4

I'm aware of being able to use the cryptsetup isLuks command to find out whether a partition is a LUKS container. I want to be able to use this command with the mountpoint of the LUKS container for the case that I cannot be sure that I know the partition's device name, how can I do this in one command?

For example, I have a Luks container at /dev/sda2, I open it with

$ cryptsetup luksOpen /dev/sda2 vault

Then I mount the container with

$ mount /dev/mapper/vault /mountpoint

At this point I would like to know whether /mountpoint is a Luks container

$ cryptsetup isLuks -v /dev/sda2
Command successful.
$ cryptsetup isLuks -v /mountpoint
Command failed with code 15: Block device required
$ cryptsetup isLuks -v /dev/mapper/vault
Command failed with code 22: Device /dev/mapper/vault is not a valid LUKS device.

Normally I'd use lsblk to get the block device of a mountpoint, but this returns the /dev/mapper/vault path.

└─sda2   8:8    0   9.3G  0 part
  └─vault 252:0    0   9.3G  0 crypt /mountpoint

If I could resolve /dev/mapper/vault to /dev/sda2 somehow, I would be able to use command substitution inside the cryptsetup isLuks command.

It would be great to find something more elegant than using awk or something to parse the output of mount, but if that's the only way then it works I suppose.

4 Answers 4

3

I had the same problem to. Solved like this.

lsblk -sJp | jq -r --arg dsk "/dev/mapper/disk_name" '.blockdevices | .[] | select(.name == $dsk) | .children | .[0] | .name'

Return e.g. /dev/sda2

2

This should work. It's a little long, but making a bash function would simplify it:

cryptsetup isLuks -v `df /mountpoint | tail -n1 | awk '{print $1;}'`
7
  • Unfortunately that gives me the /dev/mapper/vault path from df so I get the Command failed with code 22: Device /dev/mapper/vault is not a valid LUKS device. error. (I'm not the downvoter)
    – Arronical
    May 28, 2019 at 15:26
  • “Adding a check (…) is left as an exercise for the reader.” sounds really condescending and unproductive to me. Please add either an example how one could do that or at least a link to a question covering the topic. The same goes for making a bash function – if you deem it useful in this particular case you should show how it’s done.
    – dessert
    May 28, 2019 at 16:26
  • 1
    @dessert or I just remove that part.
    – RonJohn
    May 28, 2019 at 16:46
  • @Arronical since /dev/mapper is used, does that mean that LVM is involved?
    – RonJohn
    May 28, 2019 at 16:48
  • 1
    awk 'END{print $1}' saves you the tail call.
    – dessert
    May 28, 2019 at 18:16
1

someone mentioned using lsblk

This is a relatively easy way but only if you do

alias lsblk2='lsblk -o type,name,label,partlabel,size,fstype,model,serial,wwn,uuid'

Then the output from lsblk will have much extra useful information, and the FSTYPE will show crypto_LUKS and then show the resulting partitions underneath. And you'll also have the disk model and serial number to reference which I find useful making heads and tails of things.

man lsblk and add any options after the -o that you may find make it more useful for yourself.

I think this way... getting a simple visible tree list of all disks that linux currently sees... is the most straight forward way with least typing to know which disks/partitions are luks encrypted, will show up as crypto_LUKS at least that's what I see using RHEL 7.9.

0

This worked for me:

for part in $(lsblk -o NAME -ln | grep -E '^[^loop]'); do
    if cryptsetup isLuks /dev/$part 2> /dev/null; then
        lsblk /dev/$part -ln -o MOUNTPOINT
    fi
done

The lsblk command had only the NAME option, so we will only get the name of the partitions in the system. The -ln also quit the title and the tree form, so is a pure list. The grep command is optional, it will skip checking the loop partitions created by snap. Then another lsblk to the partition detected as LUKS.

It's tricky, but LUKS and cryptsetup works with partitions, not mountpoints. If you are going to use it inside a script, you can create it as a function for better practice.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .