#Can I edit crypttab?

1 messages · Page 1 of 1 (latest)

cursive mist
#

Hi on fedora workstation I tend to add ,tries=5 to my crypttab file as a qol improvement to the disk unlock. However my understanding is this won't persist on an ostree distro across new deployments

So is the approach basically to layer my own? I'm assuming I can basically do this as some diff?

Thanks 🙂

candid tide
#

changes you make to files in /etc do persist across new deployments

#

the way ostree deployments work is that /usr is replaced entirely with the new image, while /etc does a three-way merge, where files that are unmodified from the corresponding file in /usr/etc are replaced with the new image's version of the file, but files that differ from the corresponding file in /usr/etc are not replaced

#

(this is also why it's often recommended to use "drop-in" configuration files instead of editing an existing configuration file in /etc, because if you edit a file in /etc then you won't receive any future updates to it)

cursive mist
#

Ah right that makes sense. So in this case id need to copy the file to /usr/etc/crypttab and edit there?

candid tide
#

oh but also with /etc/crypttab (and a few other similar files), there's no corresponding file in /usr/etc at all, so it won't be replaced with new deployments regardless

candid tide
#

you can edit files in /etc and the changes will persist, just keep in mind that the changes persisting necessarily means that you won't receive future updates to that file from the base image

cursive mist
candid tide
#

set an override for what?

#

oh you mean if you want to edit a file in /usr? yeah you can't do that directly in an ostree system, you'd have to layer a package that makes the change

#

one of the main points of the atomic system is that /usr is read-only and determined entirely by the base image + layered packages/overrides

#

so e.g. if you have two systems with the same base image + additional layers then their /usr directories should be bit-for-bit identical

cursive mist
candid tide
#

crypttab is in /etc, not /usr, so like I said there's no issue with editing that

#

there's very rarely any reason to want to edit something in /usr

cursive mist
#

Amazing thanks for your help 😃

candid tide
#

oh actually it's worth mentioning, if you want to temporarily edit something in /usr (like to test out a change), you can run rpm-ostree usroverlay as root and it'll remount /usr as read-write, letting you make changes that only persist until reboot