Previously I described how to partition your drive using LVM2 and dm-crypt. This time, I'm going to go over how to boot this system.
First off, you're going to want to have your livecd handy, because it's likely something won't quite be right the first time around. Also, you'll want to make sure your kernel is built with support for initramfs. This requires the
BLK_DEV_INITRD configure option, named "Initial RAM filesystem and RAM disk (initramfs/initrd) support" in the "General setup" menu. You'll then need to specify the location of a source file for the initramfs.
Probably the easiest thing to do is to grab my current initramfs package and tweak it to suit your needs. You'll at the least need to change some paths in the config.txt and init files. But, it should serve as a good starting point. When you're done, put the path to the config.txt file in the "Initramfs source file(s)" (
CONFIG_INITRAMFS_SOURCE) setting in the kernel.
Now, rebuild and reinstall your kernel, reboot, and pray.
I hope this will help people improve their laptop's security. Feel free to post any questions you have in the comments. Good luck!