Bug 716136

Summary: systemd: doesn't mount my encrypted /home
Product: [openSUSE] openSUSE 12.1 Reporter: Vincent Untz <vuntz>
Component: BasesystemAssignee: Karl Eichwalder <ke>
Status: RESOLVED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Major    
Priority: P5 - None CC: fcrozat, ke, lnussel, suse-beta
Version: Factory   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Attachments: dmesg
dmesg with systemd debug info :-)

Description Vincent Untz 2011-09-06 13:39:36 UTC
My encrypted /home doesn't get mounted with systemd.

I do get the prompt, but nothing happens afterwards.

Note that doing "systemctl restart cryptsetup@cr_sda3.service" doesn't help.

This is my /etc/crypttab:

cr_sda3         /dev/disk/by-id/ata-ST9160412AS_5VG1695C-part3 none       none
Comment 1 Vincent Untz 2011-09-06 13:40:03 UTC
Created attachment 449359 [details]
dmesg
Comment 2 Vincent Untz 2011-09-06 13:51:44 UTC
Created attachment 449362 [details]
dmesg with systemd debug info :-)
Comment 3 Vincent Untz 2011-09-06 13:57:19 UTC
Relevant fstab line:

/dev/mapper/cr_sda3  /home                ext4       acl,user_xattr,noauto 0 0

Could it be the noauto?
Comment 4 Vincent Untz 2011-09-06 14:10:08 UTC
So apparently, removing noauto is enough for this. An alternative is to change the flags to "...,noauto,comment=systemd.automount".

As I certainly didn't add noauto myself, I can only assume we used to create encrypted partitions this way, and so on upgrade to 12.1, this will possibly be an issue people will hit. So it should at least get documented in the release notes that people should remove the noauto flag themselves.
Comment 5 Ludwig Nussel 2011-09-09 11:55:21 UTC
YaST can in theory correct such things on upgrade. It should be nofail instead of noauto though (boot.crypto can time out and you don't want to fall into single user mode then). The noauto is probably from a time when nofail wasn't supported. It needs to be clarified whether yast still adds 'noauto' nowadays.
Comment 6 Frederic Crozat 2011-09-09 12:05:22 UTC
just for the record, boot.crypto isn't used at all under systemd (but similar feature in systemd can also timeout ;)
Comment 7 Ludwig Nussel 2011-09-09 12:12:35 UTC
I know but if the installation is not migrated to systemd just removing noauto would be wrong. nofail is needed to prevent emergency mode in boot.localfs then.
Comment 8 Frederic Crozat 2011-09-09 12:14:03 UTC
boot.localfs is also disabled under systemd ;)
Comment 9 Karl Eichwalder 2011-09-22 07:06:20 UTC
To write a proper release notes entry (without doing research first), I need a summary, please ;)
Comment 10 Vincent Untz 2011-09-22 14:04:32 UTC
Karl, something like this would do it:

"If you are using encrypted partitions, and you notice they are not automatically mounted with systemd, a likely cause is the 'noauto' flag in /etc/fstab for these partitions. Simply remove this flag. For instance, change the following line:

/dev/mapper/cr_sda3  /home                ext4       acl,user_xattr,noauto 0 0

to

/dev/mapper/cr_sda3  /home                ext4       acl,user_xattr 0 0

"
Comment 11 Ludwig Nussel 2011-09-22 14:15:37 UTC
/dev/mapper/cr_sda3  /home  ext4  acl,user_xattr,nofail 0 2
Comment 12 Christian Boltz 2011-10-09 17:33:46 UTC
If the example is changed to use "nofail", then the sentence
    Simply remove this flag.
should be changed to
    Simply replace the "noauto" flag with "nofail".

That said: I'd really welcome if this was fixed automatically by YaST or zypper dup. Shouldn't be too hard IMHO - the following sed command in %post of cryptsetup (or another package) should work: (Warning: untested!)
    sed -i '/^\/dev/mapper/cr_/ s/,noauto,nofail/' etc/fstab
Comment 13 Christian Boltz 2011-10-10 10:32:25 UTC
(In reply to comment #12)
> dup. Shouldn't be too hard IMHO - the following sed command in %post of
> cryptsetup (or another package) should work: (Warning: untested!)
>     sed -i '/^\/dev/mapper/cr_/ s/,noauto,nofail/' etc/fstab

Argh, obviously untested :-/

     sed -i '/^\/dev\/mapper\/cr_/ s/,noauto,/nofail/' etc/fstab

Untested again, but at least the syntax should be correct now ;-)
Comment 14 Karl Eichwalder 2011-10-13 14:44:11 UTC
Once again, it too confusing to write a release notes entry.  Please, fix the reported bug first; see comment 12 and 13.

