I have /etc/crypttab as follows:sda7_crypt UUID=<...> /dev/sda8:/keyfile luks,discard,keyscript=/lib/esi/tpm_key_passsda7_crypt is my root filesystem, so I use update-initramfs to decrypt it from early on (otherwise I could not continue boot).Yet systemd automatically creates a systemd-cryptsetup@sda7_crypt.service unit, which depends upon a dev-sda8:-keyfile.device, which times out. This eventually fails, but it slows boot time down and creates error messages.How do I indicate that this is already mounted by initram, and does not need to be mounted by systemd? I had thought about option noauto in crypttab, but was concerned it might prevent it from loading in ini tram?UPDATE:I tried noauto, it didn't work. Still mounts in initram, but also still tries on boot. crypttab now looks like:sda7_crypt UUID=<...> /dev/sda8:/keyfile luks,discard,keyscript=/lib/esi/tpm_key_pass,noautoWhat can I do to clean this up?
why does systemd cryptsetup try to remount the root partition already mounted?
linux;systemd;encryption;cryptsetup
Turns out this is 2 individual systemd issues, specifically how systemd-cryptsetup-generator works. It doesn't recognize keyscript=... option, so it chokes on keys that are valid for passdev like /dev/sda8:/keyfile.The systemd units automatically generated by systemd-cryptsetup-generator are not smart enough to recognize that the item already is mounted, and so tries to mount it again.For more details, see this Debian bug report https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618862According to the bug report, you can stop it from generating the systemd units by passing kernel options luks=no, but that prevents all crypttab automatic mounting. This is fine if all you have is encrypted root, but if there are separate individual partitions, then they don't mount.