sudo gdisk /dev/nvme0n1
> command: o (create new empty gpt partition record)
> proceed: y
it may tell us that there is no current partition table on the disk and that it will create new GPT entires in memory.
this will delete all partitions and create a new protective master boot record (MBR).
Next create the new parition by doing:
command: n
partition number: 1
First sector: (press enter to use default 2048)
Last sector: (press enter to use default remaining space)
hex code (enter to use default of 8300 'Linux Filesystem')
Finally write changes to disk and exit:
comand: w (write to disk)
proceed: y
this will overwrite existing partition and wipe the disk.
we can check if the parition was created properly using lsblk
The new partition can be seen here
nvme0n1
|-nvme0n1p1
may I have confirmation,
are you going to have a prompt for passphrase to decrypt your ROOTFS_ENC?
please customize it (a prompt for passphrase) by yourself since we’re not supported with a prompt for passphrase by default.
No my intention was not to set up any kind of passphrase prompt, I wanted the partition to be decrypted automatically on boot by the internal key generation on the Jetson which is what I assumed get_luks.sh would allow me to do.
I only demonstrated that I could encrypt the drive as LUKS outside the script to demonstrate that the gen_luks.sh script did not appear to perform this step.
When you say encrypted root_fs are you talking about encrypting the drive where the OS is stored? If so this is not really my intention, I really want to make it so that the SSD in the jetson which will be used to store data is encrypted with the intention that no one can remove it and plug it into another pc to obtain this data.
may I also confirm which Jetpack public release version you’re working with?
you may refer to release tag, $ cat /etc/nv_tegra_release for confirmation.
it’s disk encryption to create a new, encrypted APP_ENC partition contains the rest of the file system.
you’ll need to full flash the target with ROOTFS_ENC=1 flag to enable that.
please see-also Topic 270934 for the steps to enable disk encryption with a custom key.
So to understand correctly, in order for me to be able to flash an external drive (NVMe) using gen_luks.sh (with no custom key) I will first have to re-flash the jetson with ROOTFS_ENC=1 enabled?
Would this the likely reason why gen_luks.sh does not appear to encrypt the partition as luks after the reboot?
it’s gen_luks.sh tool to have disk encryption for dynamically created partition.
see-also developer guide, Enabling Disk Encryption for Dynamically Created Partitions.
it’s full flash the target with ROOTFS_ENC=1 flag to have partition layout update, it adds APP_ENC partition which contains the encrypted data.
I am well aware that gen_luks.sh is the tool for encrypting dynamically allocated parititions, my question is asking why this tool is not working for me.
I have now tried on a completely seperate device (Orin-NX), re-flashed to scratch and am still having no luck.
again heere is my process:
create new partition (100gb)
lsblk
matoha@orin-nx-2:~$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
zram0 252:0 0 978.5M 0 disk [SWAP]
zram1 252:1 0 978.5M 0 disk [SWAP]
zram2 252:2 0 978.5M 0 disk [SWAP]
zram3 252:3 0 978.5M 0 disk [SWAP]
zram4 252:4 0 978.5M 0 disk [SWAP]
zram5 252:5 0 978.5M 0 disk [SWAP]
zram6 252:6 0 978.5M 0 disk [SWAP]
zram7 252:7 0 978.5M 0 disk [SWAP]
nvme0n1 259:0 0 1.8T 0 disk
├─nvme0n1p1 259:1 0 80G 0 part /
├─nvme0n1p2 259:2 0 128M 0 part
├─nvme0n1p3 259:3 0 768K 0 part
├─nvme0n1p4 259:4 0 31.6M 0 part
├─nvme0n1p5 259:5 0 128M 0 part
├─nvme0n1p6 259:6 0 768K 0 part
├─nvme0n1p7 259:7 0 31.6M 0 part
├─nvme0n1p8 259:8 0 80M 0 part
├─nvme0n1p9 259:9 0 512K 0 part
├─nvme0n1p10 259:10 0 64M 0 part /boot/efi
├─nvme0n1p11 259:11 0 80M 0 part
├─nvme0n1p12 259:12 0 512K 0 part
├─nvme0n1p13 259:13 0 64M 0 part
├─nvme0n1p14 259:14 0 400M 0 part
└─nvme0n1p15 259:15 0 479.5M 0 part
make new paritition on nvme0n1
matoha@orin-nx-2:~$ sudo gdisk /dev/nvme0n1
GPT fdisk (gdisk) version 1.0.8
Partition table scan:
MBR: protective
BSD: not present
APM: not present
GPT: present
Found valid GPT with protective MBR; using GPT.
Command (? for help): n
Partition number (16-128, default 16):
First sector (1248808-3907029134, default = 170822208) or {+-}size{KMGTP}:
Last sector (170822208-3907029134, default = 3907029134) or {+-}size{KMGTP}: +100G
Current type is 8300 (Linux filesystem)
Hex code or GUID (L to show codes, Enter = 8300):
Changed type of partition to 'Linux filesystem'
Command (? for help): w
Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!
Do you want to proceed? (Y/N): y
OK; writing new GUID partition table (GPT) to /dev/nvme0n1.
Warning: The kernel is still using the old partition table.
The new table will be used at the next reboot or after you
run partprobe(8) or kpartx(8)
The operation has completed successfully.
force re-read of drive:
sudo partprobe /dev/nvme0n1
new partition (16) now shows on lsblk
Encrypt the disk using gen_luks
---
sudo /usr/sbin/gen_luks.sh /dev/nvme0n1p16 crypt_ssd
matoha@orin-nx-2:/usr/sbin$ sudo /usr/sbin/gen_luks.sh /dev/nvme0n1p16 crypt_ssd
All data on /dev/nvme0n1p16 will be wiped out after luks disk is created. Reply YES to continue:
YES
Do you want to format encrypted partition crypt_ssd into ext4? Reply YES or No:
YES
Do you want to reboot the device to create encrypted partition? Reply YES or No:
YES
The device tries to re-boot, but this time I am now facing a different issue than originally (on the orin nano)
Basically the jetson says during to boot process:
Locking aborted. The locking path /run/cryptsetup is unusable (not a directory or missing)
Cannot format device /dev/nvme0np16`
see image: https://images2.imgbox.com/2e/7d/OfjFE6k6_o.jpg
once logged-in i checked and /run/cryptsetup/ does seem to exist, although i can’t cd into it i get permission denied.
Like last time, the partition has not been encrypted using luks.
Do you know How I can remove the existing boot loop / check?#
EDIT: okay I managed to break out of the loop i simply just had to reset the file
opt/nvidia/cryptluks
I am getting close to reaching breaking point with this method of encryption, I am constantly coming up against walls when trying, am I something missing obvious? Is it not possible to encrypt this drive or something??