Automatic decryption of root volume stopped working

rogerroger · n00b Joined: 24 May 2023 Posts: 8

After updating my kernel from version 6.8.12 my root volume will no longer decrypt automatically. I've tried swapping the version of the kernel/efi file with a emerge --config sys-kernel/gentoo-kernel-bin and swapping out the versions (tried 6.8.10, 6.8.12, 6.9.2, 6.9.3). Neither 6.9 version works.

I'm using a bit of a custom setup with clevis binding the key to the tpm, booster to generate the initramfs and to automatically get the key on boot and decrypt my root volume and sbctl to create and bundle the final efi. This setup has worked without any issues for the last year. I've already tried rebinding the key in case something about my efi vars changed or similar but it didn't make a difference. Just changing the kernel version makes things work/break.

How would I best go about figuring out why this is happening?

Hu · Administrator Joined: 06 Mar 2007 Posts: 22598

As I understand the typical use of TPMs, this is expected and desirable. You changed out the kernel, so when the kernel is measured into the TPM, you get the wrong measurement, and the TPM refuses to provide the key.

You wrote that you tried rebinding the key. What exactly did you do here?

rogerroger · n00b Joined: 24 May 2023 Posts: 8

The command used to regenerate the key was

rogerroger · n00b Joined: 24 May 2023 Posts: 8

I went with the assumption that something about the kernel config changed recently and built the 6.9.2 kernel with the 6.8.12 config and my system unlocks normally again.

I executed the following command in /usr/src and installed gentoo-kernel-6.9.2.

Hu · Administrator Joined: 06 Mar 2007 Posts: 22598

I suggest examining the help text for those options to see if any sound relevant to your problem. If not, then the next step would be to speculatively enable part of them, test, then either enable or disable as appropriate until you have bisected down to the specific option.

rogerroger · n00b Joined: 24 May 2023 Posts: 8

I spent a lot of time trying out different options but it either always worked or never worked.
Turns out that gentoo-kernel and gentoo-kernel-bin don't use the same config options and some of them are related to my issue...
In the end I gave up for now and after some fiddling got a working solution with dracut (did you know that you need to install dracut before clevis for the necessary modules to get installed? I didn't).

I'm just gonna assume that this is bug is on booster and will look deeper into it in the future

Princess Nell · l33t Joined: 15 Apr 2005 Posts: 925

Apologies for the completely unrelated question - have you tried NBDE with this setup? I looked at this a while back but couldn't figure out how to add support for OpenRC into the vanilla code. I was definitely not aware we have an overlay with tang and clevis and tried to roll my own.