Adding swap space to the encrypted partition

Adding swap space to the encrypted partition

[JohnW]

[-- Attachment #1: Type: text/plain, Size: 618 bytes --]

Hi Cip-Dev community,

Is there a way to add a swap space to the encrypted partition? Something that will look like

nvme0n1               259:0    0 238.5G  0 disk
├─nvme0n1p1           259:1    0   512M  0 part  /boot/efi
├─nvme0n1p2           259:2    0   1.4G  0 part  /boot
└─nvme0n1p3           259:3    0 236.6G  0 part
└─nvme0n1p3_crypt   253:0    0 236.5G  0 crypt
├─my-root   253:1    0 235.6G  0 lvm   /
└─my-swap_1 253:2    0   980M  0 lvm   [SWAP]

Regards,
John

[-- Attachment #2: Type: text/html, Size: 3567 bytes --]

Re: [cip-dev] Adding swap space to the encrypted partition

[Gylstorff Quirin]

Hi John,

On 5/29/24 6:51 PM, JohnW via lists.cip-project.org wrote:
> Hi Cip-Dev community,
> 
> Is there a way to add a swap space to the encrypted partition? Something 
> that will look like
> 
> nvme0n1               259:0    0 238.5G  0 disk
> ├─nvme0n1p1           259:1    0   512M  0 part  /boot/efi
> ├─nvme0n1p2           259:2    0   1.4G  0 part  /boot
> └─nvme0n1p3           259:3    0 236.6G  0 part
>    └─nvme0n1p3_crypt   253:0    0 236.5G  0 crypt
>      ├─my-root   253:1    0 235.6G  0 lvm   /
>      └─my-swap_1 253:2    0   980M  0 lvm   [SWAP]
> 
We currently have no  support for lvm based partition layouts or swap in 
isar and isar-cip-core.


Currently you could add a swap partition via *.wks, but I never tested this.

Due have the requirement to use swap or is this a nice to have?

Quirin


> Regards,
> John
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#16066): https://lists.cip-project.org/g/cip-dev/message/16066
> Mute This Topic: https://lists.cip-project.org/mt/106372674/1753640
> Group Owner: cip-dev+owner@lists.cip-project.org
> Unsubscribe: https://lists.cip-project.org/g/cip-dev/leave/8129121/1753640/1405269326/xyzzy [quirin.gylstorff@siemens.com]
> -=-=-=-=-=-=-=-=-=-=-=-
> 

Re: Adding swap space to the encrypted partition

[JohnW]

[-- Attachment #1: Type: text/plain, Size: 326 bytes --]

Hi Quirin,

I attempted to add a swap space within the wks file. However it created a swap space outside the encrypted partition.

We have devices that does not have large RAM where the swap space is needed to keep things running, so it is necessary for us to include a swap space within our partition.

Regards,
John

[-- Attachment #2: Type: text/html, Size: 355 bytes --]

Re: [cip-dev] Adding swap space to the encrypted partition

[Gylstorff Quirin]

Hi John,

On 6/7/24 12:49 AM, JohnW via lists.cip-project.org wrote:
> Hi Quirin,
> 
> I attempted to add a swap space within the wks file. However it created 
> a swap space outside the encrypted partition.

yes this is expected you would need to add the swap partition to the 
list of partition(variable CRYPT_PARTITIONS) to be encrypted. This would
also require to modify /etc/fstab.

Could be a swap file an alternative?

Best regards
Quirin
> 
> We have devices that does not have large RAM where the swap space is 
> needed to keep things running, so it is necessary for us to include a 
> swap space within our partition.

> 
> Regards,
> John
> 
> 
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#16131): https://lists.cip-project.org/g/cip-dev/message/16131
> Mute This Topic: https://lists.cip-project.org/mt/106372674/1753640
> Group Owner: cip-dev+owner@lists.cip-project.org
> Unsubscribe: https://lists.cip-project.org/g/cip-dev/leave/8129121/1753640/1405269326/xyzzy [quirin.gylstorff@siemens.com]
> -=-=-=-=-=-=-=-=-=-=-=-
> 

Re: Adding swap space to the encrypted partition

[JohnW]

[-- Attachment #1: Type: text/plain, Size: 243 bytes --]

Hi Quirin,

> 
> Could be a swap file an alternative?

I would like to stay with swap partition as it is a more common practice, also has less concern about compatibility and speed with different format of file system.

Regards,
John

[-- Attachment #2: Type: text/html, Size: 283 bytes --]

Re: Adding swap space to the encrypted partition

[JohnW]

[-- Attachment #1: Type: text/plain, Size: 727 bytes --]

I tried adding the following before the rootfs partition in the kickstart file.

> 
> part swap --use-label --size 2G --label swap1 --fstype=swap --fsoptions=sw

and also tried updating https://github.com/ilbers/isar/blob/2c76d889035ea05114b1a31bb73b025c0247a278/scripts/lib/wic/plugins/imager/direct.py#L105 to allow swap to be added to the fstab. CRYPT_PARTITIONS has been updated to
> 
> 
> CRYPT_PARTITIONS = "swap1:swap:reencrypt platform:/:reencrypt"

also tried
> 
> CRYPT_PARTITIONS = "swap1::reencrypt platform:/:reencrypt"

The image booted into initramfs and based on the debug log it says
> 
> Begin: Encryption of /dev/sda2 ... cannot resize partition. unsupport
> fstype: swap

Regards,
John

[-- Attachment #2: Type: text/html, Size: 964 bytes --]

Re: [cip-dev] Adding swap space to the encrypted partition

[quirin.gylstorff]

[-- Attachment #1: Type: text/plain, Size: 1372 bytes --]

Hi John,

Ok that is fixable we need to add an additional case in the crypt script for resizing swap in https://gitlab.com/cip-project/cip-core/isar-cip-core/-/blob/master/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.script?ref_type=heads#L80
Can you send a patch ?

Best regards
Quirin
________________________________
Von: cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org> im Auftrag von JohnW via lists.cip-project.org <johnxw=amazon.com@lists.cip-project.org>
Gesendet: Tuesday, June 11, 2024 5:31:41 AM
An: cip-dev@lists.cip-project.org <cip-dev@lists.cip-project.org>
Betreff: Re: [cip-dev] Adding swap space to the encrypted partition

I tried adding the following before the rootfs partition in the kickstart file.
part swap --use-label --size 2G --label swap1 --fstype=swap --fsoptions=sw
and also tried updating https://github.com/ilbers/isar/blob/2c76d889035ea05114b1a31bb73b025c0247a278/scripts/lib/wic/plugins/imager/direct.py#L105 to allow swap to be added to the fstab. CRYPT_PARTITIONS has been updated to
CRYPT_PARTITIONS = "swap1:swap:reencrypt platform:/:reencrypt"
also tried
CRYPT_PARTITIONS = "swap1::reencrypt platform:/:reencrypt"
The image booted into initramfs and based on the debug log it says
Begin: Encryption of /dev/sda2 ... cannot resize partition. unsupport fstype: swap
Regards,
John

[-- Attachment #2: Type: text/html, Size: 2489 bytes --]