>> 2. Encrypted root filesystem.
>>
>> Red Hat Bug #182479 discusses adding support for an encrypted root
> It's #124789.
>> filesystem to Fedora. The bug contains a patch for mkinird that
>> facilitates this. Eventually it would be nice to see support in anaconda
>> for this, but #182479 is the first step.
> One thing you miss in the latest patch is support for an encrypted
> root device on top of an LVM volume.
> With your patch the code does the following starting at about line 730 in
> mkinitrd:
> if [ "$kernelmajor" == "2.4" ]; then
> # kernel 2.4.x LVM stufff
> elif [ -n "$root_enc" ]; then
> # crypto-root stuff
> else
> # kernel 2.6.x LVM stuff
> fi
> What you really want is to have the crypto root stuff occurring outside
> the if statement in question. Also inside the "if [ -n "$root_enc"
> ]; then" block you want to have "if [ -z $root_lvm ]; then" around the
> "mkdmnod" bit so that mkdmnod doesn't get called twice.
I'm sorry, but I don't have any experience with LVM volumes. What I
do know is that right now if root_enc=1 then root_lvm=1 but root_lvm=1
does NOT mean root_enc=1. The tests go like this (line 852):
if [ is LVM (actually is device mapper) ]; then
root_lvm=1
if [ is encrypted ]; then
root_enc=1
fi
fi
So, how can I support both of these cases:
LVM volume, unencrypted
LVM volume encrypted
?
I need a way to test if a root filesystem is really an LVM volume and
not possibly just a DM/encrypted volume. In other words, how can I
ask "is this device mapper volume truly a LVM volume?" Root_enc and
root_lvm need to be decoupled.
> Also in recent kernels the AES module is aes-i586 (maybe we should have an
> alias in the module-init-tools config).
In my recent kernels, aes is not aes-i586 because my kernel is built
for PowerPC. So I imagine an alias from aes to aes-i586 would make
i586 more consistent with other architectures.
--
Mike
:wq