Once done, please provide an update RN entry and assign the bug to me again.  (I hope that this procedure is ok with you.)
Comment 15 Vincent Untz 2011-10-13 14:57:25 UTC
Karl: is comment 10 not enough? (with the change mentioned by Luwdig and Christian in comments 11 & 12)

I'm unsure what package would fix this on upgrades anyway -- the way you reassigned the bug, nothing will get fixed :/
Comment 16 Christian Boltz 2011-10-13 19:25:58 UTC
(In reply to comment #15)
> I'm unsure what package would fix this on upgrades anyway 

The boot.crypto initscript and /etc/crypttab are both owned by cryptsetup, which is maintained by Ludwig. I'm sure he's a better assignee than the screening team for this bug.

Ludwig, what do you think about fixing this bug with sed on /etc/fstab in %post of cryptsetup? See comment #13
Comment 17 Karl Eichwalder 2011-10-14 07:30:04 UTC
(In reply to comment #15)
> Karl: is comment 10 not enough? (with the change mentioned by Luwdig and
> Christian in comments 11 & 12)

Literal diffs are always a PITA ;)  But otherwise, you are right.  Here is the merged version that I'm going to add to the RN:

<title>Mounting Encrypted Partitions with systemd</title>
<para>
If encrypted partitions are not automatically mounted with systemd, the 'noauto' flag in <filename>/etc/fstab</filename> for these partitions could be the cause. Replacing this flag with 'nofail' will fix it. For instance, change
the following line:</para>

<screen>/dev/mapper/cr_sda3  /home                ext4       acl,user_xattr,noauto 0 0</screen>
<para>
to
</para>
<screen>/dev/mapper/cr_sda3  /home                ext4       acl,user_xattr 0 0</screen>
Comment 18 Karl Eichwalder 2011-10-14 07:35:22 UTC
(In reply to comment #16)
> (In reply to comment #15)
> > I'm unsure what package would fix this on upgrades anyway 
> 
> The boot.crypto initscript and /etc/crypttab are both owned by cryptsetup,
> which is maintained by Ludwig. I'm sure he's a better assignee than the
> screening team for this bug.
> 
> Ludwig, what do you think about fixing this bug with sed on /etc/fstab in %post
> of cryptsetup? See comment #13

I cloned the bug: bnc#724113
Comment 19 Karl Eichwalder 2011-10-14 08:40:31 UTC
Done (sr to Factory).
Comment 20 Christian Boltz 2011-10-14 11:46:36 UTC
(In reply to comment #17)
> Literal diffs are always a PITA ;)  

Yes, seems so ;-)

> <screen>/dev/mapper/cr_sda3  /home                ext4      
> acl,user_xattr,noauto 0 0</screen>
> <para>
> to
> </para>
> <screen>/dev/mapper/cr_sda3  /home                ext4       acl,user_xattr 0
> 0</screen>

The last line should contain acl,user_xattr,nofail (the ",nofail" is missing).
Comment 21 Karl Eichwalder 2011-10-14 14:00:29 UTC
Thanks for spotting (no, I did not do this intentionally)!  Now fixed in SVN:

  <sect3 id="crypto-part-systemd">
   <!-- bnc#716136 -->
   <title>Mounting Encrypted Partitions with systemd</title>
   <para>
If encrypted partitions are not automatically mounted with systemd, the
<literal>noauto</literal> flag in <filename>/etc/fstab</filename> for
these partitions could be the cause. Replacing this flag with
<literal>nofail</literal> will fix it. For instance, change the
following line:</para>

<screen>/dev/mapper/cr_sda3  /home   ext4    acl,user_xattr,noauto 0 0</screen>
<para>to</para>
<screen>/dev/mapper/cr_sda3  /home   ext4    acl,user_xattr,nofail 0 0</screen>
  </sect3>
Comment 22 Ludwig Nussel 2011-10-14 14:05:29 UTC
now if you also change the last zero to 2 you get fsck too
Comment 23 Karl Eichwalder 2011-10-17 08:53:07 UTC
Thanks, fixed in SVN.  To avoid confusion, I changed both entries (old and new):

...
<screen>/dev/mapper/cr_sda3  /home   ext4    acl,user_xattr,noauto 0 2</screen>
<para>to</para>
<screen>/dev/mapper/cr_sda3  /home   ext4    acl,user_xattr,nofail 0 2</screen>
  </sect3>
Comment 24 Karl Eichwalder 2011-10-21 07:34:29 UTC
submitted again