Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #227711 > unrolled thread

Encrypting boot partition in guest results in boot failure libvirt qemu-kvm

Started byjohn doe <johndoe65534@mail.com>
First post2020-10-09 19:30 +0200
Last post2020-10-13 13:10 +0200
Articles 6 — 2 participants

Back to article view | Back to linux.debian.user

Contents

  Encrypting boot partition in guest results in boot failure libvirt  qemu-kvm john doe <johndoe65534@mail.com> - 2020-10-09 19:30 +0200
    Re: Encrypting boot partition in guest results in boot failure  libvirt qemu-kvm Charles Curley <charlescurley@charlescurley.com> - 2020-10-09 21:50 +0200
      Re: Encrypting boot partition in guest results in boot failure  libvirt qemu-kvm john doe <johndoe65534@mail.com> - 2020-10-10 08:10 +0200
        Re: Encrypting boot partition in guest results in boot failure  libvirt qemu-kvm Charles Curley <charlescurley@charlescurley.com> - 2020-10-10 18:00 +0200
          Re: Encrypting boot partition in guest results in boot failure  libvirt qemu-kvm john doe <johndoe65534@mail.com> - 2020-10-10 18:30 +0200
            Re: Encrypting boot partition in guest results in boot failure  libvirt qemu-kvm john doe <johndoe65534@mail.com> - 2020-10-13 13:10 +0200

#227711 — Encrypting boot partition in guest results in boot failure libvirt qemu-kvm

Fromjohn doe <johndoe65534@mail.com>
Date2020-10-09 19:30 +0200
SubjectEncrypting boot partition in guest results in boot failure libvirt qemu-kvm
Message-ID<AY4nn-4qf-1@gated-at.bofh.it>
Debians,

I'm using libvirt with qemu-kvm to install Debian Buster VM with
encrypted lvm.
The installation and booting the guest works fine.

Now I would like to encrypt the boot partition,, I can succesfully
encrypt the boot partition.
As soon as I restart the guest, I can no longer access the guest as it
will not boot at all.


Doing this process on an other host but directly invoking qemu works
flowlessly.

Is there something that I need to change in the domain xml?


Obviously, I'm missing something, any input on what is welcome.


--
John Doe

[toc] | [next] | [standalone]

#227712 — Re: Encrypting boot partition in guest results in boot failure libvirt qemu-kvm

FromCharles Curley <charlescurley@charlescurley.com>
Date2020-10-09 21:50 +0200
SubjectRe: Encrypting boot partition in guest results in boot failure libvirt qemu-kvm
Message-ID<AY6yS-5HL-7@gated-at.bofh.it>
In reply to#227711
On Fri, 9 Oct 2020 19:28:59 +0200
john doe <johndoe65534@mail.com> wrote:

> Now I would like to encrypt the boot partition,, I can succesfully
> encrypt the boot partition.
> As soon as I restart the guest, I can no longer access the guest as it
> will not boot at all.

Are you not even getting to the grub boot loader? If you are, I suspect
you need to set up grub to handle the encrypted boot partition.

-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [next] | [standalone]

#227713 — Re: Encrypting boot partition in guest results in boot failure libvirt qemu-kvm

Fromjohn doe <johndoe65534@mail.com>
Date2020-10-10 08:10 +0200
SubjectRe: Encrypting boot partition in guest results in boot failure libvirt qemu-kvm
Message-ID<AYgeR-3E3-3@gated-at.bofh.it>
In reply to#227712
On 10/9/2020 9:45 PM, Charles Curley wrote:
> On Fri, 9 Oct 2020 19:28:59 +0200
> john doe <johndoe65534@mail.com> wrote:
>
>> Now I would like to encrypt the boot partition,, I can succesfully
>> encrypt the boot partition.
>> As soon as I restart the guest, I can no longer access the guest as it
>> will not boot at all.
>
> Are you not even getting to the grub boot loader? If you are, I suspect
> you need to set up grub to handle the encrypted boot partition.
>

No, I'm not even getting the grub bootloader.

Is it working for you?

