What I am trying to achieve is to have an encrypted root file system on a Raspberry Pi (running Raspian Buster) that gets unlocked at boot via ssh. I got quite far by adapting a tutorial for Kali linux and got it working at least once, but it does not survive kernel updates yet.
One of the problems is, that this setup is using an initramfs that is referenced in /boot/config.txt by
initramfs initramfs.gz followkernel
and that needs to be updated after an kernel update by manually calling e.g.
mkinitramfs -o /boot/initramfs.gz 4.19.118-v7+
where 4.19.118-v7+ depends on the current kernel version and the kind of Raspberry Pi hardware that is used. Of course, I want to have this automatically done whenever apt upgrade installs a new kernel.
This is where I got stuck with 2 problems:
- A) Where and how do I plug in that update process in a proper way?
- B) How do I determine the correct kernel version to use?
Regarding A) I came as far as learning that raspberrypi-kernel.postinst executes /etc/kernel/postinst.d/. This again calls /usr/sbin/update-initramfs which in the end will call mkinitramfs. Where I got confused was this code in /usr/sbin/update-initramfs:
set_initramfs()
{
initramfs="${BOOTDIR}/initrd.img-${version}"
}
It determines the filename for the initramfs. No such file got ever generated during the update and I'm not sure if I am on the right track, as wikipedia says that the init.rd scheme was superseded by the initramfs scheme. However, I was not able to find a good documentation that describes how things are supposed to happen after a kernel module upgrade. (Good links appreciated).
So my question is:
Where is a good place to plug in a script that runs the mkinitramfs command? Should I modify /etc/kernel/postinst.d/? Will this solution be stable over the next few Debian versions?
Regarding B), it is easy to get available kernel versions with
> ls -l /lib/modules/ | awk -F" " '{print $9}'`
5.4.51+
5.4.51-v7+
5.4.51-v7l+
5.4.51-v8+
But how do I automatically select the right one for the current hardware? For a Pi3B+ this would be 5.4.51-v7+. Is there a way to determine this automatically?
Thank you very much for your help!
