void-runit icon indicating copy to clipboard operation
void-runit copied to clipboard

03-filesystems.sh can't access a keyfile on a separate, encrypted /boot partition

Open humky opened this issue 2 years ago • 1 comments

In a setup where /boot is encrypted and placed onto completely separate encrypted disk, and keyfiles are used in crypttab, runit (03-filesystems.sh) tries to check the /boot partition for a keyfile but fails due to it not being mounted by dracut(initramfs) or anything else.

The cryptdevice of /boot partition is already opened in previous booting steps (I assume by grub), it's just isn't mounted yet, at the very end of 03-filesystems it reads fstab and mounts everything properly.

The end result is that I can see warnings during boot about "Failed to open key file.", but otherwise boot ends and mounts everything just fine.

I've added a couple of lsblk checks before "Activating encrypted devices" and after it, to show the point, and also show my configuration in this video: https://fastupload.co/1097693

humky avatar Aug 13 '21 19:08 humky

Finally, after hours of searching I found how to mount /boot partition early, it is possible via dracut config, it just takes two special commands to include fstab, not just install_items as is usually done for crypttab:

add_fstab+=" /etc/fstab "
use_fstab="yes"

Although the "Activating encrypted devices..." step still completes with visual warnings "Device void-root already exists." and the same for void-boot. I think it would be nice to add some sort of exception to /etc/runit/crypt.awk: if $1 (device name) already exists (therefor opened) - exit, else continue as usual. I don't know how to do it on my own.

humky avatar Aug 14 '21 14:08 humky