Request for Documentation on Encrypting SquashFS RootFS with Yocto for i.MX93

[udayMouli]

I am trying to encrypt my squashfs rootfs for imx93 during build time. I am using yocto
i tried fetching below document but i am unable to
https://community.nxp.com/docs/DOC-342300
can you please help me to point to proper documentation related to encrypting squashfs of rootfs

[AldoG]

Hello,

For this you may refer to the Linux Kernel documentation:

https://github.com/nxp-imx/linux-imx/tree/lf-6.12.y/Documentation/security/keys
https://github.com/nxp-imx/linux-imx/blob/lf-6.12.y/Documentation/security/keys/trusted-encrypted.rs...
https://github.com/nxp-imx/linux-imx/blob/lf-6.12.y/Documentation/security/keys/ecryptfs.rst

Best regards/Saludos,
Aldo.

[udayMouli]

I have reviewed section 10.5.5 and would like to implement a similar encryption approach. Our requirement is to encrypt the production-ready SquashFS image during build time in Yocto. However, using /dev/mapper is not feasible since it requires root privileges.
Is there any method or documentation available for integrating dm-crypt-based encryption directly into a Yocto recipe?

[AldoG · Accepted solution]

Hello,

We do not have documentation available for this, but you may use as a reference one of our partners implementation for this kind of use case:
https://github.com/toradex/meta-toradex-security/blob/kirkstone-6.x.y/docs/README-encryption.md

You may create the layer the same way they are using it, so it is indeed possible
https://github.com/toradex/meta-toradex-security/tree/kirkstone-6.x.y

Best regards/Saludos,
Aldo.

[AldoG]

Hi,

I forgot to mention that you may also check our Linux documentation, i.MX Linux User's Guide Chapter 10 Security & 10.5.5 DM-Crypt usage on i.MX Platforms without CAAM hardware IP

Since i.MX93 does not have have CAAM hardware IP enabled.

Best regards/Saludos,
Aldo.