--
John Doe

[toc] | [prev] | [next] | [standalone]

#227715 — Re: Encrypting boot partition in guest results in boot failure libvirt qemu-kvm

FromCharles Curley <charlescurley@charlescurley.com>
Date2020-10-10 18:00 +0200
SubjectRe: Encrypting boot partition in guest results in boot failure libvirt qemu-kvm
Message-ID<AYprP-19g-5@gated-at.bofh.it>
In reply to#227713
On Sat, 10 Oct 2020 08:06:16 +0200
john doe <johndoe65534@mail.com> wrote:

> No, I'm not even getting the grub bootloader.

If you aren't even getting to to GRUB, then your problem isn't an
encrypted /boot partition, it's something else. Possibly something you
did in the process of encrypting /boot. Possibly a limitation in
libvirt.

> 
> Is it working for you?

No. I have looked at the process but not tried it yet. I will probably
experiment with a Bullseye installation.

-- 
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

[toc] | [prev] | [next] | [standalone]

#227716 — Re: Encrypting boot partition in guest results in boot failure libvirt qemu-kvm

Fromjohn doe <johndoe65534@mail.com>
Date2020-10-10 18:30 +0200
SubjectRe: Encrypting boot partition in guest results in boot failure libvirt qemu-kvm
Message-ID<AYpUS-1z3-3@gated-at.bofh.it>
In reply to#227715
On 10/10/2020 5:10 PM, Charles Curley wrote:
> On Sat, 10 Oct 2020 08:06:16 +0200
> john doe <johndoe65534@mail.com> wrote:
>
>> No, I'm not even getting the grub bootloader.
>
> If you aren't even getting to to GRUB, then your problem isn't an
> encrypted /boot partition, it's something else. Possibly something you
> did in the process of encrypting /boot. Possibly a limitation in
> libvirt.
>

Okay, I have installed Debian Buster encrypted lvm using virt-install,
done the commands to encrypt the boot partition.
If I boot the VM with qemu directly, it works as I would expected to but
as long as I use Libvirt it does not.

With apparmor disabled, I as you conclude that the issue is libvirt related.

I'm not seeing anything in the log that would indicate where the issue lies.

>>
>> Is it working for you?
>
> No. I have looked at the process but not tried it yet. I will probably
> experiment with a Bullseye installation.
>

Installing the VM with encrypted lvm is straight forward making the root
partition encrypted and working well.

--
John Doe

[toc] | [prev] | [next] | [standalone]

#227763 — Re: Encrypting boot partition in guest results in boot failure libvirt qemu-kvm

Fromjohn doe <johndoe65534@mail.com>
Date2020-10-13 13:10 +0200
SubjectRe: Encrypting boot partition in guest results in boot failure libvirt qemu-kvm
Message-ID<AZqlQ-69n-17@gated-at.bofh.it>
In reply to#227716
On 10/10/2020 6:25 PM, john doe wrote:
> On 10/10/2020 5:10 PM, Charles Curley wrote:
>> On Sat, 10 Oct 2020 08:06:16 +0200
>> john doe <johndoe65534@mail.com> wrote:
>>
>>> No, I'm not even getting the grub bootloader.
>>
>> If you aren't even getting to to GRUB, then your problem isn't an
>> encrypted /boot partition, it's something else. Possibly something you
>> did in the process of encrypting /boot. Possibly a limitation in
>> libvirt.
>>
>
> Okay, I have installed Debian Buster encrypted lvm using virt-install,
> done the commands to encrypt the boot partition.
> If I boot the VM with qemu directly, it works as I would expected to but
> as long as I use Libvirt it does not.
>
> With apparmor disabled, I as you conclude that the issue is libvirt
> related.
>
> I'm not seeing anything in the log that would indicate where the issue
> lies.
>
>>>
>>> Is it working for you?
>>
>> No. I have looked at the process but not tried it yet. I will probably
>> experiment with a Bullseye installation.
>>
>
> Installing the VM with encrypted lvm is straight forward making the root
> partition encrypted and working well.
>

Thanks to the libvirt folks (1), I got it working by doing:

Add those two lines in the domain xml in the os section

   <os>
     ....
     <bootmenu enable='yes'/>
     <bios useserial='yes'/>
   </os>


The package 'sgabios' may also be needed.


1)  https://www.redhat.com/archives/libvirt-users/2020-October/msg00052.html

--
John Doe

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web