Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for disk encryption and zfs #148

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Conversation

CragW
Copy link
Collaborator

@CragW CragW commented Nov 29, 2021

New d-i questions:
dell-recovery/encryption boolean (default: false)
dell-recovery/use_zfs boolean (default: false)

Screenshot for reference:
encryption

This commit introduces a custom disk layout different from default
configuration offerings by ubiquity/partman, therefore spoofing it
in casper stage to dismiss partition setup at earliest possible.

Added d-i question dell-recovery/encryption defauled false, toggle
it on in the preseed file to enable disk encryption.

Custom partition layout fresh added keystore to host all the key
files, for instance the key-file for rootfs OS partition. Both the
keystore and rootfs partitions are default LUKS encrypted.

Initially, 3 key slots are reserved for keystore decryption. The third
slot is created only if user decided to adopt measured boot.

  key slot 0: hardware identity
  key slot 1: user passphrase
  key slot 2: random generated

fs-unlock firstly finds tpm sealing object if present will retrieve
the key according to PCR policy verification on successful will salt
chosen PCRs, otherwise simply unlock the rootfs by pre-defined hardware
identity.
New added d-i question dell-recovery/use_zfs to enable zfs custom
disk layout in the preseed file.
Changes:
 1. add zfs-unload-encryption.conf to user-runtime-dir@ systemd
 2. add /usr/sbin/zfs-unload-encryption to unload encryption key
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant