Bug 2028091

Summary:	[RFE] Support a null pin
Product:	Red Hat Enterprise Linux 9	Reporter:	Antonio Murdaca <amurdaca>
Component:	clevis	Assignee:	Sergio Correia <scorreia>
Status:	CLOSED ERRATA	QA Contact:	Martin Zelený <mzeleny>
Severity:	unspecified	Docs Contact:
Priority:	medium
Version:	9.0	CC:	dapospis, mzeleny
Target Milestone:	rc	Keywords:	FutureFeature, Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	clevis-18-102.el9	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:
Clones:	2028096 (view as bug list)		Environment:
Last Closed:	2022-05-17 13:05:07 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2028096

Description Antonio Murdaca 2021-12-01 13:13:47 UTC

Description of problem:

We have a use case where we build a raw image formatted with luks and we cannot store a default password to later unlock the container during installation. Our idea was to have a pin similar to the sss's test pin upstream so we could 1) format the disk, 2) clevis luks bind with the test (null) pin, 3) cryptsetup luksRemoveKey, 4) ship the image. When the installer has to unlock the disk, it'll simply call clevis-luks-unlock and it could do its things there. In our use case, we have an extra step on first-boot where we'll re-encrypt the disk using tpm2 so it's still secure.

We'd need a new `clevis-pin-null` shipped in RHEL and as a dracut module too within `clevis-dracut`



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 8 errata-xmlrpc 2022-05-17 13:05:07 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: clevis), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:2451