I'm setting up an encrypted root fs, which I've done before, but this time I'm using a PGP-encrypted keyfile with a symmetric password to familiarize myself with the process.
There are two places where configuration of encrypted roots seems to occur, in the kernel init options under
cryptopts, and in
/etc/crypttab, which seems to be used by
mkinitramfs to bake certain things into the initramfs.
It's kind of cumbersome to update things in both places; after all, what's the point of having it in two places if the one suffices? I do see the value of having things in
/etc/crypttab, as the initramfs can be generated differently with different hooks and scripts if a LUKS volume is present.
Using a previous example emended for this question, here's my crypttab:
picrypt /dev/mmcblk0p2 /boot/diskkey.gpg luks,keyscript=/lib/cryptsetup/scripts/decrypt_gnupg
Presumably, this tells the initramfs that
/dev/mmcblk0p2 should be decrypted to use the name
picrypt, specifying that we want to use
luks and to pass the
/boot/diskkey.gpg file to the
/lib/cryptsetup/scripts/decrypt_gnupg script to generate a passphrase for the volume.
Next, here are my cryptopts from my kernel init line:
Again, we're re-specifying that
picrypt, and in this case we're also telling it that there's an LVM volume inside called
pi which it should wait for before trying to mount the root filesystem specified by the
root=/dev/mapper/pi-root kernel parameter.
This setup isn't working, strangely enough, as it seems to be ignoring the crypttab's key file and key script parameters and not prompting for the GPG symmetric key passphrase, rather directly for a key. I'm going to emend my script to include
cryptopts, but why must I do this?
Is there a way to include all of this (or at least most of it) in
/etc/crypttab and not duplicate everything in the kernel init line? It's kind of ridiculous to have to change everything twice. Do these different sources simply provide different functions, crypttab in the form of hooks and cryptopts in the form of actual parameters to cryptsetup?