Setting correct size for "cryptsetup: WARNING: Option 'size' missing in crypttab for plain dm-crypt mapping root" message

Question

I have a full disk encryption using ecryptfs, after upgrading to 18.10 a warning message started to appearing at boot:

cryptsetup: WARNING: Option 'size' missing in crypttab for plain dm-crypt mapping root. Please read /usr/share/doc/cryptsetup/README.initramfs and add the correct 'size' option to your crypttab(5).

From what I see at /usr/share/doc/cryptsetup-initramfs/README.initramfs.gz I should edit /etc/cryptsetup and set the correct size, but how should this size be calculated for my system?

This is the content of /etc/crypttab:

 cryptswap1 UUID=1d1XXXXXXXXXXXX /dev/urandom swap,offset=1024,cipher=aes-xts-plain64

Answer 1

Add the size like size=256 to /etc/crypttab configuration:

cryptswap1 UUID=1d1XXXXXXXXXXXX /dev/urandom swap,offset=1024,cipher=aes-xts-plain64,size=256

Answer 2

Editing the 'crypttab' file was not enough in my case (upgraded to Ubuntu 20.04).

After editing the file, I had to disable (temporary) the swap file and re-generate the initramfs image:

sudo swapoff -a
sudo update-initramfs -c -k all
sudo swapon -a

Unfortunately, that step should be repeated after every kernel update.

Answer 3

(In order to come up with a complete answer to this question, I'm posting this one, as an extension to marcanuy's own answer.)

Note: The warning considered (above) stems from the Debian Cryptsetup Initramfs integration.

1. Find the size of the encryption key in question. Therefor, let's ask cryptsetup itself (for me, the problem has shown up regarding the encrypted swap partition on /dev/sda5):

   $ sudo cryptsetup status cryptswap1  
   /dev/mapper/cryptswap1 is active and is in use.  
   type: PLAIN  
   cipher: aes-xts-plain64  
   keysize: 256 bits
   key location: dm-crypt
   device: /dev/sda5  
   [...]  
   

2. Read keysize (and type).

3. If type: PLAIN, add the size (taken from above) to the corresponding entry in /etc/crypttab (as sudo):

   cryptroot /dev/sda5 none cipher=aes-xts-plain64,size=256,hash=sha1
   

   For a swap partition, the entry might look slightly different (eg., using /dev/urandom as (random) key file)

4. Re-generate initramfs (does not have to be re-done by you on kernel update):

   $ sudo update-initramfs -u
   

   This might throw a warning, which can be ignored to my best knowledge. The warning regarding missing size option missing while booting, however, should have disappeared.

5. Finally, reboot to verify everything works as expected and the warning has gone.

Remark: For type: LUKS, /etc/crypttab should actually rather look as follows, as most of the information can be read from the mandatory LUKS header:

cryptroot /dev/sdaX none luks,discard

Answer 4

If you only have encrypted swap partitions, the correct way to prevent initramfs from using them for resume is to add:

RESUME=none into /etc/initramfs-tools/conf.d/resume

For example:

echo "RESUME=none" | sudo tee /etc/initramfs-tools/conf.d/resume