Bug 1659579
| Summary: | online fsadm resize of luks volume now requires passphrase | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Corey Marthaler <cmarthal> | |
| Component: | cryptsetup | Assignee: | Ondrej Kozina <okozina> | |
| Status: | CLOSED WONTFIX | QA Contact: | Storage QE <storage-qe> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | high | |||
| Version: | 8.0 | CC: | agk, jbrassow, mbroz, okozina, prajnoha | |
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
|
| Target Release: | 8.0 | |||
| Hardware: | x86_64 | |||
| OS: | Linux | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | ||
| Doc Text: | Story Points: | --- | ||
| Clone Of: | ||||
| : | 1750680 (view as bug list) | Environment: | ||
| Last Closed: | 2021-02-01 07:31:13 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
|
Description
Corey Marthaler
2018-12-14 17:27:24 UTC
Yes, this is expected. We switched to LUKS2 by default in RHEL8 and LUKS2 format uploads volume keys in dm-crypt target via kernel keyring. The query for passphrase pops up when cryptsetup detects key in dm-crypt is passed via kernel keyring. You may workaround it by adding --disable-keyring parameter to "cryptsetup open" command. It won't ask for the passphrase in fsadm resize afterwards. What should be done with this issue, if this new behavior is expected? 1. I verified that "--disable-keyring" at luksOpen time does turn off the passphrase request during the fsadm resize 2. I verified that w/o "--disable-keyring", a proper passwd does properly resize both the underlying lvm device and fs 3. The only remaining issue w/ the new behavior is if a valid paswd isn't given and you end up with a resized LV but not luks/fs device and now need manual intervention. Also "--disable-keyring" *doesn't* help you if you reencrypt either.
[root@hayes-01 ~]# lvcreate --virtualsize 1G -T snapper_thinp/POOL -n origin
Logical volume "origin" created.
[root@hayes-01 ~]# echo Str0ngP455w0rd### | cryptsetup luksFormat /dev/snapper_thinp/origin
[root@hayes-01 ~]# echo Str0ngP455w0rd### | cryptsetup luksOpen --disable-keyring /dev/snapper_thinp/origin luks_origin
[root@hayes-01 ~]# mkfs.ext4 /dev/mapper/luks_origin
mke2fs 1.44.6 (5-Mar-2019)
[...]
Writing superblocks and filesystem accounting information: done
[root@hayes-01 ~]# mount /dev/mapper/luks_origin /mnt/origin
[root@hayes-01 ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/luks_origin 977M 2.5M 908M 1% /mnt/origin
[root@hayes-01 ~]# lvextend -L +500M -r /dev/snapper_thinp/origin
Size of logical volume snapper_thinp/origin changed from 1.00 GiB (256 extents) to <1.49 GiB (381 extents).
Logical volume snapper_thinp/origin successfully resized.
resize2fs 1.44.6 (5-Mar-2019)
Filesystem at /dev/mapper/luks_origin is mounted on /mnt/origin; on-line resizing required
old_desc_blocks = 1, new_desc_blocks = 1
The filesystem on /dev/mapper/luks_origin is now 386048 (4k) blocks long.
[root@hayes-01 ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/luks_origin 1.5G 3.0M 1.4G 1% /mnt/origin
[root@hayes-01 ~]# lvextend -L +500M -r /dev/snapper_thinp/origin
Size of logical volume snapper_thinp/origin changed from <1.49 GiB (381 extents) to <1.98 GiB (506 extents).
Logical volume snapper_thinp/origin successfully resized.
resize2fs 1.44.6 (5-Mar-2019)
Filesystem at /dev/mapper/luks_origin is mounted on /mnt/origin; on-line resizing required
old_desc_blocks = 1, new_desc_blocks = 1
The filesystem on /dev/mapper/luks_origin is now 514048 (4k) blocks long.
# now reencrypt
[root@hayes-01 ~]# echo Str0ngP455w0rd### | cryptsetup reencrypt --resilience none --active-name luks_origin
Finished, time 00:21.004, 2008 MiB written, speed 95.6 MiB/s
# Doesn't work after reencryption
[root@hayes-01 ~]# lvextend -L +500M -r /dev/snapper_thinp/origin
Size of logical volume snapper_thinp/origin changed from <1.98 GiB (506 extents) to 2.46 GiB (631 extents).
Logical volume snapper_thinp/origin successfully resized.
Enter passphrase for /dev/mapper/snapper_thinp-origin:
No key available with this passphrase.
fsadm: Failed to resize active LUKS device
/usr/sbin/fsadm failed: 1
(In reply to Corey Marthaler from comment #3) This is bug in online reencryption. Currently we reload keys in kernel keyring despite --disable-keyring parameter. Do you agree to clone this into separate bug? After evaluating this issue, there are no plans to address it further or fix it in an upcoming release. Therefore, it is being closed. If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened. |