You are not logged in.
I'm trying to get an encrypted setup of Arch working. My drive has an MBR partition table with the following partitions:
/dev/sdd1 (old OS, should be irrelevant)
/dev/sdd2 (/boot, unencrypted)
/dev/sdd3 (/home, encrypted)
/dev/sdd4 (/, encrypted)
I've done the following:
- edited /etc/mkinitcpio.conf to add keyboard support early, regenerated initramfs
- edited /etc/default/grub to add GRUB_ENABLE_CRYPTODISK=y and regenerated /boot/grub/grub.cfg
- edited /etc/crypttab and /etc/fstab Also copied /etc/crypttab to /etc/crypttab.initramfs and regenerated initramfs, though this probably doesn't help since initramfs happens after the failure I describe.
What I expect should happen is, GRUB starts up, looks for the unlocked root partition's UUID (added to grub.cfg by grub-mkconfig[), and realizes that it's locked thanks to GRUB_ENABLE_CRYPTODISK=y. Then it should prompt me for a password, unlock the partition, and boot happily. Instead, what happens is I never got prompted for a password, I can choose to boot to Arch Linux from the selection list, but GRUB tells me that it can't find device UUID=[UUID of the mapper of my decrypted root partition] and falls into emergency mode. Looking at the GRUB command, it looks like this happens during linux /vmlinuz-linux root=[UUID of the mapper of my decrypted root partition].
What else do I need to do to make GRUB decrypt my root partition before trying the linux command? Preferably without directly editing /boot/grub/grub.cfg as I'd like to be able to easily use grub-mkconfig in the future.
crypttab and crypttab.initramfs
# Configuration for encrypted block devices.
# See crypttab(5) for details.
# NOTE: Do not list your root (/) partition here, it must be set up
# beforehand by the initramfs (/etc/mkinitcpio.conf).
# <name> <device> <password> <options>
# home UUID=b8ad5c18-f445-495d-9095-c9ec4f9d2f37 /etc/mypassword1
# data1 /dev/sda3 /etc/mypassword2
# data2 /dev/sda5 /etc/cryptfs.key
# swap /dev/sdx4 /dev/urandom swap,cipher=aes-cbc-essiv:sha256,size=256
# vol /dev/sdb7 none
arch-root /dev/sdb3 none timeout=180
arch-home /dev/sdb4 none timeout=180fstab
# Static information about the filesystems.
# See fstab(5) for details.
# <file system> <dir> <type> <options> <dump> <pass>
# /dev/mapper/arch-root UUID=9b9cbf79-33eb-4538-95f3-823b9c0df00c
LABEL=arch-root / ext4 rw,relatime 0 1
# /dev/sdb2 UUID=1732bde7-af9f-43f3-95f1-53d917b87e99
LABEL=arch-boot /boot ext4 rw,relatime 0 2
# /dev/mapper/arch-home UUID=df344e33-a432-4baa-8502-13f0f6795797
LABEL=arch-home /home ext4 rw,relatime 0 2grub
# GRUB boot loader configuration
GRUB_DEFAULT=0
GRUB_TIMEOUT=5
GRUB_DISTRIBUTOR="Arch"
GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 quiet"
GRUB_CMDLINE_LINUX=""
# Preload both GPT and MBR modules so that they are not missed
GRUB_PRELOAD_MODULES="part_gpt part_msdos"
# Uncomment to enable booting from LUKS encrypted devices
#GRUB_ENABLE_CRYPTODISK=y
# Set to 'countdown' or 'hidden' to change timeout behavior,
# press ESC key to display menu.
GRUB_TIMEOUT_STYLE=menu
# Uncomment to use basic console
GRUB_TERMINAL_INPUT=console
# Uncomment to disable graphical terminal
#GRUB_TERMINAL_OUTPUT=console
# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command `vbeinfo'
