[isar-cip-core,v5,06/11] Kconfig: Add option to encrypt the rootfs

Commit Message

Quirin Gylstorff May 6, 2024, 2:17 p.m. UTC

From: Quirin Gylstorff <[e-mail]>

This allows to setup a system with all non-boot partitions encrypted.

Signed-off-by: Quirin Gylstorff <[e-mail]>
---
 Kconfig                 | 14 +++++++++++++-
 kas/opt/encrypt-all.yml | 23 +++++++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 kas/opt/encrypt-all.yml

Patch

diff --git a/Kconfig b/Kconfig
index 9478a06..dd41a2d 100644
--- a/Kconfig
+++ b/Kconfig
@@ -205,12 +205,24 @@  config KAS_INCLUDE_SWUPDATE_SECBOOT
 config IMAGE_DATA_ENCRYPTION
 	bool "Encrypt data partitions on first boot"
 	depends on TARGET_QEMU_AMD64 || TARGET_QEMU_ARM64 || TARGET_QEMU_ARM
-	select IMAGE_SECURE_BOOT
 	help
 	  This enables LUKS encryption for the partitions /var and /home.
 
+config IMAGE_FULL_ENCRYPTION
+	bool "Encrypt rootfs and data partitions"
+	depends on TARGET_QEMU_AMD64 || TARGET_QEMU_ARM64 || TARGET_QEMU_ARM
+	select IMAGE_DATA_ENCRYPTION
+	help
+	  This enables LUKS encryption for all non-boot partitions on first boot.
+	  If the partitions contain secrets the first boot must occur in a secure
+	  location.
+
 config KAS_INCLUDE_DATA_ENCRYPTION
 	string
 	default "kas/opt/encrypt-data.yml" if IMAGE_DATA_ENCRYPTION
 
+config KAS_INCLUDE_FULL_ENCRYPTION
+	string
+	default "kas/opt/encrypt-all.yml" if IMAGE_FULL_ENCRYPTION
+
 endif
diff --git a/kas/opt/encrypt-all.yml b/kas/opt/encrypt-all.yml
new file mode 100644
index 0000000..b6d4041
--- /dev/null
+++ b/kas/opt/encrypt-all.yml
@@ -0,0 +1,23 @@ 
+#
+# CIP Core, generic profile
+#
+# Copyright (c) Siemens AG, 2024
+#
+# Authors:
+#  Quirin Gylstorff <[e-mail]>
+#
+# SPDX-License-Identifier: MIT
+#
+
+header:
+  version: 14
+  includes:
+    - kas/opt/encrypt-data.yml
+local_conf_header:
+  encrypted_root: |
+    # Do not set mount points for systema and systemb as they are mounted by the
+    # abrootfs/verity initramfs
+    # As we use a weak default assignment in the intramfs-crypt-hook recipe we need
+    # to set all partitions
+    CRYPT_PARTITIONS = "${ABROOTFS_PART_UUID_A}::reencrypt ${ABROOTFS_PART_UUID_B}::reencrypt \
+                         home:/home:reencrypt var:/var:reencrypt"