Skip to content

Fedora Silverblue + other immutable Fedora OSes support #6

@pepawel

Description

@pepawel

Initramfs in Fedora Silverblue misses crypttab file (other Fedora variants need to be examined). A different mechanism is used, therefore custom approach has to be implemented by cryptreboot.

Cryptreboot operates in two stages:

  1. When the OS is fully loaded and the disk is unlocked: cryptreboot parses the crypttab file found inside the initramfs to identify encrypted disks and prompt the user for passphrases for those disks. While it could use /etc/crypttab for this, using the copy within the initramfs is more self-sufficient and better aligned with the standard reboot process.

  2. When the patched initramfs code is executed (early userspace): Previously, cryptreboot injected a modified crypttab file into the initramfs. This modified file contains the disk encryption keys, which allow the disk-unlocking code in the initramfs to run without requiring a passphrase from the user.

In the absence of the crypttab file within the initramfs, it is evident that an alternative disk-unlocking mechanism is in use by the initramfs. There is a need to understand how this mechanism functions to allow cryptreboot to provide it with the disk encryption key, thereby eliminating the need for a passphrase prompt.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions