guix: Ask LUKS password only once on boot when using GRUB.

* gnu/bootloader/grub.scm (make-grub-configuration): Modify.
* gnu/system/mapped-devices.scm (open-luks-device): Modify.
* gnu/tests/install.scm (%encrypted-root-installation-script): Modify.
(%encrypted-root-os): Make debugging possible.
* doc/guix.texi (Mapped Devices): Cross-reference automatic LUKS master key
passing.
(BootloaderConfiguration): Document automatic LUKS master key passing via
GRUB's (proc)/luks_script.  Update extra-initrd documentation.

Change-Id: I5be74a524de04232d156e750109707fe7e50c28a

1 files changed, 12 insertions, 3 deletions

diff --git a/gnu/bootloader/grub.scm b/gnu/bootloader/grub.scm
index 88c8d13c543..3a37f7f2947 100644
--- a/gnu/bootloader/grub.scm
+++ b/gnu/bootloader/grub.scm
@@ -404,7 +404,10 @@ when booting a root file system on a Btrfs subvolume."
               (initrd (normalize-file (menu-entry-initrd entry)
                                       device-mount-point
                                       store-directory-prefix))
-              (extra-initrd (bootloader-configuration-extra-initrd config)))
+              (extra-initrd (bootloader-configuration-extra-initrd config))
+              (luks-script-initrd
+               (and (pair? store-crypto-devices)
+                    "newc:etc/luks_script:(proc)/luks_script")))
           ;; Here DEVICE is the store and DEVICE-MOUNT-POINT is its mount point.
           ;; Use the right file names for LINUX and INITRD in case
           ;; DEVICE-MOUNT-POINT is not "/", meaning that the store is on a
@@ -412,14 +415,20 @@ when booting a root file system on a Btrfs subvolume."
 
           ;; When STORE-DIRECTORY-PREFIX is defined, prepend it the linux and
           ;; initrd paths, to allow booting from a Btrfs subvolume.
+
+          ;; When the store is on an encrypted device, inject GRUB's
+          ;; (proc)/luks_script into the initrd as /etc/luks_script so the
+          ;; initrd can use the already-decrypted master key to open LUKS
+          ;; volumes without prompting for the password a second time.
           #~(format port "menuentry ~s {
   ~a
   linux ~a ~a
-  initrd ~a ~a
+  initrd ~a ~a ~a
 }~%"
                     #$label
                     #$(grub-root-search device linux)
                     #$linux (string-join (list #$@arguments))
+                    (or #$luks-script-initrd "")
                     (or #$extra-initrd "")
                     #$initrd)))
        (multiboot-kernel
@@ -464,7 +473,7 @@ menuentry ~s {
           ;; Other type of devices aren't implemented.
           #~()))
     (let ((devices (map crypto-device->cryptomount store-crypto-devices))
-          (modules #~(format port "insmod luks~%insmod luks2~%")))
+          (modules #~(format port "insmod procfs~%insmod luks~%insmod luks2~%")))
       (if (null? devices)
           devices
           (cons modules devices))))