GRUB_GFXMODE=auto
# Uncomment to allow the kernel use the same resolution used by grub
GRUB_GFXPAYLOAD_LINUX=keep
# Uncomment if you want GRUB to pass to the Linux kernel the old parameter
# format "root=/dev/xxx" instead of "root=/dev/disk/by-uuid/xxx"
#GRUB_DISABLE_LINUX_UUID=true
# Uncomment to disable generation of recovery mode menu entries
GRUB_DISABLE_RECOVERY=true
# Uncomment and set to the desired menu colors. Used by normal and wallpaper
# modes only. Entries specified as foreground/background.
#GRUB_COLOR_NORMAL="light-blue/black"
#GRUB_COLOR_HIGHLIGHT="light-cyan/blue"
# Uncomment one of them for the gfx desired, a image background or a gfxtheme
#GRUB_BACKGROUND="/path/to/wallpaper"
#GRUB_THEME="/path/to/gfxtheme"
# Uncomment to get a beep at GRUB start
#GRUB_INIT_TUNE="480 440 1"
# Uncomment to make GRUB remember the last selection. This requires
# setting 'GRUB_DEFAULT=saved' above.
#GRUB_SAVEDEFAULT=true
# Uncomment to disable submenus in boot menu
#GRUB_DISABLE_SUBMENU=y
#
GRUB_ENABLE_CRYPTODISK=ygrub.cfg
#
# DO NOT EDIT THIS FILE
#
# It is automatically generated by grub-mkconfig using templates
# from /etc/grub.d and settings from /etc/default/grub
#
### BEGIN /etc/grub.d/00_header ###
insmod part_gpt
insmod part_msdos
if [ -s $prefix/grubenv ]; then
load_env
fi
if [ "${next_entry}" ] ; then
set default="${next_entry}"
set next_entry=
save_env next_entry
set boot_once=true
else
set default="0"
fi
if [ x"${feature_menuentry_id}" = xy ]; then
menuentry_id_option="--id"
else
menuentry_id_option=""
fi
export menuentry_id_option
if [ "${prev_saved_entry}" ]; then
set saved_entry="${prev_saved_entry}"
save_env saved_entry
set prev_saved_entry=
save_env prev_saved_entry
set boot_once=true
fi
function savedefault {
if [ -z "${boot_once}" ]; then
saved_entry="${chosen}"
save_env saved_entry
fi
}
function load_video {
if [ x$feature_all_video_module = xy ]; then
insmod all_video
else
insmod efi_gop
insmod efi_uga
insmod ieee1275_fb
insmod vbe
insmod vga
insmod video_bochs
insmod video_cirrus
fi
}
if [ x$feature_default_font_path = xy ] ; then
font=unicode
else
insmod part_msdos
insmod cryptodisk
insmod luks
insmod gcry_rijndael
insmod gcry_rijndael
insmod gcry_sha256
insmod ext2
cryptomount -u 05fc74f7efa749d982bb15b16f37fe36
set root='cryptouuid/05fc74f7efa749d982bb15b16f37fe36'
if [ x$feature_platform_search_hint = xy ]; then
search --no-floppy --fs-uuid --set=root --hint='cryptouuid/05fc74f7efa749d982bb15b16f37fe36' 9b9cbf79-33eb-4538-95f3-823b9c0df00c
else
search --no-floppy --fs-uuid --set=root 9b9cbf79-33eb-4538-95f3-823b9c0df00c
fi
font="/usr/share/grub/unicode.pf2"
fi
if loadfont $font ; then
set gfxmode=auto
load_video
insmod gfxterm
set locale_dir=$prefix/locale
set lang=en_US
insmod gettext
fi
terminal_input console
terminal_output gfxterm
if [ x$feature_timeout_style = xy ] ; then
set timeout_style=menu
set timeout=5
# Fallback normal timeout code in case the timeout_style feature is
# unavailable.
else
set timeout=5
fi
### END /etc/grub.d/00_header ###
### BEGIN /etc/grub.d/10_linux ###
menuentry 'Arch Linux' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-9b9cbf79-33eb-4538-95f3-823b9c0df00c' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_msdos
insmod ext2
set root='hd1,msdos2'
if [ x$feature_platform_search_hint = xy ]; then
search --no-floppy --fs-uuid --set=root --hint-bios=hd1,msdos2 --hint-efi=hd1,msdos2 --hint-baremetal=ahci1,msdos2 1732bde7-af9f-43f3-95f1-53d917b87e99
else
search --no-floppy --fs-uuid --set=root 1732bde7-af9f-43f3-95f1-53d917b87e99
fi
echo 'Loading Linux linux ...'
linux /vmlinuz-linux root=UUID=9b9cbf79-33eb-4538-95f3-823b9c0df00c rw loglevel=3 quiet
echo 'Loading initial ramdisk ...'
