Bugzilla – Bug 445737
Encrypted root filesystem mount fails
Last modified: 2008-11-18 16:02:58 UTC
Following the work-around in http://en.opensuse.org/Encrypted_Root_File_System since YaST does not support root file encryption, testing with openSUSE 11.1 beta 5, I am no longer given the opportunity to enter the LUKS/dm-crypt password for my partitions and mounting root fails. I have tried to add the pertinent kernel modules manually to see if this helps, but I cannot find the right combination to do so. Optimally, a good way to resolve this would just be to make YaST allow root filesystem encryption using the technologies stated in the article.
Please understand that bugzilla is no discussion forum and the method described in the wiki is a quite inofficial one. So a better place to discuss this is one of our mailinglists. Nevertheless I've just recently sucessfully installed a SLES11beta5 (same code base) on encrypted / so the initrd is in principle capable to handle the situation. For testing I used this script: http://www.suse.de/~lnussel/mkcryptroot Maybe it helps you debug your problem
That script helped me find the issue. It appears that I had an issue with updating the initrd and the boot loader. Thank you. I'll see if I can't update the wiki with my findings.
BTW- the script appears to have a couple bugs. 1. The awk line mangled my luks_root= (or luks_crypt_root= ?) statements as well as removing the root= statement. 2. On the encrypted root mounted on /mnt, the /etc/fstab must be updated for the filesystem to boot correctly, or even though you decrypted the partition at boot, you are still mounting the unencrypted partition.
(In reply to comment #3 from David Bailey) > BTW- the script appears to have a couple bugs. Well, fortunately it's just a hack and nothing I'd publish widely :-) > 1. The awk line mangled my luks_root= (or luks_crypt_root= ?) statements as > well as removing the root= statement. They are not needed. The mkinird records those values so the generated initrd automatically uses them (at least if you call mkinitrd in a chroot). > 2. On the encrypted root mounted on /mnt, the /etc/fstab must be updated for > the filesystem to boot correctly, or even though you decrypted the partition at > boot, you are still mounting the unencrypted partition. IIRC that doesn't happen as / is already mounted by the kernel. fsck will likely check the wrong partition though.