Is there a way to
kexec reboot a running kernel without having to decrypt an encrypted LUKS root filesystem?
I'd imagine not, but I'm not sure if there's a workaround for this.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
If my other answer does for some reason not meet your requirements (e.g. because you don't want a keyfile on your volume or your
/boot is not encrypted), I can also recommend this project: https://github.com/flowztul/keyexec
As grub2 supports decrypting LUKS-encrypted volumes, I'll assume that your
/boot partition is encrypted as well. This also thwarts some evil-maid attacks.
If this is the case, you can safely have a key which can decrypt the volume inside your initramfs. Now, when kexec loads your initramfs into ram, it'll be able to decrypt your partition when loading the new kernel.
Because this guide to set up an luks keyfile inside of the initramfs, which also solves the problem of having to enter the keyphrase twice (first in grub, second when the initramfs is loading).