--- ./init 2018-04-18 20:55:09.661574000 +0200 +++ ./init.new 2021-02-10 00:23:26.448715585 +0100 @@ -76,7 +76,12 @@ INITRD=$(cat /initrd-name) ROOTDEV=$(cat /rootdev) ROOTFS=$(cat /rootfs) -LUKSDEV=$(cat /luksdev) +if grep -q : luksdev; then + LUKSDEV=$(cat /luksdev|cut -d: -f1) + LUKSNAME=$(cat /luksdev|cut -d: -f2) +else + LUKSDEV=$(cat /luksdev) +fi LUKSTRIM=$(cat /lukstrim 2>/dev/null) LUKSKEY=$(cat /lukskey) RESUMEDEV=$(cat /resumedev) @@ -137,6 +142,12 @@ ;; esac done +# If GRUB unlocked the LUKS device it sends a command line like: +# BOOT_IMAGE=/boot/ root=/dev/mapper/ +# In this case we use as last argument of "cryptsetup luksOpen" +# and mount /dev/mapper/ on /mnt + +echo $root | grep -q /dev/mapper && LUKSNAME=$(basename $root) # If udevd is available, use it to generate block devices # else use mdev to read sysfs and generate the needed devices @@ -193,8 +204,9 @@ # partitions or mdadm arrays. # Unavailable devices such as LVM Logical Volumes will need to be # deferred until they become available after the vgscan. - - if [ -x /sbin/cryptsetup ]; then + + [ "$LUKSKEY" ] && ! echo "$LUKSKEY" |grep -q "^/dev" && KEYININITRD="y" + if [ -x /sbin/cryptsetup ] && [ ! "$KEYININITRD" ] ; then # Determine if we have to use a LUKS keyfile: if [ ! -z "$LUKSKEY" ]; then @@ -229,6 +241,8 @@ CRYPTDEV="luks$(basename $LUKSDEV)" elif [ "x$ROOTDEV" = "x$(basename $ROOTDEV)" ]; then CRYPTDEV="$ROOTDEV" + elif [ "$LUKSNAME" ]; then + CRYPTDEV="$LUKSNAME" else CRYPTDEV="luks$(basename $LUKSDEV)" fi @@ -252,6 +266,12 @@ done fi + if [ -x /sbin/cryptsetup ] && [ "$KEYININITRD" ] ; then + [ ! "$LUKSNAME" ] && LUKSNAME=cryptroot + echo "Unlocking the root partition." + cryptsetup open --key-file "$LUKSKEY" "$LUKSDEV" "$LUKSNAME" + fi + # Initialize LVM: if [ -x /sbin/vgchange ]; then mkdir -p /var/lock/lvm # this avoids useless warnings