cryptsetup cannot initialize crypto backend from initramfs
1
vote
1
answer
712
views
I'm on an embedded Linux device and trying to open an encrypted squashfs for my rootfs.
The image is created on the host (build agent) and from there I'm able to open and work with the content, so I know the image is correct. From the embedded Linux's initramfs when I try to open the image I get the error:
root# cryptsetup open ./rootfs.sqfs.img rootfs
# cryptsetup 2.5.0 processing "/usr/sbin/cryptsetup --debug open ./rootfs.sqfs.img rootfs"
# Verifying parameters for command open.
# Running command open.
# Locking memory.
# Installing SIGINT/SIGTERM handler.
# Unblocking interruption on signal.
# Allocating context for crypt device ./rootfs.sqfs.img.
# Trying to open and read device ./rootfs.sqfs.img with direct-io.
# Initialising device-mapper backend library.
# Trying to load any crypt type from device ./rootfs.sqfs.img.
Cannot initialize crypto backend.
Device ./rootfs.sqfs.img is not a valid LUKS device.
# Releasing crypt device ./rootfs.sqfs.img context.
# Releasing device-mapper backend.
# Unlocking memory.
Some searching online make it sound like this error is caused by a missing kernel module, but I have all modules that have been listed.
I have the following CRYPTO modules enabled:
CONFIG_CRYPTO_SHA1_ARM=y
CONFIG_CRYPTO_SHA256_ARM=y
CONFIG_CRYPTO_SHA512_ARM=y
CONFIG_CRYPTO_AES_ARM=y
CONFIG_CRYPTO_ALGAPI=y
CONFIG_CRYPTO_ALGAPI2=y
CONFIG_CRYPTO_AEAD=y
CONFIG_CRYPTO_AEAD2=y
CONFIG_CRYPTO_BLKCIPHER=y
CONFIG_CRYPTO_BLKCIPHER2=y
CONFIG_CRYPTO_HASH=y
CONFIG_CRYPTO_HASH2=y
CONFIG_CRYPTO_RNG=y
CONFIG_CRYPTO_RNG2=y
CONFIG_CRYPTO_RNG_DEFAULT=y
CONFIG_CRYPTO_AKCIPHER2=y
CONFIG_CRYPTO_AKCIPHER=y
CONFIG_CRYPTO_KPP2=y
CONFIG_CRYPTO_KPP=y
CONFIG_CRYPTO_ACOMP2=y
CONFIG_CRYPTO_RSA=y
CONFIG_CRYPTO_ECDH=y
CONFIG_CRYPTO_MANAGER=y
CONFIG_CRYPTO_MANAGER2=y
CONFIG_CRYPTO_USER=y
CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y
CONFIG_CRYPTO_GF128MUL=y
CONFIG_CRYPTO_NULL=y
CONFIG_CRYPTO_NULL2=y
CONFIG_CRYPTO_WORKQUEUE=y
CONFIG_CRYPTO_CRYPTD=y
CONFIG_CRYPTO_AUTHENC=y
CONFIG_CRYPTO_CCM=y
CONFIG_CRYPTO_GCM=y
CONFIG_CRYPTO_SEQIV=y
CONFIG_CRYPTO_ECHAINIV=y
CONFIG_CRYPTO_CBC=y
CONFIG_CRYPTO_CTR=y
CONFIG_CRYPTO_CTS=y
CONFIG_CRYPTO_ECB=y
CONFIG_CRYPTO_XTS=y
CONFIG_CRYPTO_KEYWRAP=y
CONFIG_CRYPTO_CMAC=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_CRC32C=y
CONFIG_CRYPTO_GHASH=y
CONFIG_CRYPTO_MD5=y
CONFIG_CRYPTO_RMD128=y
CONFIG_CRYPTO_RMD160=y
CONFIG_CRYPTO_RMD256=y
CONFIG_CRYPTO_RMD320=y
CONFIG_CRYPTO_SHA1=y
CONFIG_CRYPTO_SHA256=y
CONFIG_CRYPTO_SHA512=y
CONFIG_CRYPTO_AES=y
CONFIG_CRYPTO_ARC4=y
CONFIG_CRYPTO_DES=y
CONFIG_CRYPTO_DEFLATE=y
CONFIG_CRYPTO_LZO=y
CONFIG_CRYPTO_ZSTD=y
CONFIG_CRYPTO_ANSI_CPRNG=y
CONFIG_CRYPTO_DRBG_MENU=y
CONFIG_CRYPTO_DRBG_CTR=y
CONFIG_CRYPTO_DRBG=y
CONFIG_CRYPTO_JITTERENTROPY=y
CONFIG_CRYPTO_USER_API=y
CONFIG_CRYPTO_USER_API_HASH=y
CONFIG_CRYPTO_USER_API_SKCIPHER=y
CONFIG_CRYPTO_USER_API_RNG=y
CONFIG_CRYPTO_USER_API_AEAD=y
CONFIG_CRYPTO_HASH_INFO=y
CONFIG_CRYPTO_HW=y
CONFIG_CRYPTO_DEV_ATMEL_AES=y
CONFIG_CRYPTO_DEV_ATMEL_TDES=y
I also have device mapper support (dm_crypt) in my kernel. All options are built into the kernel, so issue is not from a module not loaded.
On the embedded Linux system cryptsetup version 2.5.0 is installed. The host has version 2.2.2 installed. The embedded Linux is running kernel 4.19.231.
What else am I missing for having cryptsetup able to map this to /dev/mapper/rootfs
?
EDIT:
Thought I was using the kernel backend, not sure how to check on the embedded linux system.
