Pmbootstrap: Make full disk encryption optional

[ollieparanoid]

For performance reasons, the full disk encryption should become optional.

Required changes:

• pmbootstrap install:
  
  
  
  • Add a --no-fde switch (or something like that)
  
  
  • Always assign a partition label to the postmarketOS root partition (this is something we should do anyway)
  
  
• postmarketos-mkinitfs:
  
  
  
  • Instead of searching for a cryptsetup partition, find the postmarketOS root partition by device label
  
  
  • When it was found, check whether it is encrypted or not. If it isn't, directly boot from it
  
  

[PMaynard]

I would advise this to be opt-out by default. Thoughts?

[ollieparanoid]

As in: you need to explicitly disable encryption? That's how I would like to have it, too.

[PabloCastellano]

I'm working on it here

https://github.com/PabloCastellano/pmbootstrap/tree/optional_full_disk_encryption

[ollieparanoid]

Short update: the code from your PR made my i9100 go into a boot loop (which has to do with its sdcard, and the way mount_subpartitions() mounts all partitions from the sdcard twice, so the right one needs to be used to mount as real root file system, because the other one will appear as busy).
I'll try to put a better documentation in the source. Also the telnet hook did not work anymore with the unencrypted root file system, because /dev/pts only gets mounted in the usb-unlock hook.

I'm refactoring this, so it works for the i9100 and the telnet hook is also working. And it is understandable, that this broke, because it is really hard to test. I am grateful for your contribution! This is just to let you know why mainlining it will take some more time.

While I'm working on this, I have documented initramfs development (and as an excuse to store my script for testing there). I have also added this ticket to my Milestones list.

[PabloCastellano]

Hi. I'm sorry to hear that. Tell me how can I help you.
I don't have any device with sdcard to test it. Can you paste the output of the kpartx -l command? Do you need some testing with something else?

[ollieparanoid]

I don't have the output right here, but if you want to help testing, I could tell you when I refactored that sd-card related part, then you could test it. That feedback would be very valuable :)

[ollieparanoid]

I have refactored it! But I need to rebase the branch on master, lots of conflicts now. Anyway, if you want to, you can already test it:

https://github.com/postmarketOS/pmbootstrap/tree/optional-full-disk-encryption

(I'd like to have the rebased version tested by 2 or 3 people, before we push it to master.)

[MartijnBraam]

I just build and flashed my hammerhead from the optional-fde branch and it seems to work perfectly