Arch Linux

newsboost

Member

Registered: 2016-07-24

Posts: 157

Can't use clonezilla for encrypted LUKS2-partition

Hi Arch'ers,

For some years, I've been using the Clonezilla ISO to boot off from a USB-stick, for partition backups. But lately, I've been using my main harddisk partition as a full disk LUKS2-encrypted LVM-partition with detached header. But looks like I'm stopping with that from now on, because it doesn't work any longer (my setup is slightly different now, I think the detached header/LUKS2 is the culprit). I'm not completely sure what it is that makes Clonezilla fail to decrypt this LVM-partition - but my guess is that it first sees the partition (/dev/nvme0n1p6) and notices that it is marked as an LVM-partition and then it incorrectly tries to use the LVM-partition, before it's fully decrypted - but as it's an "invalid LVM-partition" it also shows up as "not used" (my guess)...

More concrete explanation:
When I come to the point where I have to mount the LUKS-encrypted partition and I write: "cryptsetup --verbose luksOpen /dev/nvme0n1p6 --header=..headerfile.bin --key-file=..keyfile.bin cryptLVM", Clonezilla fails with

"Cannot use device /dev/nvme0n1p6 which is in use (already mapped or mounted). Command failed with code -5 (device already exists or device is busy)."

I tried "lsof /dev/nvme0n1p6" and "lsof | grep -i nvme" and several other things I can't remember (including combinations of "pvchange -a n" to try to "disable LVM" before lukssetup). The "lsof" prints absolutely nothing, so I can't understand/see what it's complaining about...

When I boot from the Arch Linux USB-stick and type in the EXACT same command, the LVM-partition becomes unlocked and I can access the LVM-partitions below the decrypted partition (root and swap). It's strange, I don't understand it. But (unless any of you know the explanation and maybe a solution), I've decided that now I want to use https://wiki.archlinux.org/index.php/Partclone and make future partition backups directly from the Arch Linux boot USB. The last few times I performed a clonezilla-backup, I think I did something like this:

(1) partclone.ext4 -c -s /dev/mapper/vg-root -o mybackupStorage/CLEAN_LINUX_NVIDIA_UNENCRPT/fresh_Arch_install.img
(2) /usr/sbin/ocs-sr -q2 -c -j2 -z1p -i 4096 -sfsck -senc -p choose savedisk 2018-12-19-00-img nvme0n1

About the first command (1): I think this is called by the latter "ocs-sr"-script, for all individual partitions... If I only need a single partition, luckily I can directly use this command as I understand it. However, the latter command is the reason I wrote all of this, because it's a bit more confusing how I should proceed here:

About the latter command (2), I tried to see if I could run or install "ocs-sr" in Arch Linux, but that doesn't seem to be the case. I think

ocs-sr

is a wrapper, that does some clever things (found some part of it at https://github.com/stevenshiau/clonezil … bin/ocs-sr), so if I want to clone a full harddisk (all partitions) this "ocs-sr savedisk" command is run. But I don't understand it: It looks like it also uses e.g. "ocs-run-boot-param ocs_saveparts_postrun" and I might prefer a full partdisk-cloned image, which is better than just "dd" (more efficiently stored). The command automatically zips and -j2 apparantly means "--clone-hidden-data".

Question: How do I make something similar to what the "ocs-sr"-commandline (2) does in Arch Linux, if I boot from the Arch Linux USB and only have those tools available (suppose I want to create a fulldisk cloned image efficiently and don't seem to have the "ocs-sr" script available in arch linux, how to do the same and include MBR/GPT partition table etc)? Maybe the Wiki about partclone could be updated (https://wiki.archlinux.org/index.php/Partclone, I could even give it an attempt, but first I need to understand how to accomplish this like Clonezilla does it, efficiently) ? Looking forward to hear from you, thanks!

newsboost

Member

Registered: 2016-07-24

Posts: 157

Re: Can't use clonezilla for encrypted LUKS2-partition

Hmm. Not much interest in this. Maybe I wrote a bad/boring explanation. I still think it would be a good idea to add a little bit to the wiki at https://wiki.archlinux.org/index.php/Partclone, about how to "replace ocs-sr" in an "Arch-linux"-way. So far, this is what I did:

fdisk -l > fdisk_partition_layout.txt
sfdisk -d /dev/nvme0n1 > sfdisk_partition_layout.txt

After this, I think/believe that we can just do partclone.ext4, partclone.fat32, partclone.ntfs on all partitions... I think it's nice to have the partition info (start/end/size sectors), because that info I'm guessing isn't included in the partclone-data... And then I guess the "Microsoft reserved partition"-partition need to be fully cloned and handled separatly, e.g. using a tool like "dd", see e.g. partition 2 below?

Number  Start   End     Size    File system  Name                          Flags
 1      1049kB  274MB   273MB   fat32        EFI system partition          boot, esp
 2      274MB   290MB   16.8MB               Microsoft reserved partition  msftres
 3      290MB   135GB   134GB   ntfs         Basic data partition          msftdata
 5      135GB   135GB   537MB                boot
 6      135GB   1024GB  889GB   ext4         lvm
 4      1024GB  1024GB  547MB   ntfs         Basic data partition          hidden, diag

I wish there was something better than "dd" for partition 2, but anyway... Isn't it relevant to add to the wiki, how to get around using ocs-sr? Well, at least in my case I've been forced to do it (because clonezilla doesn't understand my LUKS2-encryption, I suppose)...? Anyone, have any good ideas or comments to add? Do you e.g. agree with my thinking or not? Thanks for any feedback/ideas/suggestion! :-)