* [gentoo-user] Initrd-script questions
@ 2008-03-18 16:56 99% Florian Philipp
0 siblings, 0 replies; 1+ results
From: Florian Philipp @ 2008-03-18 16:56 UTC (permalink / raw
To: Gentoo-User
[-- Attachment #1: Type: text/plain, Size: 1278 bytes --]
Hi list!
I'd like to have some advice on my situation:
I have a custom init-script (derived from genkernel). What it already
does is to let gpg ask for a passphrase to decrypt a file on /boot and
then to use to content of that file as the key to a LUKS-formatted swap
(logical volume) which is then used to resume from disk.
What I would also like to do is to use the very same key for other
lvm-volumes like /var and /var/tmp but that doesn't seem that easy.
First idea: Just do the same as with the swap-volume. However, all other
mappings are gone after resuming/booting.
Second idea: Write the plaintext-keyfile to /boot and then use it
via /etc/conf.d/cryptfs before removing it in a secure manner (srm,
provided by app-misc/secure-delete). Problem: When resuming, /boot is
already mounted. Writing to it and then resuming leads to filesystem
corruption.
Third idea: Using a dedicated volume for storing the plaintext key.
Cumbersome, doesn't reduce the risk that srm isn't enough to protect the
key.
So ... what I'd need is a way to transfer data between an initial
ramdisk and the real init. Ideally in form of tmpfs-mountpoint.
I don't think my odds are very high but I just wanted to ask...
Thanks in advance!
Florian Philipp
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [relevance 99%]
Results 1-1 of 1 | reverse | options above
-- pct% links below jump to the message on this page, permalinks otherwise --
2008-03-18 16:56 99% [gentoo-user] Initrd-script questions Florian Philipp
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox