Difference between revisions of "Rootfs over encrypted lvm"

(Basic system setup)
(Create logical volumes)
 
(57 intermediate revisions by 7 users not shown)
Line 1: Line 1:
This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive  
+
This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the [[Funtoo Linux Installation]] Guide.
  
= Prepare the hard drive and partitions =
+
== Prepare the hard drive and partitions ==
 
This is an example partition scheme, you may want to choose differently.
 
This is an example partition scheme, you may want to choose differently.
 
<code>/dev/sda1</code> used as <code>/boot</code>. <code>/dev/sda2</code> will be encrypted drive with LVM.
 
<code>/dev/sda1</code> used as <code>/boot</code>. <code>/dev/sda2</code> will be encrypted drive with LVM.
 
+
* <code>/dev/sda1</code> -- <code>/boot</code> partition.
* <code>/dev/sda1</code> -- <code>/boot</code> partition.  
+
 
* <code>/dev/sda2</code> -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [http://www.funtoo.org/Funtoo_Linux_Installation#Prepare_Hard_Disk] for more information on GPT and MBR.  
 
* <code>/dev/sda2</code> -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [http://www.funtoo.org/Funtoo_Linux_Installation#Prepare_Hard_Disk] for more information on GPT and MBR.  
 
* <code>/dev/sda3</code> -- <code>/</code> partition, will be the drive with LUKS and LVM.
 
* <code>/dev/sda3</code> -- <code>/</code> partition, will be the drive with LUKS and LVM.
  
 +
With UEFI:
 +
* <code>/dev/sda1</code> -- <tt>/boot</tt>
 +
* <code>/dev/sda2</code> -- <tt>/</tt> partition
 +
 +
=== Wipe the hard drive ===
 
<console>
 
<console>
# ##i##dd if=/dev/zero of=/dev/sda3 bs=100M
+
# ##i##gdisk /dev/sda
# ##i##dd if=/dev/urandom of=/dev/sda3 bs=100M
+
 
 +
Command: ##i##x ↵
 +
Expert command: ##i##z ↵
 +
About to wipe out GPT on /dev/sda. Proceed?: ##i##y ↵
 +
GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
 +
Blank out MBR?: ##i##y ↵
 
</console>
 
</console>
The <code>dd</code> part is optional, and the command only needs to be run for security reasons (i.e only if you had top secret files on your drive). The command overwrites the lingering data on the device with random data. It takes around 6 hours to complete for a 200GB drive.
+
{{Fancywarning|This action will destroy all data on the disk.}}
  
{{Note}} You will get a message about reaching the end of the device when the <code>dd</code> command has finished. This behavior is intended.
+
== Encrypting the drive ==
 
+
Read more about different cipher options here: [http://blog.wpkg.org/2009/04/23/cipher-benchmark-for-dm-crypt-luks/]
= Encrypting the drive =
+
 
<console>
 
<console>
 
# ##i##cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
 
# ##i##cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
 
# ##i##cryptsetup luksOpen /dev/sda3 dmcrypt_root
 
# ##i##cryptsetup luksOpen /dev/sda3 dmcrypt_root
 
</console>
 
</console>
 
 
There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.
 
There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.
 
+
{{Fancywarning|The default keymap at boot time is '''us'''. If you enter your passphrase using a different keymap, you won't be able to unlock your crypt volume if the passphrase contains any characters that are located elsewere on your keyboard layout that with the us layout.}}
 
= Create logical volumes =
 
= Create logical volumes =
 
<console>
 
<console>
Line 35: Line 42:
 
</console>
 
</console>
 
Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.
 
Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.
 +
{{fancynote| Please, notice that above mentioned partitioning scheme is an example and not a default recommendation, change it accordingly to desired scheme.}}
  
 
= Create a filesystem on volumes =
 
= Create a filesystem on volumes =
Line 61: Line 69:
 
* '''lvm2'''
 
* '''lvm2'''
 
* '''a bootloader (grub recommended)'''
 
* '''a bootloader (grub recommended)'''
* '''kernel sources (gentoo-sources recommended)'''
+
* '''kernel sources '''
  
 
= Editing the fstab =
 
= Editing the fstab =
 
Fire up your favorite text editor to edit <code>/etc/fstab</code>. You want to put the following in the file:
 
Fire up your favorite text editor to edit <code>/etc/fstab</code>. You want to put the following in the file:
<console>
+
 
 +
{{file|name=/etc/fstab|desc= |body=
 
# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
 
# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
 
/dev/sda1              /boot        ext2      noauto,noatime                  1 2
 
/dev/sda1              /boot        ext2      noauto,noatime                  1 2
Line 73: Line 82:
 
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
 
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
 
/dev/mapper/vg-home    /home        ext4      noatime,nodiratime              0 0
 
/dev/mapper/vg-home    /home        ext4      noatime,nodiratime              0 0
</console>
+
}}
  
= Kernel options =
+
== Kernel options ==
{{Note}}This part is particularly important: pay close attention.
+
{{fancynote| This part is particularly important: pay close attention. }}<br>
 
{{kernelop
 
{{kernelop
|'''General setup --->'''
+
|title=
|'''[*] Initial RAM filesystem and RAM disk (initramfs/initrd) support'''
+
|desc=
 +
General setup --->
 +
      [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support
 
}}
 
}}
 
 
{{kernelop
 
{{kernelop
|'''Device Drivers --->''' <br> '''Generic Driver Options --->'''
+
|title=
|'''[*] Maintain a devtmpfs filesystem to mount at /dev''' <br>
+
|desc=
 +
Device Drivers --->
 +
      Generic Driver Options --->  
 +
      [*] Maintain a devtmpfs filesystem to mount at /dev
 
}}
 
}}
 
 
{{kernelop
 
{{kernelop
|'''Device Drivers --->''' <br> '''[*] Multiple devices driver support --->'''
+
|title=
|'''<*>Device Mapper Support''' <br> '''<*> Crypt target support'''
+
|desc=
 +
Device Drivers --->
 +
      [*] Multiple devices driver support --->
 +
      <*>Device Mapper Support
 +
        <*> Crypt target support
 
}}
 
}}
 
 
{{kernelop
 
{{kernelop
|'''Cryptographic API --->'''
+
|title=
|'''-*-AES cipher algorithms''' <br> '''<*> XTS support'''
+
|desc=
 +
Cryptographic API --->
 +
      <*> XTS support
 +
      -*-AES cipher algorithms
 
}}
 
}}
  
Line 101: Line 119:
 
'''Build your initramfs with [https://bitbucket.org/piotrkarbowski/better-initramfs better-initramfs] project.'''
 
'''Build your initramfs with [https://bitbucket.org/piotrkarbowski/better-initramfs better-initramfs] project.'''
  
{{note}}better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices.
+
{{fancynote| better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices and file system support.}}
  
 
<console>
 
<console>
##r### ##b##cd /opt
+
# ##i##cd /opt
##r### ##b##git clone git://github.com/slashbeast/better-initramfs.git
+
# ##i##git clone git://github.com/slashbeast/better-initramfs.git
##r### ##b##cd better-initramfs
+
# ##i##cd better-initramfs
##r### ##b##less README.rst
+
# ##i##less README.rst
##r### ##b##bootstrap/bootstrap-all
+
# ##i##bootstrap/bootstrap-all
##r### ##b##make prepare
+
# ##i##make prepare
##r### ##b##make image
+
# ##i##make image
 
</console>
 
</console>
  
 
Copy resulting <code>initramfs.cpio.gz</code> to <code>/boot</code>:
 
Copy resulting <code>initramfs.cpio.gz</code> to <code>/boot</code>:
<console>##r### ##b##cp output/initramfs.cpio.gz /boot</console>
+
<console># ##i##cp output/initramfs.cpio.gz /boot</console>
  
 
Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads
 
Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads
 
<console>
 
<console>
##r### ##b##wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
+
# ##i##wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
##r### ##b##tar xf release-x86_64-v0.5.tar.bz2
+
# ##i##tar xf release-x86_64-v0.5.tar.bz2
##r### ##b##cd release*
+
# ##i##cd release*
##r### ##b##gzip initramfs.cpio
+
# ##i##gzip initramfs.cpio
##r### ##b##cp initramfs.cpio.gz /boot
+
# ##i##cp initramfs.cpio.gz /boot
 
</console>
 
</console>
  
 
Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with <code>git</code>. Go to the better-initramfs source dir and follow:
 
Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with <code>git</code>. Go to the better-initramfs source dir and follow:
 
