Plymouth does not show password prompt with encrypted root

[Slabity]

Issue description

Plymouth has the ability to ask the user for their password to decrypt their root device if necessary. Currently, Plymouth runs after the user already decrypts their device in the TTY, and as far as I can tell there is no option to override this.

Steps to reproduce

1. Encrypt your root with LUKS.

2. Enable plymouth:

boot.plymouth.enable = true

3. Reboot. The init process will request your password before plymouth runs.

Technical details

• System: NixOS 17.09pre108553.0011f9065a (HummingBird)
• Nix version: 1.11.9
• Nixpkgs version: 17.09pre108553.0011f9065a
• Sandboxing enabled: false

[abbradar]

I remember myself trying to implement this some time ago; this would probably need us moving from shell scripts based initrd to systemd. Maybe I'll take another look at this...

[gilligan]

Has anything ever happened in this regard? Does anyone know?

[Slabity]

Unfortunately I was unable to get this working. I ended up disabling plymouth entirely. Hopefully someone else has a better idea on how to get this working.

[hedning]

I might have broken this with #39978. Checking if reverting 5777272 fixes the problem could be worthwhile.

[jtojnar]

Nope @hedning, this issue has been around for a long time.

[nioncode]

Ideally, we should have flicker free boot like Fedora has now (see https://hansdegoede.livejournal.com/19224.html and https://hansdegoede.livejournal.com/19673.html).

[andersk]

Still an issue. I suspect this will require #72401 (systemd in initramfs) and #99011 (nixos/plymouth: Add label plugin and a font to the initrd).

[cole-h]

May also be influenced by #88789.

[TLATER]

#99011 was merged, for reference.

[anthr76]

Since the above was implemented is anything else blocking this from being resolved?

[WillPower3309]

Since the above was implemented is anything else blocking this from being resolved?

Afaik #170136 will fix this issue

[WillPower3309]

Anyone test with latest nixpkgs master? Afaik it should work based on the systemd in stage 1 milestone progress

[iclanzan]

I am on commit 934e076, added boot.plymouth.enable = true and Plymouth didn’t even come up at all. Do I need other settings now? Should I try an even fresher commit?

[iclanzan]

I am seeing these lines in the journal that mention Plymouth:

May 10 19:03:41 ken systemd[1]: Forward Password Requests to Plymouth was skipped because of a failed condition check (ConditionPathExists=/run/plymouth/pid).
May 10 19:03:42 ken systemd[1]: Starting Tell Plymouth To Write Out Runtime Data...
May 10 19:03:42 ken systemd[1]: Finished Tell Plymouth To Write Out Runtime Data.

The "condition check" message is repeated half a dozen times.

[WillPower3309]

I am seeing these lines in the journal that mention Plymouth:

May 10 19:03:41 ken systemd[1]: Forward Password Requests to Plymouth was skipped because of a failed condition check (ConditionPathExists=/run/plymouth/pid).
May 10 19:03:42 ken systemd[1]: Starting Tell Plymouth To Write Out Runtime Data...
May 10 19:03:42 ken systemd[1]: Finished Tell Plymouth To Write Out Runtime Data.

The "condition check" message is repeated half a dozen times.

@dasJ does this have implications wrt #170136 ?

[nomeata]

Just gave it a shot, release-22.05, with

boot.initrd.systemd.enable = true;
boot.plymouth.enable = true;

There was systemd in stage1, and there was a job that said something about starting plymouth before it would ask for the password, but plymouth did not actually come up, and after a short pause the screen was reset and more textual start up message appeared, including a textual password prompt. (This was my first experiment with systemd in stage1, and other things were strange, so I reverted for now.)

[naufik]

On 22.05, I managed to have a minimal nixos-branded plymouth password prompt using the following config:

{config, pkgs, lib, ...}:
{
  # ...
  boot.plymouth = {
    enable = true;
    theme = "breeze";
  };

  boot.initrd.systemd.enable = true;
}

The text "Starting Plymouth" appears beforehand, and afterwards a graphical prompt appears.

According to the documentation for boot.plymouth.themePackages a package is only specified by default for theme "breeze".

