why does systemd cryptsetup try to remount the root partition already mounted?

Question

I have /etc/crypttab as follows:

sda7_crypt UUID=<...> /dev/sda8:/keyfile luks,discard,keyscript=/lib/esi/tpm_key_pass

sda7_crypt is my root filesystem, so I use update-initramfs to decrypt it from early on (otherwise I could not continue boot).

Yet systemd automatically creates a systemd-cryptsetup@sda7_crypt.service unit, which depends upon a dev-sda8:-keyfile.device, which times out. This eventually fails, but it slows boot time down and creates error messages.

How do I indicate that this is already mounted by initram, and does not need to be mounted by systemd? I had thought about option noauto in crypttab, but was concerned it might prevent it from loading in ini tram?

UPDATE:

I tried noauto, it didn't work. Still mounts in initram, but also still tries on boot. crypttab now looks like:

sda7_crypt UUID=<...> /dev/sda8:/keyfile luks,discard,keyscript=/lib/esi/tpm_key_pass,noauto

What can I do to clean this up?

Answer 1

Turns out this is 2 individual systemd issues, specifically how systemd-cryptsetup-generator works.

1. It doesn't recognize keyscript=... option, so it chokes on keys that are valid for passdev like /dev/sda8:/keyfile.
2. The systemd units automatically generated by systemd-cryptsetup-generator are not smart enough to recognize that the item already is mounted, and so tries to mount it again.

For more details, see this Debian bug report https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618862

According to the bug report, you can stop it from generating the systemd units by passing kernel options luks=no, but that prevents all crypttab automatic mounting. This is fine if all you have is encrypted root, but if there are separate individual partitions, then they don't mount.