Skip to content
Snippets Groups Projects

Make compatible with cryptsetup's encrypt hook

Closed Tallero Tallero requested to merge tallero/mkinitcpio-archiso:crypto into master

This merge request makes archiso hook compatible with the correct output of the encrypt hook, that can so be enabled and configured to handle LUKS encrypted archiso systems.

Changes

When the encrypt successfully ends, it exports a static root variable containing the path of the device mapper representing the root device (by default /dev/mapper/root).

Since the root device here is on a file on the bootmnt and not on a disk directly, I've changed the cryptsetup encrypt hook to support an intermediate mount for bootmnt on /run/cryptdev.

Compatibility is obtained by bind mounting /run/cryptdev to bootmnt and replacing the loopmount with root if it exists.

Value of archisodevice has been changed from /dev/disk/by-label/$archisolabel to dev/disk/by-uuid/$archisouuid to avoid boot problems when multiple archisolabel'd devices are inserted.

Depends on nested cryptkey support cryptsetup merge request (where should it be submitted for review?).

Solves #14 and #15 (moved).

See specular MR on archlinux/archiso!217 (closed).

Edited by Tallero Tallero

Merge request reports

Pipeline #20880 passed

Pipeline passed for 49e02733 on tallero:crypto

Approval is optional

Closed by nl6720nl6720 9 months ago (Jul 9, 2024 2:20pm UTC)

Merge details

  • The changes were not merged into master.

Activity

Filter activity
  • Approvals
  • Assignees & reviewers
  • Comments (from bots)
  • Comments (from users)
  • Commits & branches
  • Edits
  • Labels
  • Lock status
  • Mentions
  • Merge request status
  • Tracking
  • nl6720
  • nl6720
  • added 1 commit

    • a0ef2b97 - add support for encryption key

    Compare with previous version

  • added 1 commit

    Compare with previous version

  • added 1 commit

    Compare with previous version

  • Tallero Tallero changed the description

    changed the description

  • Tallero Tallero changed the description

    changed the description

  • Tallero Tallero changed title from Add support for LUKS encrypted file system to Add support for LUKS encrypted file systems

    changed title from Add support for LUKS encrypted file system to Add support for LUKS encrypted file systems

  • added 1 commit

    Compare with previous version

  • added 1 commit

    Compare with previous version

  • added 1 commit

    Compare with previous version

  • added 1 commit

    • 6f1b027a - Add cryptsetup dependency on README

    Compare with previous version

  • added 1 commit

    Compare with previous version

  • Tallero Tallero changed the description

    changed the description

  • Tallero Tallero mentioned in issue #14

    mentioned in issue #14

  • Tallero Tallero changed the description

    changed the description

  • added 1 commit

    Compare with previous version

  • Tallero Tallero changed the description

    changed the description

  • added 1 commit

    Compare with previous version

  • added 1 commit

    Compare with previous version

    • If something like this were to be merged (no guarantees here), IMHO it should be in a separate optional archiso_something hook.

      It would probably either need a special kernel command line parameter to detect and set a correct mount_handler or some special handling in the archiso hook. I'd prefer the first option if possible.

    • Check now.

      I've published the changes to command-line kernel paramaters parsing I had to add to the encrypt hook to have it support opening both cryptdevice and cryptkey from files instead than just disks on cryptsetup-nested-cryptkey.

      Edited by Tallero Tallero
    • Please register or sign in to reply
  • added 1 commit

    Compare with previous version

  • added 1 commit

    Compare with previous version

  • added 1 commit

    Compare with previous version

  • added 1 commit

    Compare with previous version

  • Loading
  • Loading
  • Loading
  • Loading
  • Loading
  • Loading
  • Loading
  • Loading
  • Loading
  • Loading
  • Please register or sign in to reply
    Loading