Block-device encryption without reinstallation
Block-device encryption without reinstallation
Posted Oct 1, 2025 15:20 UTC (Wed) by muase (subscriber, #178466)In reply to: Block-device encryption without reinstallation by berto
Parent article: Managing encrypted filesystems with dirlock
I'm not familiar with the internals of the device mapper but I can imagine that this would need changes in dm-crypt: you would need to have a device that is only encrypted up to a certain offset, and that offset would change in real time while the device is being used.As far as I know, there is
cryptsetup-reencrypt, which already has an online-mode for reencryption but it seems that this also supports initial encryption. I'm not sure if you can use it to online-encrypt the currently booted volume; but if I understand the manpage correctly, it should be possible to boot into a minimal environment, start the encryption, convert everything to device-mapper volumes, and then reboot and continue the encryption online.