Mailing List Archive: Encrypted swap with keyfile

Hi everyone,

So I've been trying to get my encrypted swap working but didn't have a
lot of success so far. I have /dev/sda2 as the swap partition and
/dev/sda3 as the root partition. I did encrypt the swap partition with a
keyfile and the unlock works fine but the problem is that my initramfs
asks to decrypt the swap partition before the root partition and since
the keyfile is stored in the root partition it still asks me for a
password. I use genkernel to make my initramfs and I am passing the
crypt_swap, crypt_swap_keydev and crypt_swap_key options but I'm
guessing that since /dev/sda2 comes before /dev/sda3, the initramfs
tries to decrypt that one first. How can I go around this? Is my only
option to try and reorder these partitions?

Thank you!

On Sat, Jul 8, 2023 at 4:29?AM efeizbudak <efeizbudak@disroot.org> wrote:
>
> I use genkernel to make my initramfs and I am passing the crypt_swap, crypt_swap_keydev and crypt_swap_key options but I'm guessing that since /dev/sda2 comes before /dev/sda3, the initramfs tries to decrypt that one first. How can I go around this? Is my only option to try and reorder these partitions?
>

So, I've never really used genkernel, but this seems like the sort of
thing that wouldn't be hard to do with dracut. If it doesn't already
have native support for putting keyfiles in the initramfs, it would be
pretty easy to create a module that does.

Just loading the keyfile into the initramfs is trivial using
install_items in the config file. You'd still need to change the
logic to load it, or maybe do it via kernel command line.

Perhaps genkernel has some way to add a file to the initramfs as well.

--
Rich