Difference between /etc/conf.d/dmcrypt vs. /etc/crypttab

[nagmat84]

I try to setup an LUKS-encrypted root FS with FIDO2. The guide Gentoo Wiki: RootFS Encryption does not create any configuration file at all. I assumme it uses Discoverable Partitions to automatically mount the partitions correctly. That won't work in my case, as I need to tell the device mapper to read password for decryption from the FIDO2 stick.

The guide Gentoo Wiki: DM Crypt creates the configuration file /etc/conf.d/dmcrypt. However, there does not seem to be a man page for that file.

The guide Amedeos: Configure Gentoo to unlock LUKS root file system with FIDO2 key creates the configuration file /etc/crypttab. This file has indeed a proper Linux man page.

I am wondering what is the difference between the both configuration files /etc/conf.d/dmcrypt and /etc/crypttab?

1. Is /etc/conf.d/dmcrypt Gentoo specific?
   
2. Does /etc/conf.d/dmcrypt only work for OpenRC-based systems? (My system uses SystemD as the service manager.)
   
3. Which tool reads which configuration file?
   
4. Can both files be used to achieve the same things or are there aspects which can only be configured by one but not the other file?

[CodAv]

/etc/conf.d/dmcrypt is only used by the dm-crypt OpenRC init script. That said, as your installation uses a systemd profile, this file can be ignored as it isn't used - you have to put the configuration into /etc/crypttab instead. Conversion is mostly straightforward, but a few caveats are there:

• Make sure you have the "cryptsetup" USE flag enabled for sys-app/systemd, otherwise the service generator which uses crypttab is not installed.
  
• Populate /etc/crypttab with your required settings. Use "man crypttab" for a guide on the syntax.
  
• crypttab is definitely more basic than dm-crypt, for example it doesn't have a way to specify pre/post mount actions (I think these are handled in a different service unit in systemd)

In your case, systemd provides the required options to use FIDO2 via systemd-cryptenroll, which is also supported in crypttab. A line like this in /etc/crypttab should work:

[nagmat84]

As far as I understand, systemd only uses /etc/fstab and /etc/crypttab to generate *.mount service files upon boot on-the-fly. (I assume this would also be the place to define pre-/post-mount actions if one needed them.) According to my knowledge there are to "generators" provided by systemd: an fstab-related generator which translates the traditional files into mount unit files and a GPT auto-discovery generator which uses partition UUIDs to generate associated mount unit files.

If possible I would like to aboid using fstab and crypttab complete and only use the GPT-based approach. Currently, this is working fine, because I haven't yet enrolled a FIDO2 security token. (I only use password-based decryption.) Systemd is able to disover that automatically.

Question: Is there any systemd-based approach which allows using FIDO2 without maintaining crypttab? Maybe a kernel parameter which is passed to systemd?