Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Encrypt dom0 swap #79

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Encrypt dom0 swap #79

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions rpm_spec/core-dom0-linux.spec.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,6 +143,9 @@ install -m 644 system-config/00-qubes-ignore-devices.rules $RPM_BUILD_ROOT%_udev
install -m 644 system-config/12-qubes-ignore-lvm-devices.rules $RPM_BUILD_ROOT%_udevrulesdir
install -m 644 system-config/99z-qubes-mark-ready.rules $RPM_BUILD_ROOT%_udevrulesdir
install -m 644 -D system-config/disable-lesspipe.sh $RPM_BUILD_ROOT/etc/profile.d/zz-disable-lesspipe.sh
install -m 644 -D system-config/[email protected] $RPM_BUILD_ROOT%_unitdir/[email protected]
install -m 644 -D system-config/99-qubes-cryptsetup.conf $RPM_BUILD_ROOT%_unitdir/[email protected]/30_qubes.conf

install -m 755 -D system-config/kernel-grub2.install $RPM_BUILD_ROOT/usr/lib/kernel/install.d/80-grub2.install
install -m 755 -D system-config/kernel-xen-efi.install $RPM_BUILD_ROOT/usr/lib/kernel/install.d/90-xen-efi.install
install -m 755 -D system-config/kernel-remove-bls.install $RPM_BUILD_ROOT/usr/lib/kernel/install.d/99-remove-bls.install
Expand Down
1 change: 1 addition & 0 deletions system-config/75-qubes-dom0.preset
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,3 +54,4 @@ enable qubesd.service
enable anti-evil-maid-unseal.service
enable anti-evil-maid-check-mount-devs.service
enable anti-evil-maid-seal.service
enable [email protected]
8 changes: 8 additions & 0 deletions system-config/99-qubes-cryptsetup.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
[Unit]
Before=dev-mapper-%i.swap
Requires=systemd-random-seed.service
After=systemd-random-seed.service

[Service]
TimeoutSec=infinity
ExecStartPost=/sbin/udevadm trigger /dev/mapper/%I
29 changes: 29 additions & 0 deletions system-config/[email protected]
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
# Automatically generated by systemd-cryptsetup-generator

[Unit]
Description=Cryptography Setup for %I
Documentation=man:crypttab(5) man:systemd-cryptsetup-generator(8) man:[email protected](8)
SourcePath=/etc/crypttab
DefaultDependencies=no
IgnoreOnIsolate=true
After=cryptsetup-pre.target
Before=blockdev@dev-mapper-%i.target
Wants=blockdev@dev-mapper-%i.target
Conflicts=umount.target
After=systemd-random-seed.service
BindsTo=dev-qubes_dom0-swap.device
After=dev-qubes_dom0-swap.device
Before=umount.target

[Service]
Type=oneshot
RemainAfterExit=yes
TimeoutSec=0
KeyringMode=shared
OOMScoreAdjust=500
ExecStart=/usr/lib/systemd/systemd-cryptsetup attach 'swap' '/dev/qubes_dom0/swap' '/dev/urandom' 'swap,cipher=aes-xts-plain64,discard,size=512,nofail'
ExecStop=/usr/lib/systemd/systemd-cryptsetup detach 'swap'
ExecStartPost=/sbin/mkswap '/dev/mapper/swap'

[Install]
WantedBy=cryptsetup.target