Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-110511

No volume key gets linked after specifying link-volume-key option in the cryptab

Linking RHIVOS CVEs to...Migration: Automation ...Sync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Not a Bug
    • Icon: Undefined Undefined
    • None
    • rhel-10.0
    • cryptsetup
    • None
    • No
    • None
    • rhel-storage-crs
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      I wanted to use link-volume-key option to link LUKS volume key to specified keyring so later the key will be passed to kdump kernel.

      What is the impact of this issue to you?

      kdump won't be able to save vmcore LUKS-encrypted volume.

      Please provide the package NVR for which the bug is seen:

      6.12.0-120.el10.x86_64
      cryptsetup-2.7.5-2.el10.x86_64

      How reproducible is this bug?:

      Always

      Steps to reproduce

      1. Prepare the following kickstart file luks.ks and share it by "python -m http.server"
        %packages
        kernel-core
        %end
        
        autopart --encrypted --passphrase=c --type=lvm
        clearpart --all --initlabel
        # Root password
        rootpw --allow-ssh --plaintext c
        reboot
        
      2. Install the system
        virt-install --ram 4096 --location http://download.devel.redhat.com/rhel-10/nightly/RHEL-10/latest-RHEL-10/compose/BaseOS/x86_64/os/ --extra-args="
        console=ttyS0 inst.ks=http://192.168.122.1:8000/luks.ks "
        
      3.  Set up link-volume-key option in /etc/crypttab e.g.
        luks-312df05d-5002-47e4-982f-76e34a72bf7c UUID=312df05d-5002-47e4-982f-76e34a72bf7c none  discard,link-volume-key=@u::%logon:cryptsetup:312df05d-5002-47e4-982f-76e34a72bf7c
        
      4.  Reboot the system

      Expected results

      LUKS volume key will gets linked to a logon key

      # keyctl show
      Session Keyring
       757556085 --alswrv      0     0  keyring: _ses
      1050121202 --alswrv      0 65534   \_ keyring: _uid.0
       965244752 --alsw-v      0     0       \_ logon: cryptsetup:dcb89579-566c-404f-8a7f-231e386e5b55
      

      Actual results

      No logon key shows in the output of "keyctl show".

      Notes

      1. 'cryptsetup open "UUID=DEVICE" DUMMY --link-vk-to-keyring=KEY_DES --test-passphrase' can link key to specified keyring
      2. I notice Fedaor kernel-6.14.0-63.fc42.x86_64 also has this issue but -6.15.9-201.fc42.x86_64 and 6.15.10-200.fc42.x86_64 work.

              okozina@redhat.com Ondrej Kozina
              coxu@redhat.com Coiby Xu
              Ondrej Kozina Ondrej Kozina
              storage-qe storage-qe
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: