Goal: Emulate Full-Disk Encryption (FDE) for MicroOS on Raspberry Pi 4B in QEMU before real-world deployment
- Expected : System should be encrypted with LUKS2 (via
systemd-cryptenroll). - Observed : Combustion config executes successfully, but FDE is not applied…
Environement
| Elements | Details |
|---|---|
| Host | DEBIAN_VERSION_FULL=13.6 |
| Hypervisor | EMU emulator version 10.0.11 (Debian 1:10.0.11+ds-0+deb13u1) |
| Machine QEMU | virt (AArch64) |
| Image MicroOS | openSUSE-MicroOS.aarch64-ContainerHost-RaspberryPi.raw |
QEMU Command used
The Image and initrd are extracted from the root partition of the MicroOS image: openSUSE-MicroOS.aarch64-ContainerHost-RaspberryPi.raw.
fuel-ignition.img come from https://opensuse.github.io/fuel-ignition/
sudo qemu-system-aarch64 \
-machine virt \
-m 4G -smp 4 -cpu cortex-a72 \
-kernel /mnt/root_partition/boot/Image \
-drive file=openSUSE-MicroOS.aarch64-ContainerHost-RaspberryPi.raw,format=raw,if=virtio \
-drive file=fuel-ignition.img,format=raw,if=none,id=ignition \
-device qemu-xhci \
-device usb-storage,drive=ignition \
-initrd /mnt/root_partition/boot/initrd \
-usb -device usb-kbd \
-append "root=/dev/vda2 rootwait" \
-nographic -serial mon:stdio
Combustion script
#!/bin/bash
# combustion: network prepare
# script generated with https://opensuse.github.io/fuel-ignition/
if [ "${1-}" = "--prepare" ]; then
# We set disk-encryption-tool-dracut.encryption credential to
# "force". This will make disk-encryption-tool-dracut force the
# encryption, ignoring that Combusion configured the system, and
# will skip the permission countdown
#
# After the encryption the recovery key is registered in the
# kernel keyring %user:cryptenroll
mkdir -p /run/credstore
echo "force" > /run/credstore/disk-encryption-tool-dracut.encrypt
exit 0
fi
# Redirect output to the console
exec > >(exec tee -a /dev/tty0) 2>&1
mount /home
# Configuring user: root ...
echo 'root:$2a$10$OHoXSUi1w6.artKB05W0y.naRJDuc97ppdrefGx5cTxYdsaPJQdmS' | chpasswd -e
umount /home
# Disk Encryption
#
# Create a valid machine-id, as this will be required to create later
# the host secret
systemd-machine-id-setup
# We want to persist the host secret key created via systemd-cred
# (/var/lib/systemd/credential.secret)
mount /var
mkdir -p /etc/credstore.encrypted
credential="$(mktemp disk-encryption-tool.XXXXXXXXXX)"
# Enroll recovery key
echo "1" > "$credential"
systemd-creds encrypt --name=sdbootutil-enroll.rk "$credential" \
/etc/credstore.encrypted/sdbootutil-enroll.rk
# Enroll extra password
echo "testthefdeonmicroos" > "$credential"
systemd-creds encrypt --name=sdbootutil-enroll.pw "$credential" \
/etc/credstore.encrypted/sdbootutil-enroll.pw
shred -u "$credential"
# Umount back /var to not confuse tukit later
umount /var
# Keyboard
test -f /etc/vconsole.conf && FONT=$(grep ^FONT= /etc/vconsole.conf)
systemd-firstboot --force --keymap=fr
test -n "$FONT" && echo "$FONT" >> /etc/vconsole.conf
# Timezone
systemd-firstboot --force --timezone=Europe/Paris
# Leave a marker
echo "Configured with combustion" > /etc/issue.d/85-combustion.conf
echo "Configured with combustion" > /etc/issue.d/85-combustion.issue
# Close outputs and wait for tee to finish.
exec 1>&- 2>&-; wait;
Result
The system boots, but FDE is not applied despite the Combustion script running.
Can someone help me ?
