Post #1495852
2026-03-25 07:56 UTC
…the activation and mounting of disk images. It's not the only mechanism to lock things that got some love in systemd v260:
/etc/crypttab (and equivalent ways to configure a LUKS volume, such as the kernel command line) acquired a new option: fixate-volume-key=. This per-volume option accepts a hash derived from the volume key of the LUKS volume. If specified, activation will only succeed if the volume key actually matches this hash.
There's a counterpart to this in systemd-repart, …
Replies (1)
-
@pid_eins@mastodon.social 2026-03-25 07:58
…i.e. systemd's disk image generator and dynamic partitioner, that can generate encrypted file systems. If the (pre-existing) --generate-crypttab= option is used it will now automatically write out the right fixate-volume-key= options, so that the crypttab and the disk image are tightly bound together.