From b90597b98d46767207a0e92a84fb39c344472b69 Mon Sep 17 00:00:00 2001 From: Danny Milosavljevic Date: Sun, 8 Feb 2026 21:50:42 +0100 Subject: guix: Ask LUKS password only once on boot when using GRUB. * gnu/bootloader/grub.scm (make-grub-configuration): Modify. * gnu/system/mapped-devices.scm (open-luks-device): Modify. * gnu/tests/install.scm (%encrypted-root-installation-script): Modify. (%encrypted-root-os): Make debugging possible. * doc/guix.texi (Mapped Devices): Cross-reference automatic LUKS master key passing. (BootloaderConfiguration): Document automatic LUKS master key passing via GRUB's (proc)/luks_script. Update extra-initrd documentation. Change-Id: I5be74a524de04232d156e750109707fe7e50c28a --- gnu/bootloader/grub.scm | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) (limited to 'gnu/bootloader') diff --git a/gnu/bootloader/grub.scm b/gnu/bootloader/grub.scm index 88c8d13c543..3a37f7f2947 100644 --- a/gnu/bootloader/grub.scm +++ b/gnu/bootloader/grub.scm @@ -404,7 +404,10 @@ when booting a root file system on a Btrfs subvolume." (initrd (normalize-file (menu-entry-initrd entry) device-mount-point store-directory-prefix)) - (extra-initrd (bootloader-configuration-extra-initrd config))) + (extra-initrd (bootloader-configuration-extra-initrd config)) + (luks-script-initrd + (and (pair? store-crypto-devices) + "newc:etc/luks_script:(proc)/luks_script"))) ;; Here DEVICE is the store and DEVICE-MOUNT-POINT is its mount point. ;; Use the right file names for LINUX and INITRD in case ;; DEVICE-MOUNT-POINT is not "/", meaning that the store is on a @@ -412,14 +415,20 @@ when booting a root file system on a Btrfs subvolume." ;; When STORE-DIRECTORY-PREFIX is defined, prepend it the linux and ;; initrd paths, to allow booting from a Btrfs subvolume. + + ;; When the store is on an encrypted device, inject GRUB's + ;; (proc)/luks_script into the initrd as /etc/luks_script so the + ;; initrd can use the already-decrypted master key to open LUKS + ;; volumes without prompting for the password a second time. #~(format port "menuentry ~s { ~a linux ~a ~a - initrd ~a ~a + initrd ~a ~a ~a }~%" #$label #$(grub-root-search device linux) #$linux (string-join (list #$@arguments)) + (or #$luks-script-initrd "") (or #$extra-initrd "") #$initrd))) (multiboot-kernel @@ -464,7 +473,7 @@ menuentry ~s { ;; Other type of devices aren't implemented. #~())) (let ((devices (map crypto-device->cryptomount store-crypto-devices)) - (modules #~(format port "insmod luks~%insmod luks2~%"))) + (modules #~(format port "insmod procfs~%insmod luks~%insmod luks2~%"))) (if (null? devices) devices (cons modules devices)))) -- cgit v1.2.3