grub with encrpted root no longer automatically loads luks

grub with encrpted root no longer automatically loads luks

[Jack Hill]

Hi Guix,

I've noticed that recently (unfortunately, I don't know exactly when it 
started), that grub no longer prompts me to enter my password to unlock my 
root filesystem. I notice that at the grub command line, if I enter 
`cryptomount -a`, I am not prompted for a password, and the root 
filesystem does not become available. However, if I first run `insmod 
luks` and then `cryptomount -a`, I am prompted for my password, and the 
root filesystem become available and I can boot normally.

Therefore, it seem like grub is not auto-loading the luks module for some 
reason. Why might this be the case? What needs to be changed so that luks 
is auto loaded?

Best,
Jack

my config.scm:

;; This is an operating system configuration template
;; for a "desktop" setup with GNOME and Xfce where the
;; root partition is encrypted with LUKS.

(use-modules (gnu) (gnu system nss) (gnu services xorg)
 	     (gnu packages linux))
(use-service-modules desktop)
(use-package-modules certs gnome scanner security-token)

(operating-system
  (host-name "alperton")
  (timezone "America/New_York")
  (locale "en_US.utf8")

  (bootloader (bootloader-configuration
 	      (bootloader grub-bootloader)
 	      (target "/dev/sda")))

  ;; Specify a mapped device for the encrypted root partition.
  ;; The UUID is that returned by 'cryptsetup luksUUID'.
  (mapped-devices
   (list (mapped-device
 	 (source (uuid "f7776767-70c9-44e3-9973-c1334d301348"))
 	 (target "alperton_root")
 	 (type luks-device-mapping))))

  (file-systems (cons*
 		(file-system
 		 (device (file-system-label "boot"))
 		 (mount-point "/boot")
 		 (type "ext4"))
 		(file-system
 		 (device (file-system-label "alperton_root"))
 		 (mount-point "/")
 		 (type "ext4")
 		 (dependencies mapped-devices))
 		%base-file-systems))

  (swap-devices (list "/root/swap"))

  (users (cons (user-account
 	       (name "jackhill")
 	       (comment "Jack Hill")
 	       (group "users")
 	       (supplementary-groups '("wheel" "netdev"
 				       "audio" "lp" "video"))
 	       (home-directory "/home/jackhill"))
 	      %base-user-accounts))

  ;; This is where we specify system-wide packages.
  (packages (cons* nss-certs         ;for HTTPS access
 		  fuse-exfat
 		  gvfs              ;for user mounts
 		  %base-packages))

  ;; Add GNOME and/or Xfce---we can choose at the log-in
  ;; screen with F1.  Use the "desktop" services, which
  ;; include the X11 log-in service, networking with
  ;; NetworkManager, and more.
  (services (cons* (service gnome-desktop-service-type)
 		  (bluetooth-service)
 		  (simple-service 'custom-udev-rules udev-service-type (list sane-backends libu2f-host))
 		  %desktop-services))

  ;; Allow resolution of '.local' host names with mDNS.
  (name-service-switch %mdns-host-lookup-nss))

Re: grub with encrpted root no longer automatically loads luks

[Giovanni Biscuolo]

[-- Attachment #1: Type: text/plain, Size: 2195 bytes --]

Hello Jack,

I don't have a Guix machine using root on encrypted LUKS now, but I
tested this non so long ago and it worked well

Jack Hill <jackhill@jackhill.us> writes:

> I've noticed that recently (unfortunately, I don't know exactly when it 
> started), that grub no longer prompts me to enter my password to unlock my 
> root filesystem.

Are you able to boot to a previous Guix System generation and try to
find the one that introduced this behaviour?

Are you sure you did not reconfigured your device mapping meanwhile?

> I notice that at the grub command line, if I enter 
> `cryptomount -a`, I am not prompted for a password, and the root 
> filesystem does not become available. However, if I first run `insmod 
> luks` and then `cryptomount -a`, I am prompted for my password, and the 
> root filesystem become available and I can boot normally.

I imagine you are entering the grub CLI because you get some error:
what's the error please?

[...]

