Re: [gentoo-hardened] Gentoo / RSBAC / Encrypted Root / Unmount fails

[dante]

Hi Mike,

I run two gentoo servers with both encrypted root fs and GRSEC/RBAC/PAX
--- so it is possible.  I didn't used LUKS, I set everything up step by
step by hand.  I've got a little mini-howto (with an already prepared
initrd) if you'd like to see what I did:

	http://www.virtualblueness.net/~blueness/encryptedroot/

I know this doesn't directly answer your question but it may help.

--

Anthony Basile, Ph.D.
Chair IT, D'Youville College



On Tue, 2006-07-11 at 10:11 +0200, Michael Decker wrote:
> 	Hi,
>
> could somebody help me to solve this problem. I try to encrypting whole
> root device by doing this howto:
>
>
> So my booting fails caused by an unmount error.
>
> On booting an own created initrd will be started to open luks encrypted
> filesystem, so this last steps of linuxrc-script [2] fails (on umount
> command):
>
> 	--- SNIP ---
> pivot_root . initrd
>
> # Start init and flush ram device exec
> chroot . /bin/sh <<- EOF >/dev/console 2>&1
> umount initrd
> rm -rf initrd
> blockdev --flushbufs /dev/ram0
> exec /sbin/init ${CMDLINE}
> EOF
> 	--- SNAP ---
>
> So I get this error:
> 	--- SNIP ---
> EXT3 FS on dm-0, internal journal
> EXT3-fs: dm-0: 1 orphan inode deleted
> EXT3-fs: recovery complete.
> EXT3-fs: mounted filesystem with journal data mode.
> 0000000037|rsbac_free_dat_dentry(): freeing dat dir dentries
> 0000000038|do_umount() [sys_umount()]: umount failed -> calling
> rsbac_mount for Device 01:00
> 	--- SNAP ---
>
> I've run the kernel with this options:
> 	--- SNIP ---
> Kernel command line: root=/dev/ram0 rw init=/linuxrc rsbac_softmode
> console=ttyS0,57600 console=tty0
> 	--- SNAP ---
>
> Is this a RSBAC problem? Do I have to modify the script [2]? Perhaps
> could somebody give a suggestion?
>
> Best regards,
> 	Michael Decker
>
> [1]
> http://gentoo-wiki.com/SECURITY_Encrypting_Root_Filesystem_with_DM-Crypt_with_LUKS
> [2]
> http://gentoo-wiki.com/SECURITY_Encrypting_Root_Filesystem_with_DM-Crypt_with_LUKS#Initrd_Scripts
> --
> Michael Decker                      Michael.Decker@×××××.de
> TESIS SYSware GmbH                      http://www.tesis.de
> Baierbrunnerstr. 15 * 81379 Muenchen * Tel. [phone]
>
-- 
gentoo-hardened@g.o mailing list