Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-83779

ReaR doesn't recover LUKS encrypted systems properly when multiple keyslots are in use

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • rhel-9.7
    • rhel-8.10, rhel-9.5, rhel-10.0, eln
    • rear
    • None
    • rear-2.6-27.el9
    • No
    • Moderate
    • 1
    • rhel-base-utils-core
    • ssg_core_services
    • 0
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • BaseUtilsC Sprint CY25_00
    • Unspecified
    • Unspecified
    • Unspecified
    • None

      See PR 3430 for issue and long description.

      Steps to reproduce

      1. Install a QEMU/KVM (in UEFI if binding against the TPM) and root device hosting LVM VG encrypted
      2. Either attach a TPM2 device and bind the encrypted device to it
        # yum -y install clevis-pin-tpm2.x86_64
        # clevis luks bind -f -d /dev/vda3 tpm2 '{"pcr_ids":"7"}'
        
      3. Or add a new key to the device using "pbkdf2" algorithm
        # cryptsetup luksAddKey --force-password --pbkdf=pbkdf2 /dev/vda3
      4. Create rescue ISO

      Expected results

      Only 1 line for "crypt" parameters:

      crypt /dev/mapper/luks-157c516f-a8a8-48f2-9b79-082ea905d73b /dev/vda3 type=luks2 cipher=aes-xts-plain64 key_size=512 hash=sha256 uuid=157c516f-a8a8-48f2-9b79-082ea905d73b
      

      Actual results

      Getting 2 lines for "crypt" parameters, which breaks recovery:

      crypt /dev/mapper/luks-157c516f-a8a8-48f2-9b79-082ea905d73b /dev/vda3 type=luks2 cipher=aes-xts-plain64 key_size=512 hash=sha256
      sha256 uuid=157c516f-a8a8-48f2-9b79-082ea905d73b
      

              rhn-support-pcahyna Pavel Cahyna
              rhn-support-rmetrich Renaud Métrich
              Pavel Cahyna Pavel Cahyna
              Lukáš Zaoral Lukáš Zaoral
              Votes:
              1 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated: