd /usr/src/linux
+
# ##i##cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
 +
# ##i##cryptsetup luksOpen /dev/sda3 dmcrypt_root
 
</console>
 
</console>
As we are now in the kernel sources directory, we can run a script that allows us to modify them. Run:
+
There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.
 +
{{Fancywarning|The default keymap at boot time is '''us'''. If you enter your passphrase using a different keymap, you won't be able to unlock your crypt volume if the passphrase contains any characters that are located elsewere on your keyboard layout that with the us layout.}}
 +
= Create logical volumes =
 
<console>
 
<console>
###i## make menuconfig
+
# ##i##pvcreate /dev/mapper/dmcrypt_root
 +
# ##i##vgcreate vg /dev/mapper/dmcrypt_root
 +
# ##i##lvcreate -L10G --name root vg         
 +
# ##i##lvcreate -L2G --name swap vg
 +
# ##i##lvcreate -L5G --name portage vg
 +
# ##i##lvcreate -l 100%FREE -nhome vg
 
</console>
 
</console>
While you edit the sources, keep the following in mind:
+
Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.
* To build something into your kernel, press y when you have it selected.
+
{{fancynote| Please, notice that above mentioned partitioning scheme is an example and not a default recommendation, change it accordingly to desired scheme.}}
* To exclude something from your kernel, press n when you have it selected.
+
* To build something as a module, press m.  
+
  
Things that you may need to include in your kernel:
+
= Create a filesystem on volumes =
as modules:
+
* Wireless/LAN drivers
+
* Support for your graphics card
+
* Support for your audio card
+
* Support for USB devices
+
as built in:
+
* scsi sata & or ata controllers
+
* file system used
+
{{fancynote| Many pages on the wiki will tell you the kernel requirements for the application that they are about. Keep your eyes open for the blue background, white text sections of pages. Like on this one: [[uvesafb| uvesafb]]}}
+
 
+
=== Building and installing the kernel sources ===
+
After you finish configuring your kernel sources, you will need to build them. To build your sources, run the following:
+
 
<console>
 
<console>
###i## make
+
# ##i##mkfs.ext2 /dev/sda1
 +
# ##i##mkswap /dev/mapper/vg-swap
 +
# ##i##mkfs.ext4 /dev/mapper/vg-root
 +
# ##i##mkfs.ext4 /dev/mapper/vg-portage
 +
# ##i##mkfs.ext4 /dev/mapper/vg-home
 
</console>
 
</console>
{{fancytip| You can add -j<number of processing cores + 1> after make to build the kernel more quickly.}}
 
  
When the kernel and its modules finish building, install them:
+
= Basic system setup =
 
<console>
 
<console>
###i## make modules_install && make install
+
# ##i##swapon /dev/mapper/vg-swap
 +
# ##i##mkdir /mnt/funtoo
 +
# ##i##mount /dev/mapper/vg-root /mnt/funtoo
 +
# ##i##mkdir -p /mnt/funtoo/{boot,usr/portage,home}
 +
# ##i##mount /dev/sda1 /mnt/funtoo/boot
 +
# ##i##mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
 +
# ##i##mount /dev/mapper/vg-home /mnt/funtoo/home
 
</console>
 
</console>
Now that you have installed your kernel and modules, it is a good idea to install an [[Building_a_Kernel_from_Source#Initramfs| Initramfs]].
+
Now perform all the steps required for basic system install, please follow [http://docs.funtoo.org/wiki/Funtoo_Linux_Installation]
* If your system has a separate ''/usr'' partition, is encrypted, or uses some other non-standard configuration, it will probably not boot without an initramfs.
+
don't forget to emerge the following before your install is finished:
* If your system is unencrypted, with file system, and hard drive controllers compiled in rather than as modules, it will not need an initramfs.
+
  
== Advanced version ==
+
* '''cryptsetup'''
=== Getting ready to start ===
+
* '''lvm2'''
 +
* '''a bootloader (grub recommended)'''
 +
* '''kernel sources '''
  
{{fancynote| In this case we are building a kernel that is booting root in LVM over encrypted LUKS container.
+
= Editing the fstab =
If you don't have this setup, don't worry, you just don't need all the modules, but everything else is similar.}}
+
Fire up your favorite text editor to edit <code>/etc/fstab</code>. You want to put the following in the file:
First, there is the decision which linux kernel sources we need.
+
There are plenty of them in the repositories around, often it is not easy to distinguish between them.
+
  
I would always trust my distribution of choice and take what is has to offer - and funtoo has a lot to offer!
+
{{file|name=/etc/fstab|desc= |body=
 +
# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
 +
/dev/sda1              /boot        ext2      noauto,noatime                  1 2
 +
/dev/mapper/vg-swap    none          swap      sw                              0 0
 +
/dev/mapper/vg-root    /            ext4      noatime,nodiratime,defaults    0 1
 +
/dev/sr0                /mnt/cdrom    auto      noauto,ro                      0 0
 +
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
 +
/dev/mapper/vg-home    /home        ext4      noatime,nodiratime              0 0
 +
}}
  
I really do recommend (especially if it is your first time) to build a debian-sourced genkernel like described in chapter 5 "Using Debian-Sources with Genkernel" in the [[Funtoo_Linux_Kernels| Funtoo Kernels Tutorial]].
+
== Kernel options ==
 +
{{fancynote| This part is particularly important: pay close attention. }}<br>
 +
{{kernelop
 +
|title=
 +
|desc=
 +
General setup --->
 +
      [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support
 +
}}
 +
{{kernelop
 +
|title=
 +
|desc=
 +
Device Drivers --->
 +
      Generic Driver Options --->
 +
      [*] Maintain a devtmpfs filesystem to mount at /dev
 +
}}
 +
{{kernelop
 +
|title=
 +
|desc=
 +
Device Drivers --->
 +
      [*] Multiple devices driver support --->
 +
      <*>Device Mapper Support
 +
        <*> Crypt target support
 +
}}
 +
{{kernelop
 +
|title=
 +
|desc=
 +
Cryptographic API --->
 +
      <*> XTS support
 +
      -*-AES cipher algorithms
 +
}}
  
From there you should have a running system booting nicely from your own build (just little bit bloated) kernel. This is more than you can expect from any other ready to go distribution.
+
= Initramfs setup and configuration =
 +
== Better-initramfs ==
 +
'''Build your initramfs with [https://bitbucket.org/piotrkarbowski/better-initramfs better-initramfs] project.'''
  
{{fancynote| We are using RedHat's dracut in order to build a nice initramfs (containing all the necessary tools and extra drivers our kernel might need to start the system). Although dracut is the way to go, more sophisticated and not as buggy as gentoo's genkernel approach, more and more funtoo geeks start using slashbeast's better-initramfs, which we will cover at the end of this howto! So after having set up a genkernel from debian or gentoo sources we are going to build a kernel with either (or both) dracut or/and better-initramfs. So gentoo sources with genkernel is always my backup if anything is not working correctly on my system. For the slightly more geeky approach with my own initram I am using pf-sources, ck-sources or any other more or less heavily patched sources.}}
+
{{fancynote| better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices and file system support.}}
  
Let's go!
+
<console>
 +
# ##i##cd /opt
 +
# ##i##git clone git://github.com/slashbeast/better-initramfs.git
 +
# ##i##cd better-initramfs
 +
# ##i##less README.rst
 +
# ##i##bootstrap/bootstrap-all
 +
# ##i##make prepare
 +
# ##i##make image
 +
</console>
  
=== Kernel Sources ===
+
Copy resulting <code>initramfs.cpio.gz</code> to <code>/boot</code>:
The source you use on your system is up to you. For a laptop or desktop system, the following are recommended:
+
<console># ##i##cp output/initramfs.cpio.gz /boot</console>
* '''{{Package|sys-kernel/pf-sources}}'''
+
* '''{{Package|sys-kernel/ck-sources}}'''
+
* '''{{Package|sys-kernel/gentoo-sources}}'''
+
* '''{{Package|sys-kernel/git-sources}}'''
+
* '''{{Package|sys-kernel/sysrescue-std-sources}}'''
+
* '''{{Package|sys-kernel/debian-sources}}'''
+
{{fancynote| If you are unsure of which sources you would like to use, emerge <code>gentoo-sources</code>. That's always a safe bet for a general system. For more information on available kernels, check out: [[Funtoo Linux Kernels]]}}
+
  
