sdm-add-luks-key ends with error

[ans-0]

Hey,
A big thank you to gitbls for creating sdm -- especially, for the disk encryption.
The encryption of a used image worked smoothly (*).
Unfortunately, I have some troubles setting it up to accept a keyfile.
After calling sudo sdm-add-luks-key /mnt/big-long-uuid.lek, the following shows up

> Configure initramfs
update-initramfs: Generating /boot/initrd.img-6.6.47+rpt-rpi-v8
E: /etc/initramfs-tools/hooks/luks-hooks failed with return 1.
update-initramfs: failed for /boot/initrd.img-6.6.47+rpt-rpi-v8 with 1.

The same happens when update-initramfs -u is called alone (or the system is updated).

Many thanks for any help in advance! Please let me know which other information are needed.

*) Just the first time, I was to quick with manually rebooting after the sdmcryptfs script started the raspbian console. Maybe a request for patience in the description could be nice.

[gitbls]

Sorry you're having an issue. To ensure that I understand correctly, you are passing a key which is on a disk mounted at mountpoint '/mnt'?

If that's the case, that won't work because sdm-add-luks-key uses the '/mnt' mountpoint when mounting the USB disk. Please retry it with the .lek file somewhere other than under /mnt.

Clearly sdm-add-luks-key should disallow this, and if this is indeed the issue you're having, I'll update it after the root cause is confirmed.

[ans-0]

Thank you so much for your support!
Yes, I passed the key which was generated with sdm-make-luks-usb-key to a USB storage with
sudo sdm-make-luks-usb-key /dev/sda --init

If that's the case, that won't work because sdm-add-luks-key uses the '/mnt' mountpoint when mounting the USB disk. Please retry it with the .lek file somewhere other than under /mnt.

It is the first time that I use a key-file to decrypt a linux system.
So, please excuse -- seems like I misunderstood the instructions. They said that

Add the USB keyfile on the host with the encrypted rootfs (on the system running with an encrypted rootfs):

sudo mount /dev/sdX /mnt
sudo /usr/local/sdm/sdm-add-luks-key /mnt/big-long-uuid.lek
sudo umount /mnt

In my very first attempt, I just replaced sdX by sda1 (where the key was created), the keyfile name and the first sdm in the second line by bin (assuming it was a typo).
Now, I tried a couple of other things following your comment, like copying the key file to the home folder and calling
sudo /usr/local/bin/sdm-add-luks-key ~/big-long-uuid.lek

The error is still the same (with sda1 mounted to /mnt or not).

Let me add two points although they might be obvious / not relevant:

1. sudo sdm-add-luks-key had no problems to copy the keyfile to /root/ . Just the initramfs update fails.
2. I downloaded the sdm-add-luks-key and sdm-make-luks-usb-key scripts after rootfs was encrypted.

Which other information are needed / can be helpful to solve the problem?

[gitbls]

I will need to set up an encrypted system to try to see what's going on. If you are going to timeout and rebuild your disk, please let me know before I invest any time in this.

[ans-0]

I will need to set up an encrypted system to try to see what's going on.

Thank you for the extra efforts.

If you are going to timeout

No, not at all. I am not in a hurry.
However, if you would prefer that I am rebuilding the system, I can do so (although not in the near future) -- especially if you think that this could "solve" the problem.

By the way, i called sudo update-initramfs -u -v but cannot find any more detailed info about the error in the verbose. Here are the last lines:

Calling hook cryptroot-unlock
Adding script /usr/share/cryptsetup/initramfs/bin/cryptroot-unlock
Calling hook luks-hooks
Adding binary /usr/bin/bash
E: /etc/initramfs-tools/hooks/luks-hooks failed with return 1.
Removing /boot/initrd.img-6.6.47+rpt-rpi-v8.dpkg-bak
update-initramfs: failed for /boot/initrd.img-6.6.47+rpt-rpi-v8 with 1.

I am not sure if that helps. Let me know if the full verbose would do so.

[gitbls]

I've got a system ready to work on but ran out of time today. Will have more info in the next day or two.

[gitbls]

Good news. I can repro it. Still chasing root cause. 🤔

[gitbls]

Found root cause, and fixed. Planning to check in later today and will update this Discussion with details.

[gitbls]

sdm V12.10 is available that corrects this issue. To correct your system so that update-initramfs works correctly, please do:

• sudoedit etc/initramfs-tools/hooks/luks-hooks
• Change the line

copy_file text /usr/bin/sdmluksunlock

to

copy_file text /usr/bin/sdmluksunlock || true

Save the file, then rerun update-initramfs -u

Please let me know how it goes. Thanks for finding and reporting this, and apologies for the hassle.

[ans-0]

Great, it works like a charm. The initframs update finishes smoothly and now the keyfile is used for decryption while booting.
Thank you very much for taking care of the problem so quickly.

[gitbls]

By the way, I said:

If that's the case, that won't work because sdm-add-luks-key uses the '/mnt' mountpoint when mounting the USB disk. Please retry it with > the .lek file somewhere other than under /mnt.
I was reading the code too quickly, and this is most definitely incorrect. Sorry for the misinformation...read the code way too quickly!

[ans-0]

I was reading the code too quickly, and this is most definitely incorrect. Sorry for the misinformation...read the code way too quickly!

No problem at all. I appreciate very much that you immediately took care of the problem.

In case it helps to reduce confusion, let me mention that I found another typo in the documentation Disk-Encryption.md (besides the one mentioned before, in line 300) :
In line 71, there is one sdm- too much in sdm-sdm-add-luks-key .

However, I would like to stress that the documentation is well written. Thank you!

[gitbls]

Thx for pointing this out. Apparently my fingers had a mind of their own! 🤣