added zfsbootmenu docs
shmalebx9
parent
b393e1154e
commit
73b90a4394
|
|
@ -39,6 +39,8 @@ the `/boot` partition is accessible.
|
||||||
Full encryption for basic LUKS2 is supported in libreboot.
|
Full encryption for basic LUKS2 is supported in libreboot.
|
||||||
See [the guide](encryption.md) for more detail.
|
See [the guide](encryption.md) for more detail.
|
||||||
|
|
||||||
|
[The ZFSbootmenu guide](zfsbootmenu.md) builds upon the main encryption guide but describes a setup with ZFS native encryption and ZFSbootmenu.
|
||||||
|
|
||||||
Rebooting system in case of freeze
|
Rebooting system in case of freeze
|
||||||
===================================
|
===================================
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,111 @@
|
||||||
|
---
|
||||||
|
title: ZFSbootmenu with Full Disk Encryption Guide
|
||||||
|
x-toc-enable: true
|
||||||
|
...
|
||||||
|
|
||||||
|
As described in the [general encryption guide,](encryption.md) Libreboot allows for full disk encryption including the boot partition.
|
||||||
|
Just as with the general guide, this explanation will demonstrate how to create a partition with moderate encryption for GRUB as well as a root partition with strong encryption.
|
||||||
|
The major differences between the encryption method described in the general guide and this guide are:
|
||||||
|
|
||||||
|
+ `/boot` must remain on the *root* zfs encrypted partition
|
||||||
|
+ The root partition will be encrypted with ZFS native encryption rather than LUKS
|
||||||
|
+ ZFSbootmenu will be loaded at the second boot stage (after Libreboot itself) rather than directly loading the operating system kernel/initramfs
|
||||||
|
|
||||||
|
[ZFSbootmenu](https://docs.zfsbootmenu.org/en/latest/) works by placing modified versions of the operating system kernel where they can be loaded by the system's bootloader.
|
||||||
|
ZFSbootmenu provides installation guides for various major distros in their [official docs.](https://docs.zfsbootmenu.org/en/latest/)
|
||||||
|
You should follow those docs for installation, only noting the differences necessary for full disk encryption described below.
|
||||||
|
The only differences between this guide and the docs are:
|
||||||
|
|
||||||
|
+ You need not install/configure syslinux as GRUB in Libreboot will be used to load the ZFSbootmenu kernel/initramfs
|
||||||
|
+ The ZFSbootmenu kernel/initramfs will reside on a LUKS encrypted partition you will create in this guide
|
||||||
|
+ Cryptsetup must be installed and configured to mount the LUKS encrypted partition
|
||||||
|
|
||||||
|
## Creating Encrypted Partition for GRUB
|
||||||
|
|
||||||
|
The following section is mostly identical to the main encryption guide except for the naming conventions of the partition in question.
|
||||||
|
When using ZFSbootmenu, the OS kernel/initramfs will reside on the root partion in the `/boot` directory; **not** on a separate boot partition.
|
||||||
|
The partition created in this section is only used to load the ZFSbootmenu kernel/initramfs itself and is therefore referred to as the 'pre-boot environment' *(pbe)* partition.
|
||||||
|
|
||||||
|
**Step 1:**
|
||||||
|
Create a LUKS2 formatted device with the PBKDF2 algorithm.
|
||||||
|
You can play around with the iteration count.
|
||||||
|
A higher iteration is more secure but will take GRUB a **very** long time to decrypt.
|
||||||
|
The [debian encrypted boot guide](https://cryptsetup-team.pages.debian.net/cryptsetup/encrypted-boot.html) recommends a count of 500,000 which will still take GRUB a very long time (around 25 seconds) but is faster than the default 1,000,000.
|
||||||
|
Use whatever count makes you feel comfortable.
|
||||||
|
I'll use an arbitrarily low count.
|
||||||
|
You'll also want to use a different password than you intend to use for your root partition.
|
||||||
|
We don't want someone to be able to get our root key by brute-forcing our less secure boot key.
|
||||||
|
|
||||||
|
`sudo cryptsetup luksFormat /dev/sda1 --type luks2 --pbkdf pbkdf2 --pbkdf-force-iterations 200000`
|
||||||
|
|
||||||
|
**Step 2:**
|
||||||
|
Format and mount the new LUKS2 device.
|
||||||
|
|
||||||
|
```
|
||||||
|
sudo cryptsetup luksOpen /dev/sda1 pbe
|
||||||
|
sudo mkfs.ext4 -L boot /dev/mapper/pbe
|
||||||
|
sudo mkdir -p /boot/pbe
|
||||||
|
sudo mount /dev/mapper/boot /boot/pbe
|
||||||
|
```
|
||||||
|
**Note:**
|
||||||
|
If you wish to change the passphrase for the boot partition in the future then you'll need to pass the same arguments to cryptsetup as when you created it.
|
||||||
|
If you don't pass any special arguments, the key will be changed to the distro's default encryption and grub won't be able to decrypt it.
|
||||||
|
The command to use is:
|
||||||
|
|
||||||
|
`cryptsetup luksChangeKey /dev/sda1 --type luks2 --pbkdf pbkdf2 --pbkdf-force-iterations 200000`
|
||||||
|
|
||||||
|
## Configure ZFSbootmenu
|
||||||
|
|
||||||
|
The [official ZFSbootmenu docs](https://docs.zfsbootmenu.org/en/latest/guides/general.html) will provide the most up-to-date information.
|
||||||
|
The only differences from the official documentation relevant here are that anything related to syslinux can be ignored and the configuration must be tailored to create only a single kernel/initramfs set.
|
||||||
|
Note that you should follow the *MBR/syslinux* guide for your distro if you are using the ZFSbootmenu guides.
|
||||||
|
|
||||||
|
Here is an example configuration:
|
||||||
|
|
||||||
|
```
|
||||||
|
> vim /etc/zfsbootmenu/config.yaml
|
||||||
|
|
||||||
|
Global:
|
||||||
|
ManageImages: true
|
||||||
|
BootMountPoint: /boot/pbe
|
||||||
|
DracutConfDir: /etc/zfsbootmenu/dracut.conf.d
|
||||||
|
PreHooksDir: /etc/zfsbootmenu/generate-zbm.pre.d
|
||||||
|
PostHooksDir: /etc/zfsbootmenu/generate-zbm.post.d
|
||||||
|
InitCPIOConfig: /etc/zfsbootmenu/mkinitcpio.conf
|
||||||
|
Components:
|
||||||
|
ImageDir: /boot/pbe/zfsbootmenu
|
||||||
|
Versions: false
|
||||||
|
Enabled: true
|
||||||
|
syslinux:
|
||||||
|
Config: /boot/syslinux/syslinux.cfg
|
||||||
|
Enabled: false
|
||||||
|
EFI:
|
||||||
|
ImageDir: /boot/pbe
|
||||||
|
Versions: false
|
||||||
|
Enabled: false
|
||||||
|
Kernel:
|
||||||
|
CommandLine: ro quiet loglevel=4
|
||||||
|
```
|
||||||
|
|
||||||
|
## Final Steps
|
||||||
|
|
||||||
|
Refer to the [general guide](encryption.md) on how to set up fstab/crypttab to mount the pre-boot environment on boot.
|
||||||
|
Replace references to *boot* with *pbe* if copying commands from the guide.
|
||||||
|
For example: make sure the partition is mounted at `/boot/pbe` rather than just `/boot.`
|
||||||
|
|
||||||
|
Ensure that your OS kernel/initramfs is generated with LUKS support.
|
||||||
|
LUKS support is generally automatically enabled in the kernel upon installing *cryptsetup.*
|
||||||
|
|
||||||
|
Create a simulated grub configuration to point Libreboot's GRUB to ZFSbootmenu.
|
||||||
|
Libreboot will search for and source a grub configuration file on boot/decryption automatically.
|
||||||
|
**Do not** actually install GRUB.
|
||||||
|
Simply create a file on the partition created for GRUB at `/boot/pbe/grub/grub.cfg` which points to the ZFSbootmenu kernel/initramfs.
|
||||||
|
|
||||||
|
```
|
||||||
|
mkdir -p /boot/pbe/grub
|
||||||
|
> vim /boot/pbe/grub/grub.cfg
|
||||||
|
|
||||||
|
linux /zfsbootmenu/vmlinuz-* loglevel=4
|
||||||
|
initrd /zfsbootmenu/initramfs-*
|
||||||
|
boot
|
||||||
|
```
|
||||||
Loading…
Reference in New Issue