Red Hat Bugzilla – Bug 500821
When selecting encrypt system the swap is set to unencrypted partition
Last modified: 2013-02-28 23:07:53 EST
Description of problem: System with one disk, with prepared these partitions Disk /dev/sda: 160.0 GB, 160000000000 bytes 255 heads, 63 sectors/track, 19452 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes Device Boot Start End Blocks Id System /dev/sda1 * 1 26 204800 83 Linux Partition 1 does not end on cylinder boundary. /dev/sda2 26 19452 156043389+ 8e Linux LVM both partition are zeroed (with dd if=/dev/zero ...) no lvm signature etc. When I start vnc installation a check "encrypt system" and "review and modify partitoning layout" and without touching option list which is default in "remove all partitions and create default layout") the partitioning layout is following: sda1 - boot, sda2 - encrypted PV (with root lv), sda3 - *unencrypted* swap Returning back and forward it switch to (correct) sda1 - boot, sda2 encrypted PV (with root ands swap LV) Version-Release number of selected component (if applicable): 11.1.2.168 System with encrypted root but not encrypted swap is not secure configuration and should be avoided.
Created attachment 343953 [details] wrong partitioning snapshot
This partitioning layout shown is a custom layout. The "Encrypt System" checkbox does one thing: it encrypts the PV(s) that we create during *automatic* partitioning. If you go in and create custom partitions it is up to you to specify that they be encrypted if that is what you want. Is there something that I am missing here?
I did not specified custom partition for swap, that partition was added by anaconda (note sda3 is not there - I had just some free space on disk). I tried to reuse PV. If I encrypt root, swap must be encrypted too - otherwise it is not secure anyway. But note: "Returning back and forward it switch to (correct) sda1 - boot, sda2 encrypted PV (with root ands swap LV)" So after just pressing back and forward button the cfg is different. (I have no current install here, not sure if it is still reproducible...)
Let me assure you that anaconda did not create a swap partition automatically. There is no code to do this. I can also assure you that the naming of the vg/lv are not anaconda's. You did not mention that this is an interactive kickstart installation. I suspect that there is a bug related to either your kickstart script or anaconda's handling of interactive kickstart. Please attach the ks.cfg.
From comment #4: > I tried to reuse PV. Which is it? Did you specify "remove all partitions" or did you specify a custom partitioning layout?
I was unable to reproduce the behavior described in this report. Please reopen it if you have a reliable procedure to reproduce it.