Musings about on-disk encryption in Fedora Core
Nils Philippsen
nphilipp at redhat.com
Tue Jul 6 15:39:27 UTC 2004
[Alasdair, I've copied you because I don't know if you're subscribed to
fedora-devel-list and thought this might be interesting to you, for the
rest of the thread, you can start at
http://www.redhat.com/archives/fedora-devel-list/2004-July/msg00251.html
]
On Mon, 2004-07-05 at 23:20, Nils Philippsen wrote:
> On Mon, 2004-07-05 at 21:54, W. Michael Petullo wrote:
> > >> I am working on implementing encrypted root filesystem support to
> > >> mkinitrd. See
> > >> https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=124789 for more
> > >> information and an patch.
> >
> > > I looked at the patch any I see the problem that you need to call
> > > mkinitrd with certain arguments in order for this to work. This
> > > should just kind of determine the parameters (i.e. read them from a
> > > config file written while creating the encrypted root device) used on
> > > the current root fs and apply them automatically so that calls to
> > > mkinitrd from e.g. the kernel pkgs' %post scripts work.
> >
> > Okay, that's a great point. Where should the configuration file be? /
> > etc/sysconfig/rootfs would get my vote.
>
> ACK as far as I'm concerned.
Thinking about it again, I'm rather for using the same fstab like list I
mentioned in my original post (well as soon as something like that is
specified), e.g. a file /etc/dmtab which would contain this:
<realdevicename> <dmdevicename> <type> <options ...>
in our case e.g. with key on a USB stick:
/dev/sda5 crypt-dev-sda5 crypt authtype=filesystem,keydev=/dev/sdb4,keypath=efsk,keymat_fstype=vfat,cipher=aes-plain[,iv_offset=...,sector_offset=...]
or a mere passphrase for a logical volume (for this case the installer
should forbid using "crypt" as the VG name ;-):
/dev/mapper/vg00-lv_root crypt-lvm-vg00-lv_root crypt authtype=passphrase,cipher=aes-plain[,...]
or for swap:
/dev/sda7 crypt-dev-sda7 crypt authtype=random,cipher=aes-plain
Alasdair, what do you think would be best to store such fixed, not
automatically determinable realdev->dmdev mappings -- such an fstab like
file or rather separated config files /etc/device-mapper/<module>.conf,
or ...?
Nils
--
Nils Philippsen / Red Hat / nphilipp at redhat.com
"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety." -- B. Franklin, 1759
PGP fingerprint: C4A8 9474 5C4C ADE3 2B8F 656D 47D8 9B65 6951 3011
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <http://listman.redhat.com/archives/fedora-devel-list/attachments/20040706/9793a030/attachment.sig>
More information about the fedora-devel-list
mailing list