<console>
 
<console>
##r### ##b##cd /opt/better-initramfs
+
# ##i##cd /opt/better-initramfs
##r### ##b##git pull
+
# ##i##git pull
##r### ##b##less ChangeLog
+
# ##i##less ChangeLog
 +
</console>
 +
{{fancynote| Please read the ChangeLog carefuly and perform necessary updates to <code>/etc/boot.conf</code>. Also, please backup the working <code>/boot/initramfs.cpio.gz</code> and <code>/etc/boot.conf</code> before updating better-initramfs.}}
 +
Alternatively and much faster is to install better-initramfs-bin package, recently added to Funtoo's portage tree:
 +
<console>
 +
# ##i##emerge better-initramfs-bin
 
</console>
 
</console>
{{Note}}Please read the ChangeLog carefuly and perform necessary updates to <code>/etc/boot.conf</code>. Also, please backup the working <code>/boot/initramfs.cpio.gz</code> and <code>/etc/boot.conf</code> before updating better-initramfs.
 
  
 
== Genkernel ==
 
== Genkernel ==
 
Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:
 
Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:
<pre>genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all</pre>
+
<console>
Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2:
+
# ##i##genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all </console>
  
{{code|/etc/boot.conf|<pre>
+
== Bootloader Configuration ==
 +
=== Grub2 configuration ===
 +
==== better-initramfs ====
 +
An example <code>/etc/boot.conf</code> for better-initramfs:
 +
 
 +
<pre>
 
boot {
 
boot {
 
   generate grub
 
   generate grub
Line 145: Line 172:
 
}
 
}
 
"Funtoo Linux" {
 
"Funtoo Linux" {
   kernel kernel-genkernel-x86_64-2.6.39
+
   kernel vmlinuz[-v]
   initrd initramfs-genkernel-x86_64-2.6.39
+
   initrd /initramfs.cpio.gz
   params += crypt_root=/dev/sda2 dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
+
   params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
}</pre>}}
+
</pre>
  
= Grub2 configuration =
+
Now, run <code>boot-update</code> to write the configuration files to <code>/boot/grub/grub.cfg</code>
An example of <code>/etc/boot.conf</code> for better-initramfs
+
 
{{code|/etc/boot.conf|<pre>
+
==== genkernel ====
 +
Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing <code>/etc/boot.conf</code>:
 +
 
 +
<pre>
 
boot {
 
boot {
 
   generate grub
 
   generate grub
Line 159: Line 189:
 
}
 
}
 
"Funtoo Linux" {
 
"Funtoo Linux" {
   kernel bzImage[-v]
+
   kernel kernel-genkernel-x86_64-3.13.0
   initrd /initramfs.cpio.gz
+
   initrd initramfs-genkernel-x86_64-3.13.0
   params += enc_root=/dev/sda2 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
+
   params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet
}</pre>}}
+
</pre>
  
= Lilo configuration =
+
== Lilo configuration ==
 
For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support
 
For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support
<pre>
+
<console>
# echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
+
# ##i##echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
# emerge lilo</pre>
+
# ##i##emerge lilo
 +
</console>
  
{{code|/etc/lilo.conf|<pre>append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"
+
Example <code>/etc/lilo.conf</code>:
 +
 
 +
<pre>
 +
append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"
 
boot=/dev/sda
 
boot=/dev/sda
 
compact
 
compact
Line 178: Line 212:
 
read-only
 
read-only
 
timeout=50
 
timeout=50
image=/boot/kernel-genkernel-x86_64-2.6.39
+
image=/boot/kernel-genkernel-x86_64-3.13.0
initrd=/boot/initramfs-genkernel-x86_64-2.6.39
+
initrd=/boot/initramfs-genkernel-x86_64-3.13.0
 
label=funtoo
 
label=funtoo
</pre>}}
+
</pre>
= Syslinux bootloader setup =
+
 
Syslinux is another advanced bootloader which you can find on all live CD's.  
+
== Syslinux bootloader setup ==
<pre>
+
Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.
# emerge syslinux
+
<console>
# mkdir /boot/extlinux
+
# ##i##emerge syslinux
# extlinux --install /boot/extlinux
+
# ##i##mkdir /boot/extlinux
# dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
+
# ##i##extlinux --install /boot/extlinux
 +
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
 
- or -
 
- or -
# sgdisk /dev/sda --attributes=1:set:2
+
# ##i##sgdisk /dev/sda --attributes=1:set:2
# dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition</pre>  
+
# ##i##dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition
{{code|/boot/extlinux/extlinux.conf|<pre>LABEL kernel1_bzImage-3.2.1
+
</console>
 +
 
 +
Example <code>/boot/extlinux/extlinux.conf</code>:
 +
 
 +
<pre>
 +
LABEL kernel1_bzImage-3.2.1
 
MENU LABEL Funtoo Linux bzImage-3.2.1
 
MENU LABEL Funtoo Linux bzImage-3.2.1
 
LINUX /bzImage-3.2.1
 
LINUX /bzImage-3.2.1
 
INITRD /initramfs.cpio.gz
 
INITRD /initramfs.cpio.gz
 
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root
 
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root
</pre>}}
+
</pre>
  
= Final steps =
+
== Final steps ==
 
Umount everything, close encrypted drive and reboot
 
Umount everything, close encrypted drive and reboot
<pre>umount /mnt/funtoo/proc (/dev, /home, /usr/portage, /boot)
+
<console>
vgchange -a n
+
# ##i##umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot}
cryptsetup luksClose /dev/sda2 dmcrypt_root</pre>
+
# ##i##vgchange -a n
 +
# ##i##cryptsetup luksClose /dev/sda2 dmcrypt_root
 +
</console>
 
After reboot you will get the following:
 
After reboot you will get the following:
<pre>>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
+
<console>
 +
>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
 
>>> Create all the symlinks to /bin/busybox.
 
>>> Create all the symlinks to /bin/busybox.
 
>>> Initiating /dev/dir
 
>>> Initiating /dev/dir
Line 213: Line 256:
 
No volume group found
 
No volume group found
 
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
 
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
Enter passphrase fore /dev/sda2:</pre>
+
Enter passphrase fore /dev/sda2:
 +
</console>
 
Type your password
 
Type your password
  
<pre>>>> Again, getting LVM volumes up (if any, after map dmcrypt).
+
<console>
 +
>>> Again, getting LVM volumes up (if any, after map dmcrypt).
 
   Reading all physical volumes.  This may take a while...
 
   Reading all physical volumes.  This may take a while...
 
   Found volume group "vg" using metadata type lvm2
 
   Found volume group "vg" using metadata type lvm2
Line 231: Line 276:
 
Password:
 
Password:
 
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
 
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
oleg@orion ~ %</pre>
+
oleg@orion ~ %
 +
</console>
  
= Additional links =
+
== Additional links and information ==
 
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
 
* [[gentoo-wiki:Root filesystem over LVM2, DM-Crypt and RAID|Root filesystem over LVM2, DM-Crypt, and RAID]]
 
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]
 
* [http://wiki.archlinux.org/index.php/System_Encryption_with_LUKS_for_dm-crypt System Encryption with LUKS for dm-crypt]
 +
* [http://en.wikipedia.org/wiki/Logical_volume_management Wikipedia article on LVM]
 +
* [https://wiki.archlinux.org/index.php/Dm-crypt_with_LUKS Arch Wiki article]
  
 
[[Category:HOWTO]]
 
[[Category:HOWTO]]

Latest revision as of 12:16, 13 September 2014

This howto describes how to setup LVM and rootfs with cryptoLUKS-encrypted drive. It is not meant to be a standalone installation guide, rather, it is meant to be read alongside the Funtoo Linux Installation Guide.

Prepare the hard drive and partitions

This is an example partition scheme, you may want to choose differently. /dev/sda1 used as /boot. /dev/sda2 will be encrypted drive with LVM.

  • /dev/sda1 -- /boot partition.
  • /dev/sda2 -- BIOS boot partition (not needed for MBR - only needed if you are using GPT) This step required for GRUB2. For more info, see: [1] for more information on GPT and MBR.
  • /dev/sda3 -- / partition, will be the drive with LUKS and LVM.

With UEFI:

  • /dev/sda1 -- /boot
  • /dev/sda2 -- / partition

Wipe the hard drive

# gdisk /dev/sda

Command: x ↵
Expert command: z ↵
About to wipe out GPT on /dev/sda. Proceed?: y ↵
GPT data structures destroyed! You may now partition the disk using fdisk or other utilities.
Blank out MBR?: y ↵

Warning

This action will destroy all data on the disk.

