<div dir="ltr"><div>I apologize in advance for the formatting, this is my first time using a mailing list and I don't know how to format it well.</div><div><br></div><div>I can't get systemd-cryptsetup to accept the cryptsetup.pkcs11-pin credential. It doesn't seem to get used by systemd-cryptsetup, I still have to manually unlock it at boot time.</div><div><br></div><div>For testing, I've set a pin 4321, in /boot/efi/key.txt (this is the pin to unlock the pkcs11 device)</div><div><br></div><div>I'm using system-cryptsetup version 257.x that I built on another machine and copied over (with the libraries and updated ldconfig) I would update the entire systemd but I'm not sure how to do that (yet)</div><div><br></div><div>The base version of systemd on the system is 255.x.</div><div><br></div><div>Here is some output trying the cryptsetup.pkcs11-pin credential - when I do this... it still prompts for the pin. </div><div><br></div><div>davew@speed:~$ sudo systemctl status systemd-cryptsetup@os_crypt.service<br>● systemd-cryptsetup@os_crypt.service - Cryptography Setup for os_crypt<br> Loaded: loaded (/etc/crypttab; generated)<br> Drop-In: /etc/systemd/system/systemd-cryptsetup@os_crypt.service.d<br> └─override.conf<br> Active: active (exited) since Wed 2025-01-15 15:09:43 UTC; 17s ago<br> Docs: man:crypttab(5)<br> man:systemd-cryptsetup-generator(8)<br> man:systemd-cryptsetup@.service(8)<br> Process: 521 ExecStartPre=/bin/bash -c echo "cryptsetup.pkcs11-pin=$(cat ${CREDENTIALS_DIRECTORY}/cryptsetup.pkcs11-pin)" (code=exited, status=0/SUCCESS)<br> Process: 550 ExecStart=/usr/bin/systemd-cryptsetup attach os_crypt /dev/disk/by-uuid/c7dad40e-973a-4381-9bcb-6c4477429f95 none luks,pkcs11-uri=auto (code=exited><br> Main PID: 550 (code=exited, status=0/SUCCESS)<br> CPU: 193ms<br><br>Jan 15 15:09:37 speed systemd[1]: Starting systemd-cryptsetup@os_crypt.service - Cryptography Setup for os_crypt...<br>Jan 15 15:09:38 speed bash[521]: cryptsetup.pkcs11-pin=4321<br>Jan 15 15:09:43 speed systemd-cryptsetup[550]: Successfully logged into security token 'LUKS'.<br>Jan 15 15:09:43 speed systemd-cryptsetup[550]: Successfully decrypted key with security token.<br>Jan 15 15:09:43 speed systemd[1]: Finished systemd-cryptsetup@os_crypt.service - Cryptography Setup for os_crypt.<br><br></div><div>davew@speed:~$ /usr/bin/systemd-cryptsetup --version<br>systemd 257 (257.2)<br>-PAM -AUDIT +SELINUX -APPARMOR +IMA +IPE +SMACK -SECCOMP -GCRYPT -GNUTLS +OPENSSL -ACL +BLKID -CURL -ELFUTILS -FIDO2 -IDN2 -IDN -IPTC -KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS -LIBFDISK +PCRE2 -PWQUALITY -P11KIT -QRENCODE -TPM2 -BZIP2 -LZ4 -XZ +ZLIB -ZSTD -BPF_FRAMEWORK -BTF -XKBCOMMON +UTMP +SYSVINIT -LIBARCHIVE<br><br></div><div>davew@speed:~$ systemd --version<br>systemd 255 (255.4-1ubuntu8.4)<br>+PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified<br><br></div><div>davew@speed:~$ cat /etc/systemd/system/systemd-cryptsetup@os_crypt.service.d/override.conf<br>[Unit]<br>After=boot-efi.mount<br><br>[Service]<br>LoadCredential=cryptsetup.pkcs11-pin:/boot/efi/key.txt<br>ExecStartPre=/bin/bash -c 'echo "cryptsetup.pkcs11-pin=$(cat ${CREDENTIALS_DIRECTORY}/cryptsetup.pkcs11-pin)"'<br><br></div><div>davew@speed:~$ sudo cat /boot/efi/key.txt<br>4321<br><br></div><div>Below, I was able to get this to work by running it all manually in the override... but then I may as well get rid of the crypttab and just set up the service manually.</div><div><br></div><div>This is a contrived example, I will have a socket listening and responding to requests</div><div><br></div><div>davew@speed:~$ sudo cat /etc/systemd/system/systemd-cryptsetup@os_crypt.service.d/override.conf<br>[Unit]<br>After=boot-efi.mount<br><br>[Service]<br>LoadCredential=cryptsetup.pkcs11-pin:/boot/efi/key.txt<br>Environment=PINFILE=%d/cryptsetup.pkcs11-pin<br>ExecStartPre=/bin/bash -c 'echo "cryptsetup.pkcs11-pin=$(cat ${CREDENTIALS_DIRECTORY}/cryptsetup.pkcs11-pin)"'<br>ExecStartPre=/bin/bash -c 'echo "PINFILE HERE: $PINFILE"'<br>ExecStart=<br>ExecStart=/bin/bash -c "PIN=$(cat $PINFILE) /usr/bin/systemd-cryptsetup attach os_crypt /dev/disk/by-uuid/c7dad40e-973a-4381-9bcb-6c4477429f95 none luks,pkcs11-uri=auto"</div><div><br></div><div>Thanks,</div><div><br>David.</div><div><br></div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Wed, Jan 15, 2025 at 12:37 PM Andrei Borzenkov <<a href="mailto:arvidjaar@gmail.com">arvidjaar@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On Wed, Jan 15, 2025 at 2:31 PM David White <<a href="mailto:dr.white.nz@gmail.com" target="_blank">dr.white.nz@gmail.com</a>> wrote:<br> ><br> > Hi there,<br> ><br> > Just want some help with setting credentials for systemd-cryptsetup@.service services.<br> ><br> > I have a crypttab file with the following:<br> ><br> > (I set a label for this volume with a udev rule as I have to use a label)<br> ><br> <br> I am not sure I understand it. Label is a property of the filesystem;<br> how do you set it using "udev rule"?<br> <br> > os_crypt LABEL=os_luks none try-empty-password=1,luks,pkcs11-uri=auto,discard<br> ><br> > I read in the systemd-cryptsetup documentation that I should be able to pass credential "cryptsetup.pkcs11-pin"<br> ><br> > I couldn't figure out from the documentation how to do this.<br> ><br> > I assume I create a drop-in for systemd-cryptsetup@os_crypt.service<br> ><br> > and add the credential there:<br> ><br> > LoadCredential=cryptsetup.pkcs11-pin:/path/to/unix/socket<br> ><br> > Would that work?<br> <br> For this to work you need some process listening on the<br> /path/to/unix/socket and answering the request.<br> <br> > If not, how would I go about passing a pkcs11 pin to cryptsetup.<br> ><br> <br> You can simply drop your credentials into any standard directory like<br> /etc/credstore. systemd-cryptsetup@xxx.service already has<br> ImportCredentials=cryptsetup.*.<br> <br> The catch is that systemd-cryptsetup only tries the single generic<br> credential name. There is no provision for different pins (via<br> credentials) for different devices. As long as you only have one<br> token, it is OK. But now I wonder if it could be a reason for failing<br> to use different tokens to unlock different volumes concurrently.<br> </blockquote></div>