Portage of **sdm-cryptconfig**, questions.

[BobSquarePants]

Hi @gitbls ,

As said I'm figuring out how work sdm-cryptconfig

What does the line 350

[ $xnopwd -eq 1 ] && kskip="&& /bin/false"

It only set the variable kskip and create the file /usr/bin/sdmluksunlock if the user selected to not have a password ? is that right ?

Thanks.

[gitbls]

As you've seen, sdm-cryptconfig creates the script sdmcryptfs, which is run in the initramfs to do the encryption. sdmcryptfs in versions prior to V13.5 was definitely V1. It worked but had some issues.

In V13.5 I completely redid sdmcryptfs and it's significantly better now, using a technique that I just used in the new yubikey support.

TLDR; old code that should have removed. Thanks for pointing it out. 👍

[gitbls]

Line 630

[BobSquarePants]

Exactly, it's what I saw, But you were seeming to say ( in your first reply ) that sdmcryptfs took over.
ok, I'll re read your code (from the top) again :)

---

So no matter what doconfiginitramfs() will generate the file /usr/bin/sdmluksunlock ? that is later still use right ?

[gitbls]

Yes, doconfiginitramfs generates sdmluksunlock always. I mis-spoke earlier, when I said that sdm-cryptconfig creates sdmcryptfs. That is incorrect. It generates sdmluksunlock, which uses the new technique that I mentioned, but didn't describe.

[BobSquarePants]

and if I'm understand correctly /usr/bin/sdmluksunlock is only needed when user do not use a "typed" password, correct ?

[gitbls]

sdmluksunlock is used when a keyfile is configured to unlock the rootfs. IF a keyfile is configured, sdmluksunlock can use that keyfile OR can accept the Luks passphrase.

You may not have looked at it yet, but the yubi plugin can configure an encrypted rootfs to be unlocked by a yubikey. At the moment it's only provided as an sdm plugin, but I'll likely be building that as a standalone script as well. It also has a script that runs in the initramfs. So, in addition to the passphrase, a Luks unlock can either be a keyfile OR a yubikey, but not both.

[BobSquarePants]

@gitbls

Thanks again for your help in this portage project.
To be able to enable Luks encryption on MX Linux respin for raspberry

So before I actually code this, I converted sdm-cryptconfig into a human "readable" steps to do just the encryption (xchacha20) with (at the moment) no options possible.

Let me know if I forgot something (of course the specific for MX I'll handle it )

---

Required Linux packages

• cryptsetup
• cryptsetup-initramfs
• cryptsetup-bin

Config initramfs

/etc/initramfs-tools/initramfs.conf

MODULES=most

Create luks-hooks

/etc/initramfs-tools/hooks/luks-hooks
that source /usr/share/initramfs-tools/hook-functions

Modify nodules

/etc/initramfs-tools/modules

algif_skcipher
xchacha20
adiantum
aes_arm
sha256
nhpoly1305
dm-crypt

Modify initramfs.conf

/etc/initramfs-tools/initramfs.conf

KEYMAP=y

Update initramfs

update-initramfs -u

update cmdline.txt

/boot/firmware/cmdline.txt

set root=/dev/mapper/<something> rw cryptdevice=/dev/mmcblk0p2:<something> luks.crypttab=no

Not sure about /dev/mmcblk0p2

update fstab

PARTUUID=/dev/mapper/

update crypttab

/dev/mmcblk0p2 luks,discard,tries=3

a command that will run after reboot to rebuild (again) initramfs and reboot

mv /etc/initramfs-tools/hooks/luks-hooks /etc/initramfs-tools/hooks/.sdm.luks-hooks.old

Wipe line that contains

• sdmcryptfs
• mapper
• sdmcrypto
• sdmnopwd
• /etc/sdm/assets/cryptroot

write the outcome into /etc/initramfs-tools/hooks/luks-hooks

chmod 755 /etc/initramfs-tools/hooks/luks-hooks
update-initramfs -u

Do I miss something ?

