opening privileged shell after entering wrong password for LUKS three times

[hon]

You should have root filesystem encrypted by LUKS. Start operational system and enter incorrect passphrase for root filesystem three times. Wait several seconds and you give busybox shell with superuser rights from initramdisk.
System should not open shell. It should ask for passphrase forever or show error, but don't open shell. OS: Ubuntu 12.04, Ubuntu 14.04.

[Seth Arnold (seth-arnold)]

There are any number of ways to get a privileged shell from a system when physically present at booting. The important part is that your data is still encrypted without the keys.

Thanks

[hon (hon2048)]

Access to keyboard on booting system is not physical access. System may have protected GRUB and firmware. Attacker may got priveleged shell without physical access and damage data, firmware, or add keyloger into /boot.

[hon (hon2048)]

To fix this bug use the attachment.
If mainteiners want to fix this bug they should replace string "crypttries=3" to "crypttries=0" in /usr/share/initramfs-tools/scripts/local-top/cryptroot. But may be better to deny access to shell in panic() function in /usr/share/initramfs-tools/scripts/functions?