I'm switching to Dracut and I've numerous problems. In order to eliminate them one by one, first I want my system to boot correctly. So my Grub2 entry looks like this:

menuentry 'dracut' {
        insmod gzio
        if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
        insmod part_msdos
        insmod ext2
        set root='hd1,msdos1'
        if [ x$feature_platform_search_hint = xy ]; then
          search --no-floppy --fs-uuid --set=root --hint-bios=hd1,msdos1 --hint-efi=hd1,msdos1 --hint-baremetal=ahci1,msdos1  829c0201-9b6d-4e18-8464-9d2551311ea6
          search --no-floppy --fs-uuid --set=root 829c0201-9b6d-4e18-8464-9d2551311ea6
        echo    'Loading Linux 4.9.0-2-amd64 ...'
    linux   /vmlinuz-4.9.0-2-amd64 rd.shell rd.debug log_buf_len=1M
        echo    'Loading dracut initial ramdisk ...'
        initrd  /initramfs-4.9.0-2-amd64.img

I expect to be dropped into the rescue shell and then manually assemble the root file system, and continue booting; but there is no cryptsetup binary in the rescue shell.

Dracut configuration file /etc/dracut.conf.d/* looks like this:


Relevant list of modules are as follows:

# dracut --list-modules | grep crypt
dracut: Executing: /usr/bin/dracut --list-modules

How can I add cryptsetup so I could manually unlock the encrypted partition manually (via rescue shell)?


as of debian dracut-core 044+243-3, /usr/lib/dracut/modules.d/90crypt/module-setup.sh:

require_any_binary $systemdutildir/systemd-cryptsetup cryptsetup || return 1

so dracut first tries to include /lib/systemd/systemd-cryptsetup, if the first not exist then include /sbin/cryptsetup, if neither then fail.

these are each provided by cryptsetup-bin 2:2.1.0-5 and systemd 241-1, respectively.

the usage of /lib/systemd/systemd-cryptsetup is not very same as /sbin/cryptsetup. indeed, it has less functionality:

systemd-cryptsetup attach VOLUME SOURCEDEVICE [PASSWORD] [OPTIONS]
systemd-cryptsetup detach VOLUME

Attaches or detaches an encrypted block device.

See the systemd-cryptsetup@.service(8) man page for details.

so we may want include /sbin/cryptsetup by

dracut --install "/sbin/cryptsetup" /boot/initrd.1 4.19.0-5-amd64

or in /etc/dracut.conf.d/XXX


there are also "include" switches that copy only the file itself, while "install" switches also copy dynamic libraries.

finally, verify the inclusion: lsinitrd /boot/initrd.1.

output (maybe with |grep cryptsetup):

-rwxr-xr-x   1 root     root        47152 Jul  3 09:10 sbin/cryptsetup  
-rw-r--r--   1 root     root       363920 Feb  9 07:40 lib/x86_64-linux-gnu/libcryptsetup.so.12.4.0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.