[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 3/3] docs: Add documentation on detached header option to cryptom
From: |
Glenn Washburn |
Subject: |
[PATCH 3/3] docs: Add documentation on detached header option to cryptomount |
Date: |
Tue, 10 May 2022 23:53:09 -0500 |
Signed-off-by: Glenn Washburn <development@efficientek.com>
---
docs/grub.texi | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/docs/grub.texi b/docs/grub.texi
index 8d1536c4d..9437b46a5 100644
--- a/docs/grub.texi
+++ b/docs/grub.texi
@@ -4356,19 +4356,26 @@ Alias for @code{hashsum --hash crc32 arg @dots{}}. See
command @command{hashsum}
@node cryptomount
@subsection cryptomount
-@deffn Command cryptomount [ [@option{-p} password] | [@option{-k} keyfile
[@option{-O} keyoffset] [@option{-S} keysize] ] ] device|@option{-u}
uuid|@option{-a}|@option{-b}
+@deffn Command cryptomount [ [@option{-p} password] | [@option{-k} keyfile
[@option{-O} keyoffset] [@option{-S} keysize] ] ] [@option{-H} file]
device|@option{-u} uuid|@option{-a}|@option{-b}
Setup access to encrypted device. A passphrase will be requested interactively,
if neither the @option{-p} nor @option{-k} options are given. The option
@option{-p} can be used to supply a passphrase (useful for scripts).
Alternatively the @option{-k} option can be used to supply a keyfile with
options @option{-O} and @option{-S} optionally supplying the offset and size,
-respectively, of the key data in the given key file.
-
+respectively, of the key data in the given key file. The @option{-H} options
can
+be used to supply cryptomount backends with an alternative header file (aka
+detached header). Not all backends have headers nor support alternative header
+files (currently only LUKS1 and LUKS2 support them).
Argument @var{device} configures specific grub device
(@pxref{Naming convention}); option @option{-u} @var{uuid} configures device
with specified @var{uuid}; option @option{-a} configures all detected encrypted
devices; option @option{-b} configures all geli containers that have boot flag
set.
+Devices are not allowed to be given as key files nor as detached header files.
+However, this limitation can be worked around by using blocklist syntax. So
+for instance, @code{(hd1,gpt2)} can not be used, but @code{(hd1,gpt2)0+} will
+achieve the desired result.
+
GRUB suports devices encrypted using LUKS, LUKS2 and geli. Note that necessary
modules (@var{luks}, @var{luks2} and @var{geli}) have to be loaded manually
before this command can be used. For LUKS2 only the PBKDF2 key derivation
--
2.34.1
[PATCH 3/3] docs: Add documentation on detached header option to cryptomount,
Glenn Washburn <=
Re: [PATCH 0/3] Cryptomount detached headers, Daniel Kiper, 2022/05/13