[gentoo-user] Initrd-script questions

[Florian Philipp <lists@f_philipp.fastmail.net>]

[-- Attachment #1: Type: text/plain, Size: 1278 bytes --]

Hi list!

I'd like to have some advice on my situation:

I have a custom init-script (derived from genkernel). What it already
does is to let gpg ask for a passphrase to decrypt a file on /boot and
then to use to content of that file as the key to a LUKS-formatted swap
(logical volume) which is then used to resume from disk.

What I would also like to do is to use the very same key for other
lvm-volumes like /var and /var/tmp but that doesn't seem that easy.

First idea: Just do the same as with the swap-volume. However, all other
mappings are gone after resuming/booting.

Second idea: Write the plaintext-keyfile to /boot and then use it
via /etc/conf.d/cryptfs before removing it in a secure manner (srm,
provided by app-misc/secure-delete). Problem: When resuming, /boot is
already mounted. Writing to it and then resuming leads to filesystem
corruption.

Third idea: Using a dedicated volume for storing the plaintext key.
Cumbersome, doesn't reduce the risk that srm isn't enough to protect the
key.

So ... what I'd need is a way to transfer data between an initial
ramdisk and the real init. Ideally in form of tmpfs-mountpoint.

I don't think my odds are very high but I just wanted to ask...

Thanks in advance!

Florian Philipp

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]