From: "JohnW" <johnxw@amazon.com>
To: cip-dev@lists.cip-project.org
Subject: Re: [isar-cip-core][RFC 8/8] Add example to encrypt the rootfs
Date: Mon, 25 Mar 2024 10:48:16 -0700 [thread overview]
Message-ID: <1141.1711388896493643788@lists.cip-project.org> (raw)
In-Reply-To: <d7cc79e4-ef20-4d31-befe-229ca3274fb7@siemens.com>
[-- Attachment #1: Type: text/plain, Size: 634 bytes --]
>
> This should build an rootfs without efibootguard and with systemd-boot:
>
> ```
> kas-container build
> kas-cip.yml:kas/board/qemu-amd64.yml:kas/opt/encrypt_rootfs.yml
> ```
I tried this build and tried to boot this image from USB with secure boot disabled in BIOS. The boot stuck at
>
>
> EFI stub: Loaded initrd from LINUX_EFI_INITRD_MEDIA_GUID device path
> EFI stub: Measured initrd data into PCR9
I currently have a image build based on ISAR with grub boot loader that has secure boot working properly with all of my test devices. Is it possible if I can add the /opt/encrypt_rootfs.yml into that build?
[-- Attachment #2: Type: text/html, Size: 671 bytes --]
next prev parent reply other threads:[~2024-03-25 17:48 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-19 18:18 [cip-dev][isar-cip-core][RFC 0/8] Rework disk encryption Quirin Gylstorff
2024-03-19 18:18 ` [cip-dev][isar-cip-core][RFC 1/8] initramfs-crypt-hook: Allow switching between clevis and systemd Quirin Gylstorff
2024-03-19 18:33 ` Jan Kiszka
2024-03-20 11:27 ` Gylstorff Quirin
2024-03-19 18:18 ` [cip-dev][isar-cip-core][RFC 2/8] initramfs-crypt-hook: Align systemd encryption and clevis encryption Quirin Gylstorff
2024-03-19 18:18 ` [cip-dev][isar-cip-core][RFC 3/8] initramfs-crypt-hook: move the mounting of encrypted disks in a seperate function Quirin Gylstorff
2024-03-19 18:18 ` [cip-dev][isar-cip-core][RFC 4/8] initramfs-crypt-hook: Check if the TPM device fulfills the given requirements Quirin Gylstorff
2024-03-19 18:35 ` Jan Kiszka
2024-03-19 18:18 ` [cip-dev][isar-cip-core][RFC 5/8] initramfs-crypt-hook: add flag to make encryption optional Quirin Gylstorff
2024-03-19 18:36 ` Jan Kiszka
2024-03-19 18:18 ` [cip-dev][isar-cip-core][RFC 6/8] initramfs-crypt-hook: add e2fsck to avoid resize error Quirin Gylstorff
2024-03-19 18:37 ` Jan Kiszka
2024-03-20 11:42 ` Gylstorff Quirin
2024-03-19 18:18 ` [cip-dev][isar-cip-core][PATCH 7/8] initramfs-crypt-hook: split encryption and mounting Quirin Gylstorff
2024-03-19 18:18 ` [cip-dev][isar-cip-core][RFC 8/8] Add example to encrypt the rootfs Quirin Gylstorff
2024-03-19 18:42 ` Jan Kiszka
2024-03-20 11:41 ` Gylstorff Quirin
2024-03-20 11:49 ` Jan Kiszka
2024-03-22 0:24 ` [isar-cip-core][RFC " JohnW
2024-03-25 8:34 ` [cip-dev] " Gylstorff Quirin
2024-03-25 17:48 ` JohnW [this message]
2024-03-28 10:14 ` Gylstorff Quirin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1141.1711388896493643788@lists.cip-project.org \
--to=johnxw@amazon.com \
--cc=cip-dev@lists.cip-project.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox