Booting from LVM on encrypted device

Question

I've just finished a Debian install and I'm trying to boot. I've encrypted my hard drive (LUKS) without partitioning and set up LVM on it. I don't have a separate boot volume, so the system will boot from the logical volume root. I've replaced my BIOS with GRUB but I don't have a GRUB config generated for the system, so I need to boot manually from GRUB.

The GRUB shell code I've guessed to be correct is this:

cryptomount ahci0
set root=lvm/vg-root
linux /vmlinuz root=/dev/mapper/vg-root cryptdevice=/dev/sda
initrd /initrd.img

This is a modification of the configuration given here for a different encrypted LVM setup.

GRUB decrypts the drive fine, but when I try to boot like this I get the following several dozen times:

Begin: Running /scripts/local-block ...   WARNING: Failed to connect to lvmetad. Falling back to device scanning.
  Volume group "vg" not found
  Cannot process volume group vg
done.

Then I get an initramfs shell. I suspect the kernel is looking for the root logical volume before decrypting the disk, since the same thing happens if I use for example root=/dev/mapper/bogus-root. Are there kernel parameters that will allow me to boot this system, or do I have to change the initrd?

Answer 1

This can be resolved by adding /etc/crypttab to the initramfs (see manual page for crypttab for the file format) using update-initramfs from the Debian package initramfs-tools.

First, mount the encrypted disk. Then bind-mount /dev, /proc, /sys, and /run on the host into the root filesystem with e.g. mount --bind /dev /mnt/dev. Then chroot into the root filesystem. The crypttab file may now be created (in any location), or copied in before chrooting.

In order to include the crypttab in the initramfs, create a hook script in /usr/share/initramfs-tools/hooks that copies the file into the initramfs. Note that initramfs-tools uses two types of scripts: boot scripts are run by the initramfs init when the system boots, whereas hook scripts are run during the creation of the initramfs image.

The hook script should look something like this (source):

#!/bin/sh
. /usr/share/initramfs-tools/hook-functions
cp -pnL /path/to/crypttab ${DESTDIR}/etc/crypttab
chmod 644 ${DESTDIR}/etc/crypttab

${DESTDIR} expands to the root of the initramfs being created when the hook is run.

Then run update-initramfs with appropriate options. I used -k $(uname -r) since the host and the target used the same kernel version. I also used -c, and -b to specify where the image is written to.

After installing the new image or passing its path to GRUB, early userspace should decrypt the disk and map the contained logical volumes before trying to mount the root volume. The only kernel parameter needed is the root volume path, e.g. root=/dev/mapper/vg-root.