me/guix
Archived
1
0
Fork 0
Code Activity

doc: Document LUKS2 GRUB support and shortcomings

Browse source 
* doc/guix.texi (Keyboard Layout, Networking, and Partitioning)[Disk
Partitioning]: Document it.

Signed-off-by: Ludovic Courtès <ludo@gnu.org>
This commit is contained in:
Josselin Poiret 2021-11-15 20:53:40 +00:00 • committed by Ludovic Courtès
parent adce91a3ec
commit 4c5f970e8a
No known key found for this signature in database
GPG key ID: 090B11993D9AEBB5
1 changed files with 17 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
doc/guix.texi
View file

@ -98,6 +98,7 @@ Copyright @copyright{} 2021 pukkamustard@*
Copyright @copyright{} 2021 Alice Brenon@* Copyright @copyright{} 2021 Alice Brenon@*
Copyright @copyright{} 2021 Andrew Tropin@* Copyright @copyright{} 2021 Andrew Tropin@*
Copyright @copyright{} 2021 Sarah Morgensen@* Copyright @copyright{} 2021 Sarah Morgensen@*
Copyright @copyright{} 2021 Josselin Poiret@*
Permission is granted to copy, distribute and/or modify this document Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or under the terms of the GNU Free Documentation License, Version 1.3 or
@ -2493,13 +2494,24 @@ mkfs.ext4 -L my-root /dev/sda2
If you are instead planning to encrypt the root partition, you can use If you are instead planning to encrypt the root partition, you can use
the Cryptsetup/LUKS utilities to do that (see @inlinefmtifelse{html, the Cryptsetup/LUKS utilities to do that (see @inlinefmtifelse{html,
@uref{https://linux.die.net/man/8/cryptsetup, @code{man cryptsetup}}, @uref{https://linux.die.net/man/8/cryptsetup, @code{man cryptsetup}},
@code{man cryptsetup}} for more information). Assuming you want to @code{man cryptsetup}} for more information).
store the root partition on @file{/dev/sda2}, the command sequence would
be along these lines: @quotation Warning
Note that GRUB can unlock LUKS2 devices since version 2.06, but only
supports the PBKDF2 key derivation function, which is not the default
for @command{cryptsetup luksFormat}. You can check which key derivation
function is being used by a device by running @command{cryptsetup
luksDump @var{device}}, and looking for the PBKDF field of your
keyslots.
@end quotation
Assuming you want to store the root partition on @file{/dev/sda2}, the
command sequence to format it as a LUKS2 partition would be along these
lines:
@example @example
cryptsetup luksFormat /dev/sda2 cryptsetup luksFormat --type luks2 --pbkdf pbkdf2 /dev/sda2
cryptsetup open --type luks /dev/sda2 my-partition cryptsetup open /dev/sda2 my-partition
mkfs.ext4 -L my-root /dev/mapper/my-partition mkfs.ext4 -L my-root /dev/mapper/my-partition
@end example @end example