11

Is there a way to kexec reboot a running kernel without having to decrypt an encrypted LUKS root filesystem?

I'd imagine not, but I'm not sure if there's a workaround for this.

2

If my other answer does for some reason not meet your requirements (e.g. because you don't want a keyfile on your volume or your /boot is not encrypted), I can also recommend this project: https://github.com/flowztul/keyexec

0

As grub2 supports decrypting LUKS-encrypted volumes, I'll assume that your /boot partition is encrypted as well. This also thwarts some evil-maid attacks.

If this is the case, you can safely have a key which can decrypt the volume inside your initramfs. Now, when kexec loads your initramfs into ram, it'll be able to decrypt your partition when loading the new kernel.

Because this guide to set up an luks keyfile inside of the initramfs, which also solves the problem of having to enter the keyphrase twice (first in grub, second when the initramfs is loading).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.