Bug 2163497

Description of problem:
The minimal length of passwords used for LUKS/PBKDF2 in FIPS mode has been set to 8 bytes by openssl. See bug 2137557 and bug 2148841.

When a password shorter than 8 bytes is used in the installer (either specified in the kickstart file or entered manually in GUI), the installation fails with a traceback. Both luks1 and luks2 versions are affected.

It's still possible to use passwords shorter than 8 bytes when FIPS mode is not enabled.


Version-Release number of selected component (if applicable):
RHEL-9.2.0-20230123.13
cryptsetup-2.6.0-2.el9
openssl-3.0.7-2.el9
anaconda-34.25.2.6-1.el9

How reproducible:
Always

Steps to Reproduce:
1. Start installation in FIPS mode ("fips=1" on the kernel cmdline)
2. Create a LUKS device during the installation, set a password shorter than 8 bytes
3. Try to finish the installation.

The same problem can be reproduced with a kickstart installation and the following autopart command:
autopart --encrypted --passphrase=redhat

Actual results:
Anaconda crashes with a traceback.

Expected results:
The installer should not allow to use passwords shorter than 8 bytes in FIPS mode.

Additional info:
Traceback from storage.log:
...
DEBUG:blivet:                PartitionDevice.setup: vda3 ; orig: False ; status: True ; controllable: True ;
DEBUG:blivet:                LUKS.create: device: /dev/vda3 ; type: luks ; status: False ;
DEBUG:blivet:                  LUKS._create: device: /dev/vda3 ; type: luks ; status: False ;
INFO:program:[cryptsetup] Invalid passphrase for PBKDF2 in FIPS mode.

INFO:anaconda.threading:Thread Failed: AnaTaskThread-CreateStorageLayoutTask-1 (140122123155008)
ERROR:anaconda.modules.common.task.task:Thread AnaTaskThread-CreateStorageLayoutTask-1 has failed: Traceback (most recent call last):
  File "/usr/lib64/python3.9/site-packages/gi/overrides/BlockDev.py", line 1093, in wrapped
    ret = orig_obj(*args, **kwargs)
  File "/usr/lib64/python3.9/site-packages/gi/overrides/BlockDev.py", line 224, in crypto_luks_format
    return _crypto_luks_format(device, cipher, key_size, passphrase, key_file, min_entropy, luks_version, extra)
gi.repository.GLib.GError: g-bd-crypto-error-quark: Failed to add passphrase: Invalid argument (6)

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib64/python3.9/site-packages/pyanaconda/threading.py", line 275, in run
    threading.Thread.run(self)
  File "/usr/lib64/python3.9/threading.py", line 917, in run
    self._target(*self._args, **self._kwargs)
  File "/usr/lib64/python3.9/site-packages/pyanaconda/modules/common/task/task.py", line 96, in _thread_run_callback
    self._task_run_callback()
  File "/usr/lib64/python3.9/site-packages/pyanaconda/modules/common/task/task.py", line 109, in _task_run_callback
    self._set_result(self.run())
  File "/usr/lib64/python3.9/site-packages/pyanaconda/modules/storage/installation.py", line 86, in run
    self._turn_on_filesystems(
  File "/usr/lib64/python3.9/site-packages/pyanaconda/modules/storage/installation.py", line 166, in _turn_on_filesystems
    storage.do_it(callbacks)
  File "/usr/lib/python3.9/site-packages/blivet/threads.py", line 53, in run_with_lock
    return m(*args, **kwargs)
  File "/usr/lib/python3.9/site-packages/blivet/blivet.py", line 115, in do_it
    self.devicetree.actions.process(callbacks=callbacks, devices=self.devices)
  File "/usr/lib/python3.9/site-packages/blivet/actionlist.py", line 47, in wrapped_func
    return func(obj, *args, **kwargs)
  File "/usr/lib/python3.9/site-packages/blivet/actionlist.py", line 284, in process
    action.execute(callbacks)
  File "/usr/lib/python3.9/site-packages/blivet/threads.py", line 53, in run_with_lock
    return m(*args, **kwargs)
  File "/usr/lib/python3.9/site-packages/blivet/deviceaction.py", line 662, in execute
    self.device.format.create(device=self.device.path,
  File "/usr/lib/python3.9/site-packages/blivet/threads.py", line 53, in run_with_lock
    return m(*args, **kwargs)
  File "/usr/lib/python3.9/site-packages/blivet/formats/__init__.py", line 517, in create
    self._create(**kwargs)
  File "/usr/lib/python3.9/site-packages/blivet/threads.py", line 53, in run_with_lock
    return m(*args, **kwargs)
  File "/usr/lib/python3.9/site-packages/blivet/formats/luks.py", line 322, in _create
    blockdev.crypto.luks_format(self.device,
  File "/usr/lib64/python3.9/site-packages/gi/overrides/BlockDev.py", line 1115, in wrapped
    raise transform[1](msg)
gi.overrides.BlockDev.CryptoError: Failed to add passphrase: Invalid argument