MicroOS FDE + Combustion: Disk Encryption Not Applied Despite Combustion Configuration

Goal: Emulate Full-Disk Encryption (FDE) for MicroOS on Raspberry Pi 4B in QEMU before real-world deployment

  • Expected : System should be encrypted with LUKS2 (via systemd-cryptenroll).
  • Observed : Combustion config executes successfully, but FDE is not applied

Environement

Elements Details
Host DEBIAN_VERSION_FULL=13.6
Hypervisor EMU emulator version 10.0.11 (Debian 1:10.0.11+ds-0+deb13u1)
Machine QEMU virt (AArch64)
Image MicroOS openSUSE-MicroOS.aarch64-ContainerHost-RaspberryPi.raw

QEMU Command used

The Image and initrd are extracted from the root partition of the MicroOS image: openSUSE-MicroOS.aarch64-ContainerHost-RaspberryPi.raw.

fuel-ignition.img come from https://opensuse.github.io/fuel-ignition/

sudo qemu-system-aarch64 \
    -machine virt \
    -m 4G -smp 4 -cpu cortex-a72 \
    -kernel /mnt/root_partition/boot/Image \
    -drive file=openSUSE-MicroOS.aarch64-ContainerHost-RaspberryPi.raw,format=raw,if=virtio \
    -drive file=fuel-ignition.img,format=raw,if=none,id=ignition \
    -device qemu-xhci \
    -device usb-storage,drive=ignition \
    -initrd /mnt/root_partition/boot/initrd \
    -usb -device usb-kbd \
    -append "root=/dev/vda2 rootwait" \
    -nographic -serial mon:stdio

Combustion script

#!/bin/bash
# combustion: network prepare
# script generated with https://opensuse.github.io/fuel-ignition/

if [ "${1-}" = "--prepare" ]; then
  # We set disk-encryption-tool-dracut.encryption credential to
  # "force".  This will make disk-encryption-tool-dracut force the
  # encryption, ignoring that Combusion configured the system, and
  # will skip the permission countdown
  #
  # After the encryption the recovery key is registered in the
  # kernel keyring %user:cryptenroll
  mkdir -p /run/credstore
  echo "force" > /run/credstore/disk-encryption-tool-dracut.encrypt

  exit 0
fi

# Redirect output to the console
exec > >(exec tee -a /dev/tty0) 2>&1

mount /home

# Configuring user: root ...
echo 'root:$2a$10$OHoXSUi1w6.artKB05W0y.naRJDuc97ppdrefGx5cTxYdsaPJQdmS' | chpasswd -e

umount /home

# Disk Encryption
#
# Create a valid machine-id, as this will be required to create later
# the host secret
systemd-machine-id-setup
# We want to persist the host secret key created via systemd-cred
# (/var/lib/systemd/credential.secret)
mount /var
mkdir -p /etc/credstore.encrypted
credential="$(mktemp disk-encryption-tool.XXXXXXXXXX)"
# Enroll recovery key
echo "1" > "$credential"
systemd-creds encrypt --name=sdbootutil-enroll.rk "$credential" \
               /etc/credstore.encrypted/sdbootutil-enroll.rk
# Enroll extra password
echo "testthefdeonmicroos" > "$credential"
systemd-creds encrypt --name=sdbootutil-enroll.pw "$credential" \
               /etc/credstore.encrypted/sdbootutil-enroll.pw
shred -u "$credential"
# Umount back /var to not confuse tukit later
umount /var

# Keyboard
test -f /etc/vconsole.conf && FONT=$(grep ^FONT= /etc/vconsole.conf)
systemd-firstboot --force --keymap=fr
test -n "$FONT" && echo "$FONT" >> /etc/vconsole.conf

# Timezone
systemd-firstboot --force --timezone=Europe/Paris

# Leave a marker
echo "Configured with combustion" > /etc/issue.d/85-combustion.conf
echo "Configured with combustion" > /etc/issue.d/85-combustion.issue

# Close outputs and wait for tee to finish.
exec 1>&- 2>&-; wait;

Result

The system boots, but FDE is not applied despite the Combustion script running.

