0

need your commbined knowledge to tackle a issue i have with moving the rootfs of Centos 8 to lvm on luks

So when flashing the centos8 image (http://isoredirect.centos.org/altarch/8/isos/armhfp/) the default layout is:

Partition1: fat32 boot
Partition2: ext4 extlinux
Partition3: swap
Partition4: ext4 rootfs

I wanted to change it as the device may be exposed to theft so it should hav fs encryption. I usually pack lvm inside a luks container so the setup should look like:

Partition1: fat32 boot
Partition2: ext4 extlinux
Partition3: LUKS /dev/mapper/sdcard
            PV /dev/mapper/sdcard
               VG sdcard
                  LV root ext4
                  LV swap

I wrote a small sumary how i run the migration:

# Install Dependencies 
dnf install cryptsetup -y

# Change Config files for new layout
echo 'add_dracutmodules+=" crypt"' > /etc/dracut.conf.d/cryptsetup.conf
echo 'add_dracutmodules+=" lvm"' > /etc/dracut.conf.d/lvm.conf
echo -e 'sdcard\tUUID=c587eb1e-18c7-43ba-bdb6-947be660ee8b\tnone\tluks' >> /etc/crypttab
sed -i 's/.*\/ ext4.*/\/dev\/mapper\/sdcard-root \/ ext4    defaults,noatime  0 1/g' /etc/fstab 
sed -i 's/.*swap swap.*/\/dev\/mapper\/sdcard-swap   swap swap    defaults,noatime 0 0/g' /etc/fstab 
sed -i 's/append ro root.*/append ro root=\/dev\/mapper\/sdcard-root rhgb LANG=en_US.UTF-8 rd.lvm.lv=sdcard\/root rd.lvm.lv=sdcard\/swap luks.name=c587eb1e-18c7-43ba-bdb6-947be660ee8b=sdcard debug systemd.log_level=debug systemd.log_target=console console=ttyS0,38400 console=tty1 systemd.debug-shell=1/g' /etc/extlinux.conf
sed -i 's/append ro root.*/append ro root=\/dev\/mapper\/sdcard-root rhgb LANG=en_US.UTF-8 rd.lvm.lv=sdcard\/root rd.lvm.lv=sdcard\/swap luks.name=c587eb1e-18c7-43ba-bdb6-947be660ee8b=sdcard debug systemd.log_level=debug systemd.log_target=console console=ttyS0,38400 console=tty1 systemd.debug-shell=1/g' /boot/extlinux/extlinux.conf

# Regenerate initrd and extlinux boot flags
dracut -f
    
# If everything worked below command should outbut crypt and lvm
lsinitrd /boot/initramfs-* -m | grep -E -e 'lvm|crypt'


# Now pull out sdcard and put it into a different machine
# Mount the last partition and backup it somewhere
sudo mount /dev/sdb4 /mnt
sudo rsync -aux /mnt/ /tmp/centosroot/
sudo umount /mnt

# Delete last 2 partitions (root and swap) and create a single partition spanning all available space
sudo parted /dev/sdb rm 4
sudo parted /dev/sdb rm 3
sudo parted -a optimal /dev/sdb mkpart primary 1% 100%

# Format the partition as luks, and create lvm layout
sudo cryptsetup -y -v --uuid=c587eb1e-18c7-43ba-bdb6-947be660ee8b --cipher aes-xts-plain64 --key-size 256 --pbkdf-memory=505372 --pbkdf-parallel=2 --pbkdf-force-iterations=4 --type luks2 luksFormat /dev/sdb3
sudo cryptsetup luksOpen  /dev/sdb3 sdcard
sudo pvcreate /dev/mapper/sdcard
sudo vgcreate sdcard /dev/mapper/sdcard
sudo lvcreate -n swap -L1G sdcard
sudo lvcreate -n root -L15G sdcard
sudo mkfs.ext4 /dev/mapper/sdcard-root
sudo mkswap /dev/mapper/sdcard-swap 

# Restore backed up root folder to lvms root logical volume
sudo mount /dev/mapper/sdcard-root /mnt
sudo rsync -aux /tmp/centosroot/ /mnt/
sudo umount /mnt
sudo rm -rf /tmp/centosroot/

# Put SDcard into Raspberry and boot

However first i had to change the luks --pbkdf-memory to 500MB as when you create the luks container on a bigger machine it gets set to 1GB which is to much to handle for the raspberry. After solving this i now hang for several days on this error at boot after the volume was sucesfully unlocked. If the password is wrong the prompt comes up again so i guess it works somehow:

boot log

Any hint hat am i doing wrong here ? I am stuck for days now on this and the error message at boot is not verry telling what is missing here :S

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.