Manual root and boot encrypted LUKS non-lvm partition on EFI unable to boot

[Ruslan Gainutdinov]

Hello!

I followed cryptsetup manual to setup LUKS encrypted root partition
https://cryptsetup-team.pages.debian.net/cryptsetup/encrypted-boot.html

- EFI bios
- EFI partition 700Mb
- LUKS encrypted partition containing both / and /boot
- LUKS mapped device directly contains ext4 partition without LVM

To do this I added a second disk, added EFI and root partions on it and copied all files preserving
attributes and permissions.

I modified files in etc and after chroot I executed:
> update-grub
> grub-install /dev/sdb

After rebooting and disabling first disk (/dev/sda) I was immediately brought into grub shell
I can notice what there is an error message flashes before booting
"No such device: c740ceea-853c-487c-82ef-3d2138f9a7d7"

I can also "source" (hd1,gpt1)/efi/ubuntu/grub.cfg and it will produce the same error.
Also cryptodisk.mod module is not loaded.

I can also add insmod ... lines into the (hd1,gpt1)/efi/ubuntu/grub.cfg
but it does not help find partioon using following line:
search.fs_uuid 85030321-f93d-47dc-aa4c-70bf751ad3f7 root cryptouuid/c740ceea853c487c82ef3d2138f9a7d7

If I try to type ls (hd1<TAB>
it will show me following information:

grub> ls (hd1)
Possible partitions are:
Device hd1: No known filesystem detected - Sector size 512B - Total size 10485760KiB
Partition hd1,gpt1: Filesystem type fat, UUID C3AC-7168 - Partition start at 1024KiB - Total size 716800KiB
Partition hd1,gpt2: No known filesystem detected - Partition start at 717824KiB - Total size 9767919.5KiB

Relevant files:

Mounting script I used to mount everything before chroot:
cryptsetup open /dev/sdb2 root
mount /dev/mapper/root root
mount /dev/sdb1 root/boot/efi
mount --bind /dev root/dev
mount --bind /sys root/sys
mount --bind /proc root/proc

/etc/crypttab
root UUID=c740ceea-853c-487c-82ef-3d2138f9a7d7 none luks,discard

/etc/default/grub
GRUB_DISABLE_OS_PROBER=true
GRUB_ENABLE_CRYPTODISK=y

/boot/efi/EFI/ubuntu/grub.cfg
search.fs_uuid 85030321-f93d-47dc-aa4c-70bf751ad3f7 root cryptouuid/c740ceea853c487c82ef3d2138f9a7d7
set prefix=($root)'/boot/grub'
configfile $prefix/grub.cfg

> blkid
/dev/sdb1: UUID="C3AC-7168" TYPE="vfat" PARTUUID="d50cd38a-ada3-f44a-bd39-0ea2f8355158"
/dev/sdb2: UUID="c740ceea-853c-487c-82ef-3d2138f9a7d7" TYPE="crypto_LUKS" PARTUUID="e527fa37-f546-6041-b376-40d2463d0812"
/dev/mapper/root: UUID="85030321-f93d-47dc-aa4c-70bf751ad3f7" TYPE="ext2"

Relevant versions:

Ubuntu 18.04.3 LTS
cryptsetup 2:2.0.2-1ubuntu1.1
grub2-common 2.02-2ubuntu8.13

Cleanup script:
umount root/dev
umount root/sys
umount root/proc
umount root/boot/efi
umount root
sync

Added GRUB_PRELOAD_MODULES:
crypto gcry_rijndael gcry_sha256 pbkdf2 cryptodisk luks

