Arch Linux

jweisber

Member

Registered: Yesterday

Posts: 1

Systemd Intermittently Fails to Unlock LUKS Volumes During Boot

I have two LUKS volumes, which my initramfs normally unlocks automatically using key files. After a system update this morning, the unlocking fails intermittently; sometimes it's one drive, sometimes the other, sometimes both, and sometimes neither. When there's a failure, it falls back to a password prompt, which usually works, but not always. Sometimes it times out entirely and drops to emergency mode.

Here's an example form a recent boot:

❯ journalctl -b -u systemd-cryptsetup@root.service -u systemd-cryptsetup@home.service
Jun 07 18:21:23 archlinux systemd[1]: Starting Cryptography Setup for home... 
Jun 07 18:21:23 archlinux systemd[1]: Starting Cryptography Setup for root... 
Jun 07 18:21:23 archlinux systemd-cryptsetup[272]: Set cipher aes, mode xts-plain64, key size 512 bits f> 
Jun 07 18:21:23 archlinux systemd-cryptsetup[273]: Set cipher aes, mode xts-plain64, key size 512 bits f> 
Jun 07 18:21:28 archlinux systemd-cryptsetup[272]: Failed to activate with key file '/etc/cryptsetup-key> 
Jun 07 18:21:30 archlinux systemd-cryptsetup[273]: Failed to activate with key file '/etc/cryptsetup-key> 
Jun 07 18:21:31 archlinux systemd-cryptsetup[272]: Set cipher aes, mode xts-plain64, key size 512 bits f> 
Jun 07 18:21:31 archlinux systemd-cryptsetup[273]: Set cipher aes, mode xts-plain64, key size 512 bits f> 
Jun 07 18:21:35 archlinux systemd[1]: Finished Cryptography Setup for home. 
Jun 07 18:21:36 archlinux systemd-cryptsetup[273]: Failed to activate with specified passphrase. (Passph> 
Jun 07 18:21:39 archlinux systemd-cryptsetup[273]: Set cipher aes, mode xts-plain64, key size 512 bits f> 
Jun 07 18:21:41 archlinux systemd[1]: Finished Cryptography Setup for root.

I've checked that the key files are present in the initramfs, and they unlock the volumes when tested manually with

cryptsetup open --test-passphrase --key-file

And anyway, the whole boot process works fine sometimes, so the key files themselves seem to be intact and being found. It's just that the unlocking step fails sometimes (even using the password on some occasions).

I tried downgrading to the previous version of systemd (from 260.2 to 260.1) and rebuilt the initramfs, no change. Problem occurs on both linux and linux-lts kernels.

Anybody seen this before, or have an idea what could cause it?