Request: Add dm_crypt and dm_mod kernel modules

Operating System ZimaOS
1

I noticed that dm_crypt and dm_mod kernel modules are missing from the current ZimaOS distribution. These modules are required to mount encrypted volumes, for example when connecting an external/portable drive with sensitive documents.

Steps to reproduce:

sudo lsmod | grep -E 'dm_mod|dm_crypt' → No result

modprobe dm_crypt
modprobe: FATAL: Module dm_crypt not found in directory /lib/modules/6.12.25

modprobe dm_mod
modprobe: FATAL: Module dm_mod not found in directory /lib/modules/6.12.25

Trying to open an encrypted volume:

cryptsetup luksOpen /dev/sdc0 portable_disk
Enter passphrase for /dev/md0:
device-mapper: reload ioctl on portable_disk (251:0) failed: Invalid argument

Enabling these modules would allow users to mount encrypted external disks. This would make Zima devices much more appealing to small offices that work with sensitive personal data such as health care/doctor’s offices, law firms, or employment agencies - especially considering the strict European privacy laws that require these professionals to encrypt their data at rest.

Since encryption of local disks is not currently supported by ZimaOS, mounting an encrypted external drive would be an elegant workaround.

I would be very grateful if the development team could accommodate my request by setting the CONFIG_DM_CRYPT option when building the kernel. This makes particular sense given that cryptsetup is already included in the distribution (but pretty much useless without the modules).

Thank you very much for your kind consideration.

1 Like
2

Request already made :slight_smile:

https://community.zimaspace.com/t/linux-unified-key-setup-luks-disk-encryption-support/8372

1 Like
3

As of ZimaOS 1.7.1, dm_crypt and dm_mod modules are now available. Thank you very much!

So, we’re one step closer to being able to mount LUKS encrypted disks. The only thing missing from the kernel is the aes-xts-plain64 algorithm required for encrypting data at rest:

# awk '/^name[[:space:]]*:/ {print $3}' /proc/crypto | grep aes-xts-plain64

To configure the kernel for the aes-xts, you could use the following options:

CONFIG_CRYPTO_XTS=y
CONFIG_CRYPTO_AES=y
CONFIG_CRYPTO_AES_GENERIC=y (or possibly CONFIG_CRYPTO_AES_NI=y for Intel hardware)
CONFIG_CRYPTO_USER_API_SKCIPHER=y

Of course the crypto algorithms can also be built as modules (e.g. CONFIG_CRYPTO_XTS=m) in order to keep the kernel compact.

1 Like