>   ;; Specify a mapped device for the encrypted root partition.
>   ;; The UUID is that returned by 'cryptsetup luksUUID'.
>   (mapped-devices
>    (list (mapped-device
>  	 (source (uuid "f7776767-70c9-44e3-9973-c1334d301348"))
>  	 (target "alperton_root")
>  	 (type luks-device-mapping))))
>
>   (file-systems (cons*
>  		(file-system
>  		 (device (file-system-label "boot"))
>  		 (mount-point "/boot")
>  		 (type "ext4"))
>  		(file-system
>  		 (device (file-system-label "alperton_root"))
>  		 (mount-point "/")
>  		 (type "ext4")
>  		 (dependencies mapped-devices))
>  		%base-file-systems))

AFAIU (mapped-device ..(target "name") (type luks-device-mapping)))
creates the mapped device /dev/mapper/name; file-system should be:

--8<---------------cut here---------------start------------->8---

  		(file-system
  		 (device "/dev/mapper/alperton_root")
  		 (mount-point "/")
  		 (type "ext4")
  		 (dependencies mapped-devices))
  		%base-file-systems))

--8<---------------cut here---------------end--------------->8---

Did your configuration worked in a prior Guix System generation?

[...]


-- 
Giovanni Biscuolo

Xelera IT Infrastructures

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

Re: grub with encrpted root no longer automatically loads luks

[Jack Hill]

Thanks for you reply.

On Fri, 21 Jun 2019, Giovanni Biscuolo wrote:

> Hello Jack,
>
> I don't have a Guix machine using root on encrypted LUKS now, but I
> tested this non so long ago and it worked well
>
> Jack Hill <jackhill@jackhill.us> writes:
>
>> I've noticed that recently (unfortunately, I don't know exactly when it
>> started), that grub no longer prompts me to enter my password to unlock my
>> root filesystem.
>
> Are you able to boot to a previous Guix System generation and try to
> find the one that introduced this behaviour?

No, I can't boot into a previous generation, as the problem seems to be 
with grub reading from the store. I have not yet tried reconfiguring with 
an older version of Guix.

> Are you sure you did not reconfigured your device mapping meanwhile?

I am reasonable certain that I have not done this.

>> I notice that at the grub command line, if I enter
>> `cryptomount -a`, I am not prompted for a password, and the root
>> filesystem does not become available. However, if I first run `insmod
>> luks` and then `cryptomount -a`, I am prompted for my password, and the
>> root filesystem become available and I can boot normally.
>
> I imagine you are entering the grub CLI because you get some error:
> what's the error please?

no such file /gnu/store/…/bzImage.
error: try loading kernel first

That's not the exact error, but pretty close.

> AFAIU (mapped-device ..(target "name") (type luks-device-mapping)))
> creates the mapped device /dev/mapper/name; file-system should be:
>
> --8<---------------cut here---------------start------------->8---
>
>  		(file-system
>  		 (device "/dev/mapper/alperton_root")
>  		 (mount-point "/")
>  		 (type "ext4")
>  		 (dependencies mapped-devices))
>  		%base-file-systems))
>
> --8<---------------cut here---------------end--------------->8---

Making the this change unfortunately did not help. Once I get the system 
booted, the root file system is mounted correctly with both configs.

> Did your configuration worked in a prior Guix System generation?

Yes, but I haven't yet had a chance to try it again with an older version 
of Guix.

Best,
Jack

Re: grub with encrpted root no longer automatically loads luks

[Mark H Weaver]

Hi Jack,

Jack Hill <jackhill@jackhill.us> writes:

> I've noticed that recently (unfortunately, I don't know exactly when
> it started), that grub no longer prompts me to enter my password to
> unlock my root filesystem.

FWIW, I also use an encrypted root filesystem on my Guix system, and
I've updated Guix since you reported the problem, and it works for me.
GRUB continues to prompt me for the LUKS passphase at boot.

One notable difference between our system configurations is that you
have a separate /boot filesystem, and I don't.  All I have is a single
encrypted root filesystem, plus %base-file-systems.  I wonder if this
might be the relevant difference?

     Regards,
       Mark

> I notice that at the grub command line, if
> I enter `cryptomount -a`, I am not prompted for a password, and the
> root filesystem does not become available. However, if I first run
> `insmod luks` and then `cryptomount -a`, I am prompted for my
> password, and the root filesystem become available and I can boot
> normally.
>
> Therefore, it seem like grub is not auto-loading the luks module for
> some reason. Why might this be the case? What needs to be changed so
> that luks is auto loaded?
>
> Best,
> Jack
>
> my config.scm:
>
> ;; This is an operating system configuration template
> ;; for a "desktop" setup with GNOME and Xfce where the
> ;; root partition is encrypted with LUKS.
>
> (use-modules (gnu) (gnu system nss) (gnu services xorg)
> 	     (gnu packages linux))
> (use-service-modules desktop)
> (use-package-modules certs gnome scanner security-token)
>
> (operating-system
>  (host-name "alperton")
>  (timezone "America/New_York")
>  (locale "en_US.utf8")
>
>  (bootloader (bootloader-configuration
> 	      (bootloader grub-bootloader)
> 	      (target "/dev/sda")))
>
>  ;; Specify a mapped device for the encrypted root partition.
>  ;; The UUID is that returned by 'cryptsetup luksUUID'.
>  (mapped-devices
>   (list (mapped-device
> 	 (source (uuid "f7776767-70c9-44e3-9973-c1334d301348"))
> 	 (target "alperton_root")
> 	 (type luks-device-mapping))))
>
>  (file-systems (cons*
> 		(file-system
> 		 (device (file-system-label "boot"))
> 		 (mount-point "/boot")
> 		 (type "ext4"))
> 		(file-system
> 		 (device (file-system-label "alperton_root"))
> 		 (mount-point "/")
> 		 (type "ext4")
> 		 (dependencies mapped-devices))
> 		%base-file-systems))
>
>  (swap-devices (list "/root/swap"))
>
>  (users (cons (user-account
> 	       (name "jackhill")
> 	       (comment "Jack Hill")
> 	       (group "users")
> 	       (supplementary-groups '("wheel" "netdev"
> 				       "audio" "lp" "video"))
> 	       (home-directory "/home/jackhill"))
> 	      %base-user-accounts))
>
>  ;; This is where we specify system-wide packages.
>  (packages (cons* nss-certs         ;for HTTPS access
> 		  fuse-exfat
> 		  gvfs              ;for user mounts
> 		  %base-packages))
>
>  ;; Add GNOME and/or Xfce---we can choose at the log-in
>  ;; screen with F1.  Use the "desktop" services, which
>  ;; include the X11 log-in service, networking with
>  ;; NetworkManager, and more.
>  (services (cons* (service gnome-desktop-service-type)
> 		  (bluetooth-service)
> 		  (simple-service 'custom-udev-rules udev-service-type (list sane-backends libu2f-host))
> 		  %desktop-services))
>
>  ;; Allow resolution of '.local' host names with mDNS.
>  (name-service-switch %mdns-host-lookup-nss))

Re: grub with encrpted root no longer automatically loads luks

[Jack Hill]

On Fri, 28 Jun 2019, Mark H Weaver wrote:

> Hi Jack,
>
> Jack Hill <jackhill@jackhill.us> writes:
>
>> I've noticed that recently (unfortunately, I don't know exactly when
>> it started), that grub no longer prompts me to enter my password to
>> unlock my root filesystem.
>
> FWIW, I also use an encrypted root filesystem on my Guix system, and
> I've updated Guix since you reported the problem, and it works for me.
> GRUB continues to prompt me for the LUKS passphase at boot.
>
> One notable difference between our system configurations is that you
> have a separate /boot filesystem, and I don't.  All I have is a single
> encrypted root filesystem, plus %base-file-systems.  I wonder if this
> might be the relevant difference?

Mark,

Thanks for your reply. I've finally had a chance to try without a separate 
/boot, and indeed it works as expected like it does for you. Since I don't 
think I was getting any benefit from having a separate /boot, I'm content 
to leave it without one. However, perhaps there is a bug here, and we 
should support a separate /boot?

As for why I started getting this problem, it appears it is because I 
didn't have a separate /boot, but then added one. Trying to remember why I 
did that, I think it was because grub-install failed at some point, and 
worked when I added a /boot. However, I didn't reboot right away, and had 
reconfigured a few more times before I rebooted and noticed the problem. 
At that point I didn't remember that I had changed the configuration with 
regards to /boot. Of course it was the thing I changed that caused the 
problem, if only I had remembered! ☺

Best,
Jack