1

OS: Parabola GNU/Linux Libre, a GNU version of Arch.

I have managed to encrypt my root partition, but I'm unsure about how to encrypt my swap partition. I know swap partitions are becoming old-fashioned and that swap files are preferred, btrfs still does not support this.

lsblk

NAME          MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
sda             8:0    0 223.6G  0 disk  
├─sda2          8:2    0 221.1G  0 part  
│ └─cryptroot 254:0    0 221.1G  0 crypt /
├─sda3          8:3    0     2G  0 part  
│ └─cryptswap 254:1    0     2G  0 crypt 
└─sda1          8:1    0   512M  0 part  /boot

/etc/fstab

# /dev/mapper/cryptroot
UUID=0126cb9b-d3aa-4f05-a39a-71682fa847bb       /               btrfs           rw,relatime,ssd,space_cache,subvolid=5,subvol=/ 0 0

# /dev/sda1
UUID=6F37-84A2          /boot           vfat            rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro      0 2

# /dev/mapper/cryptswap
UUID=aef00636-0183-48d1-ab87-8f6653a30dd8       none            swap            defaults        0 0

/boot/loader/entries/parabola.conf

title Parabola GNU/Linux-libre
linux /vmlinuz-linux-libre
initrd /initramfs-linux-libre.img
options rd.luks.uuid=c6b69115-15c6-4561-9691-fc4a05ac9622 rd.luks.name=c6b69115-15c6-4561-9691-fc4a05ac9622=cryptroot rd.luks.options=quiet rw root=/dev/mapper/cryptroot

/etc/crypttab

# crypttab: mappings for encrypted partitions
#
# Each mapped device will be created in /dev/mapper, so your /etc/fstab
# should use the /dev/mapper/<name> paths for encrypted devices.
#
# The Parabola specific syntax has been deprecated, see crypttab(5) for the
# new supported syntax.
#
# NOTE: Do not list your root (/) partition here, it must be set up
#       beforehand by the initramfs (/etc/mkinitcpio.conf).

# <name>       <device>                                                     <password>              <options>
cryptswap      /dev/disk/by-id/ata-PH4-CE240_511160905070017677-part3       /dev/urandom            swap

