Add cryptsetup(Decryption) to initramfs

Issues & Assistance
1 
System:
  Kernel: 6.1.0-0.deb11.11-amd64 arch: x86_64 bits: 64 compiler: gcc v: 10.2.1 clocksource: hpet
    available: acpi_pm parameters: BOOT_IMAGE=/boot/vmlinuz-6.1.0-0.deb11.11-amd64
    root=PARTUUID=e1ba93c9-a201-4f80-902a-94db727466de ro radeon.si_support=0 amdgpu.si_support=1
    radeon.cik_support=0 amdgpu.cik_support=1 quiet
  Console: pty pts/1 Distro: Garuda Linux base: Arch Linux
Machine:
  Type: Laptop System: LENOVO product: 80TJ v: Lenovo ideapad 110-15ACL serial: <filter> Chassis:
    type: 10 v: Lenovo ideapad 110-15ACL serial: <filter>
  Mobo: LENOVO model: Nano 5A8 v: SDK0J40679 WIN serial: <filter> UEFI: Lenovo v: 1QCN32WW
    date: 08/18/2016
Battery:
  ID-1: BATT charge: 0 Wh (0.0%) condition: 1.6/23.8 Wh (6.7%) volts: 7.3 min: 10.8
    model: LENOVO LCFC type: Unknown serial: <filter> status: not charging
CPU:
  Info: model: AMD A8-7410 APU with AMD Radeon R5 Graphics socket: FT3b bits: 64 type: MCP
    arch: Puma level: v2 built: 2014-15 process: GF 28nm family: 0x16 (22) model-id: 0x30 (48)
    stepping: 1 microcode: 0x7030105
  Topology: cpus: 1x cores: 4 smt: <unsupported> cache: L1: 256 KiB desc: d-4x32 KiB; i-4x32 KiB
    L2: 2 MiB desc: 1x2 MiB
  Speed (MHz): avg: 1000 min/max: 1000/2200 boost: enabled base/boost: 2200/2200 scaling:
    driver: acpi-cpufreq governor: conservative volts: 1.2 V ext-clock: 100 MHz cores: 1: 1000
    2: 1000 3: 1000 4: 1000 bogomips: 17566
  Flags: avx ht lm nx pae sse sse2 sse3 sse4_1 sse4_2 sse4a ssse3 svm
  Vulnerabilities: <filter>
Graphics:
  Device-1: AMD Mullins [Radeon R4/R5 Graphics] vendor: Lenovo driver: amdgpu v: kernel
    arch: GCN-2 code: Sea Islands process: GF/TSMC 16-28nm built: 2013-17 ports: active: eDP-1
    empty: HDMI-A-1 bus-ID: 00:01.0 chip-ID: 1002:9851 class-ID: 0300
  Device-2: AMD Sun XT [Radeon HD 8670A/8670M/8690M / R5 M330 M430 Radeon 520 Mobile]
    vendor: Lenovo driver: amdgpu v: kernel arch: GCN-1 code: Southern Islands process: TSMC 28nm
    built: 2011-20 pcie: gen: 2 speed: 5 GT/s lanes: 2 link-max: gen: 3 speed: 8 GT/s lanes: 8
    bus-ID: 01:00.0 chip-ID: 1002:6660 class-ID: 0380 temp: 43.0 C
  Device-3: IMC Networks EasyCamera driver: uvcvideo type: USB rev: 2.0 speed: 480 Mb/s lanes: 1
    mode: 2.0 bus-ID: 2-1.2:4 chip-ID: 13d3:a745 class-ID: 0e02 serial: <filter>
  Display: server: X.org v: 1.21.1.9 with: Xwayland v: 23.2.2 driver: gpu: amdgpu tty: 120x30
  Monitor-1: eDP-1 model: ChiMei InnoLux 0x15dc built: 2015 res: 1366x768 dpi: 101 gamma: 1.2
    size: 344x193mm (13.54x7.6") diag: 394mm (15.5") ratio: 16:9 modes: max: 1366x768 min: 640x480
  API: EGL v: 1.5 hw: drv: amd radeonsi platforms: device: 0 drv: radeonsi device: 1
    drv: radeonsi device: 2 drv: swrast gbm: drv: radeonsi surfaceless: drv: radeonsi
    inactive: wayland,x11
  API: OpenGL v: 4.6 compat-v: 4.5 vendor: mesa v: 23.2.1-arch1.2 note: console (EGL sourced)
