[gentoo-user] Re: Re: Re: Full disk encryption

[Jack Byer]

Dale wrote:

> Jack Byer wrote:
>> Dale wrote:
>>
>>> Did you use a howto for Dracut?  If so, have a link you could post?  I
>>> tried making a init thingy and after about 20 failed reboots, I scraped
>>> the idea.  I was trying to follow the howto on the Gentoo wiki I think.
>>> The unofficial wiki.
>>>
>> I had some difficulties because the way I was doing things before with my
>> homebrew solution was... non-standard.
>>
>> The problem areas that I remember from the transition were: setting the
>> USE flags correctly to build the modules I needed, initially confusing
>> dracutmodules and add_dracutmodules in dracut.conf (actually you probably
>> don't even need to edit that file at all), making sure to have a sane
>> /etc/fstab line for the root file system and passing the right root=
>> kernel command line. root=UUID=... works the best in my experience.
>>
>>
>>
>
>
> I did change the USE flags for the packages it said to.  I think some
> things have changed or something, maybe openrc?, and the script I was
> copying and working with just didn't work.  Maybe it needs updating or
> something.  I'm hoping to see a up-to-date howto or someone will post a
> good up-to-date howto for dracut.  Something even a idiot could follow.
> I think it will work for me then.  lol
>
> Dale
>
> :-)  :-)

>
I can tell you how mine is set up.

emerge -v dracut

These are the packages that would be merged, in order:

[ebuild   R   ~] sys-kernel/dracut-013-r2  USE="-debug (-selinux)" 
DRACUT_MODULES="btrfs crypt lvm -biosdevname -caps -crypt-gpg -dmraid -
dmsquash-live -gensplash -iscsi -livenet -mdraid -multipath -nbd -nfs -
plymouth -syslog -xen" 0 kB

I don't use any of the other modules so all I enable are btrfs, crypt and 
lvm.

/etc/dracut.conf has no changes from the default except for the line:

add_dracutmodules+="crypt dm lvm"

but I'm about 80% sure even that isn't necessary and you could just leave 
the default values alone. One of these days I'll get around to testing that.

I make an initramfs with the following command:

dracut --lzma <hostname>.dracut.lzma <kernel version>

(obviously change --lzma to whatever type of compression your kernel 
expects 
to use and name the file whatever you want. Make sure to include the kernel 
version just like it appears in your /lib/modules/ directory so that dracut 
includes the correct kernel modules)

Then I make grub.conf look something like this:

root (hd0,0)
kernel /<hostname> root=UUID=08b00d7f-b633-4c03-98fe-dd5942a8fb7e 
initrd /<hostname>.dracut.lzma

I like to name my kernels and initramfs files by the hostname of the 
computer since I have three that I manage but use whatever you want and 
just 
make sure you put the right filenames in grub.conf.

You can obtain the UUID of your root filesystem by a number of methods, but 
the easiest is to use ls -l /dev/disks/by-uuid/

That's really all there is to it. Dracut will boot up and load the modules 
it is compiled with and search through the disks, logical volumes, and 
dmcrypt containers until it finds a filesystem with the UUID you specify. 
Once it finds the root filesystem it mounts it with whatever options you've 
specified in /etc/fstab and then hands control over to OpenRC.

If it has the necessary modules (kernel and dracut) and you pass the right 
root= option then it Just Works.