zfs: create zfs_data pool with LUKS encryption #940
Conversation
vunnyso
temporarily deployed
to
internal-build-workflow
GitHub Actions
Inactive
vunnyso
temporarily deployed
to
internal-build-workflow
GitHub Actions
Inactive
| pool = "zfs_root"; | ||
| }; | ||
| }; | ||
| zfs_data = { |
There was a problem hiding this comment.
If you are still using this post boot script, than this should be just an empty partition.
There was a problem hiding this comment.
If using post boot script, we keep empty partition and we do something similar to this?
There was a problem hiding this comment.
Yes. We need to detect if the device already has luks headers and if only format if this is not the case.
There was a problem hiding this comment.
Addressed, now we have better control on password with post boot script.
My only concern is once I use luksFormat on zfs_data partition all zfs meta data (pools, datasets) info is lost, because of that I need to create pool and datasets again in post boot script.
With this patch we create zfs_data pool with LUKS encryption enabled and modify postBostCommands accordingly. Signed-off-by: Vunny Sodhi <[email protected]>
vunnyso
temporarily deployed
to
internal-build-workflow
GitHub Actions
Inactive
Signed-off-by: Vunny Sodhi <[email protected]>
vunnyso
temporarily deployed
to
internal-build-workflow
GitHub Actions
Inactive
| echo -n $pswd | cryptsetup luksFormat --type luks2 -q "$ZFS_LOCATION" | ||
| echo -n $pswd | cryptsetup luksOpen "$ZFS_LOCATION" "$ZFS_POOLNAME" --persistent |
There was a problem hiding this comment.
We can actually generate password randomly because we can use the TPM to unlock the disk.
| # Create pool, datasets as luksFormat will erase pools, ZFS datasets stored on that partition | ||
| zpool create -o ashift=12 -O compression=lz4 -O acltype=posixacl -O xattr=sa -f "$ZFS_POOLNAME" /dev/mapper/"$ZFS_POOLNAME" | ||
| zfs create -o quota=30G "$ZFS_POOLNAME"/vm_storage | ||
| zfs create -o quota=10G -o mountpoint=none "$ZFS_POOLNAME"/reserved |
There was a problem hiding this comment.
What is this used for? If one wants to reserve space, there is refreservation. It's a zfs property
| @@ -44,6 +44,10 @@ | |||
| boot = { | |||
| initrd.availableKernelModules = [ "zfs" ]; | |||
| supportedFilesystems = [ "zfs" ]; | |||
| zfs.extraPools = [ "zfs_data" ]; | |||
| initrd.luks.devices.zfs_data = { | |||
| device = "/dev/disk/by-partlabel/disk-disk1-zfs_data"; | |||
There was a problem hiding this comment.
I think you also need this for tpm decryption:
| device = "/dev/disk/by-partlabel/disk-disk1-zfs_data"; | |
| device = "/dev/disk/by-partlabel/disk-disk1-zfs_data"; | |
| crypttabExtraOpts = [ "tpm2-device=auto" ]; |
|
For encrypted swap we could also do the same tpm encryption dance. |
Description of changes
With this patch we create zfs_data pool with LUKS encryption enabled and modify postBostCommands accordingly.
Checklist for things done
x86_64aarch64riscv64make-checksand it passesnixos-rebuild ... switchInstructions for Testing
Difference
Test steps
Make sure now there are two pools called as
zfs_rootandzfs_dataand there is NOzfspoolusing below command.To verify
zfs_datais luks encrypted run below commandImprovements
* With this PR everytime user need to enter password when system boots.* Change decryption mechanism to Yubikey/TPM.