Skip to content

Fedora Silverblue + other immutable Fedora OSes support #6

@pepawel

Description

@pepawel

Initramfs in Fedora Silverblue misses crypttab file (other Fedora variants need to be examined). A different mechanism is used, therefore custom approach has to be implemented by cryptreboot.

Cryptreboot operates in two stages:

  1. When the OS is fully loaded and the disk is unlocked: cryptreboot parses the crypttab file found inside the initramfs to identify encrypted disks and prompt the user for passphrases for those disks. While it could use /etc/crypttab for this, using the copy within the initramfs is more self-sufficient and better aligned with the standard reboot process.

  2. When the patched initramfs code is executed (early userspace): Previously, cryptreboot injected a modified crypttab file into the initramfs. This modified file contains the disk encryption keys, which allow the disk-unlocking code in the initramfs to run without requiring a passphrase from the user.

In the absence of the crypttab file within the initramfs, it is evident that an alternative disk-unlocking mechanism is in use by the initramfs. There is a need to understand how this mechanism functions to allow cryptreboot to provide it with the disk encryption key, thereby eliminating the need for a passphrase prompt.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions