[isar-cip-core,v3,00/15] Rework disk encryption

Message

Quirin Gylstorff April 9, 2024, 1:05 p.m. UTC

From: Quirin Gylstorff <[e-mail]>

This patchset is a cleanup of the initramfs-crypt-hook:
 - Aligns the systemd and clevis implementation
 - consolidate script in a main, clevis and systemd part
 - split clevis hook for readability
 - Adds some checks for TPM parameter
 - Remove the dependency in the overlay
 - Adds an example to encrypt the rootfs
 - Add readme to switch from clevis based encryption to systemd

Changes v3:
 - Add Kconfig entry for encrypted rootfs
 - Adapt start-qemu.sh for a encrypted rootfs
 - Add the missing initramfs-hook for the encrypted rootfs example

Changes v2:
 - fix typos in commit messages
 - some fixes for Debian buster
 - split clevis hook for readability
 - consolidate script in a main, clevis and systemd part
 - Add readme to switch from clevis based encryption to systemd
 - Increase version of the hook
 - The disk encryption now sets the root mount if necessary

Quirin Gylstorff (15):
  initramfs-crypt-hook: Allow switching between clevis and systemd
  initramfs-crypt-hook: Align systemd encryption and clevis encryption
  initramfs-crypt-hook: move the mounting of encrypted disks in a
    seperate function
  initramfs-crypt-hook: Check if the TPM device fulfills the given
    requirements
  initramfs-crypt-hook: add flag to make encryption optional
  initramfs-crypt-hook: add e2fsck to avoid resize error
  initramfs-crypt-hook: split encryption and mounting
  initramfs-crypt-hook: Add check if root is part of the mountpoints
  initramfs-crypt-hook: split hook in multiple files
  initramfs-crypt-hook: Consolidate clevis and systemd scripts
  initramfs-crypt-hook: Increase version
  README.tpm2.encryption: Add section to switch from clevis to systemd
  Add example to encrypt the rootfs
  Kconfig: Add option to encrypt the rootfs
  start-qemu.sh: Support encrypted rootfs

 Kconfig                                       |  14 ++
 doc/README.tpm2.encryption.md                 |  20 +++
 kas/opt/encrypt_rootfs.yml                    |  25 +++
 ...pt_partition.clevis.bullseye_or_later.hook |  34 ++++
 .../encrypt_partition.clevis.buster.hook      |  30 ++++
 .../files/encrypt_partition.clevis.hook       |  20 +--
 .../files/encrypt_partition.clevis.script     | 157 +++--------------
 .../files/encrypt_partition.env.tmpl          |   4 +-
 .../files/encrypt_partition.script            | 164 ++++++++++++++++++
 .../files/encrypt_partition.systemd.hook      |   5 +-
 .../files/encrypt_partition.systemd.script    | 152 +++-------------
 .../files/mount_crypt_partitions.script       |  61 +++++++
 ...ook_0.1.bb => initramfs-crypt-hook_0.2.bb} |  49 +++++-
 .../files/overlay.script.tmpl                 |   2 +-
 start-qemu.sh                                 |   7 +-
 wic/x86_64-encryption.wks.in                  |  16 ++
 16 files changed, 463 insertions(+), 297 deletions(-)
 create mode 100644 kas/opt/encrypt_rootfs.yml
 create mode 100755 recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.bullseye_or_later.hook
 create mode 100755 recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.buster.hook
 create mode 100644 recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.script
 create mode 100644 recipes-initramfs/initramfs-crypt-hook/files/mount_crypt_partitions.script
 rename recipes-initramfs/initramfs-crypt-hook/{initramfs-crypt-hook_0.1.bb => initramfs-crypt-hook_0.2.bb} (54%)
 create mode 100644 wic/x86_64-encryption.wks.in