Thanks.

[BobSquarePants]

So, I've tried manually (bash) those steps and after the first
update-initramfs -u
I got

E: /etc/initramfs-tools/hooks/luks-hooks failed with return 2.

in /etc/initramfs-tools/hooks/luks-hooks

what does

copy_file text /usr/local/bin/sdmcryptfs /usr/bin 
copy_file text /etc/mappername

What is text ?

Thanks.

[BobSquarePants]

I've updated luks-hooks with

#!/bin/sh -e
PREREQS=""
case "\$1" in
        prereqs) echo "\${PREREQS}"; exit 0;;
esac

. /usr/share/initramfs-tools/hook-functions

# Don't assume that sdmcryptfs-required pgms are in initramfs
copy_exec /usr/sbin/resize2fs /usr/sbin
copy_exec /usr/sbin/fdisk /usr/sbin
copy_exec /usr/sbin/parted /usr/sbin
copy_exec /usr/sbin/cryptsetup /usr/sbin
copy_exec /usr/bin/bash /usr/bin
copy_exec /usr/bin/dd /usr/bin
copy_file text /usr/local/bin/sdmcryptfs /usr/bin
# OK if this fails; means it was copied due to keyscript in crypttab and copied in /usr/share/initramfs-tools/hooks/cryptroot
#copy_file text /usr/bin/sdmluksunlock || true  #note I supress this
copy_file text /etc/mappername
copy_file text /etc/sdmcrypto
copy_file text /etc/sdmkeyfile
exit 0

and "installed" sdmcryptfs into /usr/local/bin/sdmcryptfs

now the error changed into

E: /etc/initramfs-tools/hooks/luks-hooks failed with return 1.

I guess 1 is better than 2, so progress ? XD

[gitbls]

The copy_file function is in /usr/share/initramfs-tools/hook-functions. copy_file is documented there.

As to your error, all I can tell you is that I didn't have anyone to ask questions of, and I figured it out. You should be able to, based on how you're progressing in your understanding.

For little errors like the ones above, I really can't help you without investing time in it that I don't have. I figured all this out mid-2024, so unfortunately (for you) some of the details are a bit faded, so require me to re-read into it. Especially problematic for these types of questions ("I changed this and I'm getting an initramfs error")

So, you're welcome to ask, but I'll most likely answer with whatever I have managed to retain without readin.

I can tell you that this code is really "touchy", as you've observed with these problems, so unless it's something that I recognize, I'm going to pass on it.

I've found that what works for me in cases like this is to sit down and ELI5 to a non-technical person. Going through all the details, every single one of them, what I changed, what happened, and then answering the inevitable question "what should I try next to solve this?". In your case it could be "What would gitbls suggest I try?" 😉

Looking quickly at the copy_file function in hook-functions, I see there is a verbose argument. Perhaps update-initramfs -v might give you some insight.

[BobSquarePants]

Thank you @gitbls ,

I figured out where fail /etc/initramfs-tools/hooks/luks-hooks

copy_file text /usr/local/bin/sdmcryptfs /usr/bin

 
According to /usr/share/initramfs-tools/hook-functions

error code 1 mean the destination already exist
$3 = optional name for the file on the initramfs

So I updated luks-hooks

But the error 1 remain. 😢

Here the full output

update-initramfs: Generating /boot/initrd.img-6.12.20+rpt-rpi-v8
destdir: /var/tmp/mkinitramfs_mTPusz
resize2fs ok
fdisk ok
parted ok
cryptsetup ok
bash ok
dd ok
sdmcryptfs do not exist
E: /etc/initramfs-tools/hooks/luks-hooks failed with return 1.
update-initramfs: failed for /boot/initrd.img.-6.12.20+rpt-rpi-v8 with 1.

If anyone have an idea what could make copy_file fail, I'm all ears :)