|
 |
17b0f1 |
From ec71ee722b573560c14840214adab862b09280c3 Mon Sep 17 00:00:00 2001
|
|
|
17b0f1 |
From: Michal Sekletar <msekleta@redhat.com>
|
|
|
17b0f1 |
Date: Tue, 12 Dec 2017 17:49:14 +0100
|
|
|
17b0f1 |
Subject: [PATCH] cryptsetup: when unlocking always put path to the object into
|
|
|
17b0f1 |
Id
|
|
|
17b0f1 |
|
|
|
17b0f1 |
Some ask-password agents (e.g. clevis-luks-askpass) use Id option from
|
|
|
17b0f1 |
/run/systemd/ask-password/ask* file in order to obtain the password for
|
|
|
17b0f1 |
the device.
|
|
|
17b0f1 |
|
|
|
17b0f1 |
Id option should be in the following format,
|
|
|
17b0f1 |
e.g. Id=subsystem:data. Where data part is supposed to identify object
|
|
|
17b0f1 |
that ask-password query is done for. Since
|
|
|
17b0f1 |
e51b9486d1b59e72c293028fed1384f4e4ef09aa this field has format
|
|
|
17b0f1 |
Id=cryptsetup:/dev/block/major:minor when systemd-cryptsetup is
|
|
|
17b0f1 |
unlocking encrypted block device. However, crypttab also supports
|
|
|
17b0f1 |
encrypted image files in which case we usually set data part of Id to
|
|
|
17b0f1 |
"vol on mountpoint". This is unexpected and actually breaks network
|
|
|
17b0f1 |
based device encryption as implemented by clevis.
|
|
|
17b0f1 |
|
|
|
17b0f1 |
Example:
|
|
|
17b0f1 |
$ cat /etc/crypttab
|
|
|
17b0f1 |
clevis-unlocked /clevis-test-disk-image none luks,_netdev
|
|
|
17b0f1 |
$ systemctl start 'systemd-cryptsetup@clevis\x2dunlocked.service'
|
|
|
17b0f1 |
$ grep Id /run/systemd/ask-password/ask*
|
|
|
17b0f1 |
|
|
|
17b0f1 |
Before:
|
|
|
17b0f1 |
$ Id=cryptsetup:clevis-unlocked on /clevis-test-disk-image-mnt
|
|
|
17b0f1 |
|
|
|
17b0f1 |
After:
|
|
|
17b0f1 |
$ Id=cryptsetup:/clevis-test-disk-image
|
|
|
17b0f1 |
|
|
|
17b0f1 |
(cherry-picked from commit 5a9f1b05ed6dad48958097fb37811668e69447fb)
|
|
|
17b0f1 |
|
|
|
17b0f1 |
Resolves: #1511043
|
|
|
17b0f1 |
---
|
|
|
17b0f1 |
src/cryptsetup/cryptsetup.c | 2 +-
|
|
|
17b0f1 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
17b0f1 |
|
|
|
17b0f1 |
diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c
|
|
|
17b0f1 |
index 5dedb073e4..c57d2b2948 100644
|
|
|
17b0f1 |
--- a/src/cryptsetup/cryptsetup.c
|
|
|
17b0f1 |
+++ b/src/cryptsetup/cryptsetup.c
|
|
|
17b0f1 |
@@ -342,7 +342,7 @@ static int get_password(const char *vol, const char *src, usec_t until, bool acc
|
|
|
17b0f1 |
escaped_name = maj_min;
|
|
|
17b0f1 |
maj_min = NULL;
|
|
|
17b0f1 |
} else
|
|
|
17b0f1 |
- escaped_name = cescape(name);
|
|
|
17b0f1 |
+ escaped_name = cescape(src);
|
|
|
17b0f1 |
|
|
|
17b0f1 |
if (!escaped_name)
|
|
|
17b0f1 |
return log_oom();
|