ubiquity lvm/luks

[Dmitrijs Ledkovs]

Hello Matthew,

Sorry for the delay in replying.

On 12/06/12 11:36, Matthew Paul Thomas wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi Dmitrijs
> 
> Dmitrijs Ledkovs wrote on 08/06/12 12:13:
>> ...
>>
>> I have modified the gtk frontend's UI to include: Auto partitioning
>> page: - checkboxes for LVM & Encrypted LVM
> 

the gtk checkboxes is just a mock up, it's not merged into ubiquity.

> If either of these were mentioned in the automatic partitioning
> process, they couldn't be understandable without being explained in so
> much detail that it would be distracting.
> 

=/ yeah those checkboxes are not the best.
One of the requirements is feature parity with the alternative/server
installer. Those CD's offer LVM2 or LVM2+LUKS installations with a one
click difference, plus password setup for encryption.

cjwatson, did say on IRC, that if LVM2 or LVM2+LUKS are offered, it
should be on automatic partitioning page. As I understand it, this is
because most of the automatic options (e.g. use whole disk, resize
windows and use the rest of the disk, etc.), can optionally have LVM2 or
LVM2+LUKS.

> We could add encryption to the automatic partitioning process in
> future, but it would need to be a nicer sort -- with the option to use
> your login password as the password, and multiple recovery keys, and
> things like that.
> 

It's insecure in my opinion to use login password same as encryption
password. In larger deployments your password will be centrally managed
via LDAP, while the machine encryption passphrase will be different. The
machine passphrase should be generally very long.

We setup the partitioning first, then ask for the user setup. Encrypted
LUKS needs a password during partitioning so partitioning step will
require 'encryption password' setup. This is also a precaution, if the
installation fails users should know the password to check what has
happened on the target hard drive.

As per blueprint, this cycle we are targeting to support pre-seeding
multiple encryption passphrase (all passwords unlock the same key, one
key per block device). In the UI, only one encryption passphrase setup.


> So, please remove these checkboxes.
> 
>> Manual patitioning page: - 'add device' button, for eventually
>> creating 'complex' block devices - checkboxes 'Encrypt underlying
>> partition' in the create and edit partition dialog boxes.
> 
> I have started on the LVM design in the installer specification.
>  <https://docs.google.com/a/canonical.com/document/d/1bZ4yQIVgGaUGSYu3qiUHnQt3ieBZoqunP_DcleHCr3I/edit#heading=h.v8wi3omt1z0>
> 
> As I understand it, the tasks we need to present are:
> *   creating an LVM volume from two or more physical volumes
> *   adding a physical volume to an existing LVM volume
> *   removing a physical volume from an LVM volume
> *   dismantling an LVM volume altogether.
> 
> Is that right?
> 

LVM can be created from a single physcial volume.

So the tasks seem correct.
* creating an LVM Physical Group from _one_ or more physical volume(s)
* adding/removing physical volumes to an LVM Group
* removing an LVM Physical Group all together

(this can be done by presenting LVM as a block device and use existing
partitioning functionality)
"partitioning" the LVM Group:
* adding/removing/resizing logical volumes

-- 
Regards,
Dmitrijs.