Block-device encryption without reinstallation [LWN.net]

Block-device encryption without reinstallation

Posted Sep 30, 2025 22:34 UTC (Tue) by berto (subscriber, #58604)
In reply to: Block-device encryption without reinstallation by muase
Parent article: Managing encrypted filesystems with dirlock

Indeed, with detached headers it should be possible.

I'm not familiar with the internals of the device mapper but I can imagine that this would need changes in dm-crypt: you would need to have a device that is only encrypted up to a certain offset, and that offset would change in real time while the device is being used.

to post comments

Block-device encryption without reinstallation

Posted Oct 1, 2025 15:20 UTC (Wed) by muase (subscriber, #178466) [Link] (1 responses)

I'm not familiar with the internals of the device mapper but I can imagine that this would need changes in dm-crypt: you would need to have a device that is only encrypted up to a certain offset, and that offset would change in real time while the device is being used.

As far as I know, there is cryptsetup-reencrypt, which already has an online-mode for reencryption but it seems that this also supports initial encryption. I'm not sure if you can use it to online-encrypt the currently booted volume; but if I understand the manpage correctly, it should be possible to boot into a minimal environment, start the encryption, convert everything to device-mapper volumes, and then reboot and continue the encryption online.

Block-device encryption without reinstallation

Posted Oct 1, 2025 20:43 UTC (Wed) by berto (subscriber, #58604) [Link]

You're right, and they don't actually had to change the device mapper, they do everything in userspace remapping the device on the fly.