Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-82885

RHEL-10: libblockdev: ostree-based systems deployed with blivet can't fstrim LUKS-encrypted partitions of SSD hard drive by default

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Blocker Blocker
    • rhel-10.0
    • rhel-9.6, rhel-10.0
    • libblockdev
    • libblockdev-3.2.0-3.el10_0
    • No
    • Critical
    • rhel-sst-storage-management
    • ssg_platform_storage
    • 30
    • 31
    • 1
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • Approved Blocker
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      What were you trying to do that didn't work?

      fstrim doesn't work on `/` partition for ostree based deployments installed by anaconda/blivet.

      The fstrim is enabled by default for a long time by /etc/crypttab, however, given the fact that ostree based systems won't build initrd on system the systemd-cryptsetup-generator will not know about it when opening a root LUKS and won't set the discard option correctly.

      What is the impact of this issue to you?

      The system with these conditions:

      • LUKS partition on `/` mount
      • SSD drive
      • ostree based system

      will not have working fstrim.

      That means that after unspecified number of IO operations your system might became completely unresponsive.

      Please provide the package NVR for which the bug is seen:

      All the ostree based systems are impacted. This bug is impacting all ostree based systems deployed by anaconda/blivet.

      How reproducible is this bug?:

      Always

      Steps to reproduce

      1. Install ostree based system
      2. In the installed system run `sudo fstrim -av`
      3. If you see "fstrim: /: the discard operation is not supported" the system is impacted

      Expected results

      The fstrim command should work on `/` mount.

      Actual results

      The fstrim command raise error on `/` mount.

      Notes

      This could be fixed on newly installed systems but we can't fix this on already installed systems as there are security implications. To fix this on existing system you need to run:

      cryptsetup --allow-discards --persistent refresh <luks device>

      where the luks device could be read from `lsbkl` or `/dev/mapper/luks-*`.

      The system might require a reboot to make the changes working.

              vtrefny@redhat.com Vojtěch Trefný
              jkonecny@redhat.com Jiri Konecny
              Vojtěch Trefný Vojtěch Trefný
              Guangwu Zhang Guangwu Zhang
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated: