fix(crypt): standardise password retry behaviour with rd.luks.tries - #2344
Draft
nadzyah wants to merge 1 commit into
Draft
fix(crypt): standardise password retry behaviour with rd.luks.tries#2344nadzyah wants to merge 1 commit into
nadzyah wants to merge 1 commit into
Conversation
github-actions
Bot
added
test
nadzyah
force-pushed
the
fix-systemd-cryptsetup-wrong-pass
branch
from
April 1, 2026 15:23
b8700a0 to
39a4e2d
Compare
bdrung
reviewed
Apr 1, 2026
nadzyah
force-pushed
the
fix-systemd-cryptsetup-wrong-pass
branch
4 times, most recently
from
April 2, 2026 21:24
e802fdf to
edda796
Compare
nadzyah
force-pushed
the
fix-systemd-cryptsetup-wrong-pass
branch
2 times, most recently
from
April 13, 2026 17:27
af4d5bf to
a117d47
Compare
nadzyah
changed the title
nadzyah
force-pushed
the
fix-systemd-cryptsetup-wrong-pass
branch
3 times, most recently
from
April 15, 2026 14:34
bbe3ce5 to
69bf6b9
Compare
bdrung
reviewed
Apr 16, 2026
bdrung
reviewed
Apr 16, 2026
nadzyah
force-pushed
the
fix-systemd-cryptsetup-wrong-pass
branch
from
April 16, 2026 09:12
69bf6b9 to
73fb3e5
Compare
bdrung
reviewed
Apr 16, 2026
nadzyah
force-pushed
the
fix-systemd-cryptsetup-wrong-pass
branch
2 times, most recently
from
April 16, 2026 16:06
a9b80ba to
c301dc4
Compare
bdrung
reviewed
Apr 17, 2026
bdrung
left a comment
bdrung
left a comment
Member
There was a problem hiding this comment.
rd.luks.tries should be documented in the man page.
nadzyah
force-pushed
the
fix-systemd-cryptsetup-wrong-pass
branch
from
April 17, 2026 19:38
c301dc4 to
342cf4a
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
nadzyah
force-pushed
the
fix-systemd-cryptsetup-wrong-pass
branch
from
April 17, 2026 19:41
342cf4a to
e789dab
Compare
Without an explicit tries= in crypttab, systemd-cryptsetup defaults to three attempts and gives up, causing dracut-initqueue to hang before reaching the emergency shell. Standardise retries via rd.luks.options=tries=N (default 0, meaning unlimited) across the generator drop-in, rd.auto, luks_open_interactive, and the hostonly crypttab copy. Add a TEST-41-FULL-SYSTEMD test that sends three wrong passwords then the correct one. Bug-Ubuntu: https://launchpad.net/bugs/2146686
nadzyah
force-pushed
the
fix-systemd-cryptsetup-wrong-pass
branch
from
April 24, 2026 20:41
e789dab to
c7a0e31
Compare
Member
|
Created systemd/systemd#41984 to address the systemd-cryptsetup default in the tool itself. |
Collaborator
|
Merge conflict, marking it draft for now. |
devkontrol
marked this pull request as draft
August 10, 2026 13:44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Without an explicit tries= in the crypttab entry, systemd-cryptsetup uses its default of 3 attempts and then gives up, causing dracut-initqueue to hang silently before dropping to an emergency shell.
Set tries=0 across all paths that generate crypttab entries in the initrd. Entries that already specify tries= are left unchanged.
Add a test to TEST-41-FULL-SYSTEMD that sends three wrong passwords, then the correct one, verifying the system unlocks successfully.
The bug was originally reported on Launchpad: https://bugs.launchpad.net/ubuntu/+source/dracut/+bug/2146686
Checklist