JDM170/build
1
0
Fork 0
mirror of https://github.com/armbian/build synced 2025-09-24 19:47:06 +07:00
Code Issues Packages Projects Releases Wiki Activity

improve(lvm+cryptroot extensions): enable possibility for LVM on LUKS

Browse Source
This commit is contained in:
M.Schmidt
2024-12-03 21:47:11 +01:00
committed by Igor
parent 3ec24d40e8
commit 590b75fd6f
6 changed files with 55 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
extensions/fs-cryptroot-support.sh
View File

@@ -21,12 +21,13 @@ function extension_prepare_config__prepare_cryptroot() {
fi
}
function prepare_root_device__encrypt_root_device() {
function prepare_root_device__250_encrypt_root_device() {
# We encrypt the rootdevice (currently a loop device) and return the new mapped rootdevice
check_loop_device "$rootdevice"
display_alert "Extension: ${EXTENSION}: Encrypting root partition with LUKS..." "cryptsetup luksFormat $rootdevice" ""
echo -n $CRYPTROOT_PASSPHRASE | cryptsetup luksFormat $CRYPTROOT_PARAMETERS $rootdevice -
echo -n $CRYPTROOT_PASSPHRASE | cryptsetup luksOpen $rootdevice $CRYPTROOT_MAPPER -
add_cleanup_handler cleanup_cryptroot
display_alert "Extension: ${EXTENSION}: Root partition encryption complete." "" "ext"
# TODO: pass /dev/mapper to Docker
rootdevice=/dev/mapper/$CRYPTROOT_MAPPER # used by `mkfs` and `mount` commands
@@ -65,6 +66,9 @@ function pre_install_kernel_debs__adjust_dropbear_configuration() {
# /usr/share/initramfs-tools/hooks/dropbear will automatically add 'id_ecdsa.pub' to authorized_keys file
# during mkinitramfs of update-initramfs
#cat "${dropbear_dir}"/id_ecdsa.pub > "${SDCARD}"/etc/dropbear-initramfs/authorized_keys
# copy it a) later via hook to make use of a proper naming / structural equal -> "${DESTIMG}/${version}.img"
CRYPTROOT_SSH_UNLOCK_KEY_NAME="${VENDOR}_${REVISION}_${BOARD^}_${RELEASE}_${BRANCH}_${DESKTOP_ENVIRONMENT}".key
# copy dropbear ssh key to image output dir for convenience
cp "${dropbear_dir}"/id_ecdsa "${DEST}/images/${CRYPTROOT_SSH_UNLOCK_KEY_NAME}"
@@ -73,3 +77,12 @@ function pre_install_kernel_debs__adjust_dropbear_configuration() {
fi
fi
}
function post_umount_final_image__750_cryptroot_cleanup(){
execute_and_remove_cleanup_handler cleanup_cryptroot
}
function cleanup_cryptroot(){
cryptsetup luksClose "${CRYPTROOT_MAPPER}" 2>&1
display_alert "Cryptroot closed ${CRYPTROOT_MAPPER}" "${EXTENSION}" "info"
}

38
extensions/lvm.sh
View File

@@ -32,22 +32,17 @@ function extension_prepare_config__prepare_lvm() {
}
function post_create_partitions__setup_lvm() {
LOOP=$(losetup -f)
[[ -z $LOOP ]] && exit_with_error "Unable to find free loop device"
check_loop_device "$LOOP"
losetup $LOOP ${SDCARD}.raw
partprobe $LOOP
# the partition to setup LVM on is defined as rootpart
local lvmpart=${rootpart}
local lvmdev=${LOOP}p${lvmpart}
display_alert "LVM will be on Partition ${lvmpart}, thats ${lvmdev}" "${EXTENSION}" "info"
# Setup LVM on the partition, ROOTFS
parted -s ${SDCARD}.raw -- set ${lvmpart} lvm on
parted -s ${SDCARD}.raw -- set ${rootpart} lvm on
display_alert "LVM Partition table created" "${EXTENSION}" "info"
parted -s ${SDCARD}.raw -- print >> "${DEST}"/${LOG_SUBPATH}/lvm.log 2>&1
}
function prepare_root_device__create_volume_group() {
# the partition to setup LVM on is defined as rootpart
local lvmdev=$rootdevice
display_alert "LVM will be on Partition ${rootpart}, thats ${lvmdev}" "${EXTENSION}" "info"
# Caculate the required volume size
declare -g -i rootfs_size
@@ -57,20 +52,18 @@ function post_create_partitions__setup_lvm() {
display_alert "Root volume size" "$volsize MiB" "info"
# Create the PV VG and VOL
display_alert "LVM Creating VG" "${SDCARD}.raw" "info"
display_alert "LVM Creating VG" "${lvmdev}" "info"
check_loop_device ${lvmdev}
pvcreate ${lvmdev}
vgcreate ${LVM_VG_NAME} ${lvmdev}
wait_for_disk_sync "wait for VG to sync"
# Note that devices wont come up automatically inside docker
lvcreate -Zn --name root --size ${volsize}M ${LVM_VG_NAME}
vgmknodes
lvs >> "${DEST}"/${LOG_SUBPATH}/lvm.log 2>&1
# TODO [ms] check if disable-scan-enable is necessary
vgchange -a n ${LVM_VG_NAME}
losetup -d ${LOOP}
display_alert "LVM created volume group" "${EXTENSION}" "info"
}
function prepare_root_device__create_volume_group() {
display_alert "Using LVM root" "${EXTENSION}" "info"
vgscan
@@ -87,8 +80,11 @@ function format_partitions__format_lvm() {
display_alert "LVM labeled partitions" "${EXTENSION}" "info"
}
function post_umount_final_image__close_lvm() {
# Deactivat the Volume Group
vgchange -a n ${LVM_VG_NAME}
function post_umount_final_image__lvm_cleanup(){
execute_and_remove_cleanup_handler cleanup_lvm
}
function cleanup_lvm() {
vgchange -a n ${LVM_VG_NAME} >> "${DEST}"/${LOG_SUBPATH}/lvm.log 2>&1 || true
display_alert "LVM deactivated volume group" "${EXTENSION}" "info"
}