Bug 1755996 - Anaconda uses LUKS v1 for encrypted PVs
Summary: Anaconda uses LUKS v1 for encrypted PVs
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: anaconda
Version: 8.0
Hardware: All
OS: Linux
Target Milestone: rc
: 8.2
Assignee: Vendula Poncova
QA Contact: Release Test Team
Alexandra Nikandrova
Depends On:
Blocks: 1689193
TreeView+ depends on / blocked
Reported: 2019-09-26 14:39 UTC by Jan Stodola
Modified: 2020-11-04 03:24 UTC (History)
6 users (show)

Fixed In Version: anaconda-
Doc Type: Bug Fix
Doc Text:
.Anaconda now uses LUKS2 version as the default for an encrypted container Previously, anaconda did not use LUKS2 version by default to create an encrypted container on the `Manual Partitioning` screen. As a result, the container encryption had LUKS1 version. With this update, anaconda uses LUKS2 version as the default to create an encrypted container on the `Manual Partitioning` screen and now the container has encryption with LUKS2 version.
Clone Of:
Last Closed: 2020-11-04 03:22:50 UTC
Type: Bug
Target Upstream Version:

Attachments (Terms of Use)
program.log (51.69 KB, text/plain)
2019-09-26 14:46 UTC, Jan Stodola
no flags Details
storage.log (155.54 KB, text/plain)
2019-09-26 14:47 UTC, Jan Stodola
no flags Details

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2020:4729 0 None None None 2020-11-04 03:23:37 UTC

Description Jan Stodola 2019-09-26 14:39:20 UTC
Description of problem:
When PVs are manually checked to be encrypted during custom partitioning in GUI, anaconda creates LUKS v1 format on the PVs. There is also no choice to select LUKS v1/v2 as for other device types (raw partitions or encrypded LVs)

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. start graphical installation
2. proceed to custom partitioning
3. remove existing partitions
4. let anaconda create the partitions (LVM layout)
5. modify the volume group with rootfs and swap (and home)
6. check "Encrypt" in the VG configuration dialog
7. continue with the installation
8. reboot to installed system
9. check the LUKS version:
# cryptsetup luksDump /dev/vda2 | grep -i version

Actual results:
LUKS v1 is used:
[root@localhost ~]# cryptsetup luksDump /dev/vda2 | grep -i version
Version:        1
[root@localhost ~]#

Expected results:
LUKS v2 is used by default:
[root@localhost ~]# cryptsetup luksDump /dev/vdb1 | grep -i version
Version:        2
[root@localhost ~]#

Since it's possible to select LUKSv1/v2 for other types of devices, it should be possible to select the version for PVs as well.

Additional info:
When using encrypted autopartitioning, PVs are formatted with LUKS v2 as expected.

Comment 3 Jan Stodola 2019-09-26 14:46:41 UTC
Created attachment 1619623 [details]

Comment 4 Jan Stodola 2019-09-26 14:47:03 UTC
Created attachment 1619624 [details]

Comment 8 Chris Williams 2020-02-12 20:59:00 UTC
*** Bug 1784360 has been marked as a duplicate of this bug. ***

Comment 16 Shweta Naresh 2020-07-08 13:03:47 UTC
@Alexandra Nikandrova, I have updated the yaml file to include the BZ. You can skip the yaml file updates, and only work on the doc text.


Comment 19 Marek Havrila 2020-07-27 12:37:05 UTC
Verified on RHEL-8.3.0-20200701.2 and anaconda-

Comment 22 errata-xmlrpc 2020-11-04 03:22:50 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (anaconda bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.