Release [BETA] Pandora full-system encryption


Alemarius Nexus

Still Fresh
Joined
Jan 5, 2011
Messages
27
Age
30
Hey,

So, after asking if there was any use for it, I now want to release my method of full-system encryption for the Pandora. It is based on a heavily reworked and extended version of what I have hacked together for my own Pandora, with some scripts added to make it (relatively) easy to create such a system.

Status

This is an EARLY BETA release. I release it to see if it works for you and whether you have any suggestions for future changes. It is not as comfortable as it could be right now, but should be possible to follow.

Because this is a beta version and only tested by me right now, it may refuse to work, or it may do nasty things to you. IT MAY EVEN DESTROY YOUR WHOLE SYSTEM, although I don't think it will because the scripts are supposed to exit when something goes wrong. Please don't blame me when something goes wrong, you have been warned (but please report it so I can fix it for future releases).

There are some known issues. When booting the system, I sometimes get a message saying "waiting (init) for tty1 took too long, but we keep waiting" and the system freezes. I don't know what this message means and whether it is actually related to the encryption (it is, probably. Maybe it has something to do with udev initializing devices that were initializd by the initramfs before, using mdev, but I don't know). You'll have to hard-reboot your Pandora in this situation. Up to this point I have only got this message during the first boot, but I have had more first boots than second boots, so your mileage may vary.

Another known "issue" is that the fstab entries are wrong in the encrypted system. I was just too lazy to write the code to automatically change them, and the wrong entries haven't done any harm to me yet.

How does it work?

For those who are interested: You create a single encrypted LUKS partition on an SD card (or USB device). This one is further partitioned using LVM logical volumes. Currently, there will always be a root filesystem and an optional swap partition in there. You fill up the root filesystem with your operating system, which may need some patching to work well with this encryption, especially to make sure that the device nodes for LVM are created again, because LVM will often not do so automatically after it has once in the initramfs.

Then there must be a way for the Pandora to boot into this encrypted partition. This is done using an initramfs, which is a small filesystem that is loaded by the Linux kernel at boot time that is ought to execute all the neccessary actions required to mount the actual root filesystem, and then hand control back to the kernel to continue booting from that root filesystem. This also means that there has to be an unencrypted boot partition with the kernel and the initramfs. This initramfs contains a statically compiled version of Busybox as well as the cryptsetup and LVM tools along with their needed libraries, and my scripts. These scripts do nothing but search for an encrypted device, open it (using a keyfile or prompting the user for a password), enable the LVM devices and mount the root filesystem, then hand control over to the kernel again to go on with the actual boot process.

The encryption works using LUKS, an extension to dm-crypt, which itself is an extension to the device-mapper driver of the Linux kernel. I chose to use AES-XTS-256 as the encryption cipher, because I think this provides sufficient security and doesn't stress the CPU too much (according to the kernel configuration, OMAP seems to have hardware acceleration for AES, but I haven't seen any real difference in performance with and without this hardware driver). If you would like to use a different cipher, let me know, then I will make this configurable. Meanwhile, you could also just search for 'aes-xts-plain' in the pcrypt-create script and change the parameters if you want to.

What are the features?

As already said, there may be an encrypted swap partition along with the root filesystem. The encrypted partition may be on an SD card, or an external USB device (if USB support is enabled in the initramfs configuration), the boot partition may be anywhere the Pandora can boot from, which is only NAND or SD card as far as I know. You can have multiple passwords for the device, and keyfiles are allowed. These keyfiles can be stored on SD cards or USB devices again, either as a normal file on a filesystem, or on a raw partition/device, and are usually automatically recognized (if you have them on a filesystem and not as raw data on an SD card, you will have to edit the initramfs config file a bit). You can have multiple encrypted systems and choose the one you want to boot into at boot time.

The creation of such a system is mostly automatic using scripts, but some things must still be done manually at this time.

What operating systems are supported?

In theory, any Linux operating system that works on the Pandora should work encrypted, but you may have to patch it a bit. Currently, the only operating system supported on the encrypted root filesystem is SL4P 14.0, although other versions should work without much effort, but I did only test 14.0. SuperZaxxon will probably not work that easily, because of missing tools (cryptsetup, LVM utilities). Using the tools from SL4P in SuperZaxxon didn't work well as there seems to be a problem with missing udev rules (copying them over didn't work either), and I have absolutely no idea how udev works. Other operating systems were not tested, but if you get them to work, please let me know.

You need a kernel with support for dm-crypt and LVM, and optionally kernel and hardware support for AES and XTS. These modules are not available in the official Pandora kernel binaries right now, so I compiled my own version of the 3.2.30 kernel with these modules which you can use, but you can compile your own kernel if you want to. If you use my kernel, don't forget to copy it's modules. The modules of the default kernel will not work, because I cross-compiled my kernel with the newest CodeSourcery toolchain, which seems to render the old modules incompatible.

To create the encrypted system in the first place, you need a non-ancient Linux system with support for dm-crypt and LVM - including the kernel drivers and utility programs -, a bash shell and the U-Boot mkimage program. The default SL4P 14.0 is such a system if you use my custom kernel, so you can create the system right on your Pandora if you have SL4P. Again, I didn't manage to get it working on SuperZaxxon, unfortunately.

Now, on to the actual process. All of the following steps have to be done on a system supported for creation of the encrypted system, as described above. Download and extract the pcrypt tarball, then follow these steps:

Preparation for an SL4P based system

If you want to create your system directly on your Pandora in SL4P, you will first have to make sure your kernel supports dm-crypt and LVM. If you don't want to compile your own kernel, you can use the one included in the tarball in kernels/3.2.30-pcrypt. On a default SL4P system:


cp $PCRYPT_DIR/kernels/3.2.30-pcrypt/boot/uImage-pcrypt /boot
cp -r $PCRYPT_DIR/kernels/3.2.30-pcrypt/lib/modules/3.2.30-pcrypt /lib/modules
Then, edit you U-Boot configuration file to load the new kernel. To do so, in the file /autoboot.txt, change the line saying


ext2load mmc 0 0x80300000 /boot/uImage
to


ext2load mmc 0 0x80300000 /boot/uImage-pcrypt
Then, reboot your system and make sure the new kernel is in use by executing the following command. It should say 3.2.30-pcrypt (the '-pcrypt' suffix is important):


uname -r
Preparing the partitions

Create a sufficiently big boot partition on your SD card (my kernel is about 2.6MiB, the initramfs another 3.3MiB, both must fit in there) and format it with something the Pandora can boot from, probably ext2. Then mount it anywhere. Partitioning can be done using fdisk/cfdisk/parted on command line, or GParted if you prefer a GUI.

Create an empty partition on an SD card (may be the card with the boot partition, or another one) or USB device. I refer to this partition as the encrypted partition, but encryption will occur later. Don't format it, this will be done automatically. The encrypted partition must be big enough to carry your root filesystem and an encrypted swap partition, if you choose to use one. Note that it is not easily possible to resize this partition afterwards.

Creating the system

Finally, the interesting things happen (well, interesting for me at least). Use the pcrypt-create script from the tarball to create your system. It doesn't matter from where you run it, but it has to stay in the directory with the other files from the tarball. You can use its command line options, but let's use the interactive mode. Run


pcrypt-create -i
It will guide you through the installation process. BE VERY CAREFUL WHEN YOU ENTER THE ENCRYPTED PARTITION AND BOOT DIRECTORY, A SMALL TYPO MAY DESTROY YOUR SYSTEM. Follow the instructions of the script, where default values are provided they are usually a sane choice if you don't plan to use a custom operating system. You can use the compressed tarball of SL4P when asked to fill in the new root partition, or copy an existing system from a root directory. If you want to boot into a USB drive, don't forget to enable USB support when asked. Installation will take some time.

When pcrypt-create is finished, check the automatically created autoboot.txt in your boot directory and edit it if it's not correct.

Don't forget to unmount your boot partition, this is not done automatically!

Running the system

Plug the SD card with your boot partition and the device containing the encrypted partition (if they are not on the same card) into your Pandora, and boot from the boot partition. You should see a message that the pcrypt initramfs is running. It will ask you for a password to decrypt the device if it does not recognize a keyfile. When you enter the password correctly, it should automatically boot into your new system.

If it does: Congratulations, you now have an encrypted system running on your Pandora.

Further configuration

You may want to look at the 'config' file in the initramfs folder. You can configure some things for the boot process of your encrypted system there. If you are finished configuring, use 'pcrypt-gen-initramfs BOOT_DIRECTORY' to regenerate the initramfs file on your boot partition.

Mounting the encrypted partition

You can mount the root filesystem of your encrypted partition using the pcrypt-mount script. Unmount it with pcrypt-umount afterwards. Unmounting it with 'umount' alone will not be enough!

In case of problems

Stop, drop and roll.

No, seriously. If you have a problem using pcrypt-create or one of the other scripts, please let me know. If something seems to go wrong, don't continue blindly, or it may do something you don't want to.

If you have a problem booting into your encrypted system, let me know too. Also, you can try to work the problem out yourself by going into a rescue shell in the initramfs. Just hit CTRL-D when asked for the password. There are some pcrypt-* scripts to help you continuing the boot process. Especially, calling '. pcrypt-autoboot' at any time will try to continue the automatic boot from wherever you left it off.

(Wow, I always write way too much text for these simple things)

Download

Forum upload seems to be broken? I'll have to upload it on my not-so-professional home server then for a while:

http://alemariusnexus.com/pcrypt-0.1b.tar.gz

// EDIT: Link fixed!
 
Last edited by a moderator:
Nice howto !

I'll add a link in the Slackware advanced usage Wiki.
 
I have a >very< stupid question... how do I boot from SD card? Yes, I'm holding the R button while starting but there is no option to boot from SD card in this menu. edit-------------- Ok now, somehow it worked, i just choose 'power off' and it automatically booted to the sd card... weird.
 
Last edited by a moderator:
Hi! I was not active for a long time... I have a question, is there another way/distro that can be installed in a full disk encrypted way (cryptsetup/dm-crypt) on the Pandora?

The pcrypt script is offline :-/
 
Hey,

Just stumbled upon this thread again. I'm not using my Pandora anymore, but I just uploaded the scripts to my new server and fixed the link. The download above should work again now.
 
Back
Top