Re: [cip-dev][isar-cip-core][PATCH v4 0/9] Add option to encrypt the rootfs

[Jan Kiszka <jan.kiszka@siemens.com>]

On 02.05.24 11:31, Quirin Gylstorff wrote:
> From: Quirin Gylstorff <quirin.gylstorff@siemens.com>
> 
> This adds the option to encrypt both root file system partitions.
> The encrypted partition can be updated with SWUpdate.
> 
> The disk encryption is indepented of the selected boot method and
> could also be used to encrypt a single writable root file system.
> 
> To simplify the handling of the swupdate the encrypted partition use
> the uuid as the device mapper name.
> 
> 
> If all partitions are encrypted the partition layout looks similar to
> this:
> 
> ```
> root@demo:~# lsblk
> NAME                                     MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
> sda                                        8:0    0   5.4G  0 disk
> ├─sda1                                     8:1    0  16.1M  0 part
> ├─sda2                                     8:2    0    42M  0 part
> ├─sda3                                     8:3    0    42M  0 part
> ├─sda4                                     8:4    0     1G  0 part
> │ └─fedcba98-7654-3210-cafe-5e0710000001 252:0    0  1008M  0 crypt
> ├─sda5                                     8:5    0     1G  0 part
> │ └─fedcba98-7654-3210-cafe-5e0710000002 252:1    0  1008M  0 crypt
> │   └─verityroot                         252:4    0 115.3M  1 crypt /
> ├─sda6                                     8:6    0   1.3G  0 part
> │ └─encrypted_home                       252:2    0   1.3G  0 crypt /home
> └─sda7                                     8:7    0     2G  0 part
>   └─encrypted_var                        252:3    0     2G  0 crypt /var
> ```
> Changes v4:
>  - Clarify that only non-boot partitions are encrypted
>  - Fix typos
>  - Add note for encryptition in secure environment
> 
> Changes v3:
>  - Update the encrypted partition instead of the underling device
>  - Use uuids instead of labels for the partitions.
>  - Allow uuids and absolute path to select the partition to be
>    encrypted.
>  - Add Readme for partition selection.
> 
> Changes v2:
>  - Rewrite commit messages
>  - Rename kas/opt/encrypt-partitions.yml to kas/opt/encrypt-data.yml
>  - Rename kas/opt/encrypt-rootfs.yml to kas/opt/encrypt-all.yml
>  - Fix assignment of CRYPT_PARTITIONS
> 
> Changes from https://lists.cip-project.org/g/cip-dev/message/15512:
>  - add partition labels for a/b partitions
>  - use a/b rootfs configuration instead seperate wks file
> 
> 
> Quirin Gylstorff (9):
>   wic/*: Add part-labels to system partition
>   initramfs: allow empty mountpoint for crypt hooks
>   initramfs-crypt: Only resize partition if ext* formatted
>   fix: use luks2 to identify encrypted partition
>   Rename encrypt-partitions to encrypt-data
>   Kconfig: Add option to encrypt the rootfs
>   crypt-hook: Extend partition selection
>   README: Add rootfs encryption
>   README.swupdate: Add section about partition selection
> 
>  .gitlab-ci.yml                                |  2 +-
>  Kconfig                                       | 24 +++++++--
>  doc/README.swupdate.md                        | 16 ++++++
>  doc/README.tpm2.encryption.md                 | 22 +++++++--
>  kas/opt/encrypt-all.yml                       | 23 +++++++++
>  ...ncrypt-partitions.yml => encrypt-data.yml} |  0
>  kas/opt/security.yml                          |  2 +-
>  .../files/encrypt_partition.clevis.hook       |  2 +
>  .../files/encrypt_partition.script            | 49 ++++++++++++++-----
>  .../files/encrypt_partition.systemd.hook      |  2 +
>  .../files/mount_crypt_partitions.script       | 24 +++++++--
>  .../initramfs-crypt-hook_0.2.bb               |  3 +-
>  wic/bbb-efibootguard.wks.in                   |  4 +-
>  wic/hihope-rzg2m-efibootguard.wks.in          |  4 +-
>  wic/qemu-amd64-efibootguard-secureboot.wks.in |  4 +-
>  wic/qemu-arm64-efibootguard-secureboot.wks.in |  4 +-
>  wic/qemu-arm64-efibootguard.wks.in            |  4 +-
>  wic/qemu-riscv64-efibootguard.wks.in          |  4 +-
>  wic/x86-efibootguard.wks.in                   |  4 +-
>  19 files changed, 157 insertions(+), 40 deletions(-)
>  create mode 100644 kas/opt/encrypt-all.yml
>  rename kas/opt/{encrypt-partitions.yml => encrypt-data.yml} (100%)
> 

Just tested in qemu-amd64. It works, but there are many suspicious
warnings and messages during first boot:

Warning: keyslot operation could fail as it requires more than available memory.
Progress:  52.4%, ETA 00m06s,  528 MiB written, speed  78.8 MiB/s
Finished, time 00m11s, 1008 MiB written, speed  83.5 MiB/s
New TPM2 token enrolled as key slot 1.
/scripts/local-top/encrypt_partition: 55: /scripts/local-top/encrypt_partition: -: not found
Device /dev/sda5 is not a valid LUKS device.
skip disk resize as it not support or unnecessary for fstype: ''
Warning: keyslot operation could fail as it requires more than available memory.
Finished, time 00m11s, 1008 MiB written, speed  83.7 MiB/s
New TPM2 token enrolled as key slot 1.
/scripts/local-top/encrypt_partition: 55: /scripts/local-top/encrypt_partition: -: not found
Device /dev/sda6 is not a valid LUKS device.

Jan

-- 
Siemens AG, Technology
Linux Expert Center