All of lore.kernel.org
 help / color / mirror / Atom feed
From: Quirin Gylstorff <Quirin.Gylstorff@siemens.com>
To: jan.kiszka@siemens.com, cip-dev@lists.cip-project.org, johnxw@amazon.com
Subject: [cip-dev][isar-cip-core][PATCH v3 15/15] start-qemu.sh: Support encrypted rootfs
Date: Tue,  9 Apr 2024 15:05:32 +0200	[thread overview]
Message-ID: <20240409130638.559398-16-Quirin.Gylstorff@siemens.com> (raw)
In-Reply-To: <20240409130638.559398-1-Quirin.Gylstorff@siemens.com>

From: Quirin Gylstorff <quirin.gylstorff@siemens.com>

Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
---
 start-qemu.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/start-qemu.sh b/start-qemu.sh
index 9ec0f1c..83d1274 100755
--- a/start-qemu.sh
+++ b/start-qemu.sh
@@ -21,6 +21,7 @@ usage()
 	echo "  QEMU_PATH         use a locally built QEMU version"
 	echo "  SWUPDATE_BOOT     boot swupdate image"
 	echo "  SECURE_BOOT       start a secure boot environment"
+	echo "  TPM2_ENCRYPTION   starts swtpm to encrypt the disk partitions"
 	echo "  DISTRO_RELEASE    select a specific Debian release"
 	echo "  TARGET_IMAGE      select a specific image type"
 	exit 1
@@ -35,6 +36,10 @@ if grep -s -q "IMAGE_DATA_ENCRYPTION: true" .config.yaml; then
 	TPM2_ENCRYPTION="true"
 fi
 
+if grep -s -q "IMAGE_ROOTFS_ENCRYPTION: true" .config.yaml; then
+	TPM2_ENCRYPTION="true"
+fi
+
 if [ -n "${QEMU_PATH}" ]; then
 	QEMU_PATH="${QEMU_PATH}/"
 fi
@@ -187,7 +192,7 @@ QEMU_COMMON_OPTIONS=" \
 	${QEMU_EXTRA_ARGS} \
 	"
 
-if [ -n "${SECURE_BOOT}${SWUPDATE_BOOT}" ]; then
+if [ -n "${SECURE_BOOT}${SWUPDATE_BOOT}${TPM2_ENCRYPTION}" ]; then
 	case "${arch}" in
 		x86|x86_64|amd64)
 			if [ -n "${SECURE_BOOT}" ]; then
-- 
2.43.0



      parent reply	other threads:[~2024-04-09 13:06 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-04-09 13:05 [cip-dev][isar-cip-core][PATCH v3 00/15] Rework disk encryption Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 01/15] initramfs-crypt-hook: Allow switching between clevis and systemd Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 02/15] initramfs-crypt-hook: Align systemd encryption and clevis encryption Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 03/15] initramfs-crypt-hook: move the mounting of encrypted disks in a seperate function Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 04/15] initramfs-crypt-hook: Check if the TPM device fulfills the given requirements Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 05/15] initramfs-crypt-hook: add flag to make encryption optional Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 06/15] initramfs-crypt-hook: add e2fsck to avoid resize error Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 07/15] initramfs-crypt-hook: split encryption and mounting Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 08/15] initramfs-crypt-hook: Add check if root is part of the mountpoints Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 09/15] initramfs-crypt-hook: split hook in multiple files Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 10/15] initramfs-crypt-hook: Consolidate clevis and systemd scripts Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 11/15] initramfs-crypt-hook: Increase version Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 12/15] README.tpm2.encryption: Add section to switch from clevis to systemd Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 13/15] Add example to encrypt the rootfs Quirin Gylstorff
2024-04-09 13:05 ` [cip-dev][isar-cip-core][PATCH v3 14/15] Kconfig: Add option " Quirin Gylstorff
2024-04-09 13:05 ` Quirin Gylstorff [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240409130638.559398-16-Quirin.Gylstorff@siemens.com \
    --to=quirin.gylstorff@siemens.com \
    --cc=cip-dev@lists.cip-project.org \
    --cc=jan.kiszka@siemens.com \
    --cc=johnxw@amazon.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.