You are not logged in.

#1 2022-05-07 13:42:12

DomR
Member
Registered: 2017-02-18
Posts: 6

[SOLVED] Reinstalled bootloader does not decrypt root partition

Yesterday I was not able to boot into Arch anymore. I found that my /boot/grub/grub.cfg was corrupted, its first half having been overwritten with zero-bytes. Not sure how this happened.

# hexdump -C /boot/grub/grub.cfg | head

00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000c00  27 20 7b 0a 09 09 6c 6f  61 64 5f 76 69 64 65 6f  |' {...load_video|
00000c10  0a 09 09 73 65 74 20 67  66 78 70 61 79 6c 6f 61  |...set gfxpayloa|
00000c20  64 3d 6b 65 65 70 0a 09  09 69 6e 73 6d 6f 64 20  |d=keep...insmod |
00000c30  67 7a 69 6f 0a 09 09 69  6e 73 6d 6f 64 20 70 61  |gzio...insmod pa|
00000c40  72 74 5f 6d 73 64 6f 73  0a 09 09 69 6e 73 6d 6f  |rt_msdos...insmo|
00000c50  64 20 65 78 74 32 0a 09  09 73 65 74 20 72 6f 6f  |d ext2...set roo|
00000c60  74 3d 27 68 64 30 2c 6d  73 64 6f 73 31 27 0a 09  |t='hd0,msdos1'..|
00000c70  09 69 66 20 5b 20 78 24  66 65 61 74 75 72 65 5f  |.if [ x$feature_|

The MBR appears to be fine, as the partitions are still recognized from the installation medium. In my device setup I am using sda1 as the boot partition and sda2 as the LUKS2-encrypted root partition. I can mount the boot partition and I can decrypt, mount and arch-chroot into root.

# fdisk -l /dev/sda

Disk /dev/sda: 223.57 GiB, 240057409536 bytes, 468862128 sectors
Disk model: SanDisk SSD PLUS
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x043390d0

Device     Boot  Start       End   Sectors   Size Id Type
/dev/sda1  *      2048    411647    409600   200M 83 Linux
/dev/sda2       411648 468862127 468450480 223.4G 83 Linux
# lsblk /dev/sda

sda             8:0    0 223.6G  0 disk  
├─sda1          8:1    0   200M  0 part  
└─sda2          8:2    0 223.4G  0 part  
  └─cryptroot 253:0    0 223.4G  0 crypt
# blkid /dev/sda* /dev/mapper*

/dev/sda2: UUID="b1408c76-1677-4055-b5b0-42444fed81c1" TYPE="crypto_LUKS" PARTUUID="043390d0-02"
/dev/sda1: UUID="67bd7358-c1dd-4cac-8e4d-71aada781a8c" BLOCK_SIZE="1024" TYPE="ext4" PARTUUID="043390d0-01"
/dev/mapper/cryptroot: UUID="80288d9a-07b4-457f-89c2-ce098253360f" BLOCK_SIZE="4096" TYPE="ext4"

I restored grub.cfg from backup. The machine still went to grub rescue instead of booting, so I I decided to reinstall grub and recreate the initramfs, following the wiki. However, I still cannot boot. The password prompt to decrypt root does not come up. Instead I still get grub rescue with this message:

error: no such device: 80288d9a-07b4-457f-89c2-ce098253360f.
error: unknown filesystem.
Entering rescue mode...

Also grub rescue does not seem to be able to read the partitions:

grub rescue> ls (hd0,msdos1)
error: no such partition.

/etc/mkinitcpio.conf is configured with these hooks:

HOOKS=(base udev autodetect keyboard keymap consolefont modconf block encrypt filesystems fsck)

From /etc/default/grub:

GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 quiet cryptdevice=UUID=b1408c76-1677-4055-b5b0-42444fed81c1:cryptroot:allow-discards,no-read-workqueue,no-write-workqueue root=/dev/mapper/cryptroot"
GRUB_ENABLE_CRYPTODISK=y

Full /boot/grub/grub.cfg:

#
# DO NOT EDIT THIS FILE
#
# It is automatically generated by grub-mkconfig using templates
# from /etc/grub.d and settings from /etc/default/grub
#

### BEGIN /etc/grub.d/00_header ###
insmod part_gpt
insmod part_msdos
if [ -s $prefix/grubenv ]; then
  load_env
fi
if [ "${next_entry}" ] ; then
   set default="${next_entry}"
   set next_entry=
   save_env next_entry
   set boot_once=true
else
   set default="0"
fi

if [ x"${feature_menuentry_id}" = xy ]; then
  menuentry_id_option="--id"
else
  menuentry_id_option=""
fi

export menuentry_id_option

if [ "${prev_saved_entry}" ]; then
  set saved_entry="${prev_saved_entry}"
  save_env saved_entry
  set prev_saved_entry=
  save_env prev_saved_entry
  set boot_once=true
fi

function savedefault {
  if [ -z "${boot_once}" ]; then
    saved_entry="${chosen}"
    save_env saved_entry
  fi
}

function load_video {
  if [ x$feature_all_video_module = xy ]; then
    insmod all_video
  else
    insmod efi_gop
    insmod efi_uga
    insmod ieee1275_fb
    insmod vbe
    insmod vga
    insmod video_bochs
    insmod video_cirrus
  fi
}

if [ x$feature_default_font_path = xy ] ; then
   font=unicode
else
insmod ext2
search --no-floppy --fs-uuid --set=root 80288d9a-07b4-457f-89c2-ce098253360f
    font="/usr/share/grub/unicode.pf2"
fi

if loadfont $font ; then
  set gfxmode=auto
  load_video
  insmod gfxterm
  set locale_dir=$prefix/locale
  set lang=en_US
  insmod gettext
fi
terminal_input console
terminal_output gfxterm
if [ x$feature_timeout_style = xy ] ; then
  set timeout_style=menu
  set timeout=4
# Fallback normal timeout code in case the timeout_style feature is
# unavailable.
else
  set timeout=4
fi
### END /etc/grub.d/00_header ###

### BEGIN /etc/grub.d/10_linux ###
menuentry 'Arch Linux' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-80288d9a-07b4-457f-89c2-ce098253360f' {
	load_video
	set gfxpayload=keep
	insmod gzio
	insmod ext2
	search --no-floppy --fs-uuid --set=root 80288d9a-07b4-457f-89c2-ce098253360f
	echo	'Loading Linux linux ...'
	linux	/boot/vmlinuz-linux root=UUID=80288d9a-07b4-457f-89c2-ce098253360f rw  loglevel=3 quiet cryptdevice=UUID=b1408c76-1677-4055-b5b0-42444fed81c1:cryptroot:allow-discards,no-read-workqueue,no-write-workqueue root=/dev/mapper/cryptroot
	echo	'Loading initial ramdisk ...'
	initrd	/boot/intel-ucode.img /boot/initramfs-linux.img
}
submenu 'Advanced options for Arch Linux' $menuentry_id_option 'gnulinux-advanced-80288d9a-07b4-457f-89c2-ce098253360f' {
	menuentry 'Arch Linux, with Linux linux' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-linux-advanced-80288d9a-07b4-457f-89c2-ce098253360f' {
		load_video
		set gfxpayload=keep
		insmod gzio
		insmod ext2
		search --no-floppy --fs-uuid --set=root 80288d9a-07b4-457f-89c2-ce098253360f
		echo	'Loading Linux linux ...'
		linux	/boot/vmlinuz-linux root=UUID=80288d9a-07b4-457f-89c2-ce098253360f rw  loglevel=3 quiet cryptdevice=UUID=b1408c76-1677-4055-b5b0-42444fed81c1:cryptroot:allow-discards,no-read-workqueue,no-write-workqueue root=/dev/mapper/cryptroot
		echo	'Loading initial ramdisk ...'
		initrd	/boot/intel-ucode.img /boot/initramfs-linux.img
	}
	menuentry 'Arch Linux, with Linux linux (fallback initramfs)' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-linux-fallback-80288d9a-07b4-457f-89c2-ce098253360f' {
		load_video
		set gfxpayload=keep
		insmod gzio
		insmod ext2
		search --no-floppy --fs-uuid --set=root 80288d9a-07b4-457f-89c2-ce098253360f
		echo	'Loading Linux linux ...'
		linux	/boot/vmlinuz-linux root=UUID=80288d9a-07b4-457f-89c2-ce098253360f rw  loglevel=3 quiet cryptdevice=UUID=b1408c76-1677-4055-b5b0-42444fed81c1:cryptroot:allow-discards,no-read-workqueue,no-write-workqueue root=/dev/mapper/cryptroot
		echo	'Loading initial ramdisk ...'
		initrd	/boot/intel-ucode.img /boot/initramfs-linux-fallback.img
	}
}

### END /etc/grub.d/10_linux ###

### BEGIN /etc/grub.d/20_linux_xen ###
### END /etc/grub.d/20_linux_xen ###

### BEGIN /etc/grub.d/30_os-prober ###
### END /etc/grub.d/30_os-prober ###

### BEGIN /etc/grub.d/30_uefi-firmware ###
### END /etc/grub.d/30_uefi-firmware ###

### BEGIN /etc/grub.d/40_custom ###
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.
### END /etc/grub.d/40_custom ###

### BEGIN /etc/grub.d/41_custom ###
if [ -f  ${config_directory}/custom.cfg ]; then
  source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f  $prefix/custom.cfg ]; then
  source $prefix/custom.cfg
fi
### END /etc/grub.d/41_custom ###

Any ideas what I am missing?

Last edited by DomR (2022-05-08 18:00:11)

Offline

#2 2022-05-08 17:58:03

DomR
Member
Registered: 2017-02-18
Posts: 6

Re: [SOLVED] Reinstalled bootloader does not decrypt root partition

I figured out the solution. I had mounted the boot partition and the root partition separately and, after arch-chrooting into [mounted root], reinstalling grub there and exiting, copied the newly created files from [mounted root]/boot to [mounted boot]. What I had to do instead was mount the boot partition *inside* [mounted root] so that grub installs its files there directly. Now grub is finding its files and the machine boots as it used to.

Offline

Board footer

Powered by FluxBB