Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[SOLVED]Using LVM + uEFI secure boot - a couple of questions
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Installing Gentoo
View previous topic :: View next topic  
Author Message
johngalt
Apprentice
Apprentice


Joined: 09 Sep 2004
Posts: 258
Location: 3rd Rock

PostPosted: Mon Jun 25, 2018 6:20 pm    Post subject: [SOLVED]Using LVM + uEFI secure boot - a couple of questions Reply with quote

Hi, all,

I'm building Gentoo on 2 laptops - Dell Inspiron 3521 and Lenovo ThinkPad Edge E545. Specs:
  1. Inspiron

    Intel Celeron 1007U CPU w/ integrated Intel HD Graphics (Ivy Bridge)
    4 GM RAM
    Intel X25-M 9gen 2) 80 GB SSD SATA II

  2. Lenovo

    AMD A6-5350M CPU w/ integrated Radeon HD 8450G
    8 GB RAM
    Intel Cherryville 520 series 180 GB SSD SATA 'III'


Both machines have optical drives, and I plan to obtain HD caddies to swap them out and add additional storage (SSDs) (ordered one for Lenovo already, still sourcing one for the Dell). As I do not have them yet, and as I have become rather versatile in installing Gentoo for a basic boot to CLI, Ive started looking at alternatives to just adding the disks in and making a new mount.

My understanding is that, from reading a whole slew of sources on it, LVM would be an optimal way for me to build the install now, and after I get SSD and caddy and install, I could extend the LVM onto the new drive and then extend my / partition to use the new space, or else add new partitions and move stuff around as I see fit.

Is this a valid assumption on my part?

Also, the vast majority of forum posts and other resources dealing with LVM also end up mentioning the use of LUKS for encryption - as these are machines that I am using solely at home and solely for the purpose of re-familiarizing myself with Gentoo, my gut tells me that I don't really need LUKS at the moment, and to keep my learning curve at a tolerable level I can just ignore using it now and worry about it later on. But, I've done a bit of searching, and I cannot really see an answer to this at all:

Does LUKS introduce any overhead when the system is in actual use, or is it only using CPU cycles at boot and shutdown / reboot?

My plan is to partition the drives on both machines with 1 ESP (vfat), keeping it 550 MB (just in case I get a wild hair up where the sun doesn't shine and I decide that I want to install a different OS on the additional SSDs that come in, so keeping it large enough for compatibility with a possible Windows dual boot later on) and the rest as the logical volume for each drive. So, both machines' drives end up looking like this:

Code:

(parted) p
Model: ATA INTEL SSDSC2CW18 (scsi)
Disk /dev/sda: 171705MiB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:

Number  Start      End            Size              File system   Name   Flags
 1          1.00MiB  551MiB       550MiB                             boot     boot, esp
 2          551MiB   171704MiB  171153MiB                       lvm01   lvm


Efibootmgr is able to communicate with both machine's UEFI interface, adding to and removing from the list of bootable resources - so a direct EFI boot on each machine works perfectly fine.

From https://wiki.gentoo.org/wiki/LVM assume you manually configure the kernel and then use

Code:
genkernel --lvm --install initramfs


to build the initramfs.

Is it possible to also use genkernel / genkernel-next to build the entire kernel that will create a vmlinuz file that I can then use to bot via UEFI?

Finally, I've seen more than a little debate about this last question going on - but most of that was also from more than a couple of years ago.

Using efibootmgr, once I get a default, working kernel, I can create additional entries that II would access through the UEFI manager for alternate systems, kernel testing, desktop vs CLI, etc, even on the same HD, correct?

That's all for now.o
_________________
desultory wrote:
If you want to retain credibility as a functional adult; when you are told that you are acting boorishly, the correct response is to consider that possibility and act accordingly to correct that behavior.


Amen.


Last edited by johngalt on Tue Jun 26, 2018 4:24 am; edited 1 time in total
Back to top
View user's profile Send private message
Hu
Moderator
Moderator


Joined: 06 Mar 2007
Posts: 13831

PostPosted: Tue Jun 26, 2018 1:46 am    Post subject: Re: Using LVM + uEFI secure boot - a couple of questions Reply with quote

johngalt wrote:
I could extend the LVM onto the new drive and then extend my / partition to use the new space, or else add new partitions and move stuff around as I see fit.
Is this a valid assumption on my part?
Yes, LVM lets you extend one logical filesystem across multiple physical devices.
johngalt wrote:
these are machines that I am using solely at home and solely for the purpose of re-familiarizing myself with Gentoo, my gut tells me that I don't really need LUKS at the moment, and to keep my learning curve at a tolerable level I can just ignore using it now and worry about it later on.
This is partly true. LUKS is useful for combating anyone who takes physical possession of the drives without your permission. If property theft crimes are a serious concern in your area, you might want to care about LUKS. If burglaries are rare to non-existent, you can probably ignore LUKS.

As for "worry about it later": You cannot convert a drive in-place to add or remove LUKS. If you want to use it later, your choices are to start with it now, or accept discarding everything in the space that is later reclassified as a LUKS volume. Of course, if you realistically expect you will never want to use LUKS on the drive, installing without it is fine.
johngalt wrote:
Does LUKS introduce any overhead when the system is in actual use, or is it only using CPU cycles at boot and shutdown / reboot?
LUKS is on-the-fly encryption/decryption as the drive is accessed. That necessarily implies some level of overhead. I doubt the overhead will be sufficient to matter to you, but it does exist during routine drive access.
johngalt wrote:
Is it possible to also use genkernel / genkernel-next to build the entire kernel that will create a vmlinuz file that I can then use to bot via UEFI?
Basic Linux can do this. I cannot say whether genkernel can let you access this functionality, but I would expect the answer to be yes.
johngalt wrote:
Using efibootmgr, once I get a default, working kernel, I can create additional entries that II would access through the UEFI manager for alternate systems, kernel testing, desktop vs CLI, etc, even on the same HD, correct?
Assuming your firmware is not garbage, yes, that should work. Some vendors are known for shipping firmware that is just barely adequate for basic usage, and completely inadequate for advanced usage. I cannot say whether the machines you intend to use are likely to be in that category.
Back to top
View user's profile Send private message
russK
l33t
l33t


Joined: 27 Jun 2006
Posts: 630

PostPosted: Tue Jun 26, 2018 2:11 am    Post subject: Re: Using LVM + uEFI secure boot - a couple of questions Reply with quote

On this point:
Hu wrote:
johngalt wrote:
Is it possible to also use genkernel / genkernel-next to build the entire kernel that will create a vmlinuz file that I can then use to bot via UEFI?[/b]
Basic Linux can do this. I cannot say whether genkernel can let you access this functionality, but I would expect the answer to be yes.


I know this to be the case, I have done it over and over :D
genkernel builds a kernel the same as doing it manually.

Regards
Back to top
View user's profile Send private message
johngalt
Apprentice
Apprentice


Joined: 09 Sep 2004
Posts: 258
Location: 3rd Rock

PostPosted: Tue Jun 26, 2018 3:14 am    Post subject: Reply with quote

@Hu - Thanks for the answers. I don't live in a high crime area, and these are test-beds for me - I'm re-learning my way around Gentoo, and figured I'd dive straight into the deep end of the pool and tackle tougher projects like direct uEFI booting vs using a boot manager like Grub2 (and have decided to not use rEFInd since the Dell is no longer going to my father - I gave him a much newer Acer with Windows 10 on it, and h is happy). So, even if they were to be purloined from my house, no significant data on there for thieves, and the overall valuation of each laptop is significantly low due to age - even the SSDs in them are cheap these days.

As for doing it later, yeah, I knew it wasn't going to be an in-place upgrade of any type - If the need arises for me to learn how it works / I decided that it is a good time to tackle it as the next step in my learning process, I'll copy any files I need off the machine and wipe the drive and start over.

@russK - I ran genkernel over the weekend on both machines and neither produced a file that explicitly had vmlinuz in the name, so I either did something wrongly, or else I didn't realize that one of the files copied to /boot was, in fact, the correct file to use for efi boot.

Which file am I supposed to copy over to the ESP under /efi/boot/ in order to use efimanager to add it to the uEFI bootmanager?
_________________
desultory wrote:
If you want to retain credibility as a functional adult; when you are told that you are acting boorishly, the correct response is to consider that possibility and act accordingly to correct that behavior.


Amen.
Back to top
View user's profile Send private message
charles17
Advocate
Advocate


Joined: 02 Mar 2008
Posts: 2613

PostPosted: Tue Jun 26, 2018 3:34 am    Post subject: Re: Using LVM + uEFI secure boot - a couple of questions Reply with quote

johngalt wrote:
Using efibootmgr, once I get a default, working kernel, I can create additional entries that II would access through the UEFI manager for alternate systems, kernel testing, desktop vs CLI, etc, even on the same HD, correct?

The Dell possibly has its own tool for managing the boot items. So it could do without efiboootmgr.
On the https://wiki.gentoo.org/wiki/Dell_Latitude_E6430_%28CYRTRY1%29 I am having problems handling the initramfs as a separate file. Having the initramfs embedded in the kernel works fine.
Back to top
View user's profile Send private message
russK
l33t
l33t


Joined: 27 Jun 2006
Posts: 630

PostPosted: Tue Jun 26, 2018 3:44 am    Post subject: Reply with quote

johngalt wrote:
@russK - I ran genkernel over the weekend on both machines and neither produced a file that explicitly had vmlinuz in the name, so I either did something wrongly, or else I didn't realize that one of the files copied to /boot was, in fact, the correct file to use for efi boot.

Which file am I supposed to copy over to the ESP under /efi/boot/ in order to use efimanager to add it to the uEFI bootmanager?


johngalt,

I encourage you to check the handbook to see if this is covered better there, I suspect it's almost completely covered (I'm unsure about the initramfs part). But, I used to use reFind (before I switched back to grub for no special reason), and my refind notes might be fairly close to what you need. This is the best I can offer and it might be helpful but again, check the handbook. My notes file follows:
Code:
## !!!! When upgrading the kernel, don't forget to emerge nvidia-drivers !!!!!
# genkernel --makeopts=-j9 --menuconfig --lvm --luks --mdadm --real-root=/dev/mapper/vg1-rootfs all && emerge @module-rebuild
# grub is not used anymore, using refind now
#  && grub-mkconfig -o /boot/grub/grub.cfg
##
## For refind, PUT NEW KERNELS in the gentoo subdirectory of the EFI partition
## This is so that reFind can find them
#
#################################################################
#
## Name the kernel with a .efi extension
## Name the initramfs with a .img extension
# MAKE SURE /boot/EFI is mounted for these :
########################################
for k in $(ls /boot/kernel-genkernel*gentoo)
do
    mv $k /boot/EFI/EFI/gentoo/$(basename ${k}).efi
done
for i in $(ls /boot/initramfs*gentoo)
do
    mv $i /boot/EFI/EFI/gentoo/$(basename ${i}).img
done
for s in $(ls /boot/System.map-genkernel*gentoo)
do
    mv $s /boot/EFI/EFI/gentoo/$(basename $s)
done
########################################


You can see my little script at the end was renaming and moving the files to the EFI directory. I had an extra EFI/EFI from having two separate filesystems at one point. This worked well for refind. Maybe it is helpful for you or someone else someday.

HTH
Back to top
View user's profile Send private message
johngalt
Apprentice
Apprentice


Joined: 09 Sep 2004
Posts: 258
Location: 3rd Rock

PostPosted: Tue Jun 26, 2018 4:20 am    Post subject: Reply with quote

@Charles17 - Yeah it does, but the interface limits the number of characters I can use for a path to the .efi files - mine looks almost exactly like an old Phoenix BIOS screen except that it is actually uEFI. And unless the path is exactly or shorter in length than /efi/boot/bootx64.efi I cannot use it.

But I already verified that I could interface with the Dell via efibootmgr because I used it (booted off SystemRescueCD) to remove entries from the uEFI list that I will never use, such as a portable floppy drive and add a test entry on the last install iteration on this machine, and sure enough, the next time I rebooted the machine and entered the uEFI interface, that fd entry was gone and the one I had created was now there.

