Arch Linux

I hope this isn't a duplicate. I would very much like to see support for decrypting with passfiles located on removable devices. This feature is already available in the initrd encrypt hook, and would like to see it in the system init script.

Therefore I am submitting a patch for /etc/rc.sysinit (SHA1: 0762e263a155d641979ccef98d15c34eecfc2fdf) to add this. I've been using it for about a two weeks with no adverse effects.

This code will add another PASSWORD option format to /etc/crypttab. The new option will be in the form /path/to/device:/path/to/passphrase . Much like the initrd crypt hook, if /path/to/device does not exist it falls back to asking for a passphrase.

Here's an example of my own personal crypttab entry...
crypt-thomasl /dev/mapper/picard-thomasl /dev/disk/by-label/Keys:/picardthomaslkey

One thing I don't like about my patch is that the removable device is temporarily mounted in the /tmp directory instead of a sub-directory of /tmp. I did this because / is mounted read-only then the concerned code is run, and the decision to relocate the crypttab code after root is mounted read-write should be up to a dev. My solution probably isn't the best idea, so please review/improve this patch.