initrd /initramfs-linux.img
}
submenu 'Advanced options for Arch Linux' $menuentry_id_option 'gnulinux-advanced-9b9cbf79-33eb-4538-95f3-823b9c0df00c' {
menuentry 'Arch Linux, with Linux linux' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-linux-advanced-9b9cbf79-33eb-4538-95f3-823b9c0df00c' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_msdos
insmod ext2
set root='hd1,msdos2'
if [ x$feature_platform_search_hint = xy ]; then
search --no-floppy --fs-uuid --set=root --hint-bios=hd1,msdos2 --hint-efi=hd1,msdos2 --hint-baremetal=ahci1,msdos2 1732bde7-af9f-43f3-95f1-53d917b87e99
else
search --no-floppy --fs-uuid --set=root 1732bde7-af9f-43f3-95f1-53d917b87e99
fi
echo 'Loading Linux linux ...'
linux /vmlinuz-linux root=UUID=9b9cbf79-33eb-4538-95f3-823b9c0df00c rw loglevel=3 quiet
echo 'Loading initial ramdisk ...'
initrd /initramfs-linux.img
}
menuentry 'Arch Linux, with Linux linux (fallback initramfs)' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-linux-fallback-9b9cbf79-33eb-4538-95f3-823b9c0df00c' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_msdos
insmod ext2
set root='hd1,msdos2'
if [ x$feature_platform_search_hint = xy ]; then
search --no-floppy --fs-uuid --set=root --hint-bios=hd1,msdos2 --hint-efi=hd1,msdos2 --hint-baremetal=ahci1,msdos2 1732bde7-af9f-43f3-95f1-53d917b87e99
else
search --no-floppy --fs-uuid --set=root 1732bde7-af9f-43f3-95f1-53d917b87e99
fi
echo 'Loading Linux linux ...'
linux /vmlinuz-linux root=UUID=9b9cbf79-33eb-4538-95f3-823b9c0df00c rw loglevel=3 quiet
echo 'Loading initial ramdisk ...'
initrd /initramfs-linux-fallback.img
}
}
### END /etc/grub.d/10_linux ###
### BEGIN /etc/grub.d/20_linux_xen ###
### END /etc/grub.d/20_linux_xen ###
### BEGIN /etc/grub.d/30_os-prober ###
### END /etc/grub.d/30_os-prober ###
### BEGIN /etc/grub.d/30_uefi-firmware ###
### END /etc/grub.d/30_uefi-firmware ###
### BEGIN /etc/grub.d/40_custom ###
# This file provides an easy way to add custom menu entries. Simply type the
# menu entries you want to add after this comment. Be careful not to change
# the 'exec tail' line above.
### END /etc/grub.d/40_custom ###
### BEGIN /etc/grub.d/41_custom ###
if [ -f ${config_directory}/custom.cfg ]; then
source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f $prefix/custom.cfg ]; then
source $prefix/custom.cfg
fi
### END /etc/grub.d/41_custom ###mkinitcpio.conf
# vim:set ft=sh
# MODULES
# The following modules are loaded before any boot hooks are
# run. Advanced users may wish to specify all system modules
# in this array. For instance:
# MODULES=(piix ide_disk reiserfs)
MODULES=()
# BINARIES
# This setting includes any additional binaries a given user may
# wish into the CPIO image. This is run last, so it may be used to
# override the actual binaries included by a given hook
# BINARIES are dependency parsed, so you may safely ignore libraries
BINARIES=()
# FILES
# This setting is similar to BINARIES above, however, files are added
# as-is and are not parsed in any way. This is useful for config files.
FILES=()