So I am happy to use efibootmgr to set my items up - in fact, I'll probably set up at least one fallback, as well as a couple of test entries for testing new kernels and the like, and a basic kernel for CLI only with SSH so I can continue to work on it via SSH until I get my replacement screen put on.

As for the initramfs - https://wiki.gentoo.org/wiki/EFI_stub_kernel#Optional:_Initramfs says it can be done either way, so I was going to try that first, but seeing as how my uEFI looks even older than yours, it might just be that Dell uEFI prior to last year is just FUBAR and I'll have to embed it anyway as you did. But at least that will be easy enough.

Plus, this is all a learning experience for me, so the more things break the more I get to find answers, from all the resources available - including you guys here on the forums...

Can't count the number of times these past few weeks I've had a question, googled it and got pointed to a particular forum topic that answered what I was going to ask lol.

Thanks for your advice - I'll keep it all in mind as I plow forward.

@russK - OK, thanks. I've gone through a few genkernel pages, the handbook, (which is not geared directly toward uEFI booting but touches on it briefly) and several threads in the forum, but only found one reference to copying a bZimage file - which was not at the location that the page said it should be at. But I'm well aware that it very well was PEBKAC :D

Anyhoo, since I am doing both laptops at the same time (and the neat thing is that even with the Dell screen not working, after booting from SRCD on the Lenovo and only changing root pw and enabling a titled screen, I started doing everything else from my desktop via ssh into the Lenovo. So, without being able to see anything, I also booted SRCD on the Dell and waited a good while to ensure it had completely booted, did the exact same there, and am able to also SSH into it. Of course, it helps that I use static IPs on the DHCP server in my Mesh kit for all my devices....) I'm currently manually configuring the kernel on the Lenovo only, configuring the parts of the kernel that are going to be the same on both machines, e.g. the required items for LVM support and use, filesystem support, etc.

Then I'll save the .config, SCP to the Dell, so I only have to finish the config specific to each machine.
_________________
desultory wrote:
If you want to retain credibility as a functional adult; when you are told that you are acting boorishly, the correct response is to consider that possibility and act accordingly to correct that behavior.


Amen.
Back to top
View user's profile Send private message
johngalt
Apprentice
Apprentice


Joined: 09 Sep 2004
Posts: 258
Location: 3rd Rock

PostPosted: Tue Jun 26, 2018 4:24 am    Post subject: Reply with quote

I'm marking this solved as all of my original questions have been answered, but please, if anyone wants to contribute to the thread, feel free to enlighten me - I'm more rusty at this, which I haven't touched in 13 years, than I am at playing tennis, which I recently took back up - and it has been almost 20 years for that :)
_________________
desultory wrote:
If you want to retain credibility as a functional adult; when you are told that you are acting boorishly, the correct response is to consider that possibility and act accordingly to correct that behavior.


Amen.
Back to top
View user's profile Send private message
russK
l33t
l33t


Joined: 27 Jun 2006
Posts: 630

PostPosted: Thu Jun 28, 2018 2:50 am    Post subject: Reply with quote

johngalt wrote:
@russK - OK, thanks. I've gone through a few genkernel pages, the handbook, (which is not geared directly toward uEFI booting but touches on it briefly) and several threads in the forum, but only found one reference to copying a bZimage file - which was not at the location that the page said it should be at. But I'm well aware that it very well was PEBKAC :D

johngalt,
I only suggested to check the handbook in case you had not and also to remind future readers. If the instructions are not clear there now, they should be and could get added in the meantime.
I'm glad your questions have been answered.
One question of mine has never been answered and perhaps never will be, who is this guy, John Galt? :wink:
Regards
Back to top
View user's profile Send private message
johngalt
Apprentice
Apprentice


Joined: 09 Sep 2004
Posts: 258
Location: 3rd Rock

PostPosted: Thu Jun 28, 2018 3:56 pm    Post subject: Reply with quote

No, your script told me that I was, in fact, not really reading carefully enough. The script, in and of itself, told me exactly what needed to go where - and if I still had those compiled files around I would have use it as a template to copy those files as needed.

