All of lore.kernel.org
 help / color / mirror / Atom feed
From: Quirin Gylstorff <Quirin.Gylstorff@siemens.com>
To: jan.kiszka@siemens.com, cip-dev@lists.cip-project.org, johnxw@amazon.com
Subject: [cip-dev][isar-cip-core][PATCH v3 14/15] Kconfig: Add option to encrypt the rootfs
Date: Tue,  9 Apr 2024 15:05:31 +0200	[thread overview]
Message-ID: <20240409130638.559398-15-Quirin.Gylstorff@siemens.com> (raw)
In-Reply-To: <20240409130638.559398-1-Quirin.Gylstorff@siemens.com>

From: Quirin Gylstorff <quirin.gylstorff@siemens.com>

Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
---
 Kconfig | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/Kconfig b/Kconfig
index 7c19640..8e96865 100644
--- a/Kconfig
+++ b/Kconfig
@@ -212,5 +212,19 @@ config IMAGE_DATA_ENCRYPTION
 config KAS_INCLUDE_DATA_ENCRYPTION
 	string
 	default "kas/opt/encrypt-partitions.yml" if IMAGE_DATA_ENCRYPTION
+endif
+
+if IMAGE_FLASH && !IMAGE_DATA_ENCRYPTION && !IMAGE_SECURE_BOOT && !IMAGE_SWUPDATE
+
+config IMAGE_ROOTFS_ENCRYPTION
+	bool "Encrypt rootfs and data partitions"
+	depends on TARGET_QEMU_AMD64 || TARGET_QEMU_ARM64 || TARGET_QEMU_ARM || !IMAGE_SWUPDATE || !IMAGE_SECURE_BOOT
+	help
+	  This enables LUKS encryption for all partition. This is currently incompatible
+	  with efibootguard, secure boot and SWUpdate.
+
+config KAS_INCLUDE_ROOTFS_ENCRYPTION
+	string
+	default "kas/opt/encrypt_rootfs.yml" if IMAGE_ROOTFS_ENCRYPTION
 
 endif
-- 
2.43.0



  parent reply	other threads:[~2024-04-09 13:06 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-04-09 13:05 [cip-dev][isar-cip-core][PATCH v3 00/15] Rework disk encryption Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 01/15] initramfs-crypt-hook: Allow switching between clevis and systemd Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 02/15] initramfs-crypt-hook: Align systemd encryption and clevis encryption Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 03/15] initramfs-crypt-hook: move the mounting of encrypted disks in a seperate function Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 04/15] initramfs-crypt-hook: Check if the TPM device fulfills the given requirements Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 05/15] initramfs-crypt-hook: add flag to make encryption optional Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 06/15] initramfs-crypt-hook: add e2fsck to avoid resize error Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 07/15] initramfs-crypt-hook: split encryption and mounting Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 08/15] initramfs-crypt-hook: Add check if root is part of the mountpoints Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 09/15] initramfs-crypt-hook: split hook in multiple files Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 10/15] initramfs-crypt-hook: Consolidate clevis and systemd scripts Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 11/15] initramfs-crypt-hook: Increase version Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 12/15] README.tpm2.encryption: Add section to switch from clevis to systemd Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 13/15] Add example to encrypt the rootfs Quirin Gylstorff
2024-04-09 13:05 ` Quirin Gylstorff [this message]
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 15/15] start-qemu.sh: Support encrypted rootfs Quirin Gylstorff

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240409130638.559398-15-Quirin.Gylstorff@siemens.com \
    --to=quirin.gylstorff@siemens.com \
    --cc=cip-dev@lists.cip-project.org \
    --cc=jan.kiszka@siemens.com \
    --cc=johnxw@amazon.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.