=== Prerequisites ===
+
Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads
 +
<console>
 +
# ##i##wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
 +
# ##i##tar xf release-x86_64-v0.5.tar.bz2
 +
# ##i##cd release*
 +
# ##i##gzip initramfs.cpio
 +
# ##i##cp initramfs.cpio.gz /boot
 +
</console>
  
Regardless of the tools you already have installed, it is recommended to follow the steps below, even if you find them to be redundant.
+
Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with <code>git</code>. Go to the better-initramfs source dir and follow:
First, we edit our <code>/etc/portage/make.conf</code>:
+
<console>
 +
# ##i##cd /opt/better-initramfs
 +
# ##i##git pull
 +
# ##i##less ChangeLog
 +
</console>
 +
{{fancynote| Please read the ChangeLog carefuly and perform necessary updates to <code>/etc/boot.conf</code>. Also, please backup the working <code>/boot/initramfs.cpio.gz</code> and <code>/etc/boot.conf</code> before updating better-initramfs.}}
 +
Alternatively and much faster is to install better-initramfs-bin package, recently added to Funtoo's portage tree:
 +
<console>
 +
# ##i##emerge better-initramfs-bin
 +
</console>
  
<pre>
+
== Genkernel ==
#These compiler flags are just tweaking (optimazation) and NOT necessary:
+
Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:
CFLAGS="-O2 -pipe -march=native -ftracer -fforce-addr"
+
<console>
CXXFLAGS="${CFLAGS} -fpermissive -fomit-frame-pointer"
+
# ##i##genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all </console>
KDIR=/usr/src/linux
+
KERNEL="symlink build"
+
USE="$KERNEL ....here are your use flags...."
+
## These modules are available:
+
## DRACUT_MODULES="dracut_modules_biosdevname dracut_modules_btrfs dracut_modules_caps dracut_modules_crypt dracut_modules_crypt-gpg dracut_modules_dmraid dracut_modules_dmsquash-live dracut_modules_gensplash dracut_modules_iscsi dracut_modules_livenet dracut_modules_lvm dracut_modules_mdraid dracut_modules_multipath dracut_modules_nbd dracut_modules_nfs dracut_modules_plymouth dracut_modules_ssh-client dracut_modules_syslog"
+
## We will use these modules for LVM / LUKS:
+
DRACUT_MODULES="crypt lvm plymouth biosdevname dmraid crypt-gpg dmsquash-live ssh-client syslog"
+
</pre>
+
  
Next, we set the package keywords by adding the following to <code>/etc/portage/package.use</code>:
+
== Bootloader Configuration ==
 +
=== Grub2 configuration ===
 +
==== better-initramfs ====
 +
An example <code>/etc/boot.conf</code> for better-initramfs:
  
 
<pre>
 
<pre>
sys-kernel/dracut dm net device-mapper crypt lvm
+
boot {
 +
  generate grub
 +
  default "Funtoo Linux"
 +
  timeout 3
 +
}
 +
"Funtoo Linux" {
 +
  kernel vmlinuz[-v]
 +
  initrd /initramfs.cpio.gz
 +
  params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
 
</pre>
 
</pre>
  
{{fancynote| If you don't have lvm over encrypted LUKS you just add the "net" keyword here, or "selinux".}}
+
Now, run <code>boot-update</code> to write the configuration files to <code>/boot/grub/grub.cfg</code>
  
 +
==== genkernel ====
 +
Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing <code>/etc/boot.conf</code>:
  
Next, we build our packages:
+
<pre>
 +
boot {
 +
  generate grub
 +
  default "Funtoo Linux"
 +
  timeout 3
 +
}
 +
"Funtoo Linux" {
 +
  kernel kernel-genkernel-x86_64-3.13.0
 +
  initrd initramfs-genkernel-x86_64-3.13.0
 +
  params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
 +
</pre>
 +
 
