Arch Linux

vide

Member

Registered: 2016-06-30

Posts: 3

encrypt hook for btrfs raid

Hello

I have an arch system on a btrfs raid using two luks encrypted disks.
Everything works fine using the `sd-encrypt` hook (before latest upgrade). But I
would prefer (in particular since right now there is a bug[1]) to use the
`encrypt` hook.

In the archlinux wiki[2] or also here[3] it is explained how to modify the `encrypt` hook to decrypt two partitions.
Unfortunately when I follow this instructions I'm not prompted for a password
and the system fails to boot because of the missing root partition.

In `/etc/mkinitcpio.conf` I have:

HOOKS="base systemd udev autodetect modconf keyboard block encrypt encrypt2 filesystems fsck"

and I run:

> mkinitcpio -p linux
==> Building image from preset: /etc/mkinitcpio.d/linux.preset: 'default'
  -> -k /boot/vmlinuz-linux -c /etc/mkinitcpio.conf -g /boot/initramfs-linux.img
==> Starting build: 4.11.7-1-ARCH
  -> Running build hook: [base]
  -> Running build hook: [systemd]
  -> Running build hook: [udev]
  -> Running build hook: [autodetect]
  -> Running build hook: [modconf]
  -> Running build hook: [keyboard]
  -> Running build hook: [block]
  -> Running build hook: [encrypt]
  -> Running build hook: [encrypt2]
  -> Running build hook: [filesystems]
  -> Running build hook: [fsck]
==> Generating module dependencies
==> Creating gzip-compressed initcpio image: /boot/initramfs-linux.img
==> Image generation successful
==> Building image from preset: /etc/mkinitcpio.d/linux.preset: 'fallback'
  -> -k /boot/vmlinuz-linux -c /etc/mkinitcpio.conf -g /boot/initramfs-linux-fallback.img -S autodetect
==> Starting build: 4.11.7-1-ARCH
  -> Running build hook: [base]
  -> Running build hook: [systemd]
  -> Running build hook: [udev]
  -> Running build hook: [modconf]
  -> Running build hook: [keyboard]
  -> Running build hook: [block]
==> WARNING: Possibly missing firmware for module: aic94xx
==> WARNING: Possibly missing firmware for module: wd719x
  -> Running build hook: [encrypt]
  -> Running build hook: [encrypt2]
  -> Running build hook: [filesystems]
  -> Running build hook: [fsck]
==> Generating module dependencies
==> Creating gzip-compressed initcpio image: /boot/initramfs-linux-fallback.img
==> Image generation successful

   
In `/etc/default/grub` I have:

GRUB_CMDLINE_LINUX="cryptdevice=/dev/disk/by-uuid/867cfced-11a4-4530-aba8-ca26d70d4e15:roota cryptdevice2=/dev/disk/by-uuid/e849eb55-60b7-4042-b58f-07b6b141b545:rootb root=/dev/mapper/roota"

and I run

> grub-mkconfig -o /boot/grub/grub.cfg
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-linux
Found initrd image(s) in /boot: initramfs-linux.img
Found fallback initrd image(s) in /boot: initramfs-linux-fallback.img
done

And then in `/boot/grub/grub.cfg` I have

linux	/vmlinuz-linux root=UUID=1af0225e-edd1-4a5e-9c34-8adee4aa0a8d rw rootflags=subvol=@root cryptdevice=/dev/disk/by-uuid/867cfced-11a4-4530-aba8-ca26d70d4e15:roota cryptdevice2=/dev/disk/by-uuid/e849eb55-60b7-4042-b58f-07b6b141b545:rootb root=/dev/mapper/roota 

In `/etc/default/grub` I also tried to use `cryptdevice=UUID=...` and without
uuids `cryptodevice=/dev/sda3`, but it doesn't work.

Any idea what could be the problem?

Thanks

Edit: Also if I modify by hand `/boot/grub/grub.cfg` to contain

linux	/vmlinuz-linux cryptdevice=/dev/disk/by-uuid/867cfced-11a4-4530-aba8-ca26d70d4e15:roota cryptdevice2=/dev/disk/by-uuid/e849eb55-60b7-4042-b58f-07b6b141b545:rootb root=/dev/mapper/roota rootflags=subvol=@root  rw

I get the same problem: directly "A start job is running for dev-mapper-roota device" without prompting for a password first.

---
[1]: https://github.com/systemd/systemd/issues/6381
[2]: https://wiki.archlinux.org/index.php/Dm … partitions
[3]: https://blog.wohli.org/2017/04/23/Encry … D-as-root/

Last edited by vide (2017-07-30 18:37:40)

exad

Member

Registered: 2016-11-15

Posts: 33

Re: encrypt hook for btrfs raid

what about your /etc/crypttab

Last edited by exad (2017-08-03 12:20:51)

vide

Member

Registered: 2016-06-30

Posts: 3

Re: encrypt hook for btrfs raid

In /etc/crypttab I only have an entry for an additional(not root) disk.
No entry for the btrfs raid disks.