GENLUKS(8) System Manager's Manual GENLUKS(8)

genluks — format, encrypt and mount the partitions of a new system

genluks mountpoint device:target[:options] ...

genluks lays out an encrypted install in one command. For each device it creates a LUKS2 container, opens it, makes the file system and mounts it at target under mountpoint. Mounting follows how the targets nest, not the order given. Then every encrypted volume other than root gets a key file on the encrypted root, and /etc/crypttab is written, so one passphrase at boot opens everything; see encryption(7).

genluks checks all arguments first, shows what it will erase, and continues only when yes is typed. It then asks for the passphrase twice.

target is an absolute path, or the word swap. One of the targets must be /. options are separated by commas:

No encryption, for example for a partition another system must read. Root cannot be plain.
| |
The file system; the default is ext4. Swap takes none.

The mapped devices are named croot for root, cswap for swap and c followed by the target's letters and digits otherwise, such as cvar or chome.

genluks refuses a device that is mounted or already open, a device on the disk the running system was booted from, a device or target given twice, the EFI system partition (/boot/efi), which is formatted and mounted by hand, and a mountpoint that is already mounted.

mountpoint/etc/crypttab
Encrypted volumes besides root, with their key files.
mountpoint/etc/cryptkeys/name.key
Key files, mode 400.

The genluks utility exits 0 on success, and >0 if an error occurs.

Everything on one encrypted root:

# genluks /mnt /dev/sdX2:/

Separate /var, /home and swap, all encrypted:

# genluks /mnt /dev/sdX2:/ /dev/sdX3:/var /dev/sdX6:/home /dev/sdX8:swap

An unencrypted xfs partition shared with another system:

# genluks /mnt /dev/sdX2:/ /dev/sdX9:/data2:plain,xfs

encryption(7), installation(7), partition(7), cryptsetup(8), setup-boot(8)

September 27, 2026 setup 1.0