journalctl -b

Dec 22 23:35:54 MyComputer mkswap[341]: Setting up swapspace version 1, size = 2 GiB (2147459072 bytes)
Dec 22 23:35:54 MyComputer mkswap[341]: no label, UUID=c965e98e-b011-4e40-aef3-bb84d58d7a08
Dec 22 23:35:54 MyComputer systemd[1]: Started Cryptography Setup for swap.
Dec 22 23:35:54 MyComputer systemd[1]: Reached target Encrypted Volumes.
Dec 22 23:35:54 MyComputer systemd[1]: Found device /dev/mapper/swap.
Dec 22 23:37:23 MyComputer systemd[1]: dev-disk-by\x2duuid-aef00636\x2d0183\x2d48d1\x2dab87\x2d8f6653a30dd8.device: Job dev-disk-by\x2duuid-aef00636\x2d0183\x2d48d1\x2dab87\x2d8f6653a30dd8.device/start timed out.
Dec 22 23:37:23 MyComputer systemd[1]: Timed out waiting for device dev-disk-by\x2duuid-aef00636\x2d0183\x2d48d1\x2dab87\x2d8f6653a30dd8.device.
Dec 22 23:37:23 MyComputer systemd[1]: Dependency failed for /dev/disk/by-uuid/aef00636-0183-48d1-ab87-8f6653a30dd8.
Dec 22 23:37:23 MyComputer systemd[1]: Dependency failed for Swap.
Dec 22 23:37:23 MyComputer systemd[1]: swap.target: Job swap.target/start failed with result 'dependency'.
Dec 22 23:37:23 MyComputer systemd[1]: dev-disk-by\x2duuid-aef00636\x2d0183\x2d48d1\x2dab87\x2d8f6653a30dd8.swap: Job dev-disk-by\x2duuid-aef00636\x2d0183\x2d48d1\x2dab87\x2d8f6653a30dd8.swap/start failed with result 'dependency'.
Dec 22 23:37:23 MyComputer systemd[1]: dev-disk-by\x2duuid-aef00636\x2d0183\x2d48d1\x2dab87\x2d8f6653a30dd8.device: Job dev-disk-by\x2duuid-aef00636\x2d0183\x2d48d1\x2dab87\x2d8f6653a30dd8.device/start failed with result 'timeout'.
Dec 22 23:37:23 MyComputer systemd[1]: Mounting Temporary Directory...
Dec 22 23:37:23 MyComputer systemd[1]: Mounted Temporary Directory.
Dec 22 23:37:23 MyComputer systemd[1]: Reached target Local File Systems.
Dec 22 23:37:23 MyComputer systemd[1]: Starting Create Volatile Files and Directories...
Dec 22 23:37:23 MyComputer systemd[1]: Started Create Volatile Files and Directories.
Dec 22 23:37:23 MyComputer systemd[1]: Starting Update UTMP about System Boot/Shutdown...
Dec 22 23:37:23 MyComputer systemd[1]: Started Update UTMP about System Boot/Shutdown.
Dec 22 23:37:23 MyComputer systemd[1]: Reached target System Initialization.
Dec 22 23:37:23 MyComputer systemd[1]: Started Daily Cleanup of Temporary Directories.
Dec 22 23:37:23 MyComputer systemd[1]: Started Daily verification of password and group files.
Dec 22 23:37:23 MyComputer systemd[1]: Listening on D-Bus System Message Bus Socket.
Dec 22 23:37:23 MyComputer systemd[1]: Reached target Sockets.
Dec 22 23:37:23 MyComputer systemd[1]: Reached target Basic System.
Dec 22 23:37:23 MyComputer systemd[1]: Starting Save/Restore Sound Card State...
Dec 22 23:37:23 MyComputer systemd[1]: Starting dhcpcd on enp4s0...
Dec 22 23:37:23 MyComputer systemd[1]: Starting Login Service...
Dec 22 23:37:23 MyComputer systemd[1]: Started D-Bus System Message Bus.
...
Dec 24 00:00:09 MyComputer systemd[1]: Started Update man-db cache.
Dec 24 00:01:36 MyComputer systemd[1]: dev-disk-by\x2duuid-aef00636\x2d0183\x2d48d1\x2dab87\x2d8f6653a30dd8.device: Job dev-disk-by\x2duuid-aef00636\x2d0183\x2d48d1\x2dab87\x2d8f6653a30dd8.device/start timed out.
Dec 24 00:01:36 MyComputer systemd[1]: Timed out waiting for device dev-disk-by\x2duuid-aef00636\x2d0183\x2d48d1\x2dab87\x2d8f6653a30dd8.device.
Dec 24 00:01:36 MyComputer systemd[1]: Dependency failed for /dev/disk/by-uuid/aef00636-0183-48d1-ab87-8f6653a30dd8.
Dec 24 00:01:36 MyComputer systemd[1]: dev-disk-by\x2duuid-aef00636\x2d0183\x2d48d1\x2dab87\x2d8f6653a30dd8.swap: Job dev-disk-by\x2duuid-aef00636\x2d0183\x2d48d1\x2dab87\x2d8f6653a30dd8.swap/start failed with result 'dependency'.
Dec 24 00:01:36 MyComputer systemd[1]: dev-disk-by\x2duuid-aef00636\x2d0183\x2d48d1\x2dab87\x2d8f6653a30dd8.device: Job dev-disk-by\x2duuid-aef00636\x2d0183\x2d48d1\x2dab87\x2d8f6653a30dd8.device/start failed with result 'timeout'.

[Update]

New Information has come to light. Looks like what should have been the encrypted swap partition is not recognized.

My partitions

[Update]

I've tried the following with the same result as above:

parted 
rm 3
mkpart primary ext2 -2GiB 100%
(Ignore)
quit
dd if=/dev/urandom of=/dev/sda3 bs=1M
cryptsetup -v -y luksFormat /dev/sda3 
YES
cryptsetup open /dev/sda3 cryptswap
mkswap /dev/mapper/cryptswap
swapon /dev/mapper/cryptswap

[Update]

Encrypting the partition like above on the Live MATE version of Parabola returns an error.

1 root@parabolaiso / # cryptsetup -y -v luksFormat /dev/sda3 --debug                                                                            :(
# cryptsetup 1.7.3 processing "cryptsetup -y -v luksFormat /dev/sda3 --debug"
# Running command luksFormat.
# Locking memory.
# Installing SIGINT/SIGTERM handler.
# Unblocking interruption on signal.

WARNING!
========
This will overwrite data on /dev/sda3 irrevocably.

