1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
.Dd September 27, 2026
.Dt GENLUKS 8
.Os
.Sh NAME
.Nm genluks
.Nd format, encrypt and mount the partitions of a new system
.Sh SYNOPSIS
.Nm
.Ar mountpoint
.Sm off
.Ar device : target Op : options
.Sm on
.Ar ...
.Sh DESCRIPTION
.Nm
lays out an encrypted install in one command.
For each
.Ar device
it creates a LUKS2 container, opens it, makes the file system and
mounts it at
.Ar target
under
.Ar mountpoint .
Mounting follows how the targets nest, not the order given.
Then every encrypted volume other than root gets a key file on the
encrypted root, and
.Pa /etc/crypttab
is written, so one passphrase at boot opens everything; see
.Xr encryption 7 .
.Pp
.Sy This destroys everything on the devices.
.Nm
checks all arguments first, shows what it will erase, and continues
only when
.Li yes
is typed.
It then asks for the passphrase twice.
.Pp
.Ar target
is an absolute path, or the word
.Li swap .
One of the targets must be
.Pa / .
.Ar options
are separated by commas:
.Bl -tag -width "ext4 | xfs | btrfs"
.It Li plain
No encryption, for example for a partition another system must read.
Root cannot be plain.
.It Li ext4 | xfs | btrfs
The file system; the default is ext4.
Swap takes none.
.El
.Pp
The mapped devices are named
.Li croot
for root,
.Li cswap
for swap and
.Li c
followed by the target's letters and digits otherwise, such as
.Li cvar
or
.Li chome .
.Pp
.Nm
refuses a device that is mounted or already open, a device on the disk
the running system was booted from, a device or target given twice,
the EFI system partition
.Pq Pa /boot/efi ,
which is formatted and mounted by hand, and a
.Ar mountpoint
that is already mounted.
.Sh FILES
.Bl -tag -width Ds
.It Ar mountpoint Ns Pa /etc/crypttab
Encrypted volumes besides root, with their key files.
.It Ar mountpoint Ns Pa /etc/cryptkeys/ Ns Ar name Ns Pa .key
Key files, mode 400.
.El
.Sh EXIT STATUS
.Ex -std
.Sh EXAMPLES
Everything on one encrypted root:
.Dl # genluks /mnt /dev/sdX2:/
.Pp
Separate
.Pa /var ,
.Pa /home
and swap, all encrypted:
.Dl # genluks /mnt /dev/sdX2:/ /dev/sdX3:/var /dev/sdX6:/home /dev/sdX8:swap
.Pp
An unencrypted xfs partition shared with another system:
.Dl # genluks /mnt /dev/sdX2:/ /dev/sdX9:/data2:plain,xfs
.Sh SEE ALSO
.Xr encryption 7 ,
.Xr installation 7 ,
.Xr partition 7 ,
.Xr cryptsetup 8 ,
.Xr setup-boot 8
|
