расшифровака root раздела ключом

share_crypt   /dev/disk/by-uuid/f1500b88-fa6e-4b6c-9f34-f985b63da475   /dev/disk/by-uuid/E0D4-AEFA:/keyfile    luks,hash=plain,keyscript=/lib/cryptsetup/scripts/passdev

share_crypt   /dev/disk/by-uuid/f1500b88-fa6e-4b6c-9f34-f985b63da475   /dev/disk/by-label/SECRET:/keyfile luks,hash=plain,keyscript=/lib/cryptsetup/scripts/passdev

#
# MODULES: [ most | netboot | dep | list ]
#
# most - Add most filesystem and all harddrive drivers.
#
# dep - Try and guess which modules to load.
#
# netboot - Add the base modules, network modules, but skip block devices.
#
# list - Only include modules from the 'additional modules' list
#

cd /root
mkdir hooks ramfs
gdisk /dev/sdd		1. ef00 100мб
cd hooks;./hook_cr
lsblk -f  (UUID sda crypto_LUKS) > hooks/crypt
pacstrap /mnt base base-devel gummiboot
genfstab -p /mnt >> /mnt/etc/fstab (закоментить /boot)

arch-chroot /mnt
bash
gummiboot install
nano /boot/loader/entries/arch.conf {
title Arch Linux Encrypted
linux /vmlinuz-linux
options initrd=/initramfs-linux.img root=/dev/mapper/crypted_root rw }
nano /etc/mkinitcpio.conf { MODULES="loop"; HOOKS="...encrypt..." }
mkinitcpio -p linux
ln -s /usr/share/zoneinfo/Eorupe/Moscow /etc/localtime
nano /etc/locale.gen { ru_RU.UTF-8 }
locale-gen
echo LANG=ru_RU.UTF-8 > /etc/locale.conf 
pacman -S sudo xf86-video-intel xorg-server xorg-xinit gdm file-roller unrar dodsfstools gimp gnome-screenshot xinnamon vlc viewnior openssh wget pavucontrol pulseaudio gedit terminus-font sakura
nano /etc/sudoers { %wheel ALL=(ALL) ALL }
systemctl enable gdm.service
systemctl enable NetworkManager.service
useradd -m -g users -G wheel one
passwd one
passwd
exit

cd /root/ramfs
mv /mnt/boot/initramfs-linux.img .
pacman -Syy;pacman -S cpio
gunzip -c -9 initramfs-linux.img | cpio -i -d -H newc --no-absolute-filenames
cp /root/hooks/* /root/ramfs/hooks
nano *config { HOOKS="udev crypt" } 
find . | cpio -o -H newc | gzip -9 > initramfs-linux.img
mv initramfs-linux.img /mnt/boot

reboot

 -hook_cr-
ROOT_DEV=/dev/sda      # root device
cryptsetup close keyf
cryptsetup close crypted_root
rm -f image.iso crypt

dd if=/dev/urandom of=image.iso count=4096 &&
cryptsetup --align-payload=1 luksFormat -c aes-xts-plain64 -s 512 -h sha512 image.iso &&
cryptsetup luksOpen image.iso keyf &&
cryptsetup luksFormat -c aes-xts-plain64 -s 512 -h sha512 $ROOT_DEV --key-file=/dev/mapper/keyf &&
cryptsetup luksOpen $ROOT_DEV crypted_root --key-file=/dev/mapper/keyf &&

IFS=' '
TEXT=$(cat <<'EOTEXT'
#!/usr/bin/ash

run_hook() {
        modprobe -a -q dm-crypt >/dev/null 2>&1
        [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"
        modprobe -a -q loop >/dev/null 2>&1
        [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"

sleep 1

cryptsetup open /hooks/image.iso keyf
cryptsetup open UUID=a1aa1a1-0a1a1e-4e43-8ccc-9798ea25f7d5 crypt_root --key-file=/dev/mapper/keyf
cryptsetup close keyf
}

# vim: set ft=sh ts=4 sw=4 et:
EOTEXT
)

echo $TEXT > crypt
chmod 755 crypt