    renderer: AMD Radeon R5 Graphics (kabini LLVM 16.0.6 DRM 3.49 6.1.0-0.deb11.11-amd64), AMD
    Radeon R5 M330 (hainan LLVM 16.0.6 DRM 3.49 6.1.0-0.deb11.11-amd64), llvmpipe (LLVM 16.0.6
    256 bits)
  API: Vulkan v: 1.3.269 layers: 3 device: 0 type: integrated-gpu name: AMD Radeon R5 Graphics
    (RADV KABINI) driver: mesa radv v: 23.2.1-arch1.2 device-ID: 1002:9851 surfaces: N/A device: 1
    type: discrete-gpu name: AMD Radeon R5 M330 (RADV HAINAN) driver: mesa radv v: 23.2.1-arch1.2
    device-ID: 1002:6660 surfaces: N/A device: 2 type: cpu name: llvmpipe (LLVM 16.0.6 256 bits)
    driver: mesa llvmpipe v: 23.2.1-arch1.2 (LLVM 16.0.6) device-ID: 10005:0000 surfaces: N/A
Audio:
  Device-1: AMD Kabini HDMI/DP Audio vendor: Lenovo driver: snd_hda_intel v: kernel
    bus-ID: 00:01.1 chip-ID: 1002:9840 class-ID: 0403
  Device-2: AMD FCH Azalia vendor: Lenovo driver: snd_hda_intel v: kernel bus-ID: 00:14.2
    chip-ID: 1022:780d class-ID: 0403
  API: ALSA v: k6.1.0-0.deb11.11-amd64 status: kernel-api with: aoss type: oss-emulator
    tools: N/A
  Server-1: PipeWire v: 1.0.0 status: off with: 1: pipewire-pulse status: off 2: wireplumber
    status: off 3: pipewire-alsa type: plugin 4: pw-jack type: plugin
    tools: pactl,pw-cat,pw-cli,wpctl
Network:
  Device-1: Qualcomm Atheros QCA9377 802.11ac Wireless Network Adapter vendor: Lenovo
    driver: ath10k_pci v: kernel pcie: gen: 1 speed: 2.5 GT/s lanes: 1 bus-ID: 02:00.0
    chip-ID: 168c:0042 class-ID: 0280
  IF: wlp2s0 state: up mac: <filter>
  Device-2: Realtek RTL810xE PCI Express Fast Ethernet vendor: Lenovo driver: r8169 v: kernel
    pcie: gen: 1 speed: 2.5 GT/s lanes: 1 port: 1000 bus-ID: 03:00.0 chip-ID: 10ec:8136
    class-ID: 0200
  IF: enp3s0 state: down mac: <filter>
  IF-ID-1: br-2843d63134e5 state: up speed: 10000 Mbps duplex: unknown mac: <filter>
  IF-ID-2: docker0 state: up speed: 10000 Mbps duplex: unknown mac: <filter>
  IF-ID-3: tailscale0 state: unknown speed: -1 duplex: full mac: N/A
  IF-ID-4: veth2525790 state: up speed: 10000 Mbps duplex: full mac: <filter>
  IF-ID-5: veth2d29dfc state: up speed: 10000 Mbps duplex: full mac: <filter>
Bluetooth:
  Device-1: Qualcomm Atheros driver: btusb v: 0.8 type: USB rev: 2.0 speed: 12 Mb/s lanes: 1
    mode: 1.1 bus-ID: 2-1.1:3 chip-ID: 0cf3:e360 class-ID: e001
  Report: btmgmt ID: hci0 rfk-id: 2 state: down bt-service: N/A rfk-block: hardware: no
    software: yes address: N/A
Drives:
  Local Storage: total: 2.04 TiB used: 0 KiB (0.0%)
  ID-1: /dev/sda maj-min: 8:0 vendor: Seagate model: WDC WDS240G2G0A-00JH30 family: WD Blue /
    Red / Green SSDs size: 223.58 GiB block-size: physical: 512 B logical: 512 B sata: 3.2
    speed: 6.0 Gb/s tech: SSD serial: <filter> fw-rev: 0000 temp: 42 C
  SMART: yes state: enabled health: PASSED on: 1y 222d 8h cycles: 6387
  ID-2: /dev/sdb maj-min: 8:16 vendor: Seagate model: BUP Slim WH size: 931.51 GiB block-size:
