]> git.ipfire.org Git - thirdparty/systemd.git/commit
cryptsetup-generator: add detached LUKS header support
authorOndrej Kozina <okozina@redhat.com>
Wed, 19 Feb 2020 11:39:26 +0000 (12:39 +0100)
committerOndrej Kozina <okozina@redhat.com>
Fri, 25 Sep 2020 15:01:36 +0000 (17:01 +0200)
commita8574d00552dc9f3012a3f84ab2bcac5fb6d7e7b
tree434342676f5c15df91fdb252d65722f6641cdf2b
parentfc6f1ad1211e7add81f6f14f09d141e1fe7d09a0
cryptsetup-generator: add detached LUKS header support

Adds support for LUKS detached header device on kernel
command line. It's introduced via extension to existing
luks.options 'header=' argument beyond colon (see examples
below). If LUKS header device is specified it's expected
to contain filesystem with LUKS header image on a path
specified in the first part of header specification.

The second parameter 'luks.data' specifies LUKS data device
supposed to be paired with detached LUKS header (note that
encrypted LUKS data device with detached header is unrecognisable
by standard blkid probe).

This adds support for LUKS encrypted rootfs partition with
detached header. It can also be used for initializing online LUKS2
encryption of data device.

Examples:
    luks.data=<luks_uuid>=/dev/sdz
    luks.data=<luks_uuid>=/dev/vg/lv
    luks.data=<luks_uuid>=/dev/mapper/lv
    luks.data=<luks_uuid>=PARTUUID=<part_uuid>
    luks.data=<luks_uuid>=PARTLABEL=<part_uuid>

    luks.options=<luks_uuid>=header=/header/path:UUID=<fs_uuid>
    luks.options=<luks_uuid>=header=/header/path:PARTUUID=<part_uuid>
    luks.options=<luks_uuid>=header=/header/path:PARTLABEL=<part_label>
    luks.options=<luks_uuid>=header=/header/path:LABEL=<fs_label>
    luks.options=<luks_uuid>=header=/header/path:/dev/sdx
    luks.options=<luks_uuid>=header=/header/path:/dev/vg/lv

The '/header/path' is considered to be relative location within
filesystem residing on the header device specified beyond colon
character
man/systemd-cryptsetup-generator.xml
src/cryptsetup/cryptsetup-generator.c