CLEVIS-LUKS-UNLOCK(7)

💖 CLEVIS-LUKS-UNLOCK 💖

okay bestie, so this is clevis-luks-unlockers — the whole ✨overview✨ of clevis luks unlockers. it's a manual page (section 7, if you were wondering) and it's basically the group chat rundown of all the ways your LUKS volume can get unlocked without you typing a password like it's 2009. 🎀

---

🌸 OVERVIEW 🌸

Clevis hands you unlockers for LUKS volumes, and those unlockers can use LUKS policy. here's the roster, no cap:

• clevis-luks-unlock — unlocks manually, you do it yourself from the command line. main character energy, honestly.
• dracut — unlocks automatically during early boot.
• systemd — unlocks automatically during late boot.
• udisks2 — unlocks automatically in a GNOME desktop session.

so here's the vibe: once a LUKS volume is bound using clevis luks bind, it can be unlocked with any of the unlockers above — no password needed. periodt. 💅

---

💅 MANUAL UNLOCKING 💅

you can unlock a LUKS volume manually with this command:

$ sudo clevis luks unlock -d /dev/sda

want more tea on that one? see clevis-luks-unlock(1). 🫶

---

🦋 EARLY BOOT UNLOCKING 🦋

if Clevis integration does not already ship in your initramfs, you may need to rebuild your initramfs with this command:

$ sudo dracut -f

once Clevis is integrated into your initramfs, a simple reboot should unlock your root volume. iconique. 🎀

⚠️ ok but listen — early boot integration only works for the root volume. non-root volumes should use the late boot unlocker instead. don't come for me, that's just how it is 😭

also, Dracut will not bring up your network by default. you've got two options:

1. have it come up via DHCP by using rd.neednet=1 in kernel cmdline, or
2. specify custom network parameters, such as static IP configuration — please consult the dracut documentation for that.

DHCP can be easily added to early boot by setting it in a configuration file and rebuilding initramfs afterwards:

$ echo 'kernel_cmdline="rd.neednet=1"' | sudo tee /etc/dracut.conf.d/clevis.conf
$ sudo dracut -f

slay. ✨

---

🌈 LATE BOOT UNLOCKING 🌈

you can enable late boot unlocking by executing the following command:

$ sudo systemctl enable clevis-luks-askpass.path

after a reboot, Clevis will attempt to unlock all devices listed in /etc/crypttab that have clevis bindings — and it does this when systemd prompts for their passwords. so you just… don't have to type them. obsessed. 💜

---

🧚 DESKTOP UNLOCKING 🧚

when the udisks2 unlocker is installed, your GNOME desktop session should unlock LUKS removable devices configured with Clevis automatically. ✨

🙈 heads up: you may need to restart your desktop session after installation for the unlocker to be loaded.

---

👑 SEE ALSO 👑

• clevis-luks-unlock(1)
• clevis-luks-bind(1)

---

and that's the whole page, bestie 🫶 this was CLEVIS-LUKS-UNLOCK(7) from 10/16/2026 — go forth and unlock things, you've got this 💖🌸🎀