-
Notifications
You must be signed in to change notification settings - Fork 3
Description
Initramfs in Fedora Silverblue misses crypttab file (other Fedora variants need to be examined). A different mechanism is used, therefore custom approach has to be implemented by cryptreboot.
Cryptreboot operates in two stages:
-
When the OS is fully loaded and the disk is unlocked: cryptreboot parses the
crypttabfile found inside the initramfs to identify encrypted disks and prompt the user for passphrases for those disks. While it could use/etc/crypttabfor this, using the copy within the initramfs is more self-sufficient and better aligned with the standard reboot process. -
When the patched initramfs code is executed (early userspace): Previously, cryptreboot injected a modified
crypttabfile into the initramfs. This modified file contains the disk encryption keys, which allow the disk-unlocking code in the initramfs to run without requiring a passphrase from the user.
In the absence of the crypttab file within the initramfs, it is evident that an alternative disk-unlocking mechanism is in use by the initramfs. There is a need to understand how this mechanism functions to allow cryptreboot to provide it with the disk encryption key, thereby eliminating the need for a passphrase prompt.