# HOOKS
# This is the most important setting in this file. The HOOKS control the
# modules and scripts added to the image, and what happens at boot time.
# Order is important, and it is recommended that you do not change the
# order in which HOOKS are added. Run 'mkinitcpio -H <hook name>' for
# help on a given hook.
# 'base' is _required_ unless you know precisely what you are doing.
# 'udev' is _required_ in order to automatically load modules
# 'filesystems' is _required_ unless you specify your fs modules in MODULES
# Examples:
## This setup specifies all modules in the MODULES setting above.
## No raid, lvm2, or encrypted root is needed.
# HOOKS=(base)
#
## This setup will autodetect all modules for your system and should
## work as a sane default
# HOOKS=(base udev autodetect block filesystems)
#
## This setup will generate a 'full' image which supports most systems.
## No autodetection is done.
# HOOKS=(base udev block filesystems)
#
## This setup assembles a pata mdadm array with an encrypted root FS.
## Note: See 'mkinitcpio -H mdadm' for more information on raid devices.
# HOOKS=(base udev block mdadm encrypt filesystems)
#
## This setup loads an lvm2 volume group on a usb device.
# HOOKS=(base udev block lvm2 filesystems)
#
## NOTE: If you have /usr on a separate partition, you MUST include the
# usr, fsck and shutdown hooks.
HOOKS=(base udev autodetect keyboard modconf block sd-encrypt filesystems fsck)
# COMPRESSION
# Use this to compress the initramfs image. By default, zstd compression
# is used. Use 'cat' to create an uncompressed image.
#COMPRESSION="zstd"
#COMPRESSION="gzip"
#COMPRESSION="bzip2"
#COMPRESSION="lzma"
#COMPRESSION="xz"
#COMPRESSION="lzop"
#COMPRESSION="lz4"
# COMPRESSION_OPTIONS
# Additional options for the compressor
#COMPRESSION_OPTIONS=()Offline
...What I expect should happen is, GRUB starts up, looks for the unlocked root partition's UUID (added to grub.cfg by grub-mkconfig[), and realizes that it's locked thanks to GRUB_ENABLE_CRYPTODISK=y. Then it should prompt me for a password, unlock the partition, and boot happily.
GRUB_ENABLE_CRYPTODISK=y is only useful if your boot partition is luks1-encrypted and would like GRUB to decrypt the boot partition. Since your boot partition is unencrypted you don't need this. It has nothing to do with unlocking your separate root partition.
Please refer to this section of the wiki on how to instruct grub to decrypt the root partition, particularly the part about configuring the boot loader.
Also, you may want to look into creating keyfiles for your separate encrypted home partition and using it in conjunction with /etc/crypttab to automatically unlock your home partition.
Last edited by kermit63 (2021-12-19 23:19:18)
Never argue with an idiot, they will drag you down to their level and then beat you with experience.
It is better to light a candle than curse the darkness.
A journey of a thousand miles begins with a single step.
Offline
Ok, I understand GRUB_ENABLE_CRYPTODISK=y is unnecessary. I've been looking more into this and it seems like GRUB gets through loading the initramfs from /boot, then the failure occurs when going through the initramfs, i.e. after GRUB is finished. Why is unlocking the root partition something I want to do in GRUB rather than early in initramfs?
If I stick with decrypting in GRUB, I believe I want the "Configuring the boot loader - sd-encrypt" section of your link. Editing /etc/default/grub and updating grub.cfg:
# GRUB boot loader configuration
GRUB_DEFAULT=0
GRUB_TIMEOUT=5
GRUB_DISTRIBUTOR="Arch"
GRUB_CMDLINE_LINUX_DEFAULT="rd.luks.name=XXXXXXX-...fe36=cryptroot root=/dev/mapper/cryptroot loglevel=3 quiet"
GRUB_CMDLINE_LINUX=""
# Preload both GPT and MBR modules so that they are not missed
GRUB_PRELOAD_MODULES="part_gpt part_msdos"
# Uncomment to enable booting from LUKS encrypted devices
#GRUB_ENABLE_CRYPTODISK=y
# Set to 'countdown' or 'hidden' to change timeout behavior,
# press ESC key to display menu.
GRUB_TIMEOUT_STYLE=menu
# Uncomment to use basic console
GRUB_TERMINAL_INPUT=console
# Uncomment to disable graphical terminal
#GRUB_TERMINAL_OUTPUT=console
# The resolution used on graphical terminal
# note that you can use only modes which your graphic card supports via VBE
# you can see them in real GRUB with the command `vbeinfo'
GRUB_GFXMODE=auto
# Uncomment to allow the kernel use the same resolution used by grub
GRUB_GFXPAYLOAD_LINUX=keep
# Uncomment if you want GRUB to pass to the Linux kernel the old parameter
# format "root=/dev/xxx" instead of "root=/dev/disk/by-uuid/xxx"
#GRUB_DISABLE_LINUX_UUID=true
# Uncomment to disable generation of recovery mode menu entries
GRUB_DISABLE_RECOVERY=true
# Uncomment and set to the desired menu colors. Used by normal and wallpaper
# modes only. Entries specified as foreground/background.
#GRUB_COLOR_NORMAL="light-blue/black"
#GRUB_COLOR_HIGHLIGHT="light-cyan/blue"
# Uncomment one of them for the gfx desired, a image background or a gfxtheme
#GRUB_BACKGROUND="/path/to/wallpaper"
#GRUB_THEME="/path/to/gfxtheme"
# Uncomment to get a beep at GRUB start
#GRUB_INIT_TUNE="480 440 1"