    physical: 4096 B logical: 512 B type: USB rev: 3.0 spd: 5 Gb/s lanes: 1 mode: 3.2 gen-1x1
    tech: N/A serial: <filter> fw-rev: 0304
  SMART Message: A mandatory SMART command failed. Various possible causes.
  ID-3: /dev/sdc maj-min: 8:32 vendor: Seagate model: BUP Slim RD size: 931.51 GiB block-size:
    physical: 4096 B logical: 512 B type: USB rev: 2.1 spd: 480 Mb/s lanes: 1 mode: 2.0 tech: N/A
    serial: <filter> fw-rev: 0302
  SMART Message: A mandatory SMART command failed. Various possible causes.
Partition:
  Message: No partition data found.
Swap:
  Kernel: swappiness: 1 (default 60) cache-pressure: 50 (default 100) zswap: no
  ID-1: swap-1 type: file size: 4 GiB used: 0 KiB (0.0%) priority: -2 file: /swapfile
Sensors:
  System Temperatures: cpu: 55.8 C mobo: N/A
  Fan Speeds (rpm): N/A
  GPU: device: amdgpu temp: 48.0 C device: amdgpu temp: 44.0 C
Info:
  Processes: 283 Uptime: 2h 51m wakeups: 0 Memory: total: 8 GiB note: est. available: 6.68 GiB
  used: 2 GiB (29.9%) Init: systemd v: 255 default: graphical tool: systemctl Compilers:
  gcc: 13.2.1 alt: 12 Packages: pm: pacman pkgs: 1516 libs: 434 tools: octopi,pamac,paru
  Shell: Bash (sudo) v: 5.2.21 running-in: pty pts/1 inxi: 3.3.31
Garuda (2.6.19-2):
head: cannot open '/var/log/pacman.log' for reading: No such file or directory
  System install date:
  Last full system update: 2023-12-13
  Is partially upgraded:   No
  Relevant software:       snapper NetworkManager connman dracut
  Windows dual boot:      Yes

I installed garuda with decryption and would like to remove it from /boot, to do that i need to move all kernels and initramfs to my actually partiton /dev/sda1 but i have never used dracut and since grub wont be handling decryption anymore i need to add cryptsetup to my initramfs and also ssh to decrypt over ssh if possible.How would i do this with dracut?

2

dracut will automatically add cryptsetup when it is needed. It is probably already there. You can check with lsinitrd

However, you need to remove the keyfile from the initrd or it will be automatically decrypted.

Calamares puts a file in /etc/dracut.conf.d/ with this in the contents of the file:

# Configuration file automatically written by the Calamares system installer
# (This file is written once at install time and should be safe to edit.)
# Enables support for LUKS full disk encryption with single sign on from GRUB.

# force installing /etc/crypttab even if hostonly="no", install the keyfile
install_items+=" /etc/crypttab /crypto_keyfile.bin "

You should change the last line to:

install_items+=" /etc/crypttab "
1 Like
3

Aha! I was wondering why my system was decrypting automatically. I just assumed the behaviour of dracut would be the same because of experiences whole using gentoo. Every single time I would need to give the initramfs a few tries to get the module installed and working.

1 Like
4

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.