fix(crypt): set need_shutdown for LUKS under systemd-cryptsetup

[nadzyah]

cryptroot-ask.sh calls need_shutdown() in the legacy path, but systemd-cryptsetup has no equivalent. Without the flag, dracut-initramfs-restore exits early, the initramfs is not pivoted to at shutdown, and dm-shutdown.sh never runs, leaving LUKS stacks busy and blocking poweroff.

Add a cleanup hook that sets the flag whenever a LUKS mapping is active, matching the mdraid-needshutdown.sh / multipathd-needshutdown.sh pattern.

Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/dracut/+bug/2147476

Checklist

• I have tested it locally
• I have reviewed and updated any documentation if relevant
• I am providing new code and test(s) for it

[bdrung]

Is this a bug in systemd-shutdown? In other words: should we make this case work with systemd-shutdown and not rely on needing dracut's exitrd?

[zertrin]

I think I'm subject to the bug reported on ubuntu. I'm using Ubuntu 25.10 with the root system on LUKS, with systemd-cryptsetup.

└─nvme0n1p7                 259:7    0   590G  0 part  
  └─dm_crypt-0              252:0    0   590G  0 crypt 
    └─ubuntu--vg-ubuntu--lv 252:1    0   590G  0 lvm   /

As this is very annoying, could I "safely" test this fix on my end?

Should I use the hook in this PR and put in under /usr/lib/dracut/modules.d/70crypt (or somewhere else), then change module-setup.sh as per the diff?

[zertrin]

Hum, while digging a bit deeper to understand what's going on, I noticed that on the unmodified system, I already have a /run/initramfs/.need_shutdown while being on the main system.

I'm not sure which module is the source of it, could be lvm_scan.sh or cryptroot-ask.sh most likely (although the root passphrase is being asked by some plymouth nice UI, I don't know if that matters.)

Does this indicate that the changes in this PR wouldn't really change anything? (since, as far as I can understand, this PR is supposed to call need_shutdown function in one more case, but in my case I'm guessing it is already called).

[jefferyto]

Hello - I am the original reporter of the Launchpad issue.

I recently updated to Ubuntu 26.04 and just now tried the fix in this PR (editing /usr/lib/dracut/modules.d/70crypt/module-setup.sh, running update-initramfs -c -k all), and I still have the same issue of shutdown not fully completing.

Similar to what @zertin found, on my system (without the fix in this PR) I have the empty file ".need_shutdown" in /run/initramfs. I also believe this was created by lvm_scan.sh.

Not sure if these will be helpful (both without changes in this PR):

• Journal entries of a session where I booted my computer, then immediately triggered shutdown at the login screen
• Output of lsinitrd

[nadzyah]

@zertrin @jefferyto thank you so much for testing these changes! I really appreciate it! I'll be sure to dive back into this when I find some time later. Thanks again!

[jefferyto]

Thanks @nadzyah - just wanted to clarify, this PR, or a fix in systemd-shutdown as @bdrung asked, is probably necessary (i.e. when LUKS encryption is used but without lvm) but it doesn't appear to fix the Launchpad issue.