unofficial mirror of help-guix@gnu.org 
 help / color / mirror / Atom feed
From: Tomas Volf <~@wolfsden.cz>
To: Thomas Bennett <tom@caminu.fr>
Cc: help-guix@gnu.org
Subject: Re: luks device keyfile passed but still ask for passphrase during boot
Date: Thu, 23 May 2024 17:14:41 +0200	[thread overview]
Message-ID: <Zk9dYewMh6ILgfJf@ws> (raw)
In-Reply-To: <de1977e4-a29e-42b4-bef5-c6d55116bb13@caminu.fr>

[-- Attachment #1: Type: text/plain, Size: 3521 bytes --]

Hello,

On 2024-05-20 20:07:43 +0200, Thomas Bennett wrote:
> Hello Guix comunity,
>
> I would like to be able to mount external encrypted disk pasing key-files
> located in the root partition. Thus it would prevent me to open those
> external disks manually by entering passphrases during the boot sequence.
> Keeping only the passphrase for the root partition is fine for now.
>
> I have the following in my config.scm file regarding mapping and mounting
> one of the external disks, a backup one:
>
>  (mapped-devices (list (mapped-device
>                         (source (uuid "$ROOT_PARTION_UUID"))
>                         (target "$ROOT_PARTITION_MAPPED_NAME")
>                         (type luks-device-mapping))
>                        (mapped-device
>                         (source (uuid "$BACKUP_PARTITION_UUID"))
>                         (target "$BACKUP_PARTITION_MAPPED_NAME")
>                         (type (luks-device-mapping-with-options
>                                #:key-file
> "$BACKUP_PARTITION_KEY_FILE_PATH")))))
>
>
>  (file-systems (cons* (file-system
>                        (mount-point "$BOOT_PARTITION_MOUNTPOINT")
>                        (device (uuid "$BOOT_PARTITION_UUID" 'fat32))
>                        (type "vfat"))
>                       (file-system
>                        (mount-point "$ROOT_PARTITION_MOUNTPOINT")
>                        (device "/dev/mapper/$ROOT_PARTITION_MAPPED_NAME")
>                        (type "ext4")
>                        (dependencies mapped-devices))
>                       (file-system
>                        (create-mount-point? #t)
>                        (mount-point "$BACKUP_PARTITION_MOUNTPOINT")
>                        (type "ext4")
>                        (device "/dev/mapper/$BACKUP_PARTITION_MAPPED_NAME")
>                        (dependencies mapped-devices))
>                       %base-file-systems)))
>
> And it doesn't work. The configuration loads, but when I boot the system, it
> seems to be unable to find the key file because it stills asks for my
> passphrase to unlock the backup partition.
>
> May it be possible that the root partition is not yet mounted when the
> system tries to map the backup partition? If so, It would explain why it
> doesn't find the key file and asks for my passphrase.

I think this is the correct conclusion.  If you look into
gnu/system/linux-initrd.scm at raw-initrd procedure, you will notice that
everything is unlocked before the root being mounted.

I did not test it in any way, but based just on browsing the source code, it
looks like it unlocks only devices required for boot.  Maybe.

What you can therefore try is to split the dependencies, and instead of having
full `mapped-devices' in both, you can try to put just the respective
mapped-device as `dependencies' of $ROOT_PARTITION_MOUNTPOINT and
$BACKUP_PARTITION_MOUNTPOINT filesystems (you can probably just filter the list
by mapped-device-target).  Let me know if it worked, I am curious.

As an alternative solution, you can just put the keyfile into the initrd,
although that requires switching to encrypted boot.

>
> Do you know how to further investigate and/or what's wrong with the config
> and how to achieve the expected result?
>
> Thank you,
> Best,
> Thomas

Have a nice day,
also Tomas :)

--
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

      parent reply	other threads:[~2024-05-23 15:15 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-05-20 18:07 luks device keyfile passed but still ask for passphrase during boot Thomas Bennett
2024-05-23 12:53 ` Felix Lechner via
2024-05-23 15:14 ` Tomas Volf [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://guix.gnu.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Zk9dYewMh6ILgfJf@ws \
    --to=~@wolfsden.cz \
    --cc=help-guix@gnu.org \
    --cc=tom@caminu.fr \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).