Root filesystem over LVM2, DM-Crypt and RAID

From Gentoo Linux Wiki

Filesystems TOC

Filesystem overview Journaling filesystems Ext4 Reiser4 Proprietary filesystems Mounting Windows Partitions NTFS-3G Virtual filesystems Initramfs Network filesystems NFS Mounting SFTP and FTP shares Samba GlusterFS OpenAFS with MIT Kerberos Encrypted filesystems TrueCrypt LVM2, DM-Crypt and RAID root DM-Crypt with LUKS AES-encrypted root partition using LVM2 Compressed filesystems Squashed Portage Tree (squashfs) Volume management LVM RAID Filesystems tricks Using Graphics Card Memory as Swap Automount Swap Early

This howto aims to explain how to mix RAID, DM-Crypt and LVM2, and how to boot on it. It is written for users with some experience as it does not get into details about RAID, DM-Crypt or LVM2, check the linked howtos for more informations.

To help with the comprehension, this howto will assume the following target system.

[edit] Requirements

You will need :

• A kernel with RAID,device-mapper and LVM2 support
• RAID,DM-Crypt and LVM2 user-space tools (on Gentoo that would be : sys-fs/mdadm, sys-fs/lvm2 and sys-fs/cryptsetup)

All of this is present on the Gentoo Universal install CD.

[edit] Partitions

Create the two partitions on the first disk

Then just copy the partition table to the other disk

[edit] RAID

Create the two RAID1 Arrays

Wait for them to sync (optional)

More about RAID here

[edit] DM-Crypt

First you need to randomise the disk (optional, really long but recommended for improved security, you may want to look at frandom to speed things up)

Then create the encrypted device

And map the encrypted device

More about DM-Crypt here

[edit] LVM2

Create a Physical Volume containing the encrypted device

Create a Volume Group

Create Logical Volumes that will become your final partitions

More about LVM2 here

[edit] Formating

Format your partitions with your favorite FS

[edit] Installation

You are now all set to install gentoo, refer to the handbook and don't forget to configure your kernel correctly.

Some things you need in the Kernel are:

 Device Drivers ---> Multiple device drivers -> Device mapper support
 Device Drivers ---> Multiple device drivers -> Crypt target suport
 Cryptographic API ---> <used algorithms>

Packages needed : sys-fs/mdadm, sys-fs/lvm2 and sys-fs/cryptsetup

[edit] Access

Commands to regain access to your partitions (in case you need to)

Just for your information, the opposite of these commands are :

[edit] Initram

[edit] Packages

To simplify the rest of the procedure, some packages need the static USE flag

sys-fs/lvm2 static
sys-fs/mdadm static
sys-apps/busybox static

Re-emerge them if needed

cryptsetup needs to be installed to make it available in the initramfs

[edit] Hierarchy

An initram is just a small hierarchy compressed in a single file, you won't need a lot of files.

A few directories first

Now you can copy the binaries needed

Now for the devices

Optional Step : If you don't have a qwerty keyboard, you will need a custom keymap.

Optional Step: put a message in ASCII-ART

Optional Step: you can put fbsplash stuff if you follow the steps on the wiki, uncompress that initramfs and mix it with this.

And to finish this initram: an init script. By default, the kernel will start the /init file.

#!/bin/sh

mount -t proc proc /proc
CMDLINE=`cat /proc/cmdline`

mount -t sysfs sysfs /sys

#wait a little to avoid trailing kernel output
sleep 3

#If you don't have a qwerty keyboard, uncomment the next line 
#loadkmap < /etc/kmap-fr

#raid
/bin/mdadm --assemble /dev/md2 /dev/sda2 /dev/sdb2

#If you have a msg, show it: 
#cat /etc/msg

#dm-crypt
/bin/cryptsetup luksOpen /dev/md2 vault

#lvm
#/bin/vgscan
/bin/vgchange -ay vg

#root filesystem
mount -r /dev/mapper/vg-root /newroot

#unmount pseudo FS
umount /sys
umount /proc

#root switch
exec /bin/busybox switch_root /newroot /sbin/init ${CMDLINE}

Make sure the init file is executable:

Now you can create the initramfs file

[edit] GRUB

The last thing needed is a bootloader.
The configuration file

default 0
timeout 3

title=linux
root (hd0,0)
kernel /boot/linux-2.6.27-4
initrd /boot/initramfs

And the installation on both disks (so you can boot on the second if the first fails)

device (hd0) /dev/sda
root (hd0,0)
setup (hd0)
device (hd0) /dev/sdb
root (hd0,0)
setup (hd0)

[edit] Reboot

You should now be able to boot on your system, the passphrase will be asked just after the kernel finishes initialising and then the normal boot will occur