Yes, you can do this by accessing the master key while the volume is decrypted.
The quick and dirty to add a new passphrase:
device=/dev/sda5
volume_name=foo
cryptsetup luksAddKey $device --master-key-file <(dmsetup table --showkeys $volume_name | awk '{ print $5 }' | xxd -r -p)
device and volume_name should be set appropriately.
volume_name is the name of the decrypted volume, the one you see in /dev/mapper.
Explanation:
LUKS volumes encrypt their data with a master key. Each passphrase you add simply stores a copy of this master key encrypted with that passphrase. So if you have the master key, you simply need to use it in a new key slot.
Lets tear apart the command above.
$ dmsetup table --showkeys $volume_name
This dumps a bunch of information about the actively decrypted volume. The output looks like this:
0 200704 crypt aes-xts-plain64 53bb7da1f26e2a032cc9e70d6162980440bd69bb31cb64d2a4012362eeaad0ac 0 7:2 4096
Field #5 is the master key.
$ dmsetup table --showkeys $volume_name | awk '{ print $5 }' | xxd -r -p
Not going to show the output of this as it's binary data, but what this does is grab the master key for the volume, and then convert it into raw binary data which is needed later.
$ cryptsetup luksAddKey $device --master-key-file <(...)
This is telling cryptsetup to add a new key to the volume. Normally this action requires an existing key, however we use --master-key-file to tell it we want to use the master key instead.
The <(...) is shell command substitution & redirection. It basically executes everything inside, sends the output to a pipe, and then substitutes the <(...) with a path to that pipe.
So the whole command is just a one-liner to condense several operations.
