From 6a20799486d0c321657b56b6d2d03edb15bce07b Mon Sep 17 00:00:00 2001 From: Robert Date: Tue, 11 Nov 2025 20:11:31 -0500 Subject: [PATCH] Quick Start Guide --- README.MD | 55 +++++++++++++++++++++++++++++-------------------------- 1 file changed, 29 insertions(+), 26 deletions(-) diff --git a/README.MD b/README.MD index e354da8..7f00d54 100644 --- a/README.MD +++ b/README.MD @@ -1,53 +1,56 @@ # LUKS-Encrypted Disk Images on Linux -## NOTE: This will not work on an LXC unprivileged container! - -To make it work inside an LXC: You’d need to modify your container config (as root on the host): -``` -lxc.apparmor.profile = unconfined -lxc.cap.drop = -lxc.cgroup.devices.allow = b 7:* rwm # /dev/loop* -lxc.cgroup.devices.allow = c 10:237 rwm # /dev/mapper/control -lxc.mount.auto = proc:rw sys:rw -lxc.include = /usr/share/lxc/config/common.conf -``` - -And run the container as privileged (security.privileged = true). - -⚠️ Security warning: privileged LXC containers with these capabilities are essentially “mini-VMs” with host-level power. Not recommended on multi-tenant systems. - - ## Using your package manager: (apt, etc...) install the following: ## Requires: cryptsetup, losetup, mount, umount, findmnt, blkid ## Optional: VBoxManage (VirtualBox), virsh (libvirt) +## 1st Make a symbloic link to your bin path: +``` +sudo ln -s "$(pwd)/luks-img.sh" /usr/local/bin/ +``` + ## Quick Starts ``` 1) Create & mount a new 4 GB encrypted image: -sudo ./luks-img.sh create --file mydisk.img --size 4G +sudo luks-img.sh create --file mydisk.img --size 4G 2) Open & mount an existing image: -sudo ./luks-img.sh open --file mydisk.img --mount /mnt/luks +sudo luks-img.sh open --file mydisk.img --mount /mnt/luks 3) Close (unmount, close mapper, detach loop): -sudo ./luks-img.sh close --file mydisk.img +sudo luks-img.sh close --file mydisk.img 4) Backup the LUKS header: -sudo ./luks-img.sh header-backup --file mydisk.img --out mydisk.header +sudo luks-img.sh header-backup --file mydisk.img --out mydisk.header *) Add a new key using an existing keyfile: -sudo ./luks-img.sh add-key --file mydisk.img --keyfile /path/newkey --existing-keyfile /path/oldkey +sudo luks-img.sh add-key --file mydisk.img --keyfile /path/newkey --existing-keyfile /path/oldkey ``` ### If you want to add the image file to a VM: ## Virtual Box: ``` -sudo ./luks-img.sh launch-vbox --file mydisk.img --vm "Ubuntu VM" --start -sudo ./luks-img.sh detach-vbox --vm "Ubuntu VM" +sudo luks-img.sh launch-vbox --file mydisk.img --vm "Ubuntu VM" --start +sudo luks-img.sh detach-vbox --vm "Ubuntu VM" ``` ## libvirt/QEMU VM: ``` -sudo ./luks-img.sh attach-virt --file mydisk.img --vm myvm --target vdb --persistent -sudo ./luks-img.sh detach-virt --vm myvm --target vdb --persistent +sudo luks-img.sh attach-virt --file mydisk.img --vm myvm --target vdb --persistent +sudo luks-img.sh detach-virt --vm myvm --target vdb --persistent +``` + +## Please NOTE: This will not work on an LXC unprivileged container! +To make it work inside an LXC: You’d need to modify your container config (as root on the host): ``` +lxc.apparmor.profile = unconfined +lxc.cap.drop = +lxc.cgroup.devices.allow = b 7:* rwm # /dev/loop* +lxc.cgroup.devices.allow = c 10:237 rwm # /dev/mapper/control +lxc.mount.auto = proc:rw sys:rw +lxc.include = /usr/share/lxc/config/common.conf +``` + +And run the container as privileged (security.privileged = true). + +⚠️ Security warning: privileged LXC containers with these capabilities are essentially “mini-VMs” with host-level power. Not recommended on multi-tenant systems!!