 +
== Lilo configuration ==
 +
For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support
 
<console>
 
<console>
###i## emerge -av app-portage/gentoolkit sys-kernel/pf-sources sys-kernel/dracut sys-boot/plymouth sys-boot/plymouth-openrc-plugin
+
# ##i##echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
 +
# ##i##emerge lilo
 
</console>
 
</console>
  
=== Preparing the kernel ===
+
Example <code>/etc/lilo.conf</code>:
  
We go now to the sources directory and enter the following commands to update the kernel's  .config  file:
+
<pre>
<console>
+
append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"
###i## cd /usr/src/linux/
+
boot=/dev/sda
###i## make clean
+
compact
  CLEAN  .
+
default=funtoo
  CLEAN  arch/x86/kernel/acpi/realmode
+
lba32
  CLEAN  arch/x86/kernel/cpu
+
prompt
  CLEAN  arch/x86/kernel
+
read-only
  CLEAN  arch/x86/vdso
+
timeout=50
  CLEAN  arch/x86/lib
+
image=/boot/kernel-genkernel-x86_64-3.13.0
  CLEAN  drivers/gpu/drm/radeon
+
initrd=/boot/initramfs-genkernel-x86_64-3.13.0
  CLEAN  drivers/net/wan
+
label=funtoo
  CLEAN  drivers/scsi/aic7xxx
+
</pre>
  CLEAN  drivers/tty/vt
+
  CLEAN  drivers/video/logo
+
  CLEAN  firmware
+
  CLEAN  kernel
+
  CLEAN  lib/raid6
+
  CLEAN  lib
+
  CLEAN  security/apparmor
+
  CLEAN  security/selinux
+
  CLEAN  usr
+
  CLEAN  arch/x86/boot/compressed
+
  CLEAN  arch/x86/boot
+
  CLEAN  .tmp_versions
+
  CLEAN  vmlinux System.map .tmp_kallsyms2.S .tmp_kallsyms1.o .tmp_kallsyms2.o .tmp_kallsyms1.S .tmp_vmlinux1 .tmp_vmlinux2 .tmp_System.map
+
###i## zcat /proc/config.gz > /usr/src/linux/.config
+
</console>
+
  
Next, we run <tt>make localmodconfig</tt>. You will get some questions which you can answer mostly with either M (compiled as a module) or Y (compiled directly into the kernel). If you are not sure what to choose, press enter, and the default option will be selected.
+
== Syslinux bootloader setup ==
 +
Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.
 
<console>
 
<console>
###i## make localmodconfig
+
# ##i##emerge syslinux
Enable different security models (SECURITY) [Y/n/?] y
+
# ##i##mkdir /boot/extlinux
Enable the securityfs filesystem (SECURITYFS) [Y/?] y
+
# ##i##extlinux --install /boot/extlinux
Socket and Networking Security Hooks (SECURITY_NETWORK) [Y/?] y
+
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
Security hooks for pathname based access control (SECURITY_PATH) [Y/?] y
+
- or -
Low address space for LSM to protect from user allocation (LSM_MMAP_MIN_ADDR) [65536] 65536
+
# ##i##sgdisk /dev/sda --attributes=1:set:2
NSA SELinux Support (SECURITY_SELINUX) [Y/n/?] y
+
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition
  NSA SELinux boot parameter (SECURITY_SELINUX_BOOTPARAM) [N/y/?] n
+
  NSA SELinux runtime disable (SECURITY_SELINUX_DISABLE) [N/y/?] n
+
  NSA SELinux Development Support (SECURITY_SELINUX_DEVELOP) [Y/n/?] y
+
  NSA SELinux AVC Statistics (SECURITY_SELINUX_AVC_STATS) [Y/n/?] y
+
  NSA SELinux checkreqprot default value (SECURITY_SELINUX_CHECKREQPROT_VALUE) [1] 1
+
  NSA SELinux maximum supported policy format version (SECURITY_SELINUX_POLICYDB_VERSION_MAX) [Y/n/?] y
+
    NSA SELinux maximum supported policy format version value (SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE) [19] 19
+
TOMOYO Linux Support (SECURITY_TOMOYO) [Y/n/?] y
+
  Default maximal count for learning mode (SECURITY_TOMOYO_MAX_ACCEPT_ENTRY) [2048] 2048
+
  Default maximal count for audit log (SECURITY_TOMOYO_MAX_AUDIT_LOG) [1024] 1024
+
  Activate without calling userspace policy loader. (SECURITY_TOMOYO_OMIT_USERSPACE_LOADER) [Y/n/?] y
+
AppArmor support (SECURITY_APPARMOR) [Y/n/?] y
+
  AppArmor boot parameter default value (SECURITY_APPARMOR_BOOTPARAM_VALUE) [1] 1
+
Integrity Measurement Architecture(IMA) (IMA) [Y/n/?] y
+
EVM support (EVM) [N/y/?] (NEW)
+
Default security module
+
  1. SELinux (DEFAULT_SECURITY_SELINUX)
+
  2. TOMOYO (DEFAULT_SECURITY_TOMOYO)
+
  3. AppArmor (DEFAULT_SECURITY_APPARMOR)
+
> 4. Unix Discretionary Access Controls (DEFAULT_SECURITY_DAC)
+
choice[1-4?]: 4
+
warning: (ACPI_HOTPLUG_CPU) selects ACPI_CONTAINER which has unmet direct dependencies (ACPI && EXPERIMENTAL)
+
warning: (MEDIA_TUNER) selects MEDIA_TUNER_TEA5761 which has unmet direct dependencies (MEDIA_SUPPORT && VIDEO_MEDIA && I2C && EXPERIMENTAL)
+
#
+
# configuration written to .config
+
#
+
warning: (GFS2_FS) selects DLM which has unmet direct dependencies (EXPERIMENTAL && INET && SYSFS && CONFIGFS_FS && (IPV6 || IPV6=n))
+
warning: (IMA) selects TCG_TPM which has unmet direct dependencies (HAS_IOMEM && EXPERIMENTAL)
+
warning: (MEDIA_TUNER) selects MEDIA_TUNER_TEA5761 which has unmet direct dependencies (MEDIA_SUPPORT && VIDEO_MEDIA && I2C && EXPERIMENTAL)
+
warning: (ACPI_HOTPLUG_CPU) selects ACPI_CONTAINER which has unmet direct dependencies (ACPI && EXPERIMENTAL)
+
 
</console>
 
</console>
  
Now comes the most adventurous part!
+
Example <code>/boot/extlinux/extlinux.conf</code>:
  
=== Building the Kernel ===
+
<pre>
 +
LABEL kernel1_bzImage-3.2.1
 +
MENU LABEL Funtoo Linux bzImage-3.2.1
 +
LINUX /bzImage-3.2.1
 +
INITRD /initramfs.cpio.gz
 +
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root
 +
</pre>
 +
 
 +
== Final steps ==
 +
Umount everything, close encrypted drive and reboot
 
<console>
 
<console>
###i## make -j8  bzImage
+
# ##i##umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot}
###i## make -j8 modules
+
# ##i##vgchange -a n
###i## make modules_install
+
# ##i##cryptsetup luksClose /dev/sda2 dmcrypt_root
###i## make install
+
 
</console>
 
</console>
 +
After reboot you will get the following:
 +
<console>
 +
>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
 +
>>> Create all the symlinks to /bin/busybox.
 +
>>> Initiating /dev/dir
 +
>>> Getting LVM volumes up (if any)
 +
Reding all physical volumes. This make take awhile...
 +
No volume group found
 +
No volume group found
 +
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
 +
Enter passphrase fore /dev/sda2:
 +
</console>
 +
Type your password
  
== Initramfs ==
 
{{fancywarning| Make sure that you have built and installed your kernel sources / modules before building an initramfs.}}
 
To get your initramfs up and running, check out the [http://www.funtoo.org/Initramfs Initramfs] page. After following all the directions on the page to get your initramfs set up, continue following the ones here.
 
 
Update the <tt>grub.cfg</tt> with boot update, then reboot and see how it works!
 
 
<console>
 
<console>
###i## boot-update -v
+
>>> Again, getting LVM volumes up (if any, after map dmcrypt).
###i## reboot
+
  Reading all physical volumes.  This may take a while...
 +
  Found volume group "vg" using metadata type lvm2
 +
  4 logical volume(s) in volume group "vg" now active
 +
>>> Mounting rootfs to /newroot
 +
>>> Umounting /sys and /proc.
 +
>>> Switching root to /newroot and executing /sbin/init.
 +
INIT: version 2.88 booting
 +
Loading /libexec/rc/console/keymap
 +
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
 +
...boot messages omitted for clarity
 +
 
 +
orion login: oleg
 +
Password:
 +
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
 +
oleg@orion ~ %
 
</console>
 
</console>
 +
 +
== Additional links and information ==
 +
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
 +
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]
 +
* [http://en.wikipedia.org/wiki/Logical_volume_management Wikipedia article on LVM]
 +
* [https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS Arch Wiki article]
  
 
[[Category:HOWTO]]
 
[[Category:HOWTO]]
[[Category:Featured]]
 
[[Category:Kernel]]
 

Latest revision as of 12:16, 13 September 2014

This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the Funtoo Linux Installation Guide.

Prepare the hard drive and partitions

This is an example partition scheme, you may want to choose differently. /dev/sda1 used as /boot. /dev/sda2 will be encrypted drive with LVM.

  • /dev/sda1 -- /boot partition.
  • /dev/sda2 -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [1] for more information on GPT and MBR.
  • /dev/sda3 -- / partition, will be the drive with LUKS and LVM.

With UEFI:

  • /dev/sda1 -- /boot
  • /dev/sda2 -- / partition

Wipe the hard drive

# gdisk /dev/sda

Command: x ↵
Expert command: z ↵
About to wipe out GPT on /dev/sda. Proceed?: y ↵
GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
Blank out MBR?: y ↵
Warning: This action will destroy all data on the disk.

Encrypting the drive

Read more about different cipher options here: [2]

# cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
# cryptsetup luksOpen /dev/sda3 dmcrypt_root

There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.

Warning: The default keymap at boot time is us. If you enter your passphrase using a different keymap, you won't be able to unlock your crypt volume if the passphrase contains any characters that are located elsewere on your keyboard layout that with the us layout.

Create logical volumes

# pvcreate /dev/mapper/dmcrypt_root
# vgcreate vg /dev/mapper/dmcrypt_root
# lvcreate -L10G --name root vg           
# lvcreate -L2G --name swap vg
# lvcreate -L5G --name portage vg
# lvcreate -l 100%FREE -nhome vg

Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.

Note: Please, notice that above mentioned partitioning scheme is an example and not a default recommendation, change it accordingly to desired scheme.

Create a filesystem on volumes

# mkfs.ext2 /dev/sda1
# mkswap /dev/mapper/vg-swap
# mkfs.ext4 /dev/mapper/vg-root
# mkfs.ext4 /dev/mapper/vg-portage
# mkfs.ext4 /dev/mapper/vg-home

Basic system setup

# swapon /dev/mapper/vg-swap
# mkdir /mnt/funtoo
# mount /dev/mapper/vg-root /mnt/funtoo
# mkdir -p /mnt/funtoo/{boot,usr/portage,home}
# mount /dev/sda1 /mnt/funtoo/boot
# mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
# mount /dev/mapper/vg-home /mnt/funtoo/home

Now perform all the steps required for basic system install, please follow [3] don't forget to emerge the following before your install is finished:

  • cryptsetup
  • lvm2
  • a bootloader (grub recommended)
  • kernel sources

Editing the fstab

Fire up your favorite text editor to edit /etc/fstab. You want to put the following in the file:

/etc/fstab
# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
/dev/sda1               /boot         ext2      noauto,noatime                  1 2
/dev/mapper/vg-swap     none          swap      sw                              0 0
/dev/mapper/vg-root     /             ext4      noatime,nodiratime,defaults     0 1
/dev/sr0                /mnt/cdrom    auto      noauto,ro                       0 0
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
/dev/mapper/vg-home     /home         ext4      noatime,nodiratime              0 0

Kernel options

Note: This part is particularly important: pay close attention.

