LUKS LVM prompt

SimonJ · 2021-10-15 12:16:55

Hi,

I have install Arch on my chromebook , it has an encrypted lvm with the system and swap inside. This all works perfectly and on boot, after GRUB it stops and asks for the password.

I want it to not output text for the password. I can edit the hook file which stops some of it but right below that is a decrypt while loop which appears to accept a quiet variable.

My question is, is this correct? if so how do I set the quiet variable to silently wait for a password?

I am flying soon and would rather not have to type in a password if I am stopped, if it says boot device failed and nothing else I have some deniability.

Thanks for any pointers.

JeanLucJ · 2021-10-15 12:30:58

Hello,

You have some examples here.
Not exactly your use case, but building on 8., for example, you should get what you want.

SimonJ · 2021-10-15 12:50:14

Where does it get this value from?

[ "${quiet}" = "y" ] && CSQUIET=">/dev/null"

frostschutz · 2021-10-15 12:59:14

This should be literally just the "quiet" parameter. The variable itself is set by init_functions::parse_cmdline and the "y" is just the default value it uses for parameters that do not set any =value

/lib/initcpio/init_functions

        *)
            # valid shell variable
            eval "$key"='${value:-y}'
            ;;

frostschutz · 2021-10-15 13:03:48

for a shell script this looks kind of weird

[ "${quiet}" = "y" ] && CSQUIET=">/dev/null"

the shell does not interpret ">" if it is a part of a variable

sure enough the hook then used eval to work around that

eval cryptsetup --key-file ${ckeyfile} open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}

of course this means all other variables will be eval'd too so you can probably use this to run any code at this point

SimonJ · 2021-10-15 13:08:28

This is the section that is being used, it is the cryptsetup command I need to suppress.

            # Ask for a passphrase
            if [ ${dopassphrase} -gt 0 ]; then
                echo ""
                echo "Boot disk failed:"

                #loop until we get a real password
                while ! eval cryptsetup open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; do
                    sleep 2;
                done
            fi

but I still need it to work.

JeanLucJ · 2021-10-15 17:09:06

In the hook, the code you showed :

[ "${quiet}" = "y" ] && CSQUIET=">/dev/null"

means "if kernel paramater quiet is set, then CSQUIET has the value >/dev/null", so later

while ! eval cryptsetup open --type luks ${resolved} ${cryptname} ${cryptargs} >/dev/null; do

--> stdout goes to oblivion.
I'm not completely sure about "if kernel paramater quiet is set", but that's I understand from the mkinitcpio manual and frostschutz seems to confirm it.

You may have to redirect stderr also, so using the standard hook may prove insufficient.

But, again, I would advise creating a custom hook as suggested in the link I provided.
You can do a very simple script with any output you like (a big error message to have a good deniability), and editing the standard hook is never a good idea. For a start, if a new version if released, it will overwrite your changes.

Regards,

Last edited by JeanLucJ (2021-10-15 17:19:50)

SimonJ · 2021-10-15 20:36:09

Thank you for your help, I have read the page many times but cannot suppress the passphrase request. I can change the text around it and I think that will have to do.

Arch Linux

#1 2021-10-15 12:16:55

LUKS LVM prompt

#2 2021-10-15 12:30:58

Re: LUKS LVM prompt

#3 2021-10-15 12:50:14

Re: LUKS LVM prompt

#4 2021-10-15 12:59:14

Re: LUKS LVM prompt

#5 2021-10-15 13:03:48

Re: LUKS LVM prompt

#6 2021-10-15 13:08:28

Re: LUKS LVM prompt

#7 2021-10-15 17:09:06

Re: LUKS LVM prompt

#8 2021-10-15 20:36:09

Re: LUKS LVM prompt

Board footer