| View previous topic :: View next topic |
| Author |
Message |
nick_0189
n00b
Joined: 28 Jul 2022
Posts: 9
|
 Posted: Fri Jan 31, 2025 12:43 am Post subject: Dracut /etc/crypttab Support in Initramfs |
 |
|
Hello everyone,
In summary: Generally, when will Dracut use a crypttab file in the initramfs?
I'm trying to understand the documentation for Dracut and how I should configure it for my installation. Specifically, I don't understand the relationship between `/etc/crypttab` and Dracut. Dracut includes an option for parsing a crypttab file (`man dracut.cmdline`, `rd.luks.crypttab`), but crypttab seems to really be more of a systemd thing and I can't get Dracut to unlock root with a crypttab file embedded in the initramfs at `/etc/crypttab` - a custom module or cmdline arguments are required to unlock it. Does it unlocking root from information in a crypttab file work for anyone else? How much support does Dracut actually have for a crypttab file, since it is mentioned only briefly in the documentation and in the code?
In the source code here it looks like Dracut parses a crypttab file when the `rd.hostonly` option is passed, but why does it seem like it actually doesn't support a crypttab file the way I think it does?
I can't find anything specifically stating that Dracut doesn't support a crypttab file, and I can't find anything specifically outlining the extent to which Dracut supports a crypttab file. It's confusing to me. Any clarification would be helpful.
Thank you. |
|
| Back to top |
|
 |
sMueggli
Guru
Joined: 03 Sep 2022
Posts: 534
|
| Posted: Fri Jan 31, 2025 5:06 pm Post subject: |
|
|
| Generally Dracut does not need/read the /etc/crypttab. But that is only "generally" the case. |
|
| Back to top |
|
|
grknight
Retired Dev
Joined: 20 Feb 2015
Posts: 2001
|
| Posted: Fri Jan 31, 2025 5:23 pm Post subject: |
|
|
In the general sense, cryptroot-ask.sh is triggered by the bootup process via a udev rule and it will read crypttab if it exists.
However, it only reads it for your defined name of the device mapper location (e.g. /dev/mapper/gentoo-crypt) once the device has already been scheduled to open.
All the devices to query and open are done via one of the rd.luks command options. |
|
| Back to top |
|
|
nick_0189
n00b
Joined: 28 Jul 2022
Posts: 9
|
| Posted: Sat Feb 01, 2025 5:52 am Post subject: Dracut Initramfs: Crypttab and Udev Behavior |
|
|
Hi grknight,
Thank you for your response. So Dracut only uses crypttab to open volumes specified with a `rd.luks` cmdline option? So if I wanted to open two disks `cryptdisk1` and `cryptdisk2`, I would need to add the following to my configuration at `/etc/dracut.conf.d/luks.conf`:
| Code: | install_items+=" /crypto_keyfile.bin /crypto_header /etc/crypttab "
kernel_cmdline+=" rd.luks=cryptdisk1 rd.luks=cryptdisk2 root=/dev/mapper/cryptdisk1 " |
And then to `/etc/crypttab`:
| Code: | # Volume Name Encrypted Device Key File Options
cryptdisk1 /dev/sda /crypto_keyfile.bin header=/crypto_header
cryptdisk2 /dev/sdb /crypto_keyfile.bin |
I tried this configuration, but it did not work because it failed to find root. Should I expect it to work with an option for a header?
Also, I see that Dracut contains udev rules in `95udev-rules`, which installs a series of udev rules. One of these rules is `60-persistent-storage.rules`, which sets up links in `/dev/disk/by-id`. The `initqueue/finished` hook is run when udev has settled, but if I install a module to the `initqueue/finished` hook, why can it not read disks in `/dev/disk/by-id/`? A check is required first like the following to force Dracut to try the module again later: | Code: | if ! { test -b /dev/disk/by-id/xxx-0xXXXXXXXXXXXXXXXX; }; then
exit 1;
fi |
Shouldn't this module not be run until udev has settled, or is this not what is meant by udev being "settled?" |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
Installing Gentoo
