SYSTEMD-CRYPTSETUP(8) | systemd-cryptsetup | SYSTEMD-CRYPTSETUP(8) |
NAME
systemd-cryptsetup, systemd-cryptsetup@.service - Full disk decryption logic
SYNOPSIS
systemd-cryptsetup [OPTIONS...] attach VOLUME SOURCE-DEVICE [KEY-FILE] [CONFIG]
systemd-cryptsetup [OPTIONS...] detach VOLUME
systemd-cryptsetup@.service
system-systemd\x2dcryptsetup.slice
DESCRIPTION
systemd-cryptsetup is used to set up (with attach) and tear down (with detach) access to an encrypted block device. It is primarily used via systemd-cryptsetup@.service during early boot, but may also be called manually. The positional arguments VOLUME, SOURCE-DEVICE, KEY-FILE, and CRYPTTAB-OPTIONS have the same meaning as the fields in crypttab(5).
systemd-cryptsetup@.service is a service responsible for providing access to encrypted block devices. It is instantiated for each device that requires decryption.
systemd-cryptsetup@.service instances are part of the system-systemd\x2dcryptsetup.slice slice, which is destroyed only very late in the shutdown procedure. This allows the encrypted devices to remain up until filesystems have been unmounted.
systemd-cryptsetup@.service will ask for hard disk passwords via the password agent logic[1], in order to query the user for the password using the right mechanism at boot and during runtime.
At early boot and when the system manager configuration is reloaded, /etc/crypttab is translated into systemd-cryptsetup@.service units by systemd-cryptsetup-generator(8).
In order to unlock a volume a password or binary key is required. systemd-cryptsetup@.service tries to acquire a suitable password or binary key via the following mechanisms, tried in order:
If no suitable key may be acquired via any of the mechanisms describes above, volume activation fails.
CREDENTIALS
systemd-cryptsetup supports the service credentials logic as implemented by ImportCredential=/LoadCredential=/SetCredential= (see systemd.exec(5) for details). The following credentials are used by "systemd-crypsetup@root.service" (generated by systemd-gpt-auto-generator) when passed in:
cryptsetup.passphrase
Added in version 256.
cryptsetup.tpm2-pin
Added in version 256.
cryptsetup.fido2-pin
Added in version 256.
cryptsetup.pkcs11-pin
Added in version 256.
cryptsetup.luks2-pin
Added in version 256.
SEE ALSO
systemd(1), systemd-cryptsetup-generator(8), crypttab(5), systemd-cryptenroll(1), cryptsetup(8), TPM2 PCR Measurements Made by systemd[2]
NOTES
- 1.
- password agent logic
- 2.
- TPM2 PCR Measurements Made by systemd
systemd 256.6 |