I want multiple prompts to decrypt multiple hard disks which contain root filesystem

Question

I am running an Ubuntu 16.04 system with the following hard disk configuration:

1. 1 hard drive which I will call /dev/sda. /dev/sda has 3 partitions used for the following purposes:
   1. /dev/sda1 is used for the EFI system partition.
   2. /dev/sda2 is used for the /boot partition.
   3. /dev/sda3 is used to store an encrypted volume, encrypted with LUKS.
2. I will call the decrypted /dev/sda3 device /dev/sda3_crypt. Within /dev/sda3_crypt sits an LVM configuration. The LVM configuration consists of a volume group named "alexmini". The alexmini volume group contains the following logical volumes and filesystems:
   1. A /dev/mapper/alexmini-vg--root logical volume containing a btrfs filesystem.
   2. A /dev/mapper/alexmini-vg--swap logical volume used for swap space.
3. I have a second hard drive called /dev/sdb. /dev/sdb contains 1 partition called /dev/sdb1. /dev/sdb1 is also encrypted device using LUKS. I will call the decrypted device /dev/sdb1_crypt. /dev/sdb1_crypt contains a btrfs filesystem. /dev/sdb1_crypt is added to the /dev/mapper/alexmini-vg--root btrfs volume pool.
4. The btrfs filesystem is also my root filesystem.

When I run update-initramfs from the configuration specified above, I expected that the cryptsetup initramfs boot scripts would decrypt both /dev/sda3 and /dev/sdb1, but the scripts only decrypt /dev/sda3, which only leads to part of the btrfs volume pool to be available. I end up in the initramfs "recovery" mode.

How do I configure the update-initramfs so that the cryptsetup boot scripts will prompt me twice to decrypt both my hard disks, once for /dev/sda3 and once for /dev/sdb1?

Answer 1

Okay, I figured it out and I got it working. I spent some time studying the initramfs cryptsetup scripts under /usr/share/initramfs-tools/hooks. This directory contains scripts that are run whenever update-initramfs is executed. In particular, if cryptsetup is installed, there will be a cryptroot script in this directory, which is the one I studied to find clues to how disks are decrypted at boot.

When the initramfs is loaded at boot, there is a script that will decrypt hard disk partitions listed in a file called conf/conf.d/cryptroot. This file sits inside the initramfs archive, which you can explore by unpacking the archive with the following commands:

$ sudo cp /boot/initrd.img-4.4.0-93-generic ~
$ cd
$ # use sudo chown to change the ownership of the initramfs file to the current user
$ mv initrd.img-4.4.0-93-generic initrd.img-4.4.0-93-generic.gz
$ gunzip initrd.img-4.4.0-93-generic.gz
$ mkdir -p tmp && cd tmp
$ cpio -i < ../initrd.img-4.4.0-93-generic

Normally, conf/conf.d/cryptroot will only list the partition containing your root filesystem for decryption. If your root filesystem spans multiple encrypted partitions, such as a btrfs filesystem or a filesystem sitting in an LVM logical volume, you will not be able to properly mount the filesystem at boot because only one of your encrypted partitions will be decrypted. What we need is for all the backing partitions to be decrypted before mounting. The encrypted partitions that get listed into conf/conf.d/cryptroot are determined when you build the initramfs archive.

When you build the initramfs image, the cryptroot script scans which partitions contain your root filesystem. For btrfs filesystems, cryptroot will run btrfs commands to query the partitions backing your filesystem. However, not all partitions returned from the query will be added to conf/conf.d/cryptroot. Only queried partitions that are also listed in /etc/crypttab will be added to conf/conf.d/cryptroot. My solution was to add an entry for the second encrypted partition that was backing my root filesystem to /etc/crypttab.

My resulting /etc/crypttab file looked like the following:

sda3_crypt UUID=<my UUID for /dev/sda3> none luks,discard
sdb1_crypt UUID=<my UUID for /dev/sdb1> none luks

Afterwards, you want to run update-initramfs to generate the new initramfs, which will contain an entry for sda3_crypt and sdb1_crypt in conf/conf.d/cryptroot. This will cause the decryption script to prompt for your passphrase twice at boot: once for sda3_crypt, and another for sdb1_crypt.

TL;DR: Ensure all your partitions that back your root filesystem contain an entry in /etc/crypttab. Run update-initramfs after updating /etc/crypttab.

Side note: Whenever the update-grub runs for btrfs filesystems spanning multiple devices, it does not generate the kernel command line properly. There is a quick workaround given in https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1238347