Bug 1876837

Summary: systemd-cryptsetup asks for a passphrase even when the luks device can only be opened using a key file
Product: Red Hat Enterprise Linux 8 Reporter: Renaud Métrich <rmetrich>
Component: systemdAssignee: Michal Sekletar <msekleta>
Status: CLOSED MIGRATED QA Contact: Frantisek Sumsal <fsumsal>
Severity: medium Docs Contact:
Priority: medium    
Version: 8.2CC: dbodnarc, dtardon, msekleta, okozina, systemd-maint-list
Target Milestone: rcKeywords: Improvement, MigratedToJIRA, Triaged
Target Release: 8.0Flags: pm-rhel: mirror+
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-09-21 11:12:32 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Renaud Métrich 2020-09-08 10:19:55 UTC 
Description of problem:

When a luks device is brought up and the key is not available to open the device, systemd-cryptsetup requests a passphrase anyway, even if this makes no sense.
Fixing this requires to know how the luks device can be opened (through passphrase, key, clevis, etc.), the information may not be available with current cryptsetup API, so maybe an additional RFE may be necessary.

Version-Release number of selected component (if applicable):

systemd-239-31.el8_2.2.x86_64


How reproducible:

Always


Steps to Reproduce:
1. Set up a luks device that opens through a key

  # truncate -s 1G /root/encrypted_fs
  # echo "encrypted_fs_key" > /root/encrypted_fs.key
  # cryptsetup luksFormat /root/encrypted_fs --key-file /root/encrypted_fs.key

2. Edit /etc/crypttab to add the device but with non existing key (so that it fails)

  # echo "encrypted /root/encrypted_fs /root/no_such_key" >> /etc/crypttab
  # systemctl daemon-reload

3. Try opening the device

  # systemctl start systemd-cryptsetup

Actual results:

  Please enter passphrase for disk encrypted! 

Expected results:

  "Failure + key not found message" or "Failure + check the journal for error"
Comment 10 RHEL Program Management 2023-09-21 11:07:31 UTC 
Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug.
Comment 11 RHEL Program Management 2023-09-21 11:12:32 UTC 
This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there.

Due to differences in account names between systems, some fields were not replicated.  Be sure to add yourself to Jira issue's "Watchers" field to continue receiving updates and add others to the "Need Info From" field to continue requesting information.

To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer.  You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like:

"Bugzilla Bug" = 1234567

In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues. You can also visit https://access.redhat.com/articles/7032570 for general account information.
Comment 12 Red Hat Bugzilla 2024-01-20 04:25:04 UTC 
The needinfo request[s] on this closed bug have been removed as they have been unresolved for 120 days