12

Is there a way to kexec reboot a running kernel without having to decrypt an encrypted LUKS root filesystem?

I'd imagine not, but I'm not sure if there's a workaround for this.

  • You might be able to create a second initramfs with a embedded key file which is stored on the encrypted volume. This would at least solve the password prompt. Just like the first answer now that i read it properly – tom Nov 19 '19 at 17:55
2

If my other answer does for some reason not meet your requirements (e.g. because you don't want a keyfile on your volume or your /boot is not encrypted), I can also recommend this project: https://github.com/flowztul/keyexec

|improve this answer|||||
0

As grub2 supports decrypting LUKS-encrypted volumes, I'll assume that your /boot partition is encrypted as well. This also thwarts some evil-maid attacks.

If this is the case, you can safely have a key which can decrypt the volume inside your initramfs. Now, when kexec loads your initramfs into ram, it'll be able to decrypt your partition when loading the new kernel.

Because this guide to set up an luks keyfile inside of the initramfs, which also solves the problem of having to enter the keyphrase twice (first in grub, second when the initramfs is loading).

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.