Clevis

This material is work-in-progress ... Do not follow instructions here until this notice is removed. (Last edited by Pursuable1652 on 30 Dec 2024.)

What is clevis

It is a software that allows to encrypt/decrypt a disk by bounding to tang (network bound encryption/decryption) or a TPM (hardware chip encryption/decryption).

It is in use in redhat fedora systems

Why use clevis

With tang, you may automatically decrypt device block/files for convenience, it is encrypted and built to prevent man-in-the-middle attacks as well, since nobody gets private key, only an always changing advertised timed key.

• It is recommended to use a tang docker with this, you can use this for example: github or gitlab

Auto Disk decryption using clevis + tang

You need to run tang in a separate server, from the one you want to decrypt. I recommend running a tang server on a docker.

mkinitfs + kernel-hooks + secureboot-hook

Todo: write guide

Using mkinitfs, it is possible to force tang/clevis in initramfs generation. It is recommended to make a chroot or docker so you don't mess with your system files, and by adding these files:

Todo: The init script is too big to put in wiki, I just acquired it from initramfs generation and decompression (read the tip below)

Note: the APK package "cryptsetup" comes with veritysetup

apk add cryptsetup

Note: make sure the chroot has a linux-kernel

Edit /sbin/mkinitfs (put "# Copy custom init" before "# copy modloop signature"):

Contents of /etc/mkinitfs

... # Copy custom init cp /initramfs/init "$tmpdir"/init # copy modloop signature ...

PUT "# Clevis + tang script" AFTER "ebegin "Mounting root""

Contents of /initramfs/init

... ebegin "Mounting root" # Clevis + tang script # work in progress ...

Contents of /etc/mkinitfs/features.d/curl.files

/usr/bin/curl

Contents of /etc/mkinitfs/features.d/clevis.files

/usr/bin/clevis*

Contents of /etc/mkinitfs/mkinitfs.conf

... features="... curl clevis" ...

Then just do:

apk add secureboot-hook gummiboot gummiboot-efistub efibootmgr kernel-hooks secureboot-hook

Tip: To make sure initramfs has the scripts needed, do:

mkinitfs -c /etc/mkinitfs/mkinitfs.conf -b / $(uname -r)

Decompress:

mkdir /tmp/initramfs cd /tmp/initramfs zcat /boot/initramfs-$KERNEL | cpio -idmv

Test if "init" works by just executing it and see how it runs:

./init

---

dracut

Todo: write guide

External sources

• https://fedoramagazine.org/using-linux-system-roles-to-implement-clevis-and-tang-for-automated-luks-volume-unlocking/
• https://www.admin-magazine.com/Archive/2018/43/Automatic-data-encryption-and-decryption-with-Clevis-and-Tang
• https://wiki.archlinux.org/title/Clevis
• https://man.archlinux.org/man/clevis-encrypt-tang.1.en
• https://github.com/latchset/clevis/blob/master/src/pins/tang/clevis-encrypt-tang.1.adoc