Example: Encrypting a Linux LVM Volume

In Linux, Logical Volume Manager (LVM) is a device mapper target that provides logical volume management for the Linux kernel. You can use the same hcl add and hcl encrypt commands to register an LVM volume to KeyControl, but the Policy Agent cannot stamp a GUID on LVM volumes, unlike MBR partitions such as sdb1. Therefore an LVM cannot be migrated across VMs because that process requires a GUID.

The following examples show the process of registering a new LVM volume and a volume with existing data.

Registering a New LVM Volume

# lvs
  LV   VG     Attr     LSize    Pool Origin Data%  Meta%  Move Log Cpy%Sync Convert
  datalv hytrust-vg -wi-a-----  100.00m
  root   sub1504-vg -wi-ao----    6.73g
  swap_1 sub1504-vg -wi-ao---- 1020.00m

# hcl status
Summary
--------------------------------------------------------------------------------
KeyControl: skc1:443
KeyControl list: skc1:443
Status: Connected

Registered Devices
--------------------------------------------------------------------------------
Disk Name         Clear                             Cipher      Status
--------------------------------------------------------------------------------

Encrypted Folders
--------------------------------------------------------------------------------
Folder Name       fsid                              Cipher      Status
--------------------------------------------------------------------------------

Available Devices
--------------------------------------------------------------------------------
Disk Name           Device Node                     Size (in MB)
--------------------------------------------------------------------------------
hytrust--vg-datalv  /dev/dm-2                       100

Other Devices
--------------------------------------------------------------------------------
Disk Name           Device Node                     Status
--------------------------------------------------------------------------------
sda1                /dev/sda1                       Mounted (/boot)
sdb                 /dev/sdb                        LVM (hytrust-vg)
sda5                /dev/sda5                       LVM (sub1504-vg)
sub1504--vg-root    /dev/dm-0                       Mounted (/)
sub1504--vg-swap_1  /dev/dm-1                       Mounted (swap)

# hcl add hytrust--vg-datalv
WARNING: device hytrust--vg-datalv will be added but will not have unique ID that ensures detection if disks are reordered or moved.
WARNING: This operation will destroy the contents of the disk.
If you wish to preserve them, run "hcl encrypt" instead.
Do you want to proceed? (y/n) y
Encrypted device hytrust--vg-datalv (/dev/dm-2) attached; decrypted contents visible at /dev/mapper/clear_hytrust--vg-datalv

Creating file system ext3 on /dev/mapper/clear_hytrust--vg-datalv
--------------------------------------------------------------------------------
mke2fs 1.42.12 (29-Aug-2014)
Creating filesystem with 102400 1k blocks and 25688 inodes
Filesystem UUID: d3d987b4-4773-4e15-995d-a1669603db0a
Superblock backups stored on blocks:
    8193, 24577, 40961, 57345, 73729

Allocating group tables: done
Writing inode tables: done
Creating journal (4096 blocks): done
Writing superblocks and filesystem accounting information: done
--------------------------------------------------------------------------------

# hcl status
Summary
--------------------------------------------------------------------------------
KeyControl: skc1:443
KeyControl list: skc1:443
Status: Connected

Registered Devices
--------------------------------------------------------------------------------
Disk Name         Clear                             Cipher      Status
--------------------------------------------------------------------------------
hytrust--vg-datalv/dev/mapper/clear_hytrust--vg-datalvAES-XTS-512 Attached
 '--> auto_attach=ENABLED, attach_handler=DEFAULT, detach_handler=DEFAULT

Encrypted Folders
--------------------------------------------------------------------------------
Folder Name       fsid                              Cipher      Status
--------------------------------------------------------------------------------

Available Devices
--------------------------------------------------------------------------------
Disk Name           Device Node                     Size (in MB)
--------------------------------------------------------------------------------

Other Devices
--------------------------------------------------------------------------------
Disk Name       Device Node                     Status
--------------------------------------------------------------------------------
sda1            /dev/sda1                       Mounted (/boot)
sdb             /dev/sdb                        LVM (hytrust-vg)
sda5            /dev/sda5                       LVM (sub1504-vg)
sub1504--vg-root    /dev/dm-0                       Mounted (/)
sub1504--vg-swap_1  /dev/dm-1                       Mounted (swap)

The file system can now be created on the clear-text device.

# mkfs /dev/mapper/clear_hytrust--vg-datalv
mke2fs 1.42.12 (29-Aug-2014)
/dev/mapper/clear_hytrust--vg-datalv contains a ext3 file system
    created on Tue May  3 17:54:22 2016
Proceed anyway? (y,n) y
Creating filesystem with 102400 1k blocks and 25688 inodes
Filesystem UUID: f4a9c9ca-d451-4d20-9a32-6cdf5de844d8
Superblock backups stored on blocks:
    8193, 24577, 40961, 57345, 73729

Allocating group tables: done
Writing inode tables: done
Writing superblocks and filesystem accounting information: done

# mkdir /tmp/mnt
# mount /dev/mapper/clear_hytrust--vg-datalv /tmp/mnt

# hcl rm hytrust--vg-datalv
WARNING: Removal of devices will cause any data stored on them to be permanently lost.
Do you want to proceed? (y/n) y
Removed device hytrust--vg-datalv

Encrypting an LVM Volume with an Existing File System

# mkfs /dev/mapper/hytrust--vg-datalv
mke2fs 1.42.12 (29-Aug-2014)
Creating filesystem with 102400 1k blocks and 25688 inodes
Filesystem UUID: f643d9b9-0b12-4710-8aad-7529c61c82af
Superblock backups stored on blocks:
    8193, 24577, 40961, 57345, 73729

Allocating group tables: done
Writing inode tables: done
Writing superblocks and filesystem accounting information: done

# hcl encrypt hytrust--vg-datalv -o
All the data on hytrust--vg-datalv will be encrypted
The cleartext data will be available on /dev/mapper/clear_hytrust--vg-datalv
This operation may take long time.
Do you want to proceed? (y/n) y
hytrust--vg-datalv (/dev/dm-2) appears to contain an existing filesystem (ext2)
Do you want to proceed? (y/n) y
WARNING: device hytrust--vg-datalv will be added but will not have unique ID that ensures detection if disks are reordered or moved.
Encrypted device hytrust--vg-datalv (/dev/dm-2) attached; decrypted contents visible at /dev/mapper/clear_hytrust--vg-datalv
total device size 102400 K
Processing: 100%    Time left: 00:00:00
Completed encryption of hytrust--vg-datalv successfully