I got the same result from testing the code above, getting a text prompt after "Starting Plymouth". So potentially it's the default theme "bgrt" not including a graphical prompt.

[TLATER]

Can this issue be closed? Or should we set breeze by default, or update the plymouth.enable documentation to point this quirk out?

[zeorin]

Not working for me with @nomeata's settings… Nixos 22.05.

Plymouth starts, (though it's very slow and the wrong resolution), and shows me the passphrase prompt. When I enter the passphrase the prompt disappears and nothing happens.

When I press Escape the console output says that we're waiting for a job for a disk.

I have a somewhat complicated setup, I have 2 disks that I wanted to unlock with one passphrase, which I wanted to enter only once, so I have 3 encrypted partitions.

The first is unlocked with a passphrase, and it is the keyfile for the following 2 encrypted partitions. The first of these is the root filesystem. The second is just a data drive:

{ config, lib, pkgs, ... }:

{
  # ...

  boot = {
    # ...

    initrd.luks.devices = {
      cryptkey = {
        device = "/dev/disk/by-uuid/6b17a213-6987-4a8e-b609-5243f6ba1467";
        preLVM = true;
      };
      cryptroot = {
        device = "/dev/disk/by-uuid/556cb835-419a-48b6-a081-36d2998d9c57";
        keyFile = "/dev/mapper/cryptkey";
        preLVM = true;
        allowDiscards = true;
      };
    };

    initrd.systemd.enable = true;

    plymouth = {
      enable = true;
      theme = "breeze";
    };

  };

  # ...

  fileSystems."/data" = {
    device = "/dev/disk/by-uuid/6ee6e25c-fe6f-4c50-b7fb-985260cf8ca9";
    encrypted = {
      enable = true;
      label = "cryptdata";
      blkDev = "/dev/disk/by-uuid/14924ada-f427-411b-b426-e9db44ab0752";
      keyFile = "/dev/mapper/cryptkey";
    };
  };

  # ...
}

[TLATER]

@zeorin that sounds more like a bug with the implementation that doesn't permit your setup or at least is backwards-incompatible with it, and not a flat out missing implementation like it used to be. Perhaps that should be handled in a aeparate issue?

[GoldsteinE]

It also doesn’t work when initrd.luks.yubikeySupport = true;, but that’s probably an another issue.

[Majiir]

I have an encrypted ZFS root. With this config

{
  boot.plymouth.enable = true;
  boot.initrd.systemd.enable = true;
}

I get a textual prompt for the password. But if I include the changes from #179619, I get a graphical prompt, even with the default bgrt theme.

It sure does take a long time for udev initialization to finish and for Plymouth to take over, though.

[nomeata]

A new release, a new try, with some progress! With 22.11 and

boot.initrd.systemd.enable = true;
boot.plymouth.enable = true;

after grub I first get a few lines of text, including something akin to “Starting plymouth”, which takes a few moments. Then I do get a graphical password prompt from plymouth (success!), and it unlocks my disk. Text mode briefly pops up again, before X comes up!

It’s still noticable slower than the text mode passphrase prompt, so maybe not quite yet worth it. I guess I am spoiled and hope for a fast and flickerless experience from grub all the way through to X, which is what I had in Debian before switching to Nix OS :-)

[Zahrun]

I configured NixOS 22.11 with

boot.initrd.systemd.enable = true;
boot.plymouth.enable = true;
boot.plymouth.theme = "breeze";
environment.systemPackages = with pkgs; [
  plymouth
  breeze-plymouth
];

After nixos-rebuild switch and reboot, I am still welcomed with the GRUB "Enter passphrase for hd0,msdos1" text password input. What am I doing wrong?

[TLATER]

If you're using grub's cryptomount to unlock your luks you can't use plymouth for password prompt, because plymouth is part of the initrd and requires the kernel to already be running.

It's arguably better to do what you're doing though, since it means you can encrypt your /boot as well, albeit at a performance cost/limitation to LUKS1, or having to type passwords multiple times. It also only really helps if you use secure boot to verify grub.

People here let the initrd unlock their devices, which means that the kernel must have already started. It's the setup most commonly used by Linux distros out there, but requires leaving /boot unencrypted and because the initrd is never verified with secure boot it leaves your system vulnerable to evil maid attacks that swap in a malicious initrd.

Poettering has recently started a crusade against this poor state of affairs if you're curious about a potential better future approach: https://0pointer.de/blog/brave-new-trusted-boot-world.html

Probably will take a long time before adoption in NixOS though.

[Zahrun]

That you @TLATER, I was able to reproduce the setup with /boot unencrypted and / encrypted, at first I was surprised that NixOS was not even asking for a password to boot. For that I had to comment the line
boot.initrd.luks.devices."luks-xxx".keyfile = "/crypto_keyfile.bin".

I was always confused about why different distros had differences in luks unlocking, so thank you helping me understand the difference between grub unlocking and initrd unlocking.

However, even with

boot.initrd.systemd.enable = true;
boot.plymouth.enable = true;
boot.plymouth.theme = "breeze";
environment.systemPackages = with pkgs; [
  plymouth
  breeze-plymouth
];

I get a line Show Plymouth Boot Screen, and then the text prompt as below:

I get the same result if I use bgrt theme for plymouth. What am I doing wrong this time?

PS: I get the attached in the logs about plymouth
plymouth.log

[TLATER]

I'd recommend asking for support on discourse rather than github tickets, but the related ticket #32556 may have some hints.

I've definitely seen it work with that configuration before, though as of 21.11 setting the theme to breeze doesn't seem necessary anymore, I guess the default theme has gained password prompt support.

[nixos-discourse]

This issue has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/get-plymouth-to-show-password-prompt-for-encrypted-root/24916/1

[Majiir]

I have Plymouth showing the password prompt for both ZFS and LUKS encrypted volumes on 23.05. The Discourse thread also indicates the issue is resolved.

Is this two-line config snippet sufficient to close this issue? Or is it a problem that boot.initrd.systemd is required?

boot.initrd.systemd.enable = true;
boot.plymouth.enable = true;

[nomeata]

I can (still) confirm that it works, and that this issue can likely be closed.

I’m not using it, though, it increases my laptop boot time (from grub to X) from 9s to 17s. Yes, these numbers are amazing to what we had around 2000, but still :-)

Also there is unfortunately still flicker, and the status messages from systemd are printed in normal text mode. But flicker-free boot is a topic for a different issue… :-)

(Ok, after adding boot.kernelParams = [ "quiet" "udev.log_level=3" ]; there is no more messages in text mode, which is a bit prettier. Maybe I’ll live with the few extra seconds for loading the plymouth theme or whatever is happening.)

[TLATER]

after adding boot.kernelParams = [ "quiet" "udev.log_level=3" ]; there is no more messages in text mode

Is this actually what other distros do? I feel like it's an anti-pattern because it breaks plymouth's escape-to-see-logs feature.

[Majiir]

Closing this as completed. For future readers, LUKS+Plymouth works if you set boot.initrd.systemd.enable = true. This enables the systemd initrd, which replaces the older script-based stage 1 initrd.

See #44965 for a similar issue about ZFS+Plymouth.

[eclairevoyant]

after adding boot.kernelParams = [ "quiet" "udev.log_level=3" ]; there is no more messages in text mode

Is this actually what other distros do?

Yes.

[ElvishJerricco]

@Majiir I disagree with closing this. Systemd initrd is still marked experimental and is not feature complete. The default initrd in NixOS has this issue.

[WillPower3309]

For those running a system with a root tmpfs, you'll need to persist the /run/plymouth directory

[ElvishJerricco]

@WillPower3309 that doesn't make much sense, because /run is a tmpfs anyway and is not persisted on any system.

[WillPower3309]

@WillPower3309 that doesn't make much sense, because /run is a tmpfs anyway and is not persisted on any system.

I see you're right, and either way Plymouth starts before the mount, but why would Plymouth output:

Forward Password Requests to Plymouth was skipped because of a failed condition check (ConditionPathExists=/run/plymouth/pid).

[ElvishJerricco]

@WillPower3309 I'm not exactly sure why that happens, but it's a red herring. I see that on my system (during stage 2) and plymouth's password prompt works fine (even for passwords in stage 2)