Upgrade cryptsetup >= 2.0.3

[bugproxy]

Cryptsetup is utility used to conveniently setup disk encryption based
on DMCrypt kernel module.

These include plain dm-crypt volumes, LUKS volumes, loop-AES
and TrueCrypt (including VeraCrypt extension) format.

Project also includes veritysetup utility used to conveniently setup
DMVerity block integrity checking kernel module
and, since version 2.0, integritysetup to setup
DMIntegrity block integrity kernel module.

Version 2.0.3 include all z code for dm-crypt with protected keys

Without cryptsetup 2.0.3 (the 3 is important) we won't be able to use secure key encryption with LUKS2 and the paes cipher. Only plain mode will be usable with cryptsetup version 2.0.1.

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2018-07-16 07:49 EDT-------
*** Bug 169752 has been marked as a duplicate of this bug. ***

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2018-07-16 08:20 EDT-------
"This should really be available in 18.04 LTS as well, hence an SRU request is needed, too."

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2018-07-18 06:41 EDT-------
Following effort was done by IBM for getting this SRUed in 18.04.
Which is mandatory for Pervasive encryption suppot on an LTS release.

Extracted the cryptsetup-2.0.3 sources and copied the debian/ files from cryptsetup-2.0.2 to the -2.0.3 tree and successfully built a cryptsetup-2.0.3 deb without any further modifications (except the debian/changelog for the new version).

From my point of view, it would be possible to apply a debdiff or patch that updates the codebase from 2.0.2 to 2.0.3 but keeping the 2.0.2 package version. Cherry-picking particular commits would be possible but might take some time as they are not done by the BB team and always have the risk that related commits are missed.

[Launchpad Janitor (janitor)]

This bug was fixed in the package cryptsetup - 2:2.0.3-6ubuntu1

---------------
cryptsetup (2:2.0.3-6ubuntu1) cosmic; urgency=low

  * Merge from Debian unstable. LP: #1781912.
  * Remaining changes:
    - debian/control:
      + Recommend plymouth.
      + Invert the "busybox | busybox-static" Recommends, as the latter
        is the one we ship in main as part of the ubuntu-standard task.
    - Apply patch from Trent Nelson to fix cryptroot-unlock for busybox
      compatibility. LP: #1651818
  * Dropped changes, included in Debian:
    - Drop explicit libgcrypt20 dependency from libcryptsetup4.
    - Drop the CRYPTSETUP variable warning from the initramfs hook, as
      overlayroot package ships a dropin in conf-hooks.d triggering false
      warnings.
    - Drop _BSD_SOURCE in favor of _DEFAULT_SOURCE
    - Drop c99 std, as the default is now higher than that
  * Dropped changes, no longer needed:
    - Add maintscript to drop removed upstart system jobs.

cryptsetup (2:2.0.3-6) unstable; urgency=medium

  * debian/TODO.md: Remove mention of parent device detection for mdadm
    (#629236) as it's fixed since 2:2.0.3-2.
  * debian/README.gnupg, debian/TODO.md, debian/doc/crypttab.xml: minor typo
    fixes.
  * debian/rules, debian/patches/disable-internal-tests.patch: Remove patch to
    add configure flag '--disable-internal-tests'. The internal test suite is
    run by dh_auto_test(1), and it is skipped if DEB_BUILD_OPTIONS environment
    variable contains the string "nocheck".
  * debian/cryptdisks-functions, debian/initramfs/scripts/local-top/cryptroot:
    When the 2nd column of a crypttab entry denodes a block special device,
    resolve the device but don't convert it to /dev/block/$major:$minor.
    (Closes: #903246.)
  * debian/initramfs/hooks/cryptroot:
    + Treat null device numbers as invalid in resolve_device(), cf.
      /Documentation/admin-guide/devices.txt in the kernel source tree.
    + generate_initrd_crypttab(): add '\n' to the local IFS since
      get_resume_devno() prints one major:minor pair per line.
  * debian/initramfs/scripts/local-{top,bottom}/cryptopensc:
    + Save process ID of the pcscd daemon at local-top stage, and kill it at
      local-bottom stage. Thanks to Pascal Vibet for the patch.
      (Closes: #903574.)
    + Fix path to the pcscd executable (the fix for #880750 was incomplete).
  * debian/README.opensc: Remove mention of 'README.openct.gz' as it's gone
    since 2:2.0.3-2.
  * debian/scripts/decrypt_opensc: Fix plymouth prompt message (use
    $CRYPTTAB_NAME not $crypttarget).

cryptsetup (2:2.0.3-5) unstable; urgency=medium

  [ Jonas Meurer ]
  * debian/askpass.c, debian/scripts/passdev.c, debian/rules:
    + Drop _BSD_SOURCE in favor of _DEFAULT_SOURCE
    + Drop c99 std, as the default is now higher than that
  * debian/control:
    + Drop explicit dependencies on libgcrypt20 and libgpg-error0 from
      libcryptsetup12. They're pulled in by ${shlibs:Depends} automatically.

  [ Guilhem Moulin ]
  * debian/initramfs/cryptroot-unlock: Keep looping forever (as long as the
    disk is locked) if the CRYPTTAB_OPTION_tries variable is set to 0, cf.
    crypttab(5).
  * debian/doc/crypttab...

[Frank Heimes (fheimes)]

It looks like the best (if not even the only feasible) way to get the required functionality from cryptsetup 2.0.3 that is needed for 'Pervasive encryption support' back to the bionic package is by specifying the a list of the needed commits - sorry to say that...

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2018-07-23 03:56 EDT-------
These are the changes with 2.0.3

f34158250a Update Readme.md.
b7c2465887 Add link to ABI tracker.
a22a24bc98 Support detached header for cryptsetup-reencrypt.
fe058e2c27 Update reencrypt test to use option --type only when really needed.
fa8d5d1769 Remove losetup handling from reencrypt2 test.
2d2acda404 Add crypto backend vectors test.
4e19bc01d5 Fix test vectors test link.
5e0db46f17 Add Reed-Solomon user-space decoding lib.
dc58985ac6 Enable userspace FEC decoding in veritysetup.
5b7b1596a2 Add tests for veritysetup FEC userspace decoding.
3cf2da877f Refactor crypt_activate_by_keyfile_device_offset.
761a472b45 Remove missing digest condition from LUKS2 digest verification.
303fe886b7 Fix misleading param name in prototype.
7bee66fe36 Add new luks2 keyslot validation condition.
1e2ad19d68 Validate LUKS2 keyslot json before opening it.
8d1fb88a20 Fix return code and retry count for bad passphrase and non-tty input.
610c7858d6 Add explicit key conversion command
af0887fb48 Remove no passphrase error message from library.
86f4f4440a Reformat crypt_resize function.
c84983f91e Add simple luksConvertKey test.
fef5121cee veritysetup: add support for --check-at-most-once option.
ed2968e3e8 Add paes to ciphers that cannot be used for LUKS2 keyslot encryption.
103d75f773 configure.ac: fix bashisms
f7ad64a3d3 Move absolute path helper to m4 macro.
187170ec51 Check cipher before writing metadata (LUKS2).
f6f00b98a7 Always convert the whole last keyslot (including alignment).
f21ebaf839 Check LUKS2 conversion for luksmeta header.
23b01621ff Print better debug message for open with write mode.
869767a5cf Move general i/o code to stand-alone utility file.
fee1d659cf Fix wrong digest assignment to new LUKS2 (volume key) keyslot.
35d29b22c0 Move CRYPT_ANY_DIGEST definition.
622763b240 Fix memory leak on error path in cryptsetup-reencrypt.
4caef0dec7 Add new volume key flag to crypt_keyslot_add_by_key.
965e0237a3 Add basic test for CRYPT_VOLUME_KEY_SET flag.
169d45fbdb Move reading master key in command line utilities.
a63db4ab24 Add --master-key-file parameter to cryptsetup-reencrypt.
0891e84bf8 Add reencrypt tests for --master-key-file option.
255c8e8ff4 Avoid pbkdf benchmark on LUKS2 header down conversion.
3616ee50c0 Fix off by one bug in LUKS2 keyslot max id allocation.
48bf08922c Make all LUKS2 key size helpers return negative value on error.
fbf2d64f34 Allow crypt_volume_key_get for unbound keyslots.
eed682c529 Add fixme in luks2->luks1 convert code.
70077db07d Abort conversion when LUKS2 header contains tokens.
b11b11f9b0 Add test for LUKS2 conversion with tokens.
e5f72a0d4f Remove duplicate CRYPT_ANY_TOKEN define.
4eb75f3c80 Add debug message for failed external token validation.
d97302f351 Extend suspend tests for missing header case.
9a72ec366d Move generic ciper backend utilities to separate file.
6f6e1efbc8 Abort conversion when wrapped key cipher is used.
34b8a48252 Add stand-alone device suspend.
0b849985b2 Do not wipe keys for wrapped key enabled ciphers.
09842ce46f Update docs for crypt_keyslot_add_by_key.
f8a7ab1752 Add crypt_get_pbkdf_default() function to get...

