I am trying to encrypt a 25gb partition on my SSD with
cryptsetup in such a way that will allow
QEMU-KVM to use it as the guests drive.
I have tried luksformatting the drive:
cryptsetup luksFormat /dev/disk/by-id/...
then opening it:
cryptsetup luksOpen /dev/disk/by-id/... windows-vm
although QEMU gets permission denied when trying to access the
/dev/mapper/windows-vm device with this script:
#!/bin/bash exec qemu-system-x86_64 \ --enable-kvm \ -netdev user,id=vmnic -device virtio-net,netdev=vmnic \ -usbdevice tablet \ -monitor stdio \ -machine type=pc,accel=kvm \ -cpu host \ -m 4G \ -balloon virtio \ -name Windows \ -smp cores=2 \ -vga std \ -soundhw ac97 \ -drive file=/dev/mapper/windows-vm,cache=none,if=virtio \ "$@"
I have also tried mounting it, but mount complains that it has the wrong fs type, which makes sense since I did not run
mkfs on the device. Although I would assume I wouldn't need to since Windows would format the device anyways.
Is there any way to pair the
cryptsetup luks encryption with a partition in such a way so that once opened
QEMU-KVM can read/write/boot from it as it would a normal qcow2/raw image file?
Edit: It turns out this may be a permissions issue with the
/dev/mapper/windows-vm block device as when I run QEMU with root access the installation process began rather than giving me a permission denied error. Is there a way to allow a normal user to have direct access to the block device? By default cryptsetup gave the `/dev/mapper/windows-vm device root:root 0600.