General setup --->
      [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support
Device Drivers --->
      Generic Driver Options ---> 
      [*] Maintain a devtmpfs filesystem to mount at /dev
Device Drivers --->
      [*] Multiple devices driver support --->
      <*>Device Mapper Support
        <*> Crypt target support
Cryptographic API --->
      <*> XTS support
      -*-AES cipher algorithms

Initramfs setup and configuration

Better-initramfs

Build your initramfs with better-initramfs project.

Note: better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices and file system support.
# cd /opt
# git clone git://github.com/slashbeast/better-initramfs.git
# cd better-initramfs
# less README.rst
# bootstrap/bootstrap-all
# make prepare
# make image

Copy resulting initramfs.cpio.gz to /boot:

# cp output/initramfs.cpio.gz /boot

Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads

# wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
# tar xf release-x86_64-v0.5.tar.bz2
# cd release*
# gzip initramfs.cpio
# cp initramfs.cpio.gz /boot

Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with git. Go to the better-initramfs source dir and follow:

# cd /opt/better-initramfs
# git pull
# less ChangeLog
Note: Please read the ChangeLog carefuly and perform necessary updates to /etc/boot.conf. Also, please backup the working /boot/initramfs.cpio.gz and /etc/boot.conf before updating better-initramfs.

Alternatively and much faster is to install better-initramfs-bin package, recently added to Funtoo's portage tree:

# emerge better-initramfs-bin

Genkernel

Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:

# genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all 

Bootloader Configuration

Grub2 configuration

better-initramfs

An example /etc/boot.conf for better-initramfs:

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
  kernel vmlinuz[-v]
  initrd /initramfs.cpio.gz
  params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet

Now, run boot-update to write the configuration files to /boot/grub/grub.cfg

genkernel

Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing /etc/boot.conf:

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
  kernel kernel-genkernel-x86_64-3.13.0
  initrd initramfs-genkernel-x86_64-3.13.0
  params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet

Lilo configuration

For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support

# echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
# emerge lilo

Example /etc/lilo.conf:

append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"
boot=/dev/sda
compact
default=funtoo
lba32
prompt
read-only
timeout=50
image=/boot/kernel-genkernel-x86_64-3.13.0
initrd=/boot/initramfs-genkernel-x86_64-3.13.0
label=funtoo

Syslinux bootloader setup

Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.

# emerge syslinux
# mkdir /boot/extlinux
# extlinux --install /boot/extlinux
# dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
- or -
# sgdisk /dev/sda --attributes=1:set:2
# dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition

Example /boot/extlinux/extlinux.conf:

LABEL kernel1_bzImage-3.2.1
MENU LABEL Funtoo Linux bzImage-3.2.1
LINUX /bzImage-3.2.1
INITRD /initramfs.cpio.gz
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root

Final steps

Umount everything, close encrypted drive and reboot

# umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot} 
# vgchange -a n
# cryptsetup luksClose /dev/sda2 dmcrypt_root

After reboot you will get the following:

>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
>>> Create all the symlinks to /bin/busybox.
>>> Initiating /dev/dir
>>> Getting LVM volumes up (if any)
Reding all physical volumes. This make take awhile...
No volume group found
No volume group found
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
Enter passphrase fore /dev/sda2:

Type your password

>>> Again, getting LVM volumes up (if any, after map dmcrypt).
  Reading all physical volumes.  This may take a while...
  Found volume group "vg" using metadata type lvm2
  4 logical volume(s) in volume group "vg" now active
>>> Mounting rootfs to /newroot
>>> Umounting /sys and /proc.
>>> Switching root to /newroot and executing /sbin/init.
INIT: version 2.88 booting
Loading /libexec/rc/console/keymap
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
...boot messages omitted for clarity
   
orion login: oleg
Password:
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
oleg@orion ~ %

Additional links and information