Encrypting the drive

Read more about different cipher options here: [2]

# cryptsetup --cipher aes-xts-plain64 luksFormat /dev/sda3
# cryptsetup luksOpen /dev/sda3 dmcrypt_root

There you'll be prompted to enter your password phrase for encrypted drive, type your paranoid password there.

Warning

The default keymap at boot time is us. If you enter your passphrase using a different keymap, you won't be able to unlock your crypt volume if the passphrase contains any characters that are located elsewere on your keyboard layout that with the us layout.

Create logical volumes

# pvcreate /dev/mapper/dmcrypt_root
# vgcreate vg /dev/mapper/dmcrypt_root
# lvcreate -L10G --name root vg           
# lvcreate -L2G --name swap vg
# lvcreate -L5G --name portage vg
# lvcreate -l 100%FREE -nhome vg

Feel free to specify your desired size by altering the numbers after the -L flag. For example, to make your portage dataset 20GB's, use the flag -L20G instead of -L5G.

Note

Please, notice that above mentioned partitioning scheme is an example and not a default recommendation, change it accordingly to desired scheme.

Create a filesystem on volumes

# mkfs.ext2 /dev/sda1
# mkswap /dev/mapper/vg-swap
# mkfs.ext4 /dev/mapper/vg-root
# mkfs.ext4 /dev/mapper/vg-portage
# mkfs.ext4 /dev/mapper/vg-home

Basic system setup

# swapon /dev/mapper/vg-swap
# mkdir /mnt/funtoo
# mount /dev/mapper/vg-root /mnt/funtoo
# mkdir -p /mnt/funtoo/{boot,usr/portage,home}
# mount /dev/sda1 /mnt/funtoo/boot
# mount /dev/mapper/vg-portage /mnt/funtoo/usr/portage
# mount /dev/mapper/vg-home /mnt/funtoo/home

Now perform all the steps required for basic system install, please follow [3] don't forget to emerge the following before your install is finished:

  • cryptsetup
  • lvm2
  • a bootloader (grub recommended)
  • kernel sources

Editing the fstab

Fire up your favorite text editor to edit /etc/fstab. You want to put the following in the file:

/etc/fstab
# <fs>                  <mountpoint>  <type>    <opts>                          <dump/pass>
/dev/sda1               /boot         ext2      noauto,noatime                  1 2
/dev/mapper/vg-swap     none          swap      sw                              0 0
/dev/mapper/vg-root     /             ext4      noatime,nodiratime,defaults     0 1
/dev/sr0                /mnt/cdrom    auto      noauto,ro                       0 0
/dev/mapper/vg-portage  /usr/portage  ext4      noatime,nodiratime              0 0
/dev/mapper/vg-home     /home         ext4      noatime,nodiratime              0 0

Kernel options

Note

This part is particularly important: pay close attention. 

General setup --->
      [*] Initial RAM filesystem and RAM disk (initramfs/initrd) support
Device Drivers --->
      Generic Driver Options ---> 
      [*] Maintain a devtmpfs filesystem to mount at /dev
Device Drivers --->
      [*] Multiple devices driver support --->
      <*>Device Mapper Support
        <*> Crypt target support
Cryptographic API --->
      <*> XTS support
      -*-AES cipher algorithms

Initramfs setup and configuration

Better-initramfs

Build your initramfs with better-initramfs project.

Note

better-initramfs supports neither dynamic modules nor udev, so you should compile your kernel with built-in support for your block devices and file system support.
# cd /opt
# git clone git://github.com/slashbeast/better-initramfs.git
# cd better-initramfs
# less README.rst
# bootstrap/bootstrap-all
# make prepare
# make image

Copy resulting initramfs.cpio.gz to /boot:

# cp output/initramfs.cpio.gz /boot

Alternatively, a pre-compiled binary initramfs is available at https://bitbucket.org/piotrkarbowski/better-initramfs/downloads

# wget https://bitbucket.org/piotrkarbowski/better-initramfs/downloads/release-x86_64-v0.7.2.tar.bz2
# tar xf release-x86_64-v0.5.tar.bz2
# cd release*
# gzip initramfs.cpio
# cp initramfs.cpio.gz /boot

Remember, better-initramfs project is a work in progress, so you need to update from time to time. It can be done easily with git. Go to the better-initramfs source dir and follow:

# cd /opt/better-initramfs
# git pull
# less ChangeLog

Note

Please read the ChangeLog carefuly and perform necessary updates to /etc/boot.conf. Also, please backup the working /boot/initramfs.cpio.gz and /etc/boot.conf before updating better-initramfs.

Alternatively and much faster is to install better-initramfs-bin package, recently added to Funtoo's portage tree:

# emerge better-initramfs-bin

Genkernel

Funtoo's genkernel capable to create initramfs for encrypted drive. Compile and install kernel and initramfs of your favorite kernel sources:

# genkernel --kernel-config=/path/to/your/custom-kernel-config --no-mrproper --makeopts=-j5 --install --lvm --luks all 

Bootloader Configuration

Grub2 configuration

better-initramfs

An example /etc/boot.conf for better-initramfs:

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
  kernel vmlinuz[-v]
  initrd /initramfs.cpio.gz
  params += enc_root=/dev/sda3 lvm luks root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet

Now, run boot-update to write the configuration files to /boot/grub/grub.cfg

genkernel

Configure the bootloader as described above, with correct kernel and initramfs images names. An example for genkernel and grub2. You will be editing /etc/boot.conf:

boot {
  generate grub
  default "Funtoo Linux"
  timeout 3
}
"Funtoo Linux" {
  kernel kernel-genkernel-x86_64-3.13.0
  initrd initramfs-genkernel-x86_64-3.13.0
  params += crypt_root=/dev/sda3 dolvm real_root=/dev/mapper/vg-root  rootfstype=ext4 resume=swap:/dev/mapper/vg-swap quiet

Lilo configuration

For oldschool geeks, an example for lilo bootloader. Emerge lilo with device-mapper support

# echo 'sys-boot/lilo device-mapper' >> /etc/portage/package.use/lilo
# emerge lilo

Example /etc/lilo.conf:

append="init=/linuxrc dolvm crypt_root=/dev/sda2 real_root=/dev/mapper/vg-root"
boot=/dev/sda
compact
default=funtoo
lba32
prompt
read-only
timeout=50
image=/boot/kernel-genkernel-x86_64-3.13.0
initrd=/boot/initramfs-genkernel-x86_64-3.13.0
label=funtoo

Syslinux bootloader setup

Syslinux is another advanced bootloader which you can find on all live CD's. Syslinux bootloader does not require additional BIOS boot partition. /dev/sda2 is the root partition.

# emerge syslinux
# mkdir /boot/extlinux
# extlinux --install /boot/extlinux
# dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/mbr.bin of=/dev/sda
- or -
# sgdisk /dev/sda --attributes=1:set:2
# dd bs=440 conv=notrunc count=1 if=/usr/share/syslinux/gptmbr.bin of=/dev/sda, for GPT partition

Example /boot/extlinux/extlinux.conf:

LABEL kernel1_bzImage-3.2.1
MENU LABEL Funtoo Linux bzImage-3.2.1
LINUX /bzImage-3.2.1
INITRD /initramfs.cpio.gz
APPEND rootfstype=ext4 luks enc_root=/dev/sda2 lvm root=/dev/mapper/vg-root

Final steps

Umount everything, close encrypted drive and reboot

# umount -l -v /mnt/funtoo/{dev, proc, home, usr/portage, boot} 
# vgchange -a n
# cryptsetup luksClose /dev/sda2 dmcrypt_root

After reboot you will get the following:

>>> better-initramfs started. Kernel version 2.6.35-gentoo-r10
>>> Create all the symlinks to /bin/busybox.
>>> Initiating /dev/dir
>>> Getting LVM volumes up (if any)
Reding all physical volumes. This make take awhile...
No volume group found
No volume group found
>>> Opening encrypted partition and mapping to /dev/mapper/dmcrypt_root
Enter passphrase fore /dev/sda2:

Type your password

>>> Again, getting LVM volumes up (if any, after map dmcrypt).
  Reading all physical volumes.  This may take a while...
  Found volume group "vg" using metadata type lvm2
  4 logical volume(s) in volume group "vg" now active
>>> Mounting rootfs to /newroot
>>> Umounting /sys and /proc.
>>> Switching root to /newroot and executing /sbin/init.
INIT: version 2.88 booting
Loading /libexec/rc/console/keymap
  OpenRC 0.6.1 is starting up Funtoo Linux (x86_64)
...boot messages omitted for clarity
   
orion login: oleg
Password:
Last login: Thu Oct 14 20:49:21 EEST 2010 on tty1
oleg@orion ~ %

Additional links and information