Are you sure? (Type uppercase yes): YES
# Allocating crypt device /dev/sda3 context.
# Trying to open and read device /dev/sda3 with direct-io.
# Initialising device-mapper backend library.
# Timeout set to 0 miliseconds.
# Iteration time set to 2000 milliseconds.
# Interactive passphrase entry requested.
Enter passphrase: 
Verify passphrase: 
# Formatting device /dev/sda3 as type LUKS1.
# Crypto backend (gcrypt 1.7.5) initialized in cryptsetup library version 1.7.3.
# Detected kernel Linux 4.8.6-gnu-1 x86_64.
# Topology: IO (512/0), offset = 0; Required alignment is 1048576 bytes.
# Checking if cipher aes-xts-plain64 is usable.
# Userspace crypto wrapper cannot use aes-xts-plain64 (-95).
# Using dmcrypt to access keyslot area.
# Calculated device size is 1 sectors (RW), offset 0.
# dm version   [ opencount flush ]   [16384] (*1)
# dm versions   [ opencount flush ]   [16384] (*1)
# Device-mapper backend running with UDEV support enabled.
# DM-UUID is CRYPT-TEMP-temporary-cryptsetup-10670
# dm versions   [ opencount flush ]   [16384] (*1)
# Device-mapper backend running with UDEV support enabled.
# Udev cookie 0xd4d2344 (semid 65536) created
# Udev cookie 0xd4d2344 (semid 65536) incremented to 1
# Udev cookie 0xd4d2344 (semid 65536) incremented to 2
# Udev cookie 0xd4d2344 (semid 65536) assigned to CREATE task(0) with flags DISABLE_SUBSYSTEM_RULES DISABLE_DISK_RULES DISABLE_OTHER_RULES         (0xe)
# dm create temporary-cryptsetup-10670 CRYPT-TEMP-temporary-cryptsetup-10670 [ opencount flush ]   [16384] (*1)
# dm reload temporary-cryptsetup-10670  [ opencount flush readonly ]   [16384] (*1)
device-mapper: reload ioctl on temporary-cryptsetup-10670 failed: Invalid argument
# Udev cookie 0xd4d2344 (semid 65536) decremented to 1
# Udev cookie 0xd4d2344 (semid 65536) incremented to 2
# Udev cookie 0xd4d2344 (semid 65536) assigned to REMOVE task(2) with flags DISABLE_SUBSYSTEM_RULES DISABLE_DISK_RULES DISABLE_OTHER_RULES         (0xe)
# dm remove temporary-cryptsetup-10670  [ opencount flush readonly ]   [16384] (*1)
# temporary-cryptsetup-10670: Stacking NODE_DEL [verify_udev]
# Udev cookie 0xd4d2344 (semid 65536) decremented to 0
# Udev cookie 0xd4d2344 (semid 65536) waiting for zero
# Udev cookie 0xd4d2344 (semid 65536) destroyed
# temporary-cryptsetup-10670: Processing NODE_DEL [verify_udev]
# dm versions   [ opencount flush ]   [16384] (*1)
# Device-mapper backend running with UDEV support enabled.
Failed to setup dm-crypt key mapping for device /dev/sda3.
Check that kernel supports aes-xts-plain64 cipher (check syslog for more info).
# Releasing crypt device /dev/sda3 context.
# Releasing device-mapper backend.
# Unlocking memory.
Command failed with code 5: Input/output error

[Update]

I actually solved it by using systemd-swap (better than nothing) instead and I'll wait for btrfs to support real swap.

  • Don't use btrfs as /, it is not stable enough for that. – DepressedDaniel Dec 24 '16 at 17:49
  • @DepressedDaniel do you have an authoratitve source to substantiate that assertion? – jasonwryan Dec 26 '16 at 21:13
  • @jasonwryan No, just personal experience with several failed btrfs partitions. – DepressedDaniel Dec 26 '16 at 23:42
  • @DepressedDaniel that hardly constitutes grounds for suggesting it isn't stable enough for /... – jasonwryan Dec 27 '16 at 0:00
  • @jasonwryan Same as shooting yourself in the foot hardly constitutes grounds for suggesting that guns are dangerous, right? – DepressedDaniel Dec 27 '16 at 0:35
1

It would be simpler to make one encrypted container and set up both / and swap on that with LVM.

Like this:

sda1  boot
sda2  LUKS-crypt
    LVM
        root-LV
        swap-LV

Then you only need one key to open it, letting you skip crypttab altogether.

| improve this answer | |
  • Is that still possible without destroying my sda2 partition? My reasoning is that that somewhere in the medium-near future btrfs is going to support swap and that I could make that switch by deleting sda3 and resizing sda2, so I would never have to deal with this again, but in the mean time, it's always nice to have a swap partition. You never know what some applications will try to do or how many browser tabs I decide to open before realizing that it costs memory. – Folât Dec 27 '16 at 9:39
  • Your current partition setup will need to be wiped to set this up, but you can rearrange the logical volumes later on without rebuilding the whole setup from the ground up. As for the file system, LVM doesn't care which file system is on the partition. That's for the rest of the system to worry about. – Mio Rin Dec 27 '16 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.