topic Re: How to boot into a luks encrypted rootfs partition from initramfs on imx6 quad? in i.MX Processors

How to boot into a luks encrypted rootfs partition from initramfs on imx6 quad?

f_alghamdi — Fri, 23 Nov 2018 15:01:56 GMT

Hi everyone,

I have been trying to do full disk encryption on iMX6 Quad eMMC (the version I use is EmbeddedArtists imx6qea COM on their carrier board)

What I have done is:

Rebuilding fsl-image-mfgtool-initramfs to support disk encryption in the kernel and cryptsetup in the image itself.
Attaching initial RAM file system image (initramfs) to the imx6q kernel by adding this to my local.conf and rebuilding core-image-minimal
INITRAMFS_IMAGE = "core-image-minimal"
INITRAMFS_IMAGE_BUNDLE = "1"
IMAGE_FSTYPES = "cpio.gz tar.bz2"
Using mfgtools to flash the newly created core-image-minimal and encrypting the rootfs part using these commands:

<CMD state="Updater" type="push" body="send" file="firmware/keyfile" >Sending key file</CMD>
<CMD state="Updater" type="push" body="$ cat $FILE | cryptsetup luksFormat /dev/mmcblk%mmc%p2 -">Encrypting and Formatting rootfs partition</CMD>
<CMD state="Updater" type="push" body="$ cryptsetup luksOpen --key-file=$FILE /dev/mmcblk%mmc%p2 mmcblk%mmc%p2">Encrypting and Formatting rootfs partition</CMD>
<CMD state="Updater" type="push" body="$ mkfs.ext3 -E nodiscard /dev/mapper/mmcblk%mmc%p2">Encrypting and Formatting rootfs partition</CMD>
<CMD state="Updater" type="push" body="$ mkdir -p /mnt/mmcblk%mmc%p2"/>
<CMD state="Updater" type="push" body="$ mount -t ext3 /dev/mapper/mmcblk%mmc%p2 /mnt/mmcblk%mmc%p2"/>
<CMD state="Updater" type="push" body="pipe tar -jxv -C /mnt/mmcblk%mmc%p2" file="files/%rootfs%-%board%.rootfs.tar.bz2">Sending and writting rootfs</CMD>
<CMD state="Updater" type="push" body="frf">Finishing rootfs write</CMD>
Booting into the kernel and its attached initramfs was successful.

By doing the above steps, I was able to encrypt the rootfs using cryptsetup. After the boot into initramfs, I successfully decrypted and mounted the rootfs partition with passphrase I provided using mfgtools

$ cryptsetup --debug -v luksOpen /dev/mmcblk3p2 rootfs
$ mkdir /mnt/rootfs && mount -t ext3 /dev/mapper/rootfs /mnt/rootfs

What I was not able to do is to auto mount the encrypted rootfs instead of the kernel's attached initramfs rootfs .

First, the crypttab infrastructure and its scripts cryptdisks, cryptdisks_start, cryptdisks_stop, etc. used to auto mount encrypted partitions are completely missing from yocto project. When you install cryptsetup on a normal linux distro you get these scripts automatically but not on yocto.
Another way is using mkinitcpio scripts but it's also not a part of yocto.
Finally, I think I will also need to update the initramfs after configuring it to mount another root partition (the luks encrypted one) which is is done using the command update-initramfs which generates a new initramfs image with new conflagrations .. Unfortunately, I was not able to find anything related to updating initramfs after bitbaking or maybe we have to setup everything upfront in yocto so the initramfs should be configured to auto mount the encrypted rootfs and then bitbake.I am not sure if the above steps are the correct way to do full disk encryption on yocto or there is another way of doing it?

Thanks

Re: How to boot into a luks encrypted rootfs partition from initramfs on imx6 quad?

Yuri — Wed, 12 Dec 2018 06:45:16 GMT

Hello,

Please create request to get more information about disk encryption,

using CAAM-accelerated dm-crypt.

Support|NXP

Have a great day,

Yuri

------------------------------------------------------------------------------

Note: If this post answers your question, please click the Correct Answer

button. Thank you!

Re: How to boot into a luks encrypted rootfs partition from initramfs on imx6 quad?

marouene_boubakri — Wed, 09 Jan 2019 10:11:24 GMT

Dear f.alghamdi@ntis.com.sa‌,

The document "Root filesystem encryption using DM-Crypt" provides detailed steps to make a transperently encrypted Root filesystem using DM-Crypt.

The target is ARM64 you can adapt for your need (Install ARM32 toolchain and compile for ARM target instead).

If this is exactlly what you are looking for, please mark the reply as "Correct Answer" to help other users to quickly identify and access it.

Regards

Maro

Re: How to boot into a luks encrypted rootfs partition from initramfs on imx6 quad?

vinothkumars — Mon, 08 Feb 2021 11:05:10 GMT

Hi @marouene_boubakri

Not able to access the document - The document "Root filesystem encryption using DM-Crypt"

Re: How to boot into a luks encrypted rootfs partition from initramfs on imx6 quad?

10sec — Tue, 10 Aug 2021 09:13:27 GMT

Dear @marouene_boubakri,

how can I get access to the document "Root filesystem encryption using DM-Crypt"?

Re: How to boot into a luks encrypted rootfs partition from initramfs on imx6 quad?

marouene_boubakri — Mon, 16 Aug 2021 09:08:39 GMT

Hi @10sec,

Kindly refer to the Application Note AN12714 i.MX Encrypted Storage Using CAAM Secure Keys Downloadable from nxp.com portale and can be found in the documentation tab of the chip/board's home page.

Regards
Maro

Re: How to boot into a luks encrypted rootfs partition from initramfs on imx6 quad?

khang_letruong — Thu, 25 May 2023 08:36:57 GMT

Dear @Yuri and @marouene_boubakri ,

Could you confirm if the document in the"Root filesystem encryption using DM-Crypt" is the same as https://www.nxp.com/docs/en/application-note/AN12714.pdf ?

Re: How to boot into a luks encrypted rootfs partition from initramfs on imx6 quad?

pb3 — Tue, 20 Aug 2024 19:44:04 GMT

Can you send me this document? "Root filesystem encryption using Dm-Crypt"?