# Uncomment to make GRUB remember the last selection. This requires
# setting 'GRUB_DEFAULT=saved' above.
#GRUB_SAVEDEFAULT=true
# Uncomment to disable submenus in boot menu
#GRUB_DISABLE_SUBMENU=y
#
GRUB_ENABLE_CRYPTODISK=y#
# DO NOT EDIT THIS FILE
#
# It is automatically generated by grub-mkconfig using templates
# from /etc/grub.d and settings from /etc/default/grub
#
### BEGIN /etc/grub.d/00_header ###
insmod part_gpt
insmod part_msdos
if [ -s $prefix/grubenv ]; then
load_env
fi
if [ "${next_entry}" ] ; then
set default="${next_entry}"
set next_entry=
save_env next_entry
set boot_once=true
else
set default="0"
fi
if [ x"${feature_menuentry_id}" = xy ]; then
menuentry_id_option="--id"
else
menuentry_id_option=""
fi
export menuentry_id_option
if [ "${prev_saved_entry}" ]; then
set saved_entry="${prev_saved_entry}"
save_env saved_entry
set prev_saved_entry=
save_env prev_saved_entry
set boot_once=true
fi
function savedefault {
if [ -z "${boot_once}" ]; then
saved_entry="${chosen}"
save_env saved_entry
fi
}
function load_video {
if [ x$feature_all_video_module = xy ]; then
insmod all_video
else
insmod efi_gop
insmod efi_uga
insmod ieee1275_fb
insmod vbe
insmod vga
insmod video_bochs
insmod video_cirrus
fi
}
if [ x$feature_default_font_path = xy ] ; then
font=unicode
else
insmod part_msdos
insmod cryptodisk
insmod luks
insmod gcry_rijndael
insmod gcry_rijndael
insmod gcry_sha256
insmod ext2
cryptomount -u 05fc74f7efa749d982bb15b16f37fe36
set root='cryptouuid/05fc74f7efa749d982bb15b16f37fe36'
if [ x$feature_platform_search_hint = xy ]; then
search --no-floppy --fs-uuid --set=root --hint='cryptouuid/05fc74f7efa749d982bb15b16f37fe36' 9b9cbf79-33eb-4538-95f3-823b9c0df00c
else
search --no-floppy --fs-uuid --set=root 9b9cbf79-33eb-4538-95f3-823b9c0df00c
fi
font="/usr/share/grub/unicode.pf2"
fi
if loadfont $font ; then
set gfxmode=auto
load_video
insmod gfxterm
set locale_dir=$prefix/locale
set lang=en_US
insmod gettext
fi
terminal_input console
terminal_output gfxterm
if [ x$feature_timeout_style = xy ] ; then
set timeout_style=menu
set timeout=5
# Fallback normal timeout code in case the timeout_style feature is
# unavailable.
else
set timeout=5
fi
### END /etc/grub.d/00_header ###
### BEGIN /etc/grub.d/10_linux ###
menuentry 'Arch Linux' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-9b9cbf79-33eb-4538-95f3-823b9c0df00c' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_msdos
insmod ext2
set root='hd1,msdos2'
if [ x$feature_platform_search_hint = xy ]; then
search --no-floppy --fs-uuid --set=root --hint-bios=hd1,msdos2 --hint-efi=hd1,msdos2 --hint-baremetal=ahci1,msdos2 1732bde7-af9f-43f3-95f1-53d917b87e99
else
search --no-floppy --fs-uuid --set=root 1732bde7-af9f-43f3-95f1-53d917b87e99
fi
echo 'Loading Linux linux ...'
linux /vmlinuz-linux root=UUID=9b9cbf79-33eb-4538-95f3-823b9c0df00c rw rd.luks.name=XXXXXXX-...fe36=cryptroot root=/dev/mapper/cryptroot loglevel=3 quiet loglevel=3 quiet
echo 'Loading initial ramdisk ...'
initrd /initramfs-linux.img
}
submenu 'Advanced options for Arch Linux' $menuentry_id_option 'gnulinux-advanced-9b9cbf79-33eb-4538-95f3-823b9c0df00c' {
menuentry 'Arch Linux, with Linux linux' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-linux-advanced-9b9cbf79-33eb-4538-95f3-823b9c0df00c' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_msdos
insmod ext2
set root='hd1,msdos2'
if [ x$feature_platform_search_hint = xy ]; then
search --no-floppy --fs-uuid --set=root --hint-bios=hd1,msdos2 --hint-efi=hd1,msdos2 --hint-baremetal=ahci1,msdos2 1732bde7-af9f-43f3-95f1-53d917b87e99
else
search --no-floppy --fs-uuid --set=root 1732bde7-af9f-43f3-95f1-53d917b87e99
fi
echo 'Loading Linux linux ...'