More links:
 - https://gitlab.com/cryptsetup/cryptsetup/wikis/LUKS-standard/on-disk-format.pdf
 - https://www.gnu.org/software/grub/manual/grub/html_node/Simple-configuration.html#Simple-configuration
---
ProblemType: Bug
ApportVersion: 2.20.9-0ubuntu7.7
Architecture: amd64
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC0: ruslan 1637 F.... pulseaudio
CurrentDesktop: ubuntu:GNOME
DistroRelease: Ubuntu 18.04
InstallationDate: Installed on 2019-09-16 (0 days ago)
InstallationMedia: Ubuntu 18.04.3 LTS "Bionic Beaver" - Release amd64 (20190805)
IwConfig:
 lo no wireless extensions.

 enp0s3 no wireless extensions.
Lsusb:
 Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
 Bus 002 Device 002: ID 80ee:0021 VirtualBox USB Tablet
 Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
MachineType: innotek GmbH VirtualBox
Package: linux (not installed)
ProcFB: 0 vboxdrmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-5.0.0-27-generic root=/dev/mapper/ubuntu--vg-root ro quiet splash vt.handoff=1
ProcVersionSignature: Ubuntu 5.0.0-27.28~18.04.1-generic 5.0.21
RelatedPackageVersions:
 linux-restricted-modules-5.0.0-27-generic N/A
 linux-backports-modules-5.0.0-27-generic N/A
 linux-firmware 1.173.9
RfKill:

Tags: bionic
Uname: Linux 5.0.0-27-generic x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo
_MarkForUpload: True
dmi.bios.date: 12/01/2006
dmi.bios.vendor: innotek GmbH
dmi.bios.version: VirtualBox
dmi.board.name: VirtualBox
dmi.board.vendor: Oracle Corporation
dmi.board.version: 1.2
dmi.chassis.type: 1
dmi.chassis.vendor: Oracle Corporation
dmi.modalias: dmi:bvninnotekGmbH:bvrVirtualBox:bd12/01/2006:svninnotekGmbH:pnVirtualBox:pvr1.2:rvnOracleCorporation:rnVirtualBox:rvr1.2:cvnOracleCorporation:ct1:cvr:
dmi.product.family: Virtual Machine
dmi.product.name: VirtualBox
dmi.product.version: 1.2
dmi.sys.vendor: innotek GmbH

[Ruslan Gainutdinov (ruslanfg)]

I was able to completely reproduce it using VirtualBox environment by installing Ubuntu from scratch with encryption enabled and then adding the second disk and enabling encryption on it manually.

[Ruslan Gainutdinov (ruslanfg)]

My hypothesis on this is that grub boot stage UUID detection mechanism are not able to read UUID for crypto_LUKS partition.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1844153

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Ruslan Gainutdinov (ruslanfg)]

apport information

[Ruslan Gainutdinov (ruslanfg)]

apport information

[Ruslan Gainutdinov (ruslanfg)]

apport information

[Ruslan Gainutdinov (ruslanfg)]

apport information

[Ruslan Gainutdinov (ruslanfg)]

apport information

[Ruslan Gainutdinov (ruslanfg)]

apport information

[Ruslan Gainutdinov (ruslanfg)]

apport information

[Ruslan Gainutdinov (ruslanfg)]

apport information

[Ruslan Gainutdinov (ruslanfg)]

apport information

[Ruslan Gainutdinov (ruslanfg)]

apport information

[Ruslan Gainutdinov (ruslanfg)]

apport information

[Ruslan Gainutdinov (ruslanfg)]

apport information

[Ruslan Gainutdinov (ruslanfg)]

Here is how I made a workaround for it.

I added an additional entry to EFI boot manager which does it properly.

Additionally as /EFI/ubuntu/grubx64.efi does not contain required drivers I fix it by creating custom grubx64.efi with memdisk and grub.cfg mapped onto it.

Here is the script to add to /etc/grub.d which does it automatically at the next grub update (for example when you install new Linux kernel)

https://gist.github.com/huksley/21282d1f7240716b5c3a1c467a5b4878

Benefits
- No additional edits or execution after updating packages
- In the case of grub-install overriding your next boot option, you can simply go to the BIOS menu and choose new option manually to boot