Skip to content

Commit

Permalink
nixos/luksroot: Check if the device was opened while reading password
Browse files Browse the repository at this point in the history
Helps the following situation:

- SSH in initrd is enabled

- NixOS is waiting for a password to be typed at the console (or
  provided via cryptsetup-askpass)

- The user logs in via SSH, but instead of running cryptsetup-askpass,
  they run "cryptsetup open" directly (because they don't know that
  they need to use NixOS's cryptsetup-askpass script, or because they
  want to use a non-trivial unlocking method that is not natively
  supported by this module)

Currently, in the above situation, NixOS will keep waiting for a
password to be entered even though the device is already unlocked. If
a password is entered, it will print a confusing "already exists"
error and keep asking for the same password.

We can improve on this by simply checking if the device is already
unlocked in our read loop. In this case, we don't need to do anything
other than return from the function and continue booting.
  • Loading branch information
CyberShadow committed Dec 31, 2024
1 parent 8456471 commit a5cc2d0
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions nixos/modules/system/boot/luksroot.nix
Original file line number Diff line number Diff line change
Expand Up @@ -185,6 +185,10 @@ let
echo "reused"
passphrase=$(cat /crypt-ramfs/passphrase)
break
elif [ -e /dev/mapper/${dev.name} ]; then
echo "opened externally"
rm -f /crypt-ramfs/device
return
else
# ask cryptsetup-askpass
echo -n "${dev.device}" > /crypt-ramfs/device
Expand Down

0 comments on commit a5cc2d0

Please sign in to comment.