Difference between revisions of "Rootfs over encrypted lvm"

From Funtoo
Jump to: navigation, search
Line 8: Line 8:
* <code>/dev/sda3</code> -- <code>/</code> partition, will be the drive with LUKS and LVM.
* <code>/dev/sda3</code> -- <code>/</code> partition, will be the drive with LUKS and LVM.
=== Wipe the hard drive ===
{{Fancywarning|This action will destroy all data on the disk.}}
# ##i##gdisk /dev/sda
# ##i##gdisk /dev/sda

Revision as of 19:29, January 28, 2014

This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive

Prepare the hard drive and partitions

This is an example partition scheme, you may want to choose differently. /dev/sda1 used as /boot. /dev/sda2 will be encrypted drive with LVM.

  • /dev/sda1 -- /boot partition.
  • /dev/sda2 -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [1] for more information on GPT and MBR.
  • /dev/sda3 -- / partition, will be the drive with LUKS and LVM.

Wipe the hard drive


This action will destroy all data on the disk.

root # gdisk /dev/sda

Command: x ↵
Expert command: z ↵
About to wipe out GPT on /dev/sda. Proceed?: y ↵
GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
Blank out MBR?: y ↵


You will get a message about reaching the end of the device when the dd command has finished. This behavior is intended.

Encrypting the drive

root # cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
root # cryptsetup luksOpen /dev/sda3 dmcrypt_root

There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.

Create logical volumes

root # pvcreate /dev/mapper/dmcrypt_root
root # vgcreate vg /dev/mapper/dmcrypt_root
root # lvcreate -L10G --name root vg           
root # lvcreate -L2G --name swap vg
root # lvcreate -L5G --name portage vg
root # lvcreate -l 100%FREE -nhome vg

Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.

Create a filesystem on volumes

root # mkfs.ext2 /dev/sda1
root # mkswap /dev/mapper/vg-swap
root # mkfs.ext4 /dev/mapper/vg-root
root # mkfs.ext4 /dev/mapper/vg-portage
root # mkfs.ext4 /dev/mapper/vg-home

Basic system setup

root # swapon /dev/mapper/vg-swap
root # mkdir /mnt/funtoo
root # mount /dev/mapper/vg-root /mnt/funtoo
root # mkdir -p /mnt/funtoo/{boot,usr/portage,home}
root # mount /dev/sda1 /mnt/funtoo/boot
root # mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
root # mount /dev/mapper/vg-home /mnt/funtoo/home

Now perform all the steps required for basic system install, please follow [2] don't forget to emerge the following before your install is finished:

  • cryptsetup
  • lvm2
  • a bootloader (grub recommended)
  • kernel sources

Editing the fstab

Fire up your favorite text editor to edit /etc/fstab. You want to put the following in the file:


Kernel options



This part is particularly important: pay close attention.

Initramfs setup and configuration


Build your initramfs with better-initramfs project.



better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices.

root # cd /opt
root # git clone git://github.com/slashbeast/better-initramfs.git
root # cd better-initramfs
root # less README.rst
root # bootstrap/bootstrap-all
root # make prepare
root # make image

Copy resulting initramfs.cpio.gz to /boot:

root # cp output/initramfs.cpio.gz /boot

Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads

root # wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
root # tar xf release-x86_64-v0.5.tar.bz2
root # cd release*
root # gzip initramfs.cpio
root # cp initramfs.cpio.gz /boot

Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with git. Go to the better-initramfs source dir and follow:

root # cd /opt/better-initramfs
root # git pull
root # less ChangeLog


Please read the ChangeLog carefuly and perform necessary updates to /etc/boot.conf. Also, please backup the working /boot/initramfs.cpio.gz and /etc/boot.conf before updating better-initramfs.


Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:

root # genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all 

Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing /etc/boot.conf:

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
"Funtoo Linux" {
  kernel kernel-genkernel-x86_64-2.6.39
  initrd initramfs-genkernel-x86_64-2.6.39
  params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet

Bootloader Configuration

Grub2 configuration

An example /etc/boot.conf for better-initramfs:

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
"Funtoo Linux" {
  kernel bzImage[-v]
  initrd /initramfs.cpio.gz
  params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet

Now, run boot-update to write the configuration files to /boot/grub/grub.cfg

Lilo configuration

For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support

root # echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
root # emerge lilo

Example /etc/lilo.conf:

append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"

Syslinux bootloader setup

Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.

root # emerge syslinux
root # mkdir /boot/extlinux
root # extlinux --install /boot/extlinux
root # dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
- or -
root # sgdisk /dev/sda --attributes=1:set:2
root # dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition

Example /boot/extlinux/extlinux.conf:

LABEL kernel1_bzImage-3.2.1
MENU LABEL Funtoo Linux bzImage-3.2.1
LINUX /bzImage-3.2.1
INITRD /initramfs.cpio.gz
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root

Final steps

Umount everything, close encrypted drive and reboot

root # umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot} 
root # vgchange -a n
root # cryptsetup luksClose /dev/sda2 dmcrypt_root

After reboot you will get the following:

>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
>>> Create all the symlinks to /bin/busybox.
>>> Initiating /dev/dir
>>> Getting LVM volumes up (if any)
Reding all physical volumes. This make take awhile...
No volume group found
No volume group found
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
Enter passphrase fore /dev/sda2:

Type your password

>>> Again, getting LVM volumes up (if any, after map dmcrypt).
  Reading all physical volumes.  This may take a while...
  Found volume group "vg" using metadata type lvm2
  4 logical volume(s) in volume group "vg" now active
>>> Mounting rootfs to /newroot
>>> Umounting /sys and /proc.
>>> Switching root to /newroot and executing /sbin/init.
INIT: version 2.88 booting
Loading /libexec/rc/console/keymap
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
...boot messages omitted for clarity
orion login: oleg
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
oleg@orion ~ %

Additional links and information