From: Quirin Gylstorff <quirin.gylstorff@...>

This encrypts a partition with LUKS and uses the TPM2 to unlock the partition during
boot.

Adapt start-qemu to support tpm2.

The implementation uses systemd-cryptenroll to add the TPM protected
passphrase to the LUKS header. systemd-cryptenroll was added with systemd version > 248.

The following table shows the support of systemd-cryptenroll in Debian
release.

| Debian version | systemd-cryptenroll suppported |
| Buster(10) | No |
| Bullseye(11) | with backports |
| Bookworm(12) | yes |

Changes v2:
- rewrite for multiple partition
- add rencrypt for populated partitions
- encrypt /var and /home

Changes v3:
- remove additional partition crypt_data
- add Readme
- fix KConfig
- only systemd is from backports
- start-qemu now checks .config.yaml for TPM2 support
- correct whitespaces

Quirin Gylstorff (8):
linux-cip: update kernel configuration for tpm2 support
use bullseye backports for systemd-cryptenroll
KConfig: add tpm option
start-qemu.sh: Create a tpm2 device
Add initramfs hook to encrypt a partition
overlay: add prerequisite 'encrypt_partition'
.gitlabci: Add ci build
Add README for encrypted partitions

.gitlab-ci.yml | 13 ++
Kconfig | 8 +
conf/distro/debian-bullseye-backports.list | 1 +
.../preferences.bullseye-backports.tpm.conf | 40 +++++
doc/README.tpm2.encryption.md | 39 +++++
kas/opt/tpm.yml | 20 +++
.../files/encrypt_partition.env.tmpl | 2 +
.../files/encrypt_partition.hook | 53 +++++++
.../files/encrypt_partition.script | 145 ++++++++++++++++++
.../initramfs-crypt-hook_0.1.bb | 40 +++++
.../initramfs-overlay-hook/files/overlay.hook | 1 +
.../files/overlay.script.tmpl | 12 +-
recipes-kernel/linux/linux-cip-common.inc | 2 +-
start-qemu.sh | 27 +++-
wic/x86-efibootguard.wks.in | 5 +-
15 files changed, 395 insertions(+), 13 deletions(-)
create mode 100644 conf/distro/debian-bullseye-backports.list
create mode 100644 conf/distro/preferences.bullseye-backports.tpm.conf
create mode 100644 doc/README.tpm2.encryption.md
create mode 100644 kas/opt/tpm.yml
create mode 100644 recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.env.tmpl
create mode 100644 recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.hook
create mode 100644 recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.script
create mode 100644 recipes-initramfs/initramfs-crypt-hook/initramfs-crypt-hook_0.1.bb

--
2.39.1