Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

03-filesystems.sh can't access a keyfile on a separate, encrypted /boot partition #80

Open
humky opened this issue Aug 13, 2021 · 1 comment

Comments

@humky
Copy link

humky commented Aug 13, 2021

In a setup where /boot is encrypted and placed onto completely separate encrypted disk, and keyfiles are used in crypttab, runit (03-filesystems.sh) tries to check the /boot partition for a keyfile but fails due to it not being mounted by dracut(initramfs) or anything else.

The cryptdevice of /boot partition is already opened in previous booting steps (I assume by grub), it's just isn't mounted yet, at the very end of 03-filesystems it reads fstab and mounts everything properly.

The end result is that I can see warnings during boot about "Failed to open key file.", but otherwise boot ends and mounts everything just fine.

I've added a couple of lsblk checks before "Activating encrypted devices" and after it, to show the point, and also show my configuration in this video:
https://fastupload.co/1097693

@humky
Copy link
Author

humky commented Aug 14, 2021

Finally, after hours of searching I found how to mount /boot partition early, it is possible via dracut config, it just takes two special commands to include fstab, not just install_items as is usually done for crypttab:

add_fstab+=" /etc/fstab "
use_fstab="yes"

Although the "Activating encrypted devices..." step still completes with visual warnings "Device void-root already exists." and the same for void-boot. I think it would be nice to add some sort of exception to /etc/runit/crypt.awk:
if $1 (device name) already exists (therefor opened) - exit, else continue as usual. I don't know how to do it on my own.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant