Howto Full disk encryption manjaro and detached header (with keyboard)
#1
This is a howto, from following the arch wiki, on how to encrypt the root partition with LUKS.

I'm using a Pinephone Pro with a keyboard, but you could probably explorer other methods if a keyboard is not available.

The SD card will contain the boot partition and the LUKS header. If it is removed, then there should be no way to access the phone or see what kind of data is present.

The internal eMMC will contain the encrypted LUKS volume.


Boot the phone from Manjaro SD and then fill the eMMC disk with random encrypted data
Code:
cryptsetup open --type plain -d /dev/urandom /dev/mmcblk2 to_be_wiped
dd if=/dev/zero of=/dev/mapper/to_be_wiped status=progress
(https://wiki.archlinux.org/title/Dm-cryp..._partition)


Format the eMMC as an encrypted disk and save our header file
Code:
cryptsetup luksFormat /dev/mmcblk2 --header /boot/header.img
(https://wiki.archlinux.org/title/Dm-cryp...UKS_header)


I was not able to get LVM to work from the Manjaro SD (2022-03-09). Creating an lvm volume group and volume worked, but after the disk was closed, the LVM volume group would not be detected when it was re-opened. I created a single partition instead.
Code:
cryptsetup open /dev/mmcblk2 crypt --header /boot/header.img
mkfs.ext4 /dev/mapper/crypt


Update our initramfs image
Follow the step in https://wiki.archlinux.org/title/Dm-cryp...crypt_hook to copy and modify the 'encrypt' hook to a custom 'encrypt2' hook to support our detached header and then modify mkinitcpio.conf
Code:
/etc/mkinitcpio.conf
...
FILES=(/boot/header.img)
...
HOOKS=(base udev keyboard autodetect keymap modconf block encrypt2 shell filesystems fsck)
Make sure to remove the bootspash-manjaro hook, so that we can see the password prompt.

Copy the system on the sd card to the encrypted partition and resize it to fit the remaining space
Code:
dd if=/dev/mmcblk1p2 of=/dev/mapper/crypt bs=4096
resize2fs /dev/mapper/crypt


Update the bootloader to boot our new system.
Code:
/boot/boot.txt
...
setenv bootargs loglevel=4 console=tty0 console=${console} earlycon=uart8250,mmio32,0xff1a0000 consoleblank=0 boot=PARTUUID=${uuid_boot} root=/dev/mapper/crypt cryptdevice=/dev/mmcblk2:crypt:header rw rootwait quiet audit=0


Finally build the initramfs and boot.scr
Code:
mkinitcpio -P
ppp-uboot-mkscr


After reboot, we should have a password prompt and boot into our encrypted system.

The /dev/mmcblk1p2 partition can be wiped and used for something else.
  Reply


Possibly Related Threads…
Thread Author Replies Views Last Post
  Is Manjaro Plasma stable for anyone? projectcato 78 12,313 Yesterday, 06:12 PM
Last Post: mburns
  Battery meter slowly reducing under keyboard charger robocone 0 58 09-23-2022, 10:19 PM
Last Post: robocone
  Waydroid on PinePhone Pro PPP (Stock Manjaro Plasma) mhedhli 7 2,296 09-18-2022, 06:54 PM
Last Post: nroth
  OBS Studio on Manjaro Fred Zyphal 0 213 08-06-2022, 08:32 PM
Last Post: Fred Zyphal
  No display on early boot after Manjaro update robocone 0 244 07-07-2022, 05:47 AM
Last Post: robocone
  Latest Manjaro-Phosh and Arch-Phosh won't boot grinzie 6 919 07-01-2022, 02:01 PM
Last Post: Chief
  Wrong pin (default manjaro install) senorsmile 5 976 06-11-2022, 03:59 PM
Last Post: senorsmile
  Manjaro 5.17.5-1 Keyboard stopped working Yst 7 1,246 06-09-2022, 11:12 AM
Last Post: graphicpanda444
  Manjaro Plasma Beta 11 sleep issue after 3/22 update Fred Zyphal 6 1,433 05-22-2022, 12:37 PM
Last Post: magdesign
  Fix keyboard layout robocone 1 563 05-16-2022, 08:03 AM
Last Post: robocone

Forum Jump:


Users browsing this thread: 1 Guest(s)