1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
|
'\" t
.TH "SYSTEMD\-CRYPTSETUP\-GENERATOR" "8" "" "systemd 255" "systemd-cryptsetup-generator"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
systemd-cryptsetup-generator \- Unit generator for /etc/crypttab
.SH "SYNOPSIS"
.PP
/usr/lib/systemd/system\-generators/systemd\-cryptsetup\-generator
.SH "DESCRIPTION"
.PP
systemd\-cryptsetup\-generator
is a generator that translates
/etc/crypttab
into native systemd units early at boot and when configuration of the system manager is reloaded\&. This will create
\fBsystemd-cryptsetup@.service\fR(8)
units as necessary\&.
.PP
systemd\-cryptsetup\-generator
implements
\fBsystemd.generator\fR(7)\&.
.SH "KERNEL COMMAND LINE"
.PP
systemd\-cryptsetup\-generator
understands the following kernel command line parameters:
.PP
\fIluks=\fR, \fIrd\&.luks=\fR
.RS 4
Takes a boolean argument\&. Defaults to
"yes"\&. If
"no", disables the generator entirely\&.
\fIrd\&.luks=\fR
is honored only in the initrd while
\fIluks=\fR
is honored by both the main system and in the initrd\&.
.sp
Added in version 186\&.
.RE
.PP
\fIluks\&.crypttab=\fR, \fIrd\&.luks\&.crypttab=\fR
.RS 4
Takes a boolean argument\&. Defaults to
"yes"\&. If
"no", causes the generator to ignore any devices configured in
/etc/crypttab
(\fIluks\&.uuid=\fR
will still work however)\&.
\fIrd\&.luks\&.crypttab=\fR
is honored only in initrd while
\fIluks\&.crypttab=\fR
is honored by both the main system and in the initrd\&.
.sp
Added in version 186\&.
.RE
.PP
\fIluks\&.uuid=\fR, \fIrd\&.luks\&.uuid=\fR
.RS 4
Takes a LUKS superblock UUID as argument\&. This will activate the specified device as part of the boot process as if it was listed in
/etc/crypttab\&. This option may be specified more than once in order to set up multiple devices\&.
\fIrd\&.luks\&.uuid=\fR
is honored only in the initrd, while
\fIluks\&.uuid=\fR
is honored by both the main system and in the initrd\&.
.sp
If
/etc/crypttab
contains entries with the same UUID, then the name, keyfile and options specified there will be used\&. Otherwise, the device will have the name
"luks\-UUID"\&.
.sp
If
/etc/crypttab
exists, only those UUIDs specified on the kernel command line will be activated in the initrd or the real root\&.
.sp
Added in version 186\&.
.RE
.PP
\fIluks\&.name=\fR, \fIrd\&.luks\&.name=\fR
.RS 4
Takes a LUKS super block UUID followed by an
"="
and a name\&. This implies
\fIrd\&.luks\&.uuid=\fR
or
\fIluks\&.uuid=\fR
and will additionally make the LUKS device given by the UUID appear under the provided name\&.
.sp
This parameter is the analogue of the first
\fBcrypttab\fR(5)
field
\fIvolume\-name\fR\&.
.sp
\fIrd\&.luks\&.name=\fR
is honored only in the initrd, while
\fIluks\&.name=\fR
is honored by both the main system and in the initrd\&.
.sp
Added in version 218\&.
.RE
.PP
\fIluks\&.data=\fR, \fIrd\&.luks\&.data=\fR
.RS 4
Takes a LUKS super block UUID followed by a
"="
and a block device specification for device hosting encrypted data\&.
.sp
For those entries specified with
\fIrd\&.luks\&.uuid=\fR
or
\fIluks\&.uuid=\fR, the data device will be set to the one specified by
\fIrd\&.luks\&.data=\fR
or
\fIluks\&.data=\fR
of the corresponding UUID\&.
.sp
LUKS data device parameter is useful for specifying encrypted data devices with detached headers specified in
\fIluks\&.options\fR
entry containing
"header="
argument\&. For example,
\fIrd\&.luks\&.uuid=\fRb40f1abf\-2a53\-400a\-889a\-2eccc27eaa40
\fIrd\&.luks\&.options=\fRb40f1abf\-2a53\-400a\-889a\-2eccc27eaa40=header=/path/to/luks\&.hdr
\fIrd\&.luks\&.data=\fRb40f1abf\-2a53\-400a\-889a\-2eccc27eaa40=/dev/sdx\&. Hence, in this case, we will attempt to unlock LUKS device assembled from data device
"/dev/sdx"
and LUKS header (metadata) put in
"/path/to/luks\&.hdr"
file\&. This syntax is for now only supported on a per\-device basis, i\&.e\&. you have to specify LUKS device UUID\&.
.sp
This parameter is the analogue of the second
\fBcrypttab\fR(5)
field
\fIencrypted\-device\fR\&.
.sp
\fIrd\&.luks\&.data=\fR
is honored only in the initrd, while
\fIluks\&.data=\fR
is honored by both the main system and in the initrd\&.
.sp
Added in version 247\&.
.RE
.PP
\fIluks\&.key=\fR, \fIrd\&.luks\&.key=\fR
.RS 4
Takes a password file name as argument or a LUKS super block UUID followed by a
"="
and a password file name\&.
.sp
For those entries specified with
\fIrd\&.luks\&.uuid=\fR
or
\fIluks\&.uuid=\fR, the password file will be set to the one specified by
\fIrd\&.luks\&.key=\fR
or
\fIluks\&.key=\fR
of the corresponding UUID, or the password file that was specified without a UUID\&.
.sp
It is also possible to specify an external device which should be mounted before we attempt to unlock the LUKS device\&. systemd\-cryptsetup will use password file stored on that device\&. Device containing password file is specified by appending colon and a device identifier to the password file path\&. For example,
\fIrd\&.luks\&.uuid=\fRb40f1abf\-2a53\-400a\-889a\-2eccc27eaa40
\fIrd\&.luks\&.key=\fRb40f1abf\-2a53\-400a\-889a\-2eccc27eaa40=/keyfile:LABEL=keydev\&. Hence, in this case, we will attempt to mount file system residing on the block device with label
"keydev"\&. This syntax is for now only supported on a per\-device basis, i\&.e\&. you have to specify LUKS device UUID\&.
.sp
This parameter is the analogue of the third
\fBcrypttab\fR(5)
field
\fIkey\-file\fR\&.
.sp
\fIrd\&.luks\&.key=\fR
is honored only in the initrd, while
\fIluks\&.key=\fR
is honored by both the main system and in the initrd\&.
.sp
Added in version 202\&.
.RE
.PP
\fIluks\&.options=\fR, \fIrd\&.luks\&.options=\fR
.RS 4
Takes a LUKS super block UUID followed by an
"="
and a string of options separated by commas as argument\&. This will override the options for the given UUID\&.
.sp
If only a list of options, without a UUID, is specified, they apply to any UUIDs not specified elsewhere, and without an entry in
/etc/crypttab\&.
.sp
This parameter is the analogue of the fourth
\fBcrypttab\fR(5)
field
\fIoptions\fR\&.
.sp
It is possible to specify an external device which should be mounted before we attempt to unlock the LUKS device\&. systemd\-cryptsetup will assemble LUKS device by combining data device specified in
\fIluks\&.data\fR
with detached LUKS header found in
"header="
argument\&. For example,
\fIrd\&.luks\&.uuid=\fRb40f1abf\-2a53\-400a\-889a\-2eccc27eaa40
\fIrd\&.luks\&.options=\fRb40f1abf\-2a53\-400a\-889a\-2eccc27eaa40=header=/luks\&.hdr:LABEL=hdrdev
\fIrd\&.luks\&.data=\fRb40f1abf\-2a53\-400a\-889a\-2eccc27eaa40=/dev/sdx\&. Hence, in this case, we will attempt to mount file system residing on the block device with label
"hdrdev", and look for
"luks\&.hdr"
on that file system\&. Said header will be used to unlock (decrypt) encrypted data stored on /dev/sdx\&. This syntax is for now only supported on a per\-device basis, i\&.e\&. you have to specify LUKS device UUID\&.
.sp
\fIrd\&.luks\&.options=\fR
is honored only by initial RAM disk (initrd) while
\fIluks\&.options=\fR
is honored by both the main system and in the initrd\&.
.sp
Added in version 208\&.
.RE
.SH "SEE ALSO"
.PP
\fBsystemd\fR(1),
\fBcrypttab\fR(5),
\fBsystemd-cryptsetup@.service\fR(8),
\fBsystemd-cryptenroll\fR(1),
\fBcryptsetup\fR(8),
\fBsystemd-fstab-generator\fR(8)
|
