From: Quirin Gylstorff <Quirin.Gylstorff@siemens.com>
To: jan.kiszka@siemens.com, cip-dev@lists.cip-project.org, johnxw@amazon.com
Subject: [cip-dev][isar-cip-core][PATCH v2 12/13] README.tpm2.encryption: Add section to switch from clevis to systemd
Date: Fri, 22 Mar 2024 11:05:22 +0100 [thread overview]
Message-ID: <20240322100605.4129226-13-Quirin.Gylstorff@siemens.com> (raw)
In-Reply-To: <20240322100605.4129226-1-Quirin.Gylstorff@siemens.com>
From: Quirin Gylstorff <quirin.gylstorff@siemens.com>
Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
---
doc/README.tpm2.encryption.md | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/doc/README.tpm2.encryption.md b/doc/README.tpm2.encryption.md
index cb3f640..69a18dd 100644
--- a/doc/README.tpm2.encryption.md
+++ b/doc/README.tpm2.encryption.md
@@ -48,3 +48,23 @@ Each entry uses the schema `<partition-label>:<mountpoint>:<reencrypt or format>
The variable `CRYPT_CREATE_FILE_SYSTEM_CMD` contains the command to create a new file system on a newly
encrypted partition. The Default (`mke2fs -t ext4`) creates an ext4 partition.
+
+# Convert clevis based encryption to systemd-cryptenroll
+## Prerequisites
+The following packages are necessary to convert a clevis based encryption to a systemd-cryptenroll
+based encryption:
+ - clevis-luks
+ - clevis-tpm2
+ - cryptsetup
+ - jq
+
+## steps to convert clevis to systemd
+The following script shows how to enroll a systemd-tpm2 token with a existinng clevis based encryption:
+```bash
+export device=/dev/sda6
+export keyslot=$(sudo cryptsetup luksDump "$device" --dump-json-metadata | jq -c '.tokens.[] | select( .type == "clevis") | .keyslots | first' | head -n1)
+if [ -n "$keyslot" ]; then
+ export PASSWORD=$(clevis luks pass -d "$device" -s"$keyslot")
+ systemd-cryptenroll --tpm2-device="$tpm_device" --tpm2-pcrs=7 "$device"
+fi
+```
--
2.43.0
next prev parent reply other threads:[~2024-03-22 10:06 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-22 10:05 [cip-dev][isar-cip-core][PATCH v2 00/13] Rework disk encryption Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 01/13] initramfs-crypt-hook: Allow switching between clevis and systemd Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 02/13] initramfs-crypt-hook: Align systemd encryption and clevis encryption Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 03/13] initramfs-crypt-hook: move the mounting of encrypted disks in a seperate function Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 04/13] initramfs-crypt-hook: Check if the TPM device fulfills the given requirements Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 05/13] initramfs-crypt-hook: add flag to make encryption optional Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 06/13] initramfs-crypt-hook: add e2fsck to avoid resize error Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 07/13] initramfs-crypt-hook: split encryption and mounting Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 08/13] initramfs-crypt-hook: Add check if root is part of the mountpoints Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 09/13] initramfs-crypt-hook: split hook in multiple files Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 10/13] initramfs-crypt-hook: Consolidate clevis and systemd scripts Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 11/13] initramfs-crypt-hook: Increase version Quirin Gylstorff
2024-03-22 10:05 ` Quirin Gylstorff [this message]
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 13/13] Add example to encrypt the rootfs Quirin Gylstorff
2024-04-08 17:50 ` Jan Kiszka
2024-04-08 17:40 ` [cip-dev][isar-cip-core][PATCH v2 00/13] Rework disk encryption Jan Kiszka
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240322100605.4129226-13-Quirin.Gylstorff@siemens.com \
--to=quirin.gylstorff@siemens.com \
--cc=cip-dev@lists.cip-project.org \
--cc=jan.kiszka@siemens.com \
--cc=johnxw@amazon.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).