ZFS: Ask for stage 2 encryption passwords using systemd-ask-password #91344
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ElvishJerricco
changed the title
ofborg
bot
added
6.topic: nixos
ElvishJerricco
changed the title
|
Having a bit of trouble testing this with legacy mountpoints. It asks for the passphrase during boot just fine, but I'm testing with |
grahamc
reviewed
Jul 2, 2020
| @@ -146,6 +148,7 @@ in | |||
| # We use `mkAfter` to ensure that LUKS password prompt would be shown earlier than the splash screen. | |||
| boot.initrd.preLVMCommands = mkAfter '' | |||
| mkdir -p /etc/plymouth | |||
| mkdir /run/plymouth | |||
There was a problem hiding this comment.
Is there any concern around this existing / should we make it -p just in case?
There was a problem hiding this comment.
There's definitely no harm in -p but it's definitely not necessary. /run is created extremely early in stage 1.
grahamc
reviewed
Jul 2, 2020
Just in case something reads stdin, so that `while read ds kl` doesn't miss anything
Co-authored-by: Graham Christensen <graham@grahamc.com>
ElvishJerricco
force-pushed
the
zfs-encryption-systemd-ask-password
branch
from
4828e65 to
e2f1594
Compare
grahamc
approved these changes
Jul 2, 2020
10 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation for this change
Currently, ZFS pools that do not contain the system root file system can only have encrypted datasets that use key files. They cannot use
keylocation=prompt. This PR fixes this by prompting for passphrases usingsystemd-ask-password.This PR also ensures Plymouth users can take advantage of this by enabling
systemd-ask-password-plymouth.service. I did have to steal one line from #84158, specificallymkdir /run/plymouth. This will have the added benefit of allowing other services to usesystemd-ask-passwordduring boot without breaking for plymouth users. Note that you need to setvirtualisation.useBootLoader = truein order to test plymouth withnixos-rebuild build-vm.Relevant: #84158, #88789
Things done
sandboxinnix.confon non-NixOS linux)nix-shell -p nixpkgs-review --run "nixpkgs-review wip"./result/bin/)nix path-info -Sbefore and after)