linux kernel mount filesystem from the encrypt partition when boot,how to?

Question

my sd card have two partition,one is the boot,and another is the filesystem,now I use linux tool cryptsetup encrypt the filesystem partition,when boot on my board,the kernel can't mount the filesystem(encrypt),my aim is to protect the whole filesystem,maybe three partition can achieve,if I have only two partition,whether it can be achieved?need to modify the kernel source?

Answer 1

You have not advised the distro you are using, and this makes a difference. It is definitely possible to do "full disk" encryption with 2 partitions under Linux, and I know that it can be done with Ubuntu. (Not sure if the default install does it, I think it does, otherwise you can get an alternate disk which does). I'd imagine there is a Spin for Fedora or CentOS as well.

The mechanism used to achieve this is as follows:

1. Create (or let the system create for you) 2 partitions, a small "boot" partition, typically about 200 megs, and a large partition for encryption. (You need to work out if you want an additional partition for swap, or if you want to mount swap encrypted either using LVM or as a file - there are advantages to each, but for security you would take a performance hit and mount it on the encrypted partition)

2. Your OS will put the bare minimum it needs to boot on the boot partition (which will typically be /boot). While this is unencrypted, it only contains "stock files".

3. The install then typically builds/recreates an initial ramdisk (initrd), which includes the files and commands needed to prompt for a password, decrypt the system and remount it as root.