Hello, On 2024-05-20 20:07:43 +0200, Thomas Bennett wrote: > Hello Guix comunity, > > I would like to be able to mount external encrypted disk pasing key-files > located in the root partition. Thus it would prevent me to open those > external disks manually by entering passphrases during the boot sequence. > Keeping only the passphrase for the root partition is fine for now. > > I have the following in my config.scm file regarding mapping and mounting > one of the external disks, a backup one: > > (mapped-devices (list (mapped-device > (source (uuid "$ROOT_PARTION_UUID")) > (target "$ROOT_PARTITION_MAPPED_NAME") > (type luks-device-mapping)) > (mapped-device > (source (uuid "$BACKUP_PARTITION_UUID")) > (target "$BACKUP_PARTITION_MAPPED_NAME") > (type (luks-device-mapping-with-options > #:key-file > "$BACKUP_PARTITION_KEY_FILE_PATH"))))) > > > (file-systems (cons* (file-system > (mount-point "$BOOT_PARTITION_MOUNTPOINT") > (device (uuid "$BOOT_PARTITION_UUID" 'fat32)) > (type "vfat")) > (file-system > (mount-point "$ROOT_PARTITION_MOUNTPOINT") > (device "/dev/mapper/$ROOT_PARTITION_MAPPED_NAME") > (type "ext4") > (dependencies mapped-devices)) > (file-system > (create-mount-point? #t) > (mount-point "$BACKUP_PARTITION_MOUNTPOINT") > (type "ext4") > (device "/dev/mapper/$BACKUP_PARTITION_MAPPED_NAME") > (dependencies mapped-devices)) > %base-file-systems))) > > And it doesn't work. The configuration loads, but when I boot the system, it > seems to be unable to find the key file because it stills asks for my > passphrase to unlock the backup partition. > > May it be possible that the root partition is not yet mounted when the > system tries to map the backup partition? If so, It would explain why it > doesn't find the key file and asks for my passphrase.
I think this is the correct conclusion. If you look into gnu/system/linux-initrd.scm at raw-initrd procedure, you will notice that everything is unlocked before the root being mounted. I did not test it in any way, but based just on browsing the source code, it looks like it unlocks only devices required for boot. Maybe. What you can therefore try is to split the dependencies, and instead of having full `mapped-devices' in both, you can try to put just the respective mapped-device as `dependencies' of $ROOT_PARTITION_MOUNTPOINT and $BACKUP_PARTITION_MOUNTPOINT filesystems (you can probably just filter the list by mapped-device-target). Let me know if it worked, I am curious. As an alternative solution, you can just put the keyfile into the initrd, although that requires switching to encrypted boot. > > Do you know how to further investigate and/or what's wrong with the config > and how to achieve the expected result? > > Thank you, > Best, > Thomas Have a nice day, also Tomas :) -- There are only two hard things in Computer Science: cache invalidation, naming things and off-by-one errors.
signature.asc
Description: PGP signature