linux /vmlinuz-linux root=UUID=9b9cbf79-33eb-4538-95f3-823b9c0df00c rw rd.luks.name=XXXXXXX-...fe36=cryptroot root=/dev/mapper/cryptroot loglevel=3 quiet loglevel=3 quiet
echo 'Loading initial ramdisk ...'
initrd /initramfs-linux.img
}
menuentry 'Arch Linux, with Linux linux (fallback initramfs)' --class arch --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-linux-fallback-9b9cbf79-33eb-4538-95f3-823b9c0df00c' {
load_video
set gfxpayload=keep
insmod gzio
insmod part_msdos
insmod ext2
set root='hd1,msdos2'
if [ x$feature_platform_search_hint = xy ]; then
search --no-floppy --fs-uuid --set=root --hint-bios=hd1,msdos2 --hint-efi=hd1,msdos2 --hint-baremetal=ahci1,msdos2 1732bde7-af9f-43f3-95f1-53d917b87e99
else
search --no-floppy --fs-uuid --set=root 1732bde7-af9f-43f3-95f1-53d917b87e99
fi
echo 'Loading Linux linux ...'
linux /vmlinuz-linux root=UUID=9b9cbf79-33eb-4538-95f3-823b9c0df00c rw rd.luks.name=XXXXXXX-...fe36=cryptroot root=/dev/mapper/cryptroot loglevel=3 quiet loglevel=3 quiet
echo 'Loading initial ramdisk ...'
initrd /initramfs-linux-fallback.img
}
}
### END /etc/grub.d/10_linux ###
### BEGIN /etc/grub.d/20_linux_xen ###
### END /etc/grub.d/20_linux_xen ###
### BEGIN /etc/grub.d/30_os-prober ###
### END /etc/grub.d/30_os-prober ###
### BEGIN /etc/grub.d/30_uefi-firmware ###
### END /etc/grub.d/30_uefi-firmware ###
### BEGIN /etc/grub.d/40_custom ###
# This file provides an easy way to add custom menu entries. Simply type the
# menu entries you want to add after this comment. Be careful not to change
# the 'exec tail' line above.
### END /etc/grub.d/40_custom ###
### BEGIN /etc/grub.d/41_custom ###
if [ -f ${config_directory}/custom.cfg ]; then
source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f $prefix/custom.cfg ]; then
source $prefix/custom.cfg
fi
### END /etc/grub.d/41_custom ###Result is:
Starting version 249.7-2-arch
ERROR: device '/dev/mapper/cryptroot' not found. Skipping fsck.
mount: /new_root: no filesystem type specified.So I don't seem to have made much progress. What's next?
Thanks for the help.
Last edited by ttshaw1 (2021-12-19 23:53:37)
Offline
HOOKS=(base udev autodetect keyboard modconf block sd-encrypt filesystems fsck)Did you fix the hooks entry by following the wiki section https://bbs.archlinux.org/profile.php?id=116861 linked? The sd-encrypt hook on its own will do nothing.
Last edited by loqs (2021-12-20 00:02:55)
Offline
Did you fix the hooks entry by following the wiki section https://bbs.archlinux.org/profile.php?id=116861 linked? The sd-encrypt hook on its own will do nothing.
Got it. I didn't realize I was mixing and matching busybox hooks with systemd stuff and they wouldn't be compatible. After changing hooks to the entry on that page with udev and encrypt, changing the kernel parameters in grub to the cryptdevice option, and rebuilding grub.cfg and initramfs, decryption is working. Thanks for the help.
I currently have an issue where I can't log into my new non-root user because "/home/$USER: change directory failed: Permission denied." I've made sure that /home/$USER is owned by my user, and /home is owned by root. Both have at least rw permissions set. I'm curious if some sort of encryption shenanigans could be at fault here, since /home is the mountpoint of a separate, encrypted partition.
Offline
I currently have an issue where I can't log into my new non-root user because "/home/$USER: change directory failed: Permission denied."
Turns out root (/) didn't have the right permissions. Set it to 755 and now it seems like everything is working. That's probably the result of doing the partitioning through a GUI in a live USB rather than in the terminal.
Offline