summaryrefslogtreecommitdiffstats
path: root/man/systemd-cryptsetup.xml
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-10 20:49:52 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-10 20:49:52 +0000
commit55944e5e40b1be2afc4855d8d2baf4b73d1876b5 (patch)
tree33f869f55a1b149e9b7c2b7e201867ca5dd52992 /man/systemd-cryptsetup.xml
parentInitial commit. (diff)
downloadsystemd-55944e5e40b1be2afc4855d8d2baf4b73d1876b5.tar.xz
systemd-55944e5e40b1be2afc4855d8d2baf4b73d1876b5.zip
Adding upstream version 255.4.upstream/255.4
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'man/systemd-cryptsetup.xml')
-rw-r--r--man/systemd-cryptsetup.xml119
1 files changed, 119 insertions, 0 deletions
diff --git a/man/systemd-cryptsetup.xml b/man/systemd-cryptsetup.xml
new file mode 100644
index 0000000..1d3a313
--- /dev/null
+++ b/man/systemd-cryptsetup.xml
@@ -0,0 +1,119 @@
+<?xml version="1.0"?>
+<!--*-nxml-*-->
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
+ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
+<!-- SPDX-License-Identifier: LGPL-2.1-or-later -->
+<refentry id="systemd-cryptsetup" conditional='HAVE_LIBCRYPTSETUP'>
+
+ <refentryinfo>
+ <title>systemd-cryptsetup</title>
+ <productname>systemd</productname>
+ </refentryinfo>
+
+ <refmeta>
+ <refentrytitle>systemd-cryptsetup</refentrytitle>
+ <manvolnum>8</manvolnum>
+ </refmeta>
+
+ <refnamediv>
+ <refname>systemd-cryptsetup</refname>
+ <refname>systemd-cryptsetup@.service</refname>
+ <!-- <refname>system-systemd\x2dcryptsetup.slice</refname> — this causes meson to go haywire because it
+ thinks this is a (windows) path. Let's just not create the alias for this name, and only include it
+ in the synopsis. -->
+ <refpurpose>Full disk decryption logic</refpurpose>
+ </refnamediv>
+
+ <refsynopsisdiv>
+ <cmdsynopsis>
+ <command>systemd-cryptsetup</command>
+ <arg choice="opt" rep="repeat">OPTIONS</arg>
+ <arg choice="plain">attach</arg>
+ <arg choice="plain">VOLUME</arg>
+ <arg choice="plain">SOURCE-DEVICE</arg>
+ <arg choice="opt">KEY-FILE</arg>
+ <arg choice="opt">CONFIG</arg>
+ </cmdsynopsis>
+
+ <cmdsynopsis>
+ <command>systemd-cryptsetup</command>
+ <arg choice="opt" rep="repeat">OPTIONS</arg>
+ <arg choice="plain">detach</arg>
+ <arg choice="plain">VOLUME</arg>
+ </cmdsynopsis>
+
+ <para><filename>systemd-cryptsetup@.service</filename></para>
+ <para><filename>system-systemd\x2dcryptsetup.slice</filename></para>
+ </refsynopsisdiv>
+
+ <refsect1>
+ <title>Description</title>
+
+ <para><filename>systemd-cryptsetup</filename> is used to set up (with <command>attach</command>) and tear
+ down (with <command>detach</command>) access to an encrypted block device. It is primarily used via
+ <filename>systemd-cryptsetup@.service</filename> during early boot, but may also be be called manually.
+ The positional arguments <parameter>VOLUME</parameter>, <parameter>SOURCEDEVICE</parameter>,
+ <parameter>KEY-FILE</parameter>, and <parameter>CRYPTTAB-OPTIONS</parameter> have the same meaning as the
+ fields in <citerefentry><refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum></citerefentry>.
+ </para>
+
+ <para><filename>systemd-cryptsetup@.service</filename> is a service responsible for providing access to
+ encrypted block devices. It is instantiated for each device that requires decryption.</para>
+
+ <para><filename>systemd-cryptsetup@.service</filename> instances are part of the
+ <filename>system-systemd\x2dcryptsetup.slice</filename> slice, which is destroyed only very late in the
+ shutdown procedure. This allows the encrypted devices to remain up until filesystems have been unmounted.
+ </para>
+
+ <para><filename>systemd-cryptsetup@.service</filename> will ask
+ for hard disk passwords via the <ulink
+ url="https://systemd.io/PASSWORD_AGENTS/">password agent logic</ulink>, in
+ order to query the user for the password using the right mechanism at boot
+ and during runtime.</para>
+
+ <para>At early boot and when the system manager configuration is reloaded, <filename>/etc/crypttab</filename> is
+ translated into <filename>systemd-cryptsetup@.service</filename> units by
+ <citerefentry><refentrytitle>systemd-cryptsetup-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>.</para>
+
+ <para>In order to unlock a volume a password or binary key is required.
+ <filename>systemd-cryptsetup@.service</filename> tries to acquire a suitable password or binary key via
+ the following mechanisms, tried in order:</para>
+
+ <orderedlist>
+ <listitem><para>If a key file is explicitly configured (via the third column in
+ <filename>/etc/crypttab</filename>), a key read from it is used. If a PKCS#11 token, FIDO2 token or
+ TPM2 device is configured (using the <varname>pkcs11-uri=</varname>, <varname>fido2-device=</varname>,
+ <varname>tpm2-device=</varname> options) the key is decrypted before use.</para></listitem>
+
+ <listitem><para>If no key file is configured explicitly this way, a key file is automatically loaded
+ from <filename>/etc/cryptsetup-keys.d/<replaceable>volume</replaceable>.key</filename> and
+ <filename>/run/cryptsetup-keys.d/<replaceable>volume</replaceable>.key</filename>, if present. Here
+ too, if a PKCS#11/FIDO2/TPM2 token/device is configured, any key found this way is decrypted before
+ use.</para></listitem>
+
+ <listitem><para>If the <varname>try-empty-password</varname> option is specified then unlocking the
+ volume with an empty password is attempted.</para></listitem>
+
+ <listitem><para>The kernel keyring is then checked for a suitable cached password from previous
+ attempts.</para></listitem>
+
+ <listitem><para>Finally, the user is queried for a password, possibly multiple times, unless
+ the <varname>headless</varname> option is set.</para></listitem>
+ </orderedlist>
+
+ <para>If no suitable key may be acquired via any of the mechanisms describes above, volume activation fails.</para>
+ </refsect1>
+
+ <refsect1>
+ <title>See Also</title>
+ <para>
+ <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>systemd-cryptsetup-generator</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>crypttab</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
+ <citerefentry><refentrytitle>systemd-cryptenroll</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+ <citerefentry project='die-net'><refentrytitle>cryptsetup</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
+ <ulink url="https://systemd.io/TPM2_PCR_MEASUREMENTS">TPM2 PCR Measurements Made by systemd</ulink>
+ </para>
+ </refsect1>
+
+</refentry>