Full disk encryption
Also known as FDE for short.
If your device has a
Y in the FDE column of the all devices table, you can enable full disk encryption with the
Needs to be ported to devices individually following this https://wiki.postmarketos.org/wiki/Osk-sdl#Porting_to_New_Devices
Changing Luks Password
To change your luks password, connect your phone's storage medium to a Linux computer with cryptsetup installed.
Run the following command:
sudo cryptsetup luksChangeKey <target-device> -S 0
I can get the target device by running the
lsblk command. For example, if my storage medium's partition table looked like:
sde 8:64 1 14.7G 0 disk
├─sde1 8:65 1 110M 0 part
└─sde2 8:66 1 14.6G 0 part
To change my password, I would run:
sudo cryptsetup luksChangeKey /dev/sde2 -S 0
Mounting Additional Encrypted Drives At Boot
As per the following from Alpine and pmOS: https://wiki.alpinelinux.org/wiki/LVM_on_LUKS#Mounting_additional_encrypted_filesystems_at_boot and https://wiki.postmarketos.org/wiki/Fstab
This process will need a Key File that has the password to the encrypted drive.
Generating and/or saving the Key File to be accessible for dmcrypt
Known password to the LUKS drive, below it is listed in
/etc/ but the saving directory can be anywhere but needs to be only accessible to root, same with the storing folder for the key:
# mkdir /etc/luks-keys # chmod +s /etc/luks-keys # echo "<luks-password>" > /etc/luks-keys/<keyfile-name> # chmod 600 /etc/luks-keys/<keyfile-name>
Randomly generated password (from Alpine):
# dd bs=512 count=4 if=/dev/urandom of=/root/crypt-home-keyfile.bin # cryptsetup luksAddKey /dev/sdb1 /root/crypt-home-keyfile.bin
Mounting the encrypted drive
Alpine and pmOS, like Gentoo, uses the
dmcrypt service rather than
Install and enable the following:
# apk add cryptsetup cryptsetup-openrc # rc-update add dmcrypt boot
Add the following lines to
key='<location and name of saved key file from section above, eg /etc/luks-keys/<keyfile-name>>'
Now fstab needs to be enabled and the drive added to the list:
# rc-update add localmount default
/etc/fstab with the information from dmcrypt:
/dev/mapper/<mounting-name> /<mounting-location, eg /home/> auto nosuid,nodev,nofail,x-gvfs-show 0 2
Touchscreen works but you can't see what you are typing. Use a keyboard and an OTG cable to enter the password and unlock it. You can also see the phone is still alive by switching with Ctrl + Alt + F1 ~ F6. FDE prompt is usually on second console(F2).
msm-fb-refresher to solve the issue:
# apk add msm-fb-refresher # mkinitfs