Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 572320 - sys-kernel/dracut fails to decrypt LUKS partition: broken crypttab file
Summary: sys-kernel/dracut fails to decrypt LUKS partition: broken crypttab file
Status: RESOLVED INVALID
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Core system (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Patrick McLean
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-01-18 23:45 UTC by Andrius Štikonas
Modified: 2016-01-23 00:35 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
rdsosreport.txt (rdsosreport.txt,70.26 KB, text/plain)
2016-01-18 23:45 UTC, Andrius Štikonas
Details
rdsosreport.txt (rdsosreport.txt,72.19 KB, text/plain)
2016-01-22 15:19 UTC, Andrius Štikonas
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Andrius Štikonas 2016-01-18 23:45:53 UTC
Created attachment 423310 [details]
rdsosreport.txt

I've generated initramfs with dracut, however it failed to boot. Just before unlocking luks partition it prints

[    5.443242] localhost dracut-initqueue[261]: systemd-escape: invalid option -- 'a'
[    5.445226] localhost dracut-initqueue[261]: Failed to start systemd-cryptsetup@luks.service: Unit systemd-cryptsetup@luks.service failed to load: No such file or directory.

This happens with dracut-044 and systemd-226-r2. I tested other combinations but they also don't work.

[ebuild   R   ~] sys-kernel/dracut-044::gentoo  USE="systemd -debug (-selinux)" 0 KiB
Comment 1 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2016-01-22 14:42:36 UTC
I'm not able to reproduce this, I use dracut with luks and systemd, what is your kernel command line?
Comment 2 Alexander Tsoy 2016-01-22 14:52:49 UTC
(In reply to Matthew Thode ( prometheanfire ) from comment #1)

You can find kernel command line in attached rdsosreport.txt

(In reply to Andrius Štikonas from comment #0)

> [    5.443242] localhost dracut-initqueue[261]: systemd-escape: invalid
> option -- 'a'

This particular error should be fixed by the following commit:
http://git.kernel.org/cgit/boot/dracut/dracut.git/patch/?id=c41df7e1db1adc51399ab2c22f251b15eb2065b1

> [    5.107911] localhost systemd[1]: systemd 226 running in system mode. (+PAM -AUDIT -SELINUX +IMA -APPARMOR +SMACK -SYSVINIT +UTMP -LIBCRYPTSETUP -GCRYPT -GNUTLS +ACL -XZ +LZ4 +SECCOMP +BLKID -ELFUTILS +KMOD -IDN)

Your systemd is compiled without cryptsetup support (-LIBCRYPTSETUP). :)
Comment 3 Andrius Štikonas 2016-01-22 14:57:43 UTC
Yeah, it also worked on my old computer. I'm not sure why it doesn't work on my new laptop

so kernel parameters are I specify both rd.luks and rd.lvm options...

rd.luks.uuid=luks-ae7636fe-6aae-493d-99fe-d3d30b19cf21 rd.lvm.lv=lvm/lvroot root=/dev/mapper/lvm-lvroot rootfstype=btrfs ro rootflags=subvol=rootfs init=/usr/lib/systemd/systemd rd.timeout=10

But it looks like something is passing some unexpected option to some script before mounting luks...
Comment 4 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2016-01-22 15:01:58 UTC
in the report you gave

BOOT_IMAGE=/rootfs/boot/vmlinuz-4.1.12-gentoo root=/dev/mapper/lvm-lvroot ro rootflags=subvol=rootfs cryptdevice=/dev/sda2:lvm rd.luks.uuid=luks-ae7636fe-6aae-493d-99fe-d3d30b19cf21 rd.lvm.lv=lvm/lvroot init=/usr/lib/systemd/systemd rd.timeout=10

specifically rd.luks.uuid=luks-ae7636fe-6aae-493d-99fe-d3d30b19cf21

should be rd.luks.uuid=ae7636fe-6aae-493d-99fe-d3d30b19cf21
Comment 5 Alexander Tsoy 2016-01-22 15:05:22 UTC
(In reply to Matthew Thode ( prometheanfire ) from comment #4)

