[gentoo-user] Re: Genkernel: non-standard crypto setup

["Jens Müller" <blog@tessarakt.de>]

Dirk Heinrichs schrieb:
> Am Freitag, 2. Januar 2009 19:36:28 schrieb Jens Müller:
>> Dirk Heinrichs schrieb:
>>> Just to make sure I understand what you want to do: You have encrypted
>>> physical volumes which you want to combine into an LVM volume group and
>>> then put logical volumes into this VG?
>> Raid part 1 \
>> Raid part 2 >- Raid5 -> /dev/md127 = PV1
>> Raid part 3 /
>>
>>                       ...(possibly others)...
>> PV1 --LVM--> VG1 --->    LV1: \dev\mapper\vg1-crypt
>>
>> LV1: \dev\mapper\vg1-crypt --cryptsetup--> \dev\mapper\crypt_pv
>>
>> \dev\mapper\crypt_pv = PV2  --LVM--> VG1 ---> (all the partitions)
>>
>> Basically, I have one encrypted "physical" volume, but I want to be
>> flexible ...
> 
> If you have one encrypted PV from which you build a VG, then every LV inside 
> it will automatically be encrypted. So where's the flexibility?

I meant it's more flexible than encrypting /dev/md127 itself.

E.g., I can create a snapshot of an LV which is still encrypted.

> Means:
> 
> PV1 --cryptsetup--> PV1_crypt --vgcreate--> VG1 --lvcreate--> LVx
> 
> To be able to choose wether to encrypt each LV or not, you need to encrypt at 
> LV level, like:
> 
> PV1 --vgcreate--> VG1 --lvcreate--> LVx --cryptsetup--> LVx_crypt
> 
> For the latter I have some scripts ready to create an initramfs which can be 
> combined with the kernel (It's for EVMS, but it should be easy to adapt to 
> LVM.

Well, the genkernel default script can be given a "crypt_root", can load
the key from a USB device, etc. ...