I'm working on a script to create a fully encrypted washable system from debootstrap. It's doing some good, but the initramfs
image that comes out does not pick up the cryptroot properly. After booting the image with qemu, I'm dropped to a busybox shell and I have to unlock the luks encryption manually with cryptsetup
:
cryptsetup luksOpen /dev/sda1 system
/scripts/local-premount/flashback
exit
(flashback does some btrfs snapshoting magic to forget changes made on every boot)
After this, boot in qemu continues normally and I am then able to generate a good initramfs
image. I copy this to the btrfs @root.base subvolume and all is well from then on.
I need help with figuring out why the cryptsetup/cryptroot part is not being picked up in the chroot environment by update-initramfs
:
echo "CRYPTSETUP=y" >> /usr/share/initramfs-tools/conf-hooks.d/cryptsetup
echo "export CRYPTSETUP=y" >> /usr/share/initramfs-tools/conf-hooks.d/cryptsetup
update-initramfs -ut
I have tried many things, I write a good fstab and crypttab and even tried to explicitly set cryptdevice in grub.cfg. Refer to the specific version of the script.
Here's how I create the fstab and crypttab:
export partuuid=$(blkid $partition | sed -re 's/.*: UUID="([^"]+)".*/\1/')
export decruuid=$(blkid /dev/mapper/$decrypted | sed -re 's/.*: UUID="([^"]+)".*/\1/')
echo "Adding flashback with uuid $partuuid"
echo "system UUID=$partuuid none luks" >> "$rootmount/etc/crypttab"
echo "UUID=$decruuid / btrfs subvol=@root.curr 0 0" >> "$rootmount/etc/fstab"
echo "UUID=$decruuid /home btrfs subvol=@home 0 0" >> "$rootmount/etc/fstab"
The question in principle is: How do you generate a functioning initramfs image in an encrypted chroot of a debootstrapped debian?
Thanks a bunch
crypttab
in place before initramfs generation. – Ferenc Wágner Mar 4 '16 at 10:43/usr/share/initramfs-tools/conf-hooks.d/cryptsetup
. However, you could addset -x
at the beginning of/usr/share/initramfs-tools/scripts/local-top/cryptroot
and get some debug info (actually, lots, so a logged serial console is recommended) after regenerating the initramfs. Appendingdebug
to your kernel command line might also help. – Ferenc Wágner Mar 5 '16 at 21:20/usr/share/initramfs-tools/conf-hooks.d/cryptsetup
- pure desperation :o) or else cryptsetup would not be included in initramfs at all. I'll try your debugging tips and update if I find something curious later. – Rbjz Mar 7 '16 at 19:49echo CRYPTSETUP=y >/etc/initramfs-tools/conf.d/force-cryptsetup
, otherwise your modifications will be lost on upgrade. Also, try using the dm-crypt device name (/dev/mapper/system
) in yourfstab
and the kernelroot=
argument. – Ferenc Wágner Mar 8 '16 at 10:23