Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have got laptop with full disk encryption. There is a /boot partion which is not encrypted and the other partition /dev/sda5 is.

In order to decrypt, it asks me for the passphrase which is then passed to the command /sbin/cryptsetup luksOpen ${name} ${device}.

How can it decrypt the partition if the command /sbin/cryptsetup is on the encrypted partition, which is not accessible. I thought maybe there is copy of the command in the /boot partition, but I have not found any.

Can somebody shed some light on this?

share|improve this question

migrated from security.stackexchange.com Sep 30 '13 at 9:37

This question came from our site for Information security professionals.

    
You could decrypt it from an initrd. See crux.nu/Wiki/Cryptsetup –  ott-- Sep 29 '13 at 23:58
    
There is a copy on the /boot partition, hidden in the initrd/initramfs, which may either be a dedicated file or built into the kernel image itself. –  frostschutz Sep 30 '13 at 10:45

1 Answer 1

Many Linux distributions use an in-memory filesystem as a temporary root filesystem when booting. There are two forms of such in-memory filesystems: initrd, the traditional form, which is a RAM drive, and initramfs, the modern form, which is a filesystem filled by data from an archive.

The job of the programs on the initrd (or initramfs, the difference is irrelevant here) is to do everything that is necessary to mount the root filesystem. This includes loading modules for the relevant drivers (for the hard disk, for the root filesystem type, and for any other data layer such as RAID and volume encryption). This also includes making the root volume ready for use. Prompting the user for the encryption password is one of these tasks.

The initrd is loaded by the bootloader (Grub, Lilo, …) at the same time as the kernel. It is generally stored in the same directory as the kernel, in /boot.

Most distributions arrange to regenerate the initrd whenever the kernel is upgraded. You may also need to regenerate the initrd in other circumstances such as a change in the location of the root filesystem or of the type of volume. If the root filesystem is encrypted, the distribution will make sure that the initrd contains cryptsetup and crypttab (these are copies from the root filesystem made when the initrd is generated).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.