Re: luks device keyfile passed but still ask for passphrase during boot

[Tomas Volf <~@wolfsden.cz>]

[-- Attachment #1: Type: text/plain, Size: 3521 bytes --]

Hello,

On 2024-05-20 20:07:43 +0200, Thomas Bennett wrote:
> Hello Guix comunity,
>
> I would like to be able to mount external encrypted disk pasing key-files
> located in the root partition. Thus it would prevent me to open those
> external disks manually by entering passphrases during the boot sequence.
> Keeping only the passphrase for the root partition is fine for now.
>
> I have the following in my config.scm file regarding mapping and mounting
> one of the external disks, a backup one:
>
>  (mapped-devices (list (mapped-device
>                         (source (uuid "$ROOT_PARTION_UUID"))
>                         (target "$ROOT_PARTITION_MAPPED_NAME")
>                         (type luks-device-mapping))
>                        (mapped-device
>                         (source (uuid "$BACKUP_PARTITION_UUID"))
>                         (target "$BACKUP_PARTITION_MAPPED_NAME")
>                         (type (luks-device-mapping-with-options
>                                #:key-file
> "$BACKUP_PARTITION_KEY_FILE_PATH")))))
>
>
>  (file-systems (cons* (file-system
>                        (mount-point "$BOOT_PARTITION_MOUNTPOINT")
>                        (device (uuid "$BOOT_PARTITION_UUID" 'fat32))
>                        (type "vfat"))
>                       (file-system
>                        (mount-point "$ROOT_PARTITION_MOUNTPOINT")
>                        (device "/dev/mapper/$ROOT_PARTITION_MAPPED_NAME")
>                        (type "ext4")
>                        (dependencies mapped-devices))
>                       (file-system
>                        (create-mount-point? #t)
>                        (mount-point "$BACKUP_PARTITION_MOUNTPOINT")
>                        (type "ext4")
>                        (device "/dev/mapper/$BACKUP_PARTITION_MAPPED_NAME")
>                        (dependencies mapped-devices))
>                       %base-file-systems)))
>
> And it doesn't work. The configuration loads, but when I boot the system, it
> seems to be unable to find the key file because it stills asks for my
> passphrase to unlock the backup partition.
>
> May it be possible that the root partition is not yet mounted when the
> system tries to map the backup partition? If so, It would explain why it
> doesn't find the key file and asks for my passphrase.

I think this is the correct conclusion.  If you look into
gnu/system/linux-initrd.scm at raw-initrd procedure, you will notice that
everything is unlocked before the root being mounted.

I did not test it in any way, but based just on browsing the source code, it
looks like it unlocks only devices required for boot.  Maybe.

What you can therefore try is to split the dependencies, and instead of having
full `mapped-devices' in both, you can try to put just the respective
mapped-device as `dependencies' of $ROOT_PARTITION_MOUNTPOINT and
$BACKUP_PARTITION_MOUNTPOINT filesystems (you can probably just filter the list
by mapped-device-target).  Let me know if it worked, I am curious.

As an alternative solution, you can just put the keyfile into the initrd,
although that requires switching to encrypted boot.

>
> Do you know how to further investigate and/or what's wrong with the config
> and how to achieve the expected result?
>
> Thank you,
> Best,
> Thomas

Have a nice day,
also Tomas :)

--
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]