So I'm trying to encrypt a partition sda2 while installing Arch Linux.

root@archiso ~ # cryptsetup luksFormat /dev/sda2 -c aes-xts-plain -y -v -s 512 -h sha512

But it fails:

Cannot format device /dev/sda2 which is still in use.

How do I fix this?

  • 1
    Use lsof to see what is using the device... – jasonwryan Jul 15 '16 at 8:00
  • I can't run lsof on that machine. – Kaotic Jul 15 '16 at 8:11
  • @Kaotic Why not? – dr01 Jul 15 '16 at 8:28

If it's in use, you should check whether it's mounted, loop-device'd, still cryptsetup-opened, active in LVM, part of a RAID set, etc. and then stop all these things. Also quit any running processes that might be using the device (partitioners, installers, ddrescue, badblocks, ...). The list of possibilities as to what could be using a device, is nearly endless. lsof or fuser are able to catch some of them...

# example only, none of these are accurate
umount /dev/sda2
losetup -D
vgchange -a n
cat /proc/mdstat | grep -C 2 sda2
mdadm --stop /dev/md??

Or, if you want to deliberately ignore the issue, you could explicitely put a loop device on top and then format the loop device. You should reboot afterwards to see if whatever was still using the device, would corrupt your LUKS header because of it (if you can't open it after reboot, that's what happened). Without rebooting, you might be able to copy data happily on the device but it's all gone later...

# dangerous hack
cryptsetup luksFormat $(losetup --find --show /dev/sda2) -s 512 -h sha512 ...

Also triple-check that you're actually working with the correct device in the first place. In your post you somehow mentioned both sda1 and sda2 so which is it?

This is not part of your issue, but aes-xts-plain is deprecated in favour of aes-xts-plain64. It's also the default cipher so you don't have to specify it at all. (see cryptsetup --help or luksDump afterwards.)

  • It's sda2 but sda1 should work aswell because it's going to be the boot partition. I tried your examples but they didn't solve the issue. How do I use lsof if my installation of arch isnt done yet? – Kaotic Jul 15 '16 at 8:36
  • Encrypting the boot partition isn't such a great idea. – frostschutz Jul 15 '16 at 8:40
  • Well thats true but it should do the encryption which it isnt. Just mistyped sda1. Thanks anyway. – Kaotic Jul 15 '16 at 8:43
  • 1
    Got it. You were right it the container was still open. Thanks alot. – Kaotic Jul 15 '16 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.