Enabling Data Encryption#

By default, user data encryption using the DriveOS Encrypted Filesystem (EFS) is disabled in NVIDIA DriveOS Linux. You can enable EFS by performing the following steps relevant to the filesystem.

Note

The scripts, services, and configurations for EFS perform I/O write operations (such as formatting, copying files, and more) on the EFS partition. As a result, the files are included in both test_nsr_rfs and dev_nsr_rfs, but they are not included in prod_nsr_rfs.

Enabling EFS in test_nsr_rfs and dev_nsr_rfs#

To enable EFS in test_nsr_rfs and dev_nsr_rfs:

Enable the EFS partition by running bind_partitions with ENABLE_DEMO_PARTITION=y as an additional argument at the end of the command syntax.
Using the bootburn utility, flash the DriveOS Linux file system by using the instructions from Flashing and boot the system.
After booting the board, ensure that the /dev/vblkdev50 partition is visible in the output from the following command:
```
$ cat /proc/partitions
```
Enable the EFS-related systemd service by running the following command:
```
$ sudo bash /etc/systemd/scripts/nv_cpu_encrypt_run_once.sh
```
Reboot the board.
Check the output of the mount command that the /home directory is mounted by the /dev/mapper/home-encrypted/ partition.