Arch Linux

foolosophy

Member

Registered: 2009-04-17

Posts: 48

[SOLVED]Decrypt more than one LUKS partition with encrypt hook on boot

I have this settining:

Two physical disks:

/dev/sda (320GB)
/dev/sda1     500MB  booteable   ext2   (not used)
/dev/sda2      319GB     LUKS_device

/dev/sdc (1000GB)
/dev/sdc1   500MB  booteable    ext4   /boot
/dev/sdc2   1000GB   LUKS_device

Those LUKS devices are LVM physical volumes which I use for my system. I have one VG (vg_pablo) which uses both PVs. Inside my VG, I have three LVs: "archlinux" (for the / filesystem), "lv_home" (/home filesystem), and "lv_swap" (for swap).

The BIOS boots from sdc with GRUB2.

Here is the kernel line:

linux    /vmlinuz-linux root=/dev/mapper/vg_pablo-archlinux cryptdevice=/dev/disk/by-uuid/{uuid of sdc2 here}:LVM-encriptado cryptdevice=/dev/mapper/disk/by-uuid/{uuid of sda2 here}:LVM-encriptado-320 resume=/dev/mapper/vg_pablo-lv_swap ro quiet add_efi_memmap

According to a discussion on the wiki, this is the format for the cryptdevice option:

cryptdevice=BLOCKDEVICE:MAPPING_TARGET

But when I boot, the encrypt hook only asks for the password of ONE of the LUKS devices, and therefore, the other one never gets mapped and so the LVM hook never sees all the PVs it needs to make my VG active.

How can we tell the encrypt hook that it needs to decrypt TWO devices?

=============
EDIT: I found these two helpful links (sorry I hadn't seen them before).
http://johanv.org/node/179
https://bbs.archlinux.org/viewtopic.php … 95#p828784

Last edited by foolosophy (2012-06-03 21:37:24)

/dev/zero

Member

From: Melbourne, Australia

Registered: 2011-10-20

Posts: 1,247

Re: [SOLVED]Decrypt more than one LUKS partition with encrypt hook on boot

The way I would have done this would be to unify sda2 and sdc2 using an LVM, then just have one LUKS partition spanning the entire logical volume, and inside the LUKS partition you can have another LVM. This would use hooks lvm2 encrypt lvm2.

For the way you have set it up instead, what happens if you pass encrypt twice?

Actually, I don't see how this can work when it comes to setting the cryptdevice flag to your kernel. I think that should be only passed once. What howto were you working off when you decided to do things this way?

foolosophy

Member

Registered: 2009-04-17

Posts: 48

Re: [SOLVED]Decrypt more than one LUKS partition with encrypt hook on boot

I followed the wiki but decided to make things a little different. I could revert and reduce the VG (using a livecd), but why is this way wrong? I wanted to have an LVM mirror of my archlinux root filesystem (the LV archroot is set to be mirrored on /sda2's PV)

/dev/zero

Member

From: Melbourne, Australia

Registered: 2011-10-20

Posts: 1,247

Re: [SOLVED]Decrypt more than one LUKS partition with encrypt hook on boot

why is this way wrong?

Because I don't think you can pass cryptdevice to the kernel more than once. The flag tells the kernel which (singular) encrypted device contains the (singular) root partition.

Kudos for trying to think outside the box, but some things just work, and other things just don't.

If you can find a source suggesting that you really can pass cryptdevice more than once, please let me know, that would be very interesting and useful information.

Last edited by /dev/zero (2012-06-03 21:24:55)

foolosophy

Member

Registered: 2009-04-17

Posts: 48

Re: [SOLVED]Decrypt more than one LUKS partition with encrypt hook on boot

Nope. I you can't, actually. I had googled a lot from elinks while trying to fix my issue but I hadn't come up with this result up until ten seconds ago: someone applied a patch to the encrypt hook to be able to do exactly what I wanted to do.

I'll see if it makes sense to post a bug report on this (feature request).

Thanks!

Last edited by foolosophy (2012-06-03 21:35:36)