Some progress has been made. I finally built up the courage to attempt to resize my / partition and reclaim some of that unused space in preparation for creating the new /home LV on my
fedora-ssd volume group.
I’ve decided not to tempt faith and try to rearrange things so that I have the / and /home LVs inside a single LUKS volume backed by
/dev/sda3, that will be a job for future me if I am doing a full re-install.
Instead I am just going to shrink the root LUKS and LV to 60GB and then setup the new /home the same way (e.g
fedora-ssd-home LV containing a LUKS volume)
Question: How does Linux (boot process) handle decryption of multiple LUKS volumes with the same passphrase?
As far as I can tell (according to
lsblk and the contents of
/etc/crypttab), my setup currently has 5 separate LUKS volumes (because I split out /root /swap /var/ /tmp /home in to separate partitions when I drunkenly installed Fedora). But they all have the same passphrase and the Linux boot process is somehow smart enough to know that so only prompts me for the passphrase once.
I still can’t find anywhere that confirms this, but my current “theory” is that during boot it just checks the passphrase against the header of each LUKS volume to see if it can decrypt any of the master key slots and only prompts for another passphrase if it fails to decrypt a master key for any LUKS volume.
Sooooo … assuming my theory is sound, it stands to reason that if I create a new
fedora-ssd-home LV and then create yet another LUKS volume inside it with the same passphrase … all should be well with the world (apart from the fact that if I had understood all this when I installed Fedora in the first place I’d only have a single LUKS volume per drive … damn it )
So that’s the plan …
Step 1) Resize the root LUKs volume
Because I am reducing the size of the volume and it’s the root volume I can’t do this online. And since it’s LUKS over LVM and not LVM over LUKS (*ouch my head hurts) the GParted UI in on the Live USB doesn’t like this and won’t let me work with the volume. So I needed to get familiar with
Since the GParted Live DB is a Debian distro with all the command line tools I need I was able to use that.
Step 2) Boot a Live USB and decrypt the root LUKS volume
Once booted I opened the terminal and did some checking to make sure I was working with the correct volume. I found that you can check if a volume is a LUKs volume using the following command:
sudo cryptsetup luksDump <device>
So I ran
sudo cryptsetup luksDump /dev/fedora-ssd/root to confirm that it was correct and it spat out the LUKS header.
Before the file-system on /dev/fedora-ssd/root could be manipulated it needed to be decrypted and mapped. I did this with the following command:
sudo cryptsetup luksOpen /dev/fedora-ssd/root decrypted_root
This will prompt for the volume passphrase and once complete will map the volume to
Step 3) Resize the file-system
I know that I am currently only using approx. 11GB on /root and pretty much have everything I need installed so I am going to reduce it down to 60G (probably still too large but much better than 256G)
I read a couple of tutorials that say there is a discrepancy between the units used by the file-system resizing tools and the LVM tools (e.g one uses 1024 for K,M,G etc and the other 1000). I’ll look into this in detail later but for the moment I decided to do the resize in 3 steps.
- Resize the file-system to 50G
- Resize the LV to 60G
- Resize the file-system again to consume the space (60G) in the LV
To resize the file-system I used the following command:
sudo resize2fs /dev/mapper/decrypted_root 50G
Note: You need to make sure you’re working on the mapped decrypted volume so it was “decrypted_root” in my case
Note: resize2fs will probably prompt you to run a filesystem check before the resize
I the resized the
fedora-ssd-root logical volume using the following command:
sudo lvresize -L 60G /dev/fedora-ssd/root
Note: Here it’s resizing the LV so the name is
/dev/fedora-ssd/root not the name of the mapped LUKS volume.
Note: You can use “+/-” when specify the size to expand or reduce “by” that amount but here I am explicitly resizing to 60G
Finally I resized the file-system on the LUKS volume to fill the LV:
sudo resize2fs /dev/mapper/decrypted_root
Note: If you don’t specify a size the file-system will be expanded to fill the entire partition/LV so should be 60G in this case.
Again, I don’t know if this 3 step resize is actually required, I need to read up a bit more to see if there are indeed still dependencies between the units used by the file-system tools and LVM but this worked for me.
Step 4) Close the LUKS volume, cross fingers and reboot
This was probably not required since I was rebooting anyway but to close the LUKS volume you can use the following command:
sudo cryptsetup close /dev/mapper/decrypted_root
At this point I crossed my fingers and rebooted back into Fedora
Luckily there was no fire and no one died
I now have a nice tidy 60G LUKS encrypted /root LV
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 489.1G 0 disk
├─sda1 8:1 0 512M 0 part /boot/efi
├─sda2 8:2 0 2G 0 part /boot
└─sda3 8:3 0 486.6G 0 part
└─fedora--ssd-root 253:0 0 60G 0 lvm
└─luks-fa9f909c-6a08-4554-b354-074aa04a80ee 253:2 0 60G 0 crypt /
A nice tidy LV
--- Logical volume ---
LV Path /dev/fedora-ssd/root
LV Name root
VG Name fedora-ssd
LV UUID BCwerR-oGdZ-ajyl-kieO-dHlR-nC0v-L3e8b3
LV Write Access read/write
LV Creation host, time localhost-live, 2018-05-02 17:43:36 +0100
LV Status available
# open 1
LV Size 60.00 GiB *** Excellent :)
Current LE 15360
Read ahead sectors auto
- currently set to 256
Block device 253:0
And plenty of free space in my
fedora-ssd volume group to create the new /home LV
--- Volume group ---
VG Name fedora-ssd
Metadata Areas 1
Metadata Sequence No 6
VG Access read/write
VG Status resizable
MAX LV 0
Cur LV 1
Open LV 1
Max PV 0
Cur PV 1
Act PV 1
VG Size <486.55 GiB
PE Size 4.00 MiB
Total PE 124556
Alloc PE / Size 15360 / 60.00 GiB
Free PE / Size 109196 / <426.55 GiB *** Excellent :)
VG UUID iLJ7iR-npsd-D4OY-cVWs-Wvoy-KIdG-RYYH39
In the next instalment of “Fumbling Through LVM + LUKS with Shecks” I will attempt to create my new fedora-ssd-home LV + LUKS volume and test my single passphrase theory.