1

I have two luks-encrypted partitions on my disk alongside with the efisys partition. First encrypted partition contains /boot only and the second one contains lvm storage for /root and swap. Grub is installed on efisys and it asks for password to decrypt /boot. After some time (grub's cryptsetup works really slow) it successfully decrypts /boot, finds kernel and initramfs disk there and handovers to them. Initramfs disk contains keyfile for lvm partition decryption, so no password needed to complete boot process. Since I have sddm autologin, I am prompted for password only once and while /boot is not mounted in the real filesystem, crypto keyfile is not reachable even by root without typing the password.

What annoys me is that I have to type passwords into kwallet and gnome-keyring to unlock them. I'd love to load the password for them from somewhere in initramfs disk during the boot and store it in the kernel's keyring via keyctl. The problem is that I am not able to do that. I can see the key from the userspace but I receive permission denied error when trying to get the payload. I've found an interesting article about the permissions of the keys, but that didn't help: I get keyctl_perm: Permission denied if I try to change permissions on the key and keyctl_link: Permission denied if I try to link the key from @s to @u in the initramfs script.

I could use a temporary file somewhere in /run with the permissions set to 700, but the question is just a plain curiosity for what I do wrong.

Here is the script I was trying to use:

/etc/initramfs-tools/scripts/local-premount/pass-the-key

key="$(cat /secret-key | /bin/keyctl padd user secret-key @s)"
/bin/keyctl setperm "${key}" 0x3f3f0000
/bin/keyctl link "${key}" @u
/bin/keyctl unlink "${key}" @s
/bin/keyctl timeout ${key} 120

0

You must log in to answer this question.

Browse other questions tagged .