In first starting all of this new learning experience, I decided that the Dell, the first machine I tackled, would be a rEFInd machine. But tracking back and forth between various different pages as I attempted to get the base system working left me a little FUBARd because, doing things the rEFInd way, I was supposed to mount /boot/efi to the ESP, whereas every other resource (including the Gentoo rEFInd wiki itself @ https://wiki.gentoo.org/wiki/Refind ) uses /boot as the mount point. But Rob says in the rEFInd pages that you can use /boot as the mount point with no issues, just adjust his instructions accordingly. In making the transitions between several pages trying to get everytihing installed, I managed to goof it up - multiple times.

As this was as much for a learning experience for me as it was for getting the laptop ready to deliver, I kept at it - over and over (3 attempts). Finally, when the screen gave way, I started working on the Lenovo, which, thogh also uEFI based, was a completley different machine - all AMD based versu the Dell being all Intel based.

That got me to thinknig on how I could refine my current work process, and so I started noticing where files could be used across machines - for example, my make.conf - the only thing that changes between the machines (for now) is that I have differing hardware, so CPUflags, video, and MAKEOPTS (and between the two laptops, MAKEOPTS is the same as both are dual core CPUs with no virtual cores). I tried using CPU specific -march and it broke tingson my Dell when emerging stuff, so I went back to the default native, which I am using everywhere until I can test on working, booting systems if going CPU specific gives me any advantage at all (without brekaing anything lol).

As I was configuring the kernel on the Lenovo, I realized that if I configured everything else that I wanted / needed in terms of system setup, like filesystems, etc. and leave off the hardware specific entries, I could easily also copy that .config ove rto hte Dell and save myself a lot of time. If you will, it's like a mini-pappy-seed, only for my strict personal use. Shortened my workload again - a lot of stuff I don't have to configure on the Dell, because I already have.

Then, after only a single failed install attempt on the Lenovo, I realized that I can streamliine it even more - instead of having to refer to so many different pages, if I add a bit of uniformity to my installs, I can make my own 'document' to perform installs, following all the required steps in order but also making sure that I add in the correct steps from other pages as needed for my install, with all the extra caveats that I might need (for example, writing down the altered mount steps needed if booting from an ubuntu live disc versus a gentoo-based distro like srcd or a direct gentoo live disc). Now that I have that document partially completeled (all the way through kernel config), it's made it even easier - I have my flow and in less than an hour (or a couple of hours if I perform the optional first emerge --deep @world after profile change) I'm on to configuring bootloaders.

At any rate, your script did help me out a lot, and that is why I said I realized it was a PEBKAC moment - I had the files, but because more than one reference said to copy the vmlinuz-named file as an .efi file, I got lost. With rEFInd, it has its own .efi file, and then is able to boot whichever kernel you point it to - which was the initial reason I opted to use it - but my frustration at the getting the actual local boot process to work led me to abandon it, especially when I read further about how efibootmgr works, and after verifying that efibootmgr was able to successfully interact with both uEFI systems on the laptops.

At any rate, though, I'm now also tackling my desktop, having made a full backup of he partitions that Windows was installed to, so I'm probably going to tackle each machine slightly differently - the desktop is BIOS based, so obviously, no efibootmgr / rEFInd. the Dell is by far the slowest machine of the group, so it will probably get genkerneled and I'll call it a day, as rEFInd on a mchine that has no worknig scren is a bit .. pretentious. lol.

The Lenovo - not 100% sure yet. I think I'm going to go the efibootmgr route on it as well, and boot kernels directly, as the kernel compile time on it is 1/4 that of the ell. But I haven't ruled out rEFInd, as it would be the only machine I currently have that I can actually use rEFInd on.

Regardless, though, I do sincerely thank you for your insight and your notes - they helped me a lot.
_________________
desultory wrote:
If you want to retain credibility as a functional adult; when you are told that you are acting boorishly, the correct response is to consider that possibility and act accordingly to correct that behavior.


Amen.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Installing Gentoo All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum