Is there a way to kexec reboot a running kernel without having to decrypt an encrypted LUKS root filesystem?

I'd imagine not, but I'm not sure if there's a workaround for this.

  • You might be able to create a second initramfs with a embedded key file which is stored on the encrypted volume. This would at least solve the password prompt. Just like the first answer now that i read it properly
    – tom
    Nov 19, 2019 at 17:55

2 Answers 2


If my other answer does for some reason not meet your requirements (e.g. because you don't want a keyfile on your volume or your /boot is not encrypted), I can also recommend this project: https://github.com/flowztul/keyexec


As grub2 supports decrypting LUKS-encrypted volumes, I'll assume that your /boot partition is encrypted as well. This also thwarts some evil-maid attacks.

If this is the case, you can safely have a key which can decrypt the volume inside your initramfs. Now, when kexec loads your initramfs into ram, it'll be able to decrypt your partition when loading the new kernel.

Because this guide to set up an luks keyfile inside of the initramfs, which also solves the problem of having to enter the keyphrase twice (first in grub, second when the initramfs is loading).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .