Hi list! I'd like to have some advice on my situation:
I have a custom init-script (derived from genkernel). What it already does is to let gpg ask for a passphrase to decrypt a file on /boot and then to use to content of that file as the key to a LUKS-formatted swap (logical volume) which is then used to resume from disk. What I would also like to do is to use the very same key for other lvm-volumes like /var and /var/tmp but that doesn't seem that easy. First idea: Just do the same as with the swap-volume. However, all other mappings are gone after resuming/booting. Second idea: Write the plaintext-keyfile to /boot and then use it via /etc/conf.d/cryptfs before removing it in a secure manner (srm, provided by app-misc/secure-delete). Problem: When resuming, /boot is already mounted. Writing to it and then resuming leads to filesystem corruption. Third idea: Using a dedicated volume for storing the plaintext key. Cumbersome, doesn't reduce the risk that srm isn't enough to protect the key. So ... what I'd need is a way to transfer data between an initial ramdisk and the real init. Ideally in form of tmpfs-mountpoint. I don't think my odds are very high but I just wanted to ask... Thanks in advance! Florian Philipp
signature.asc
Description: This is a digitally signed message part
