cryptsetup luksFormat error "Device /dev/nvme0n1p3 is in use. Can not proceed with format operation."

Question

I've followed this guideline to the point where I encrypt the target partition:

cryptsetup -h sha256 -c aes-xts-plain64 -s 512 luksFormat /dev/nvme0n1p3

Then, the error appears, even though I'd unmounted the home partition previously like so: umount -l /home

The reason for the -l-flag was that it didn't work without it. Moreover, in order to get so far, I had to boot my system till reaching the user-login screen, then press CTRL+ALT+F2 to get into tty2, there log into my user via "login" and "password", then unmount the "/home" - partition forcefully.

Even though I'd checked previously via gparted which is the mount-point on the hard-drive related to /home, it states

"Device /dev/nvme0n1p3 is in use. Can not proceed with format operation."

albeit having unmounted "/home" previously.

How can I finish encrypting my "/home" - partition with LUKS (cryptsetup)? Could I use this in the same way to encrypt my swap, /temp, and /var/temp as well, since I couldn't encrypt the entire ubuntu 20.04 installation due to being installed in parallel to Windows 10?

Answer 1

umount -l is so called lazy unmount -- for busy filesystems this waits until the filesystem is no longer in use before really unmounting it.

From mount manpage:

-l, --lazy

Lazy unmount. Detach the filesystem from the file hierarchy now, and clean up all references to this filesystem as soon as it is not busy anymore.

So the cryptsetup call failed because your /home is still in use and it is used because you are logged in. You need to logout first and then unmount your /home. For that you'll need to either login as root (which doesn't use /home) or use LiveCD.

Yes you can use the same steps to encrypt your swap (this can be done from running system after swapoff -a to disable swap) and other partitions.

Btw. if you want to encrypt your entire system, I'd recommend using LVM which allows you to setup the encryption on a single point on the physical volume layer (but that would require reinstalling your system).