setupLockingRange & setup initramfs-tools on an existing system?

[Demetrio92]

I don't quite understand why can't I simply do

1) sedutil-cli --setupLockingRange 1 $RANGE_START $RANGE_LENGTH $PASS $DEVICE 2) setup initramfs-tools to ask for the password for the drive if it is locked on boot

My partition table is already pretty much the way it would be expected.

$ lsblk
NAME          MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
nvme0n1       259:0    0   1.8T  0 disk  
├─nvme0n1p1   259:1    0  1022M  0 part  /boot/efi
├─nvme0n1p2   259:2    0     4G  0 part  /recovery
├─nvme0n1p3   259:3    0   1.8T  0 part  /
└─nvme0n1p4   259:4    0     4G  0 part  
  └─cryptswap 253:0    0     4G  0 crypt [SWAP]

[fornellas]

TBH, it may just work, assuming your partition scheme is fit, I just haven't tried that myself :-D If you figure out a working recipe, I'm happy to merge a PR updating the documentation with your working recipe.

[Demetrio92]

I managed to encrypt without reinstalling, although I bricked my system twice in the process.

Whoever wants to repeat this journey

1. back up the full drive: sudo dd if=/dev/nvme0n1 status=progress bs=1M | gzip -c --best > /DIFFERENT_DRIVE/full_disk.img.gz

2. learn how to chroot (guide for pop os, seems fairly generic though)

---

I can't verify if this will work from scratch, but definitely dding into an already initialized drive worked. Most importantly, though, the order of operations should be swapped compared to the original guide, and you shouldn't doing any of that from the booted system

0. enable tpm: sudo kernelstub -a "libata.allow_tpm=1" or any other way of setting kernel prams

1. boot into a live USB

2. chroot

3. set up boot hooks

   git clone https://github.com/fornellas/tcg_opal_rootfs
   cd tcg_opal_rootfs/
   git submodule init
   git submodule update
   make
   sudo make install

4. exit chroot, umount your nvme

5. encrypt

sedutil-cli --initialsetup $PASS $DEVICE
sedutil-cli --setMBREnable off $PASS $DEVICE
sedutil-cli --setupLockingRange 1 $RANGE_START $RANGE_LENGTH $PASS $DEVICE
sedutil-cli --enablelockingrange 1 $PASS $DEVICE

6. reboot into the target system

---

I've spent most of my time troubleshooting various intricacies of sedutil-cli. PSA: take a picture of your NVMe. You might need that PSID code that's printed on it.

Everything was tested on pop os 22.04 with ubuntu 22.04 live for chroot

[adrian5]

Thanks for the feedback Demetrio!

[fornellas]

Thanks @Demetrio92 , from the looks of it:

• This section would be a function of "whatever state the drive was before", and is probably the trickiest to get right in the general case, without risking blowing up existing data.
• This section is highly dependant on how the drive was previously partitioned. I'm not sure again, if in the general case it is possible to have a safe set of instructions for it.

While I acknowledge that in some cases, with enough knowledge it is definitely possible to setup things non-destructively, it is very hard to generalise the solution.

I'm gonna close this issue, as it seems to be "impossible" to implement generically. If you feel differently, please cut a PR with your ideas.

The shared steps here can be a good reference for more "adventurous" people anyway :-D

[fornellas]

https://github.com/fornellas/tcg_opal_rootfs/commit/54be7e38d8b91ad72357940c30c523a3ce228401

I learned the hard way that, altering the locking range essentially crypto-erases it, so it seems there's no clear path towards tweaking the locking range over a pre-existing system.

[mjm987]

So if I correctly understand, it should be sufficient to save/restore only the EFI partition on the live system by 'dd' just before/after executing 'sedutil-cli --setupLockingRange ...' ? And this way you also could easily change the size of the EFI partition?

[fornellas]

I suppose that's theoretically possible, though it is super error prone, I'd not try anything like that without having full backups.