Grub loopback - boot an arch iso file - from encrypted /boot

ua4000 · 2020-04-01 16:56:39

I know how to tell grub to boot via loopback from e.g. archlinux-2020.03.01-x86_64.iso or ubuntu iso on the hard-disk.
https://wiki.archlinux.org/index.php/Mu … ly_release
This works fine.

Thinking about migration my system to a full disk encryption, incl. luks1 encrypted /boot, I stumbled over my iso files, also maybe saved on the encrypted /boot ?

Am I right, this won't work with the official iso images, because they usually don't include cryptsetup in the initrd ?

# archlinux-2020.03.01-x86_64.iso

$ lsinitcpio -x archiso.img 
$ find . |egrep -i crypt
./usr/lib/libcrypt.so.1
./usr/lib/libcrypto.so.1.1
./usr/lib/libcryptsetup.so.12
./usr/lib/libgcrypt.so.20
./usr/lib/libk5crypto.so.3
./usr/lib/modules/5.5.6-arch1-1/kernel/cryptd.ko
./usr/lib/modules/5.5.6-arch1-1/kernel/crypto_engine.ko
./usr/lib/modules/5.5.6-arch1-1/kernel/crypto_simd.ko
./usr/lib/modules/5.5.6-arch1-1/kernel/cryptoloop.ko
./usr/lib/modules/5.5.6-arch1-1/kernel/ecryptfs.ko
./usr/lib/modules/5.5.6-arch1-1/kernel/encrypted-keys.ko
./usr/lib/modules/5.5.6-arch1-1/kernel/virtio_crypto.ko

Thanks !

Slithery · 2020-04-01 17:08:40

It should be fine, by the time GRUB gets round to reading the iso files it's already decrypted the /boot partition.

ua4000 · 2020-04-01 17:50:50

After opening the luks1 disk in grub prompt, the disk is available as (crypto0)/ in grub shell.
After that I can loopback (crypto0)/boot/archlinux-2020.03.01-x86_64.iso
Then I dropped into [rootfs ]# from initrd, because there exists no (crypto0), no /boot, only an encrpted /dev/sda3 - so there is no encrypted root file-system at this time.
The initrd hook (sd-encrypt) has to open normally the disk again with cryptsetup to make /root accessible.

As far as I understand an encrypted disk opened by grub cannot be reused, it must be opened again by cryptsetup in initrd.

ua4000 · 2020-04-01 18:15:27

The grub script also shows the problem:

#! /bin/sh -e
# sudoedit /etc/grub.d/90_archlinux-2020.03.01-x86_64.iso

export ISOFILE=(crypto0)/boot/archlinux-2020.03.01-x86_64.iso
export imgdevpath=/dev/disk/by-label/root
echo "Found ISOFILE image: ${ISOFILE}" >&2

cat << EOF
menuentry "${ISOFILE}" {
	load_video
	loopback loop ${ISOFILE}
	linux (loop)/arch/boot/x86_64/vmlinuz img_dev=${imgdevpath} img_loop=${ISOFILE} earlymodules=loop
	initrd (loop)/arch/boot/x86_64/archiso.img
	}
EOF
exit 0

How to fill out "imgdevpath" ?
This path (/dev/disk/by-label/root) does not exist, because the disk is encryptet at this stage.
And the (crypto0) device from grub is not in initrd available.

XoseM · 2020-08-11 07:55:15

hi!

have you successfully booted your iso?

I face a similar problem: want to boot (debian) iso from encrypted partition but I don't know how to configure grub entry to first decrypt partition where iso file is located.

My /boot is not encrypted though

## iso debian at /live_iso    (iso stored here when arch is running)

menuentry '[loopback] Debian 10 ISO' {
  set isofile='/live_iso/debian10.iso'     
  set imgdevpath='/dev/mapper/volumeName-rootpartition'  (where / is in the crypted system, should I use uuid instead? It doesn't work either)
  loopback loop $isofile
  linux (loop)/vmlinuz archisodevice=/dev/loop0 img_dev=$imgdevpath img_loop=$isofile earlymodules=loop
  initrd (loop)/iso.img
}

should I include part_gpt part_msdos and lvm in _earlymodules_??

*linux(loop) and initrd/loop entries in this code are NOT correct (I know),

Arch Linux

#1 2020-04-01 16:56:39

Grub loopback - boot an arch iso file - from encrypted /boot

#2 2020-04-01 17:08:40

Re: Grub loopback - boot an arch iso file - from encrypted /boot

#3 2020-04-01 17:50:50

Re: Grub loopback - boot an arch iso file - from encrypted /boot

#4 2020-04-01 18:15:27

Re: Grub loopback - boot an arch iso file - from encrypted /boot

#5 2020-08-11 07:55:15

Re: Grub loopback - boot an arch iso file - from encrypted /boot

Board footer