mount support for encrypted rootfs #52

Activity

1. KarlK90

   added

   enhancementNew feature or requestNew feature or request

   on Oct 13, 2026
2. hnez commented on Oct 13, 2026

   

   hnez

   on Oct 13, 2026

   Member

   More actions

   I work a lot on x86 systems with UEFI Secure Boot and TPM2 devices.
   For me it would be super useful if rsinit could interpret LUKS headers and the special entries that systemd-cryptenroll generates when enrolling a TPM2 device.

   The LUKS header is a small fixed header followed by a JSON object. This should be super easy to parse in rsinit, since we can just include one of the man available JSON crates.

   Here is an example dump of a LUKS header with systemd-cryptenroll TPM2 material:

   >>> import json
   >>> from pprint import pprint
   >>> import struct
   >>>
   >>> with open("/dev/mapper/loop0p3", "rb") as fd:
   ...     superblock = fd.read(4096)
   ...     header = dict(zip(('magic', 'version', 'hdr_size'), struct.unpack("!6sHQ", superblock[:16])))
   ...     luks_json = fd.read(header["hdr_size"] - 4096)
   >>> pprint(header)
   {'hdr_size': 16384, 'magic': b'LUKS\xba\xbe', 'version': 2}
   >>> luks_json = luks_json[:luks_json.find(0)]
   >>> luks_json = json.loads(luks_json)
   >>> pprint(luks_json)
   {'config': {'json_size': '12288', 'keyslots_size': '16744448'},
    'digests': {'0': {'digest': 'nmIgx7Cdl6j9Xwzi5kzlW433N8/lbSsmTtwOVb+b8DE=',
                      'hash': 'sha256',
                      'iterations': 48761,
                      'keyslots': ['0', '1'],
                      'salt': 'hFEA2eZy24Nu5BR6KY7Oj0W0GVi7qVcIFso5D+VoJFo=',
                      'segments': ['0'],
                      'type': 'pbkdf2'}},
    'keyslots': {'0': {'af': {'hash': 'sha256', 'stripes': 4000, 'type': 'luks1'},
                       'area': {'encryption': 'aes-xts-plain64',
                                'key_size': 64,
                                'offset': '32768',
                                'size': '258048',
                                'type': 'raw'},
                       'kdf': {'cpus': 1,
                               'memory': 440142,
                               'salt': 'hMPN8BBNlxjg0VozkjwSsMQMizkx86oteYAF/ytuBWA=',
                               'time': 4,
                               'type': 'argon2id'},
                       'key_size': 64,
                       'type': 'luks2'},
                 '1': {'af': {'hash': 'sha512', 'stripes': 4000, 'type': 'luks1'},
                       'area': {'encryption': 'aes-xts-plain64',
                                'key_size': 64,
                                'offset': '290816',
                                'size': '258048',
                                'type': 'raw'},
                       'kdf': {'hash': 'sha512',
                               'iterations': 1000,
                               'salt': '4mtRRP8DRU2p7TrI7oHrTgO5pXoJn0mHZVBJMe4Wk3Y=',
                               'type': 'pbkdf2'},
                       'key_size': 64,
                       'type': 'luks2'}},
    'segments': {'0': {'encryption': 'aes-xts-plain64',
                       'iv_tweak': '0',
                       'offset': '16777216',
                       'sector_size': 512,
                       'size': 'dynamic',
                       'type': 'crypt'}},
    'tokens': {'0': {'keyslots': ['1'],
                     'tpm2-blob': 'AJ4AIFObHh1ZCR3ZbQ1bVjbqbHVzWE95lfP719l01uiX53obABBJu5Q7lYyTR43Imf9t2/X9GYzhsk5+2UlqQ1ciauyu60Qv0mzcsz2hFs+MlABglDzWCcZcxJD/QwZOdb1QAoht7AmvxYdXF1EAfCc0FP52iG1N/DtEzAsCKHbeHO3HJo93XErnnVufVO4fFEAWo8+/vSQK1F2h4lk9HABOAAgACwAABBIAILrEE1TpzPYdJXRjmSOx//oNyStOQNt5iEQdH1QasG6BABAAIOTG1VTXcMG+Ooi3xUgiMpUE7IRT7l/99VsZCUS39yDv',
                     'tpm2-pcr-bank': 'sha256',
                     'tpm2-pcrs': [7, 13],
                     'tpm2-policy-hash': 'bac41354e9ccf61d2574639923b1fffa0dc92b4e40db7988441d1f541ab06e81',
                     'tpm2_srk': 'gQAAAQAiAAuS7vs2IhGmMLJ80QgP3rFM/VWyUbvWs7/Ce3/l0N7UkAAAAAEAWgAjAAsAAwRyAAAABgCAAEMAEAADABAAILxKFWteXOMFDwEfcxu8r2cKol2HMiRW3lS9/CHcwrpIACBB4ymFO6CrTy6jp4UbodvZ+bY1Jg5q6QpmXPV4Ck/juA==',
                     'type': 'systemd-tpm2'}}}
   >>>
   

   👍React with 👍1Reacted by Stefan Kerkmann
3. KarlK90

   assigned

   michaelolbrich

   on Oct 13, 2026
4. KarlK90

   added the

   Feature

   issue type on Oct 13, 2026
5. KarlK90

   changed the title [-]feature: mount support for encrypted rootfs[/-] [+]mount support for encrypted rootfs[/+] on Oct 13, 2026
6. KarlK90

   removed

   enhancementNew feature or requestNew feature or request

   on Oct 13, 2026