> specifically rd.luks.uuid=luks-ae7636fe-6aae-493d-99fe-d3d30b19cf21
> 
> should be rd.luks.uuid=ae7636fe-6aae-493d-99fe-d3d30b19cf21

No, "luks-" prefix is fine. It should not create any problem.
Comment 6 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2016-01-22 15:09:39 UTC
hmm, you are correct, I'd still test without it though.

the diferences I see, you are not defining rootfstype on the broken system and you define  cryptdevice=/dev/sda2:lvm on the broken system

can you define the rootfstype and get rid of the cryptdevice part?  at least to test past this problem.
Comment 7 Alexander Tsoy 2016-01-22 15:14:59 UTC
In comment #2 I answered that the problem is due to the lack of cryptsetup support in systemd:

> [    5.107911] localhost systemd[1]: systemd 226 running in system mode. (+PAM -AUDIT -SELINUX +IMA -APPARMOR +SMACK -SYSVINIT +UTMP -LIBCRYPTSETUP -GCRYPT -GNUTLS +ACL -XZ +LZ4 +SECCOMP +BLKID -ELFUTILS +KMOD -IDN)

Andrius, can you confirm?
Comment 8 Andrius Štikonas 2016-01-22 15:19:35 UTC
Created attachment 423608 [details]
rdsosreport.txt

Sorry, it was a bit older rdsosreport log. I was already using cryptsetup

I've created a new rdsosreport.txt with systemd-escape patch applied and libcryptsetup enabled. It still didn't boot with dracut.

So once I'm thrown into rescue shell, I can do run  cryptsetup manually and then lvm and btrfs are mounted automatically to /sysroot.

P.S. not sure what should I do if I mounted /sysroot manually if I want to boot it. "exit" didn't work.
Comment 9 Andrius Štikonas 2016-01-22 15:24:38 UTC
(In reply to Matthew Thode ( prometheanfire ) from comment #6)
> hmm, you are correct, I'd still test without it though.
> 
> the diferences I see, you are not defining rootfstype on the broken system
> and you define  cryptdevice=/dev/sda2:lvm on the broken system
> 
> can you define the rootfstype and get rid of the cryptdevice part?  at least
> to test past this problem.

I've got rid of cryptdevice part. But it's definitely luks mounting problem, not btrfs... Cause if I open luksdevice in rd shell then lvm and btrfs are dealt with automatically
Comment 10 Andrius Štikonas 2016-01-22 16:59:05 UTC
By the way, if I generate dracut without systemd, system seems to boot.
Comment 11 Andrius Štikonas 2016-01-22 18:16:29 UTC
Ok, the problem seems to be in dracut's /etc/crypttab file. I don't know why but it only contained
- timeout=10,-

so to fix my boot I just created a proper /etc/crypttab file and incuded it with install_items=/etc/crypttab in dracut configuration
Comment 12 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2016-01-22 18:31:32 UTC
k, thanks :D
Comment 13 Alexander Tsoy 2016-01-22 20:48:02 UTC
(In reply to Andrius Štikonas from comment #8)
> Created attachment 423608 [details]
> rdsosreport.txt

Combination of hostonly-cmdline + systemd + cryptsetup + nonexistent or empty or broken crypttab (or crypttab not containing the device needed to mount root) is known to cause problems. I made a patch fixing this issue long time ago, just need to send it upstream. %)

(In reply to Andrius Štikonas from comment #11)
> so to fix my boot I just created a proper /etc/crypttab file and incuded it
> with install_items=/etc/crypttab in dracut configuration

Do you really need "install_items=/etc/crypttab" after creating a proper /etc/crypttab?
Comment 14 Andrius Štikonas 2016-01-23 00:35:34 UTC
(In reply to Alexander Tsoy from comment #13)
> Do you really need "install_items=/etc/crypttab" after creating a proper
> /etc/crypttab?

Indeed, install_items is not necessary, it installed crypttab from my rootfs automatically.

P.S. I've also now added my own luks keyfile to crypttab, so I only need to type luks password in grub and not in initramfs (grub is also signed by my secure boot key).