From 96f80c1b0981d0f10ff6fd18444a7b2f218097b4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=BD=D0=B0=D0=B1?= <nabijaczleweli@nabijaczleweli.xyz> Date: Thu, 3 Dec 2020 20:13:28 +0100 Subject: [PATCH] Install dracut. Add What? README sexion. Describe initrd installation in README --- Makefile | 15 ++++++++++----- README.md | 12 ++++++++++++ 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/Makefile b/Makefile index 31d8979..b0df321 100644 --- a/Makefile +++ b/Makefile @@ -34,11 +34,11 @@ SHELLCHECK_SOURCES := $(sort $(shell grep -lR '#!/bin/.*sh' $(INITRDDIR))) MANPAGE_SOURCES := $(sort $(wildcard $(MANDIR)*.md.pp)) -.PHONY : all clean build shellcheck i-t man +.PHONY : all clean build shellcheck i-t dracut man .SECONDARY: -all : build man shellcheck i-t +all : build man shellcheck i-t dracut clean : rm -rf $(OUTDIR) @@ -47,6 +47,7 @@ build : $(subst $(SRCDIR)bin/,$(OUTDIR),$(subst .cpp,$(EXE),$(BINARY_SOURCES))) man : $(OUTDIR)man/index.txt shellcheck : $(BLDDIR)shellcheck-stamp i-t : $(OUTDIR)initramfs-tools +dracut : $(OUTDIR)dracut $(OUTDIR)man/index.txt : $(MANDIR)index.txt $(patsubst $(MANDIR)%.pp,$(OUTDIR)man/%,$(MANPAGE_SOURCES)) @@ -60,10 +61,14 @@ $(BLDDIR)shellcheck-stamp : $(SHELLCHECK_SOURCES) $(SHELLCHECK) --exclude SC1091 $^ @date > $@ -$(OUTDIR)initramfs-tools : $(sort $(wildcard $(INITRDDIR)initramfs-tools)) +$(OUTDIR)initramfs-tools : $(INITRDDIR)initramfs-tools @mkdir -p $@/usr/share/initramfs-tools/hooks $@/usr/share/tzpfms - ln $(INITRDDIR)initramfs-tools/hook $@/usr/share/initramfs-tools/hooks/tzpfms - ln $(INITRDDIR)initramfs-tools/zfs-patch.sh $@/usr/share/tzpfms/initramfs-tools-zfs-patch.sh + ln $^/hook $@/usr/share/initramfs-tools/hooks/tzpfms + ln $^/zfs-patch.sh $@/usr/share/tzpfms/initramfs-tools-zfs-patch.sh + +$(OUTDIR)dracut : $(INITRDDIR)dracut + @mkdir -p $@/usr/lib/dracut/modules.d/91tzpfms + ln $(wildcard $^/*) $@/usr/lib/dracut/modules.d/91tzpfms $(OUTDIR)%$(EXE) : $(subst $(SRCDIR),$(OBJDIR),$(subst .cpp,$(OBJ),$(SRCDIR)bin/%.cpp $(COMMON_SOURCES))) diff --git a/README.md b/README.md index 5ca492c..8aa2c65 100644 --- a/README.md +++ b/README.md @@ -12,6 +12,15 @@ T P M Plus it's a pretty good annoyed sigh onomatopoeia. +### What? + +Essentially BitLocker, but for ZFS – +a random raw key is generated and sealed to the TPM (both 2 and 1.x supported) with an additional optional password in front of it, +tying the dataset to the platform and an additional optional secret (or to the posession of the back-up). + +Both dracut (with/without Plymouth) (with/without hostonly) and initramfs-tools (with/without Plymouth) are supported for +[ZFS-on-root](https://nabijaczleweli.xyz/content/blogn_t/005-low-curse-zfs-on-root.html) set-ups. + ### Building You'll need `pkg-config`, `ronn`, `shellcheck`, `libzfslinux-dev`, `libtss2-dev`, `libtspi-dev`, and `make` should hopefully Just Work™ if you have a C++17-capable compiler. @@ -22,6 +31,9 @@ The output binaries are trimmed of extraneous dependencies, so they're all just Copy the `out/zfs-tpm*` binaries corresponding to the back-ends you want to `/sbin`, continue as the [manual](//git.sr.ht/~nabijaczleweli/tzpfms/tree/man/zfs-tpm2-change-key.md) [page](//git.sr.ht/~nabijaczleweli/tzpfms/tree/man/zfs-tpm1x-change-key.md) instructs. +For initrd support, copy the content of either `out/dracut/` or `out/initramfs-tools/` over `/`; +these need `zfs-tpm-list` but will work with any combination of back-end `*-load-key` binaries. + <!-- #### From Debian repository The following line in `/etc/apt/sources.list` or equivalent: