Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

my sd card have two partition,one is the boot,and another is the filesystem,now I use linux tool cryptsetup encrypt the filesystem partition,when boot on my board,the kernel can't mount the filesystem(encrypt),my aim is to protect the whole filesystem,maybe three partition can achieve,if I have only two partition,whether it can be achieved?need to modify the kernel source?

share|improve this question
up vote 0 down vote accepted

You have not advised the distro you are using, and this makes a difference. It is definitely possible to do "full disk" encryption with 2 partitions under Linux, and I know that it can be done with Ubuntu. (Not sure if the default install does it, I think it does, otherwise you can get an alternate disk which does). I'd imagine there is a Spin for Fedora or CentOS as well.

The mechanism used to achieve this is as follows:

  1. Create (or let the system create for you) 2 partitions, a small "boot" partition, typically about 200 megs, and a large partition for encryption. (You need to work out if you want an additional partition for swap, or if you want to mount swap encrypted either using LVM or as a file - there are advantages to each, but for security you would take a performance hit and mount it on the encrypted partition)

  2. Your OS will put the bare minimum it needs to boot on the boot partition (which will typically be /boot). While this is unencrypted, it only contains "stock files".

  3. The install then typically builds/recreates an initial ramdisk (initrd), which includes the files and commands needed to prompt for a password, decrypt the system and remount it as root.

share|improve this answer
    
the boot partition I put my boot.scr,MLO,u-boot.bin,u-boot.image,uImage and initrd file(include cryptsetup command etc),the second partition I put my encryption filesystem(include rootfs,some libs,apps etc),right? – Lyric Feb 25 '13 at 8:58
    
Don't know about exactly what you put on /boot (My distro does not use boot.scr, MLO, u-boot.*, rather it users Grub, the kernel and an initramfs (Centos) or initrd (Ubuntu), but yes, thats the right idea. – davidgo Feb 25 '13 at 18:49
    
can you tell me the step make initrd?the more detailed the better.I use kernel3.4 on embedded Linux device. – Lyric Feb 26 '13 at 3:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .