Bug 1377355

RFE:

Override kernel default for dm-crypt mappings of LUKS1 encrypted volumes via flag put in /etc/crypttab file. This change should affect only newly created encrypted storage based on LUKS1 format during installation. Existing setups should stay intact during distro upgrade or re-installation with existing encrypted storage left intact (no re-format requested)

This flag will activate the dm-crypt mapping with discard enabled.

Reasoning for the change:

User base of Fedora distribution with SSDs grows steadily and while the argument for kernel default setting not to enable the discard is still strong one it doesn't change the fact that vast majority of users (with SSDs) doesn't want to sacrifice better performance of drive with discard/trim enabled for the sake of secrecy.

We're not speaking encrypted data security here and double emphasize on it! Only the fact that blank filesystem on top of dm-crypt device with discard enabled may create well visible patterns in ciphertext device below on SSDs.

For LUKS1 metadata format we don't have a space to store the new default in metadata and therefore we can't flip the default for new LUKS1 devices being formated via libcryptsetup or cryptsetup utility.

Changing the kernel default is of the table due to risk of data corruption with some TrueCrypt configurations involving hidden volumes.

For rotational devices the cost of enabled discard is negligible