Running on the host it appears to use openssl (see below), my initramfs does not include openssl, so if its' trying to use openssl rather than the kernel that may be my problem.
# cryptsetup 2.2.2 processing "cryptsetup --debug open rootfs.sqfs.img rootfs"
# Running command open.
# Locking memory.
# Installing SIGINT/SIGTERM handler.
# Unblocking interruption on signal.
# Allocating context for crypt device rootfs.sqfs.img.
# Trying to open and read device rootfs.sqfs.img with direct-io.
# Initialising device-mapper backend library.
# Trying to load any crypt type from device rootfs.sqfs.img.
# Crypto backend (OpenSSL 1.1.1f 31 Mar 2020) initialized in cryptsetup library version 2.2.2.
# Detected kernel Linux 5.15.0-58-generic x86_64.
# Loading LUKS2 header (repair disabled).
# Acquiring read lock for device rootfs.sqfs.img.
# Verifying lock handle for rootfs.sqfs.img.
# Device rootfs.sqfs.img READ lock taken.
# Trying to read primary LUKS2 header at offset 0x0.
# Opening locked device rootfs.sqfs.img
# Veryfing locked device handle (regular file)
# LUKS2 header version 2 of size 16384 bytes, checksum sha256.
# Checksum:a69c54af714a6d46ac5a514399ebe367012a233d742d2f2913a7b5979ae70441 (on-disk)
# Checksum:a69c54af714a6d46ac5a514399ebe367012a233d742d2f2913a7b5979ae70441 (in-memory)
# Trying to read secondary LUKS2 header at offset 0x4000.
# Reusing open ro fd on device rootfs.sqfs.img
# LUKS2 header version 2 of size 16384 bytes, checksum sha256.
# Checksum:d1a6fae45d92dd47f5a99e11e6d157bc6ba0140fc2bd62ebc1fb9dad0414f0ff (on-disk)
# Checksum:d1a6fae45d92dd47f5a99e11e6d157bc6ba0140fc2bd62ebc1fb9dad0414f0ff (in-memory)
# Device size 68157440, offset 16777216.
# Device rootfs.sqfs.img READ lock released.
# PBKDF argon2i, time_ms 2000 (iterations 0), max_memory_kb 1048576, parallel_threads 4.
# Activating volume rootfs using token -1.
# Interactive passphrase entry requested.
Enter passphrase for rootfs.sqfs.img:
# Activating volume rootfs [keyslot -1] using passphrase.
# dm version [ opencount flush ] (*1)
# dm versions [ opencount flush ] (*1)
# Detected dm-ioctl version 4.45.0.
# Detected dm-crypt version 1.23.0.
# Device-mapper backend running with UDEV support enabled.
# dm status rootfs [ opencount noflush ] (*1)
# Keyslot 0 priority 1 != 2 (required), skipped.
# Trying to open LUKS2 keyslot 0.
# Reading keyslot area [0x8000].
# Acquiring read lock for device rootfs.sqfs.img.
# Verifying lock handle for rootfs.sqfs.img.
# Device rootfs.sqfs.img READ lock taken.
# Reusing open ro fd on device rootfs.sqfs.img
# Device rootfs.sqfs.img READ lock released.
# Verifying key from keyslot 0, digest 0.
# Loading key (64 bytes, type logon) in thread keyring.
# dm versions [ opencount flush ] (*1)
# dm status rootfs [ opencount noflush ] (*1)
# Allocating a free loop device.
# Trying to open and read device /dev/loop27 with direct-io.
# Calculated device size is 100352 sectors (RW), offset 32768.
# DM-UUID is CRYPT-LUKS2-606147e882c040c3ae6c7a346a4f5b43-rootfs
# Udev cookie 0xd4da08f (semid 32788) created
# Udev cookie 0xd4da08f (semid 32788) incremented to 1
# Udev cookie 0xd4da08f (semid 32788) incremented to 2
# Udev cookie 0xd4da08f (semid 32788) assigned to CREATE task(0) with flags DISABLE_LIBRARY_FALLBACK (0x20)
# dm create rootfs CRYPT-LUKS2-606147e882c040c3ae6c7a346a4f5b43-rootfs [ opencount flush ] (*1)
# dm reload rootfs [ opencount flush securedata ] (*1)
# dm resume rootfs [ opencount flush securedata ] (*1)
# rootfs: Stacking NODE_ADD (253,2) 0:6 0660 [trust_udev]
# rootfs: Stacking NODE_READ_AHEAD 256 (flags=1)
# Udev cookie 0xd4da08f (semid 32788) decremented to 1
# Udev cookie 0xd4da08f (semid 32788) waiting for zero
# Udev cookie 0xd4da08f (semid 32788) destroyed
# rootfs: Skipping NODE_ADD (253,2) 0:6 0660 [trust_udev]
# rootfs: Processing NODE_READ_AHEAD 256 (flags=1)
# rootfs (253:2): read ahead is 256
# rootfs: retaining kernel read ahead of 256 (requested 256)
Key slot 0 unlocked.
# Releasing crypt device rootfs.sqfs.img context.
# Releasing device-mapper backend.
# Closing read only fd for rootfs.sqfs.img.
# Closed loop /dev/loop27 (rootfs.sqfs.img).
# Unlocking memory.
Command successful.
**[SOLVED]**
My issue was caused by the fact I was using a musl-libc and lvm2 required glibc. After switching to glibc cryptsetup was able to load the proper backend.
Asked by dangeroushobo
(707 rep)
Feb 16, 2023, 02:07 PM
Last activity: Feb 16, 2023, 08:33 PM
Last activity: Feb 16, 2023, 08:33 PM