Encrypted Root Filesystem HOWTO
Prev |  | Next

# 3. Setting up the boot device

## 3.1. Creating the ramdisk

To begin with, chroot inside the encrypted partition and create the boot device mount point:

    chroot /mnt/efs
    mkdir /loader

Then, create the initial ramdisk (initrd), which will be needed afterwards:

    cd
    dd if=/dev/zero of=initrd bs=1k count=4096
    mke2fs -F initrd
    mkdir ramdisk
    mount -o loop initrd ramdisk

If you're using grsecurity, you may get a "Permission denied" error message; in this case you'll have to run the mount command outside chroot.

Create the filesystem hierarchy and copy the required files in it:

    mkdir ramdisk/{bin,dev,lib,mnt,sbin}
    cp /bin/{bash,mount} ramdisk/bin/
    ln -s bash ramdisk/bin/sh
    mknod -m 600 ramdisk/dev/console c 5 1
    mknod -m 600 ramdisk/dev/hda2    b 3 2
    mknod -m 600 ramdisk/dev/loop0   b 7 0
    cp /lib/{ld-linux.so.2,libc.so.6,libdl.so.2} ramdisk/lib/
    cp /lib/{libncurses.so.5,libtermcap.so.2}    ramdisk/lib/
    cp /sbin/{losetup,pivot_root} ramdisk/sbin/

It's ok if you see a message like "/lib/libncurses.so.5: No such file or directory", or "/lib/libtermcap.so.2: No such file or directory"; bash only requires one of these two libraries. You can check which one is actually required with:

    ldd /bin/bash

Compile the sleep program, which will prevent the password prompt being flooded by kernel messages (such as usb devices being registered).

    cat > sleep.c << "EOF"
    #include <unistd.h>
    #include <stdlib.h>

    int main( int argc, char *argv[] )
    {
        if( argc == 2 )
            sleep( atoi( argv[1] ) );

        return( 0 );
    }
    EOF

    gcc -s sleep.c -o ramdisk/bin/sleep
    rm sleep.c

Create the init script:

    cat > ramdisk/sbin/init << "EOF"
    #!/bin/sh

    /bin/sleep 3

    echo -n "Enter seed value: "
    read SEED

    /sbin/losetup -e aes256 -S $SEED /dev/loop0 /dev/hda2
    /bin/mount -r -n -t ext3 /dev/loop0 /mnt

    while [ $? -ne 0 ]
    do
        /sbin/losetup -d /dev/loop0
        /sbin/losetup -e aes256 -S $SEED /dev/loop0 /dev/hda2
        /bin/mount -r -n -t ext3 /dev/loop0 /mnt
    done

    cd /mnt
    /sbin/pivot_root . loader
    exec /usr/sbin/chroot . /sbin/init
    EOF

    chmod 755 ramdisk/sbin/init

Umount the loopback device and compress the initrd:

    umount -d ramdisk
    rmdir ramdisk
    gzip initrd
    mv initrd.gz /boot/

## 3.2. Booting from a CD-ROM

I strongly advise you to start your system with a read-only media, such as a bootable CD-ROM.

Download and unpack syslinux:

    wget http://ftp.kernel.org/pub/linux/utils/boot/syslinux/syslinux-3.07.tar.bz2
    tar -xvjf syslinux-3.07.tar.bz2

Configure isolinux:

    mkdir bootcd
    cp /boot/{vmlinuz,initrd.gz} syslinux-3.07/isolinux.bin bootcd
    echo "DEFAULT /vmlinuz initrd=initrd.gz ro root=/dev/ram0" \
        > bootcd/isolinux.cfg

Create and burn the bootable cd-rom iso image:

    mkisofs -o bootcd.iso -b isolinux.bin -c boot.cat \
            -no-emul-boot -boot-load-size 4 -boot-info-table \
            -J -hide-rr-moved -R bootcd/

    cdrecord -dev 0,0,0 -speed 4 -v bootcd.iso

    rm -rf bootcd{,.iso}

## 3.3. Booting from a HD partition

The boot partition can come in handy if you happen to lose your bootable CD. Remember that hda1 is a writable media and is thus insecure; use it only in case of emergency!

Create and mount the ext2 filesystem:

    dd if=/dev/zero of=/dev/hda1 bs=8192
    mke2fs /dev/hda1
    mount /dev/hda1 /loader

Copy the kernel and the initial ramdisk:

    cp /boot/{vmlinuz,initrd.gz} /loader

If you use grub:

    mkdir /loader/boot
    cp -av /boot/grub /loader/boot/
    cat > /loader/boot/grub/menu.lst << EOF
    default 0
    timeout 10
    color green/black light-green/black
    title Linux
        root (hd0,0)
        kernel /vmlinuz ro root=/dev/ram0
        initrd /initrd.gz
    EOF
    grub-install --root-directory=/loader /dev/hda
    umount /loader

If you use lilo:

    mkdir /loader/{boot,dev,etc}
    cp /boot/boot.b /loader/boot/
    mknod -m 600 /loader/dev/hda  b 3 0
    mknod -m 600 /loader/dev/hda1 b 3 1
    mknod -m 600 /loader/dev/hda2 b 3 2
    mknod -m 600 /loader/dev/hda3 b 3 3
    mknod -m 600 /loader/dev/hda4 b 3 4
    mknod -m 600 /loader/dev/ram0 b 1 0
    cat > /loader/etc/lilo.conf << EOF
    lba32
    boot=/dev/hda
    prompt
    timeout=60
    image=/vmlinuz
        label=Linux
        initrd=/initrd.gz
        read-only
        root=/dev/ram0
    EOF
    lilo -r /loader
    umount /loader

Prev | Home | Next
Creating the encrypted root filesystem |  | Final steps