Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Encrypt dom0 swap #79

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Encrypt dom0 swap #79

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions rpm_spec/core-dom0-linux.spec.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,8 @@ install -m 644 system-config/12-qubes-ignore-lvm-devices.rules $RPM_BUILD_ROOT%_
install -m 644 system-config/11-qubes-ignore-zvol-devices.rules $RPM_BUILD_ROOT%_udevrulesdir
install -m 644 system-config/99z-qubes-mark-ready.rules $RPM_BUILD_ROOT%_udevrulesdir
install -m 644 -D system-config/disable-lesspipe.sh $RPM_BUILD_ROOT/etc/profile.d/zz-disable-lesspipe.sh
install -m 644 -D system-config/[email protected] $RPM_BUILD_ROOT%_unitdir/[email protected]

install -m 755 -D system-config/kernel-grub2.install $RPM_BUILD_ROOT/usr/lib/kernel/install.d/80-grub2.install
install -m 755 -D system-config/kernel-xen-efi.install $RPM_BUILD_ROOT/usr/lib/kernel/install.d/90-xen-efi.install
install -m 755 -D system-config/kernel-remove-bls.install $RPM_BUILD_ROOT/usr/lib/kernel/install.d/99-remove-bls.install
Expand Down
1 change: 1 addition & 0 deletions system-config/75-qubes-dom0.preset
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,3 +71,4 @@ enable qubesd.service
enable anti-evil-maid-unseal.service
enable anti-evil-maid-check-mount-devs.service
enable anti-evil-maid-seal.service
enable [email protected]
35 changes: 35 additions & 0 deletions system-config/[email protected]
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
[Unit]
Description=Qubes OS Encrypted Swap

# This is a dependency of sysinit.target, so it cannot depend on it (deadlock).
DefaultDependencies=no

# Do not stop this when trying to isolate a unit.
IgnoreOnIsolate=true

# Default dependencies for any encrypted volume.
After=cryptsetup-pre.target systemd-udevd-kernel.socket systemd-random-seed.service

# Ensure that this unit comes after its backing device,
# and is shut down if its backing device is shut down.
After=dev-qubes_dom0-swap.device
BindsTo=dev-qubes_dom0-swap.device
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Even in LVM setup, the VG name can be different, and LV name can be different too...
Previous version also had this issue, but now it's all over the place instead of just StartExec line.

Maybe it's possible to rely on generators (and maybe the default ones will be enough)? Like, setup backing device via /etc/crypttab, and then use /dev/mapper/swap as the actual swap (via /etc/fstab).

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That’s absolutely fine, and it’s what I do on my local system. I have this line in /etc/crypttab:

swap /dev/qubes_dom0/swap /dev/urandom plain,swap,cipher=aes-xts-plain64

And this in /etc/fstab (modulo padding whitespace):

/dev/mapper/swap none swap defaults 0 0

The reason that this PR does not take that approach is that these files are generated by Anaconda, which I have never touched before. I can try, though.


# Ensure that this unit is started before the block device gets used.
Before=blockdev@dev-mapper-%i.target
Wants=blockdev@dev-mapper-%i.target
Requires=systemd-random-seed.service

# Stop this unit when umounting volumes on shutdown.
Conflicts=umount.target
Before=umount.target

[Service]
Type=oneshot
RemainAfterExit=yes
TimeoutSec=infinity
ExecStart=/usr/lib/systemd/systemd-cryptsetup attach 'swap' '/dev/qubes_dom0/swap' '/dev/urandom' 'plain,swap,cipher=aes-xts-plain64'
ExecStop=/usr/lib/systemd/systemd-cryptsetup detach 'swap'
ExecStartPost=/usr/lib/systemd/systemd-makefs swap '/dev/mapper/swap'
# Prevent mlock() of the whole locale archive.
Environment=LC_ALL=C