clevis icon indicating copy to clipboard operation
clevis copied to clipboard

clevis in dracut does not run without manually specifying LUKS device

Open hexchain opened this issue 5 years ago • 0 comments

Hi,

I'm trying to let clevis automatically unlock my root partition with TPM2 on boot. My current setup is:

OS: Arch Linux, upgraded to the latest

Disk layout:

% lsblk /dev/nvme0n1
NAME        MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINT
nvme0n1     259:0    0   477G  0 disk  
├─nvme0n1p1 259:1    0   512M  0 part  /boot
└─nvme0n1p2 259:2    0 476.4G  0 part  
  └─root    254:0    0 476.4G  0 crypt /

LUKS:

% sudo cryptsetup luksDump /dev/nvme0n1p2
LUKS header information
Version:       	2
...

Data segments:
  0: crypt
	...

Keyslots:
  0: luks2
        ...
  1: luks2
        ...
Tokens:
  0: clevis
	Keyslot:  1
Digests:
  ...

dracut configurations:

% cat /etc/dracut.conf.d/*.conf
compress="lz4"
hostonly=yes
hostonly_cmdline=no
add_drivers+=" i915"
early_microcode="no"
omit_dracutmodules+=" bootchart clevis-pin-sss clevis-pin-tang dash dmsquash-live-ntfs multipath stratis cifs fcoe fcoe-uefi iscsi nbd nfs btrfs dmraid lvm mdraid lunmask qemu-net network kernel-network-modules"
uefi_stub="/usr/lib/systemd/boot/efi/linuxx64.efi.stub"

kernel command line:

% cat /proc/cmdline            
initrd=\intel-ucode.img initrd=\initramfs-linux-zen.img rw systemd.unified_cgroup_hierarchy resume=/dev/mapper/root resume_offset=24977408 intel_iommu=on mitigations=off pcie_aspm=force mem_sleep_default=deep crashkernel=512M

However, it looks like dracut does not even call clevis unless I supply an rd.luks.uuid parameter in the kernel cmdline.

Is this behavior intended, or is this a bug?

hexchain avatar Mar 16 '20 14:03 hexchain