LUKS root + UEFI - Dracut fails to include cryptsetup

[markkazakov]

Hi,

I'm trying to set up Gentoo with:
- LUKS encrypted root partition
- UEFI boot
- OpenRC (not systemd)
- Distribution kernel (sys-kernel/gentoo-kernel)

Current setup:
- /dev/nvme0n1p1 : EFI partition (mounted at /boot/efi)
- /dev/nvme0n1p2 : swap
- /dev/nvme0n1p3 : LUKS encrypted root

My dracut configuration (/etc/dracut.conf.d/):

[pingtoo]

Wecome to Gentoo,

[markkazakov]

Hi Ppingtoo,

Thanks for answering, Gentoo seems amazing, so far really impressed by the quality of the documentation!

I got lost while trying many things, so I will start from a bootable drive with gui to have a real browser.

Then attempt to reinstall with grub and all the good stuff.

I know that the current install is crooked.

[pingtoo]

I ask the question just want to know if that is your intention or simply oversight. Nowadays with UEFI and efi-stub there are more than one way to load initrd. So I just want to make sure I understand the condition correctly.

Indeed using a boot loader (GRUB) could simplify the configuration of boot much easier.

So either way should you encounter any difficulty please don't hesitate to put in more information about booting questions. I am interesting in solve boot sequence problem.

[Hu]

Reinstalling the entire system is very rarely necessary, though in some cases that can be faster than fixing what is broken.

Since you managed to boot the kernel and it has the dracut-generated initramfs (albeit not a usable initramfs), I think that:

• There is no need to reinstall the system.
• There is no need to change bootloaders.
• Using live media to re-enter the existing system, and from there fixing how the initramfs is generated, is likely sufficient.

As to how to fix the initramfs, I cannot help with that, at least yet. Hopefully, someone more familiar with dracut will join in.

If your bootloader were misconfigured, we would either not see Linux boot at all (and thus no initramfs could have run) or we would see the kernel come up without an initramfs, and would never reach the stage where dracut prints an error, since dracut is in the initramfs. Therefore, I think the bootloader is fine as-is.

[markkazakov]

Hu,

Thanks for the advice. Yes indeed it is a long process reinstalling, I will listen to your advice. And attempt to fix it from chroot.

Once I have a new bootable stick I'll upgrade with more details on what works and what doesn't.

[pietinger]

markkazakov,

I suggest the same:

[zen_desu]

pietinger shared several good articles, these may also help:
https://wiki.gentoo.org/wiki/Rootfs_encryption#Initramfs_configuration
https://wiki.gentoo.org/wiki/Full_Disk_Encryption_From_Scratch#Initramfs_configuration

the "rootfs encryption" page is about the same as the FDE one, just generally simpler.

The main thing to consider if using dracut is that your cmdline must be set perfectly for dracut to work. this can be done a variety of ways, including building the cmdline args into dracut, building them into a uki, or adding them to bootloader configuration for that boot entry.
_________________
µgRD dev
Wiki writer

[markkazakov]

So,

After a while of tinkering I still didn't manage to boot.

I have decided to go for a grub install.

I use luks2:

[NeddySeagoon]

markkazakov,

[keet]

I boot using a similar setup. This is my (entire dracut, sans comments) configuration:

/etc/dracut.conf

[pingtoo]

markkazakov,

Can you confirm initrd actually started? from your dmesg I am not able to tell if that portion executed or not. In theory if it executed you should get dracut rescue shell prompt not kernel panic unless you just simply exit the dracut rescue shell without doing anything.

[markkazakov]

keet,

Thank you so much for providing your dracut configs. It actually did the trick to allow mounting the rootfs.

pingtoo,
Yes initrd has started, after a long boot time, I was able to get a shell access to my system so everything works properly!

[pingtoo]

[markkazakov]

Yes we can close the thread.
Thank you so much to everyone who has helped me.