Nikita Dubrovskii
d1ab18f327
This allows to use Secure Execution with LUKS encrypted boot disk, key and cryptab are stored only in 'sd-boot' encrypted image. Signed-off-by: Nikita Dubrovskii <nikita@linux.ibm.com>
23 lines
511 B
Plaintext
Executable File
23 lines
511 B
Plaintext
Executable File
#!/usr/bin/bash
|
|
# This script creates new initramdisk with LUKS config within
|
|
set -euo pipefail
|
|
|
|
old_initrd=$1
|
|
new_initrd=$2
|
|
|
|
# Unpacking existing initramdisk
|
|
workdir=$(mktemp -d -p /tmp se-initramfs-XXXXXX)
|
|
cd ${workdir}
|
|
gzip -cd ${old_initrd} | cpio -imd --quiet
|
|
|
|
# Adding LUKS root key and crypttab config
|
|
mkdir -p etc/luks
|
|
cp -f /etc/luks/root etc/luks/
|
|
cp -f /etc/crypttab etc/
|
|
|
|
# Creating new initramdisk image
|
|
find . | cpio --quiet -H newc -o | gzip -9 -n >> ${new_initrd}
|
|
|
|
# Cleanup
|
|
rm -rf ${workdir}
|