I used the setup from this guide several times with no problems in the past, but in 4.3 RC2 it somehow didn’t work this time. Somehow after finishing the setup and rebooting the system, I got a boot failure.
Not sure if something changed in the new release or if I did something wrong this time, but essentially I had to put these lines in /etc/dracut.conf.d/crypt.conf:
add_dracutmodules+=" crypt "
install_items+=" /root/header.img /usr/sbin/cryptsetup /etc/crypttab "
And in /etc/crypttab:
luks /dev/disk/by-id/ata-YOUR_DISK_ID none header=/root/header.img,force,x-initrd.attach,discard
Then it worked again.
Additionally, because of the new policy system in 4.3, I wasn’t able to attach my USB to dom0 anymore. I tried to add a policy in the Qubes Policy Editor:
30-allow-dom0-block
qubes.BlockList * dom0 sys-usb allow
qubes.BlockAttach * dom0 sys-usb allow
qubes.BlockDetach * dom0 sys-usb allow
But somehow that didn’t work. Not sure if there is a bug or I made a mistake. But for now I helped myself by updating with this command:
qvm-run -u root sys-usb 'umount -f /dev/sdX1 2>/dev/null || true; umount -f /dev/sdX2 2>/dev/null || true; mkdir -p /mnt/boot/efi; mount /dev/sdX2 /mnt/boot; mount /dev/sdX1 /mnt/boot/efi' && sudo qubes-dom0-update && sudo tar -C /boot -cpf - . | qvm-run --pass-io sys-usb 'sudo tar -C /mnt/boot -xpf -' && qvm-run -u root sys-usb 'sync; umount /mnt/boot/efi /mnt/boot'`