Can someone help me ?

1 Like

Hi
For qemu and combustion I use the following instead of mounting a device;

--sysinfo type=fwcfg,entry0.name="opt/org.opensuse.combustion/script",entry0.file="/data/development/kubernetes/libvirt_combustion/combustion/script" \

For finishing off I use;

echo "Prepare first reboot service..."
mkdir -p /etc/systemd/system
## Reboot system after installation systemd service used from <https://rootco.de/2020-12-09-microos-pi-network-monitor/>
cat >/etc/systemd/system/firstbootreboot.service <<-EOF
[Unit]
Description=First Boot Reboot

[Service]
Type=oneshot
ExecStart=rm /etc/systemd/system/firstbootreboot.service
ExecStart=rm /etc/systemd/system/default.target.wants/firstbootreboot.service
ExecStart=systemctl reboot

[Install]
WantedBy=default.target
EOF
systemctl enable firstbootreboot.service

echo "openSUSE Leap 16.0 for k3s configured with Combustion." > /etc/issue.d/01-combustion.conf

I don’t use FDE, but you might find some pointers in the Aeon Documentation. Likewise I would suggest jumping on the openSUSE ARM Matrix channel or IRC #opensuse-arm as I’m sure there are boot options to use…

Some updates from my tests: I got tired of trying to make it work on QEMU, so I decided to test it directly on a Raspberry Pi 3B. Using the same Ignition and Combustion configuration, I still didn’t get Full Disk Encryption (FDE) working on the Raspberry Pi 3B.

I also tried reaching out on the IRC channel #opensuse-arm, but it doesn’t seem very active.

1 Like

@80085y Hi, they are it’s likely a timing issue… It’s usually early morning here CDT I see activity, so that’s mid-late afternoon in Europe…

Ok i got some answers on IRC :slight_smile:

ISO i used : https://download.opensuse.org/ports/aarch64/tumbleweed/appliances/openSUSE-MicroOS.aarch64-ContainerHost-RaspberryPi.raw.xz

command used to gather the logs

sudo qemu-system-aarch64 \
    -machine virt \
    -m 4G -smp 4 -cpu cortex-a72 \
    -kernel /mnt/root_partition/boot/Image \
    -drive file=openSUSE-MicroOS.aarch64-ContainerHost-RaspberryPi.raw,format=raw,if=virtio \
    -drive file=fuel-ignition.img,format=raw,if=none,id=ignition \
    -device qemu-xhci \
    -device usb-storage,drive=ignition \
    -initrd /mnt/root_partition/boot/initrd \
    -usb -device usb-kbd \
    -append "console=ttyAMA0,115200 root=/dev/vda2 rootwait rw systemd.log_level=debug systemd.log_target=console loglevel=8 rd.debug rd.systemd.show_status=1" \
    -serial mon:stdio -nographic 2>&1 | tee boot-console.log
journalctl --no-pager -b > boot-journal.txt
journalctl --no-pager -u ignition -b > ignition.txt
journalctl --no-pager -u ignition-disks -b > ignition-disks.txt
journalctl --no-pager -u ignition-files -b > ignition-files.txt
journalctl --no-pager -u combustion -b > combustion.txt
journalctl --no-pager -b | grep -iE 'ignition|combustion' > ignition-grep.txt
dmesg > dmesg.txt

logfiles : https://paste.opensuse.org/pastes/0a52aa5a55a3

1 Like

Thank you for sharing this–I am also interested in FDE after a combustion boot, and on images like the MicroOS ARM/aarch64 images. The ARM chat suggested you file a bug report on this… https://bugzilla.opensuse.org/

1 Like

tracking bug on : https://bugzilla.opensuse.org/show_bug.cgi?id=1279389