Encrypt root partition

[RFahy]

Hello.
I am currently trying to modify a Linux ( - Mepis 8 - ) installer so that it encrypts the root partition too. I found some tutorials on encryption with cryptsetup but they only treat encrypting swap and home partitions.

Basically, I'm after an encrypted root partition but which can still boot.
Any help, suggestions very appreciated.
Some have said that root doesn't have any reason to be encrypted, and I for one fear this can only be made reality by modifying the kernel and bootloader.

Thanks in advance.

[Rubberman]

If you want to encrypt the entire disc (with exception of partition table and partition boot loader), you would need to embed the decryption software in the boot block of the disc. Basically, that means you have only a few hundred bytes to do it in. Possible but not simple. In any case, you are correct in that you would also have to modify the kernel and bootloader to support this.

From your posting, I'd have to say that you have a LOT of studying to do before you have enough requisite knowledge to even understand how to approach this problem, let alone implement the solution. Good luck!

[Scandium]

I know the posting is older, but anyways:

To have an encrypted root partition using LUKS (cryptsetup) you just have to create an initramfs that gets booted via kernel command line for example. Just look after busybox it replaces all of the standard linux commands with one statically linked binary. (The commands are symlinks to the busybox executable).

Init file should look something like:

#!/bin/sh
export PATH=/bin
umask 0077
mount -t proc proc /proc
mount -t sysfs sysfs /sys
mount -t tmpfs tmpfs /dev
busybox --install -s
echo /bin/mdev > /proc/sys/kernel/hotplug
mdev -s
while ! mount -n -o ro /dev/hda1 /bootram ; do
   sleep 5
done
rm /dev/tty
ln -s /dev/console /dev/tty
cryptsetup luksOpen /dev/sdb1 root
mount /dev/mapper/root /new-root
echo > /proc/sys/kernel/hotplug
umount -l /bootram /dev /sys /proc
exec /bin/busybox switch_root /new-root /sbin/init root=/dev/mapper/root

If you created your needed devices (with mknod)

you can pack your initramfs with

find . | cpio -o -H newc | gzip -9 > /boot/initramfs

EDIT
I found a script on my HDD that should give you an idea of which devices to create. It also creates the symlinks to busybox. You have to modify it so that it suits your needs.

mkdir /tmp/myroot
cd /tmp/myroot
mkdir bin dev etc proc new

cd /tmp/myroot/bin
cp /tmp/bb/bin/busybox .
for i in echo mkdir mknod mount sed sh switch_root test touch umount
do
    ln busybox $i
done
cp /sbin/cryptsetup . 

cd /tmp/myroot/dev
mknod -m600 console c 5 1
mknod -m660 hda2 b 3 2
mknod -m660 null c 1 3
mknod -m660 ram0 b 1 0
mknod -m666 tty c 5 0

You can boot it via grub's menu.lst with

title Root encrypted Linux
root (hd0,0)
kernel /boot/linux-2.6.31 root=/dev/ram0 real_root=/dev/mapper/root
initrd /boot/initramfs