[Frank Heimes (fheimes)]

That seems to be a pretty long list of commit IDs, which is probably close to the entire diff between 2.0.2 and 2.0.3.
So please let me ask which *features* of cryptsetup 2.0.3 (and their corresponding commit IDs) are really required by IBM and 'Pervasive Encryption' for 18.04/bionic.
While looking into this again, please also keeping in mind that not all 2.0.3 features can simply be used and exploited by such an updated cryptsetup on bionic, because further needed infrastructure or components might be missing (like some tools that are only available in newer s390-tools versions).
We are obviously looking for a smaller set of commit IDs (actually for the smallest possible set).
Thx

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2018-08-06 04:59 EDT-------
A new version of cryptsetup is avaiable 2.04. Does it make sense to create a new LP entry for this version, due to the fact, that this one is fix released, Or is it possible to upgrade the this new version..? Many thx in advance

[Steve Langasek (vorlon)]

On Mon, Aug 06, 2018 at 09:09:56AM -0000, bugproxy wrote:
> ------- Comment From <email address hidden> 2018-08-06 04:59 EDT-------

> A new version of cryptsetup is avaiable 2.04. Does it make sense to
> create a new LP entry for this version, due to the fact, that this one is
> fix released, Or is it possible to upgrade the this new version..? Many
> thx in advance

If you are asking for an update to cryptsetup 2.0.4 in Ubuntu 18.10, please
file this as a separate bug report. Let's please reserve this one for the
question of what changes are needed in Ubuntu 18.04 for z protected keys.

--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
Ubuntu Developer https://www.debian.org/
<email address hidden> <email address hidden>

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2018-08-20 05:46 EDT-------
================================
== Request for Ubuntu 18.04 ===
================================

Prerequisites:
- pkey kernel module -> kernel 4.11
- paes cipher kernel module -> kernel 4.12

s390-tools
- zkey tool (first version) -> s390-tools-1.39.0
- zkey enhancements for secure key store -> s390-tools-2.4.0

- zkey-cryptsetup support for HSM master key change with LUKS2
this need to be backported due to -> s390-tools-2.6.0

- dm-crypt with protected keys (LUKS2 part in cryptsetup ) -> cryptsetup 2.0.3

/ect/crypttab Sector Size Support
Ubuntu: support f?r sector size parameter in Debian/Ubuntu crypttab parser shipped in distro specific cryptsetup package

-> not available yet , need to be done by Distro or crypttab parser maintainers

Installer support
The Ubuntu installer when suggesting to use encrypted disks on IBM Z the installer should support the option to use the PAES cipher using the paes-xts-plain64 cipher mode (with key sizes 512 bits or 1024 bits).

Before offering the the usage of the PAES cipher the installer should check whether a CCA adapter (CEX4C, CEX5C, CEX6X, ...) is available on the system.

For Ubuntu 18.04.x the following upgrades/backports are required
cryptsetup: upgrade version 2.0.2 to version >= 2.0.3
s390tools: backport
zkey as of version >= 2.4.0
zkey-cryptsetup as of version 2.6.0 (requires cryptsetup >= 2.0.3)
upgrade /etc/crypttab support

The Ubuntu 18.10 outlook is good wrt to protected key dm-crypt (PE for data at-rest).

[Andrew Cloke (andrew-cloke)]

Please note that this comment has been posted against a bug that has been closed. If additional action is required, would it be possible to raise a new bug referencing this one if necessary?
Thanks.

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2018-08-20 07:04 EDT-------
@Andrew. I used this bugzilla, due to the commend from Steve...

If you are asking for an update to cryptsetup 2.0.4 in Ubuntu 18.10, please
file this as a separate bug report.
!!!!!
Let's please reserve this one for the
question of what changes are needed in Ubuntu 18.04 for z protected keys.
!!!!!
--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
Ubuntu Developer https://www.debian.org/
<email address hidden> <email address hidden>

Please let me know, how Canonical would like to proceed here.
Many thanks in advance

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2018-08-31 07:47 EDT-------
*** Bug 169752 has been marked as a duplicate of this bug. ***

[Frank Heimes (fheimes)]

Since there are some discussions going on about bringing cryptsetup 2.0.3 features back to bionic I'm changing the ubuntu-z-systems entry to 'Opinion' - for now.

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2019-08-15 09:16 EDT-------
This feature was made available with Cosmic (18.10). The request of having it in 18.04 need to be driven by a dedicated customer. Currently, no officail request know from my side. Therefore we can close, the feature request.
If new information will come up, a new LP will be created.
Once you close it on LP side. I will close it here..
Many thanks in advance

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2019-08-15 09:28 EDT-------
IBM Bugzilla status -> closed, Fix Released for Cosmic....