The installer writes the crypttab entry of the encrypted device holding the root filesystem without `x-initrd.attach`, for example `dm_crypt-0 UUID=... none luks`. systemd's crypttab(5) says: "x-initrd.attach is still recommended with the encrypted block device containing the root file system as otherwise systemd will attempt to detach the device during the regular system shutdown while it is still in use. With this option the device will still be detached but later after the root file system is unmounted."
Workaround, confirmed on Ubuntu 26.04 with dracut over four shutdowns: change the options of that entry to `luks,x-initrd.attach`, then run `sudo systemctl daemon-reload` and `sudo update-initramfs -u`. After the next shutdown, `journalctl -b -1 -u 'systemd-cryptsetup@*'` shows no failure. Ubuntu's cryptsetup scripts accept the option (Debian #1072058), and dracut's systemd-cryptsetup supports it. systemd behaves as documented, so the fix belongs in the installer, which writes /etc/crypttab: curtin's `dm_crypt_handler` (curtin/commands/block_meta.py) writes the options it is given, `luks` by default. Fedora fixed the same in anaconda: https://github.com/rhinstaller/anaconda/pull/6785 ("Add x-initrd.attach to /etc/crypttab device for / volumes"), after https://github.com/systemd/systemd/issues/39580. ** Bug watch added: github.com/systemd/systemd/issues #39580 https://github.com/systemd/systemd/issues/39580 ** Also affects: curtin Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2152224 Title: systemd-cryptsetup fails to deactivate LUKS device on shutdown with LVM-on-LUKS root filesystem To manage notifications about this bug go to: https://bugs.launchpad.net/curtin/+bug/2152224/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
