dracut

History

Böszörményi Zoltán a01204202b Allow running on a cross-compiled rootfs For the shell scripts, new environment variables were introduced. dracutsysrootdir is the root directory, file existence checks use it. DRACUT_LDCONFIG can override ldconfig with a different one that works on the sysroot with foreign binaries. DRACUT_LDD can override ldd with a different one that works with foreign binaries. DRACUT_TESTBIN can override /bin/sh. A cross-compiled sysroot may use symlinks that are valid only when running on the target so a real file must be provided that exist in the sysroot. DRACUT_INSTALL now supports debugging dracut-install in itself when run by dracut but without debugging the dracut scripts. E.g. DRACUT_INSTALL="valgrind dracut-install or DRACUT_INSTALL="dracut-install --debug". DRACUT_COMPRESS_BZIP2, DRACUT_COMPRESS_LBZIP2, DRACUT_COMPRESS_LZMA, DRACUT_COMPRESS_XZ, DRACUT_COMPRESS_GZIP, DRACUT_COMPRESS_PIGZ, DRACUT_COMPRESS_LZOP, DRACUT_COMPRESS_ZSTD, DRACUT_COMPRESS_LZ4, DRACUT_COMPRESS_CAT: All of the compression utilities may be overridden, to support the native binaries in non-standard places. DRACUT_ARCH overrides "uname -m". SYSTEMD_VERSION overrides "systemd --version". The dracut-install utility was overhauled to support sysroot via a new option -r and fixes for clang-analyze. It supports cross-compiler-ldd from https://gist.github.com/jerome-pouiller/c403786c1394f53f44a3b61214489e6f DRACUT_INSTALL_PATH was introduced so dracut-install can work with a different PATH. In a cross-compiled environment (e.g. Yocto), PATH points to natively built binaries that are not in the host's /bin, /usr/bin, etc. dracut-install still needs plain /bin and /usr/bin that are relative to the cross-compiled sysroot. The hashmap pool allocate_tile/deallocate_tile code was removed because clang-analyze showed errors in it. hashmap_copy was removed because it wasn't used and clang-analyze showed errors in it. DRACUT_INSTALL_LOG_TARGET and DRACUT_INSTALL_LOG_LEVEL were introduced so dracut-install can use different settings from DRACUT_LOG_TARGET and DRACUT_LOG_LEVEL. Signed-off-by: Böszörményi Zoltán <zboszor@pr.hu>		2019-10-25 11:58:58 +02:00
..
README	crypt-gpg: Add README describing the procedure of moving from	2017-03-30 02:18:39 +02:00
crypt-gpg-lib.sh	remove bashism in various boot scripts	2019-01-07 12:01:55 +01:00
module-setup.sh	Allow running on a cross-compiled rootfs	2019-10-25 11:58:58 +02:00

README

# Directions for changing a system from password-based gpg keyfile
# to smartcard-based gpg keyfile

# Be sure that you meet the following requirements:
#  1. GnuPG >= 2.1 installed with
#     * Smartcard support enabled (scdaemon must be built)
#     * Direct CCID access built into scdaemon
#  2. A password-based gpg keyfile ${KEYFILE} (e.g. "keyfile.gpg"):
#     That is, a file containing the slot key for LUKS, which
#     has been encrypted symmetrically with GnuPG using
#     a password.
#  3. Your public OpenPGP identity ${RECIPIENT} (e.g. "3A696356")
#  4. An OpenPGP smartcard holding the decryption key associated
#     with your public identity
#  5. A CCID smartcard reader

#  Notes: Requirement 4. and 5. can of course be one device, e.g.
#         a USB token with an integrated OpenPGP smartcard

# Make a backup of your keyfile (assuming it lies on the boot partition)
$ cp /boot/${KEYFILE} /safe/place/keyfile.bak.gpg

# Change your keyfile from purely password-based to both
# password-based and key-based (you can then decrypt the keyfile
# with either method). As an example aes256 is chosen, the cipher
# is not important to this guide, but do note that your kernel
# must support it at boot time (be it built into the kernel image
# or loaded as a module from the initramfs).
$ cat /safe/place/keyfile.bak.gpg | gpg -d | gpg --encrypt --recipient ${RECIPIENT} --cipher-algo aes256 --armor -c > /safe/place/keyfile_sc.gpg

# Verify that you can decrypt your new keyfile both with the password
# and your smartcard.
# (with smartcard inserted, you should be prompted for your PIN, unless
#  you already did so and have not yet timed out)
$ gpg -d /safe/place/keyfile_sc.gpg
# (with smartcard disconnected, you should be prompted for your password)
$ gpg -d /safe/place/keyfile_sc.gpg

# After verification, replace your old keyfile with your new one
$ su -c 'cp /safe/place/keyfile_sc.gpg /boot/${KEYFILE}'

# Export your public key to where crypt-gpg can find it
$ gpg --armor --export-options export-minimal --export ${RECIPIENT} > /safe/place/crypt-public-key.gpg
$ su -c 'cp /safe/place/crypt-public-key.gpg /etc/dracut.conf.d/crypt-public-key.gpg'

# Rebuild your initramfs as usual
# When booting with any of the requirements not met, crypt-gpg will default to password-based keyfile unlocking.
# If all requirements are met and smartcard support is not disabled by setting the kernel option "rd.luks.smartcard=0"
# crypt-gpg will try find and use a connected OpenPGP smartcard by prompting you for the PIN and then
# unlocking the gpg keyfile with the smartcard.