# How to configure the mender to use dm-crypt partitions for rootfs?

**URL:** https://hub.mender.io/t/how-to-configure-the-mender-to-use-dm-crypt-partitions-for-rootfs/1508
**Category:** General Discussions
**Tags:** yocto, sumo, nxp, standalone
**Created:** [February 6, 2020, 11:22am UTC](https://hub.mender.io/t/how-to-configure-the-mender-to-use-dm-crypt-partitions-for-rootfs/1508 "2020-02-06T11:22:29Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![ajithpv](https://yyz2.discourse-cdn.com/flex036/user_avatar/hub.mender.io/ajithpv/32/728_2.png) [@ajithpv](https://hub.mender.io/u/ajithpv)
#### Post date: [February 8, 2020, 6:54am UTC](https://hub.mender.io/t/how-to-configure-the-mender-to-use-dm-crypt-partitions-for-rootfs/1508/3 "2020-02-08T06:54:18Z")

</div>

I have seen the following thread and mine is similar set-up (not exactly the same).

> [@Mender for updating encrypted filesystem](https://hub.mender.io/t/mender-for-updating-encrypted-filesystem/475):
>
> Hello, I am currently working on an embedded IOT product and using mender for over the air software update. I am using the mender for the past 2 years for another product and it’s working perfectly fine. The roll outs to devices are smooth after every software update. As part of security concept for the new product, my security engineer advises to have encrypted filesystem(most likely with LUKS and dm-crypt). May I know whether mender supports such encrypted file systems. The root filesystem i…

I understood that the kernel images need to be outside for this and can not update the kernel images as part of the rootfs update.

My worry is how the mender OTA update on rootfs works without specifying the physical block. If mender accesses the physical block (/dev/mmcblk0p1) and delete the partition, then the system will not mount it because encryption voids in this case. The physical partition is hidden always with dm-cyrpt and we can use the virtual physical partitions (/dev/dm-1 instead of /dev/mmcblk0p1) for the update.

However, specifying this /dev/dm-1 not passing the build.

It looks like the mender 2.0 's “`meta-mender-core/classes/mender-helpers.bbclass`” only define “`/dev/mmcblk*p*`” or “`/dev/mmcblk*`” for the U-boot.

---

_[View the full topic](https://hub.mender.io/t/how-to-configure-the-mender-to-use-dm-crypt-partitions-for-rootfs/1508)._