Can't unlock multiple devices in initramfs

[Niclas Morin]

[Impact]
clevis can be used to automatically unlock LUKS-encrypted devices during boot by asking a remote server for the key (sort of). It does so by finding the PID of the process that send up the interactive prompt "Please unlock disk xxx:" and then sends a key to that process through a fifo that the process has opened.
The bug that existed in clevis versions prior to version 17 forgot to clear the saved PID-variable, so when the PID of the first process has been found it won't find any more processes of this type. This means it can only unlock the first device. If you have for example some sort of RAID root filesystem with multiple disks (or a ZFS mirror as me) then clevis does not work at all.

[Test Plan]
- Setup a tang server on a different host:
# sudo apt install tang
# sudo systemctl enable tangd.socket --now
# reboot

- Setup two LUKS-disks that shall be decrypted during early boot (append option initramfs to them in /etc/crypttab)

- Setup clevis:
# sudo apt install clevis
# sudo apt install clevis-luks
# sudo apt install clevis-initramfs

- Bind the encrypted disks to the tang server:
# sudo clevis luks bind -d /dev/<disk1> tang '{"url": "http://<tang-server>"}'
# sudo clevis luks bind -d /dev/<disk2> tang '{"url": "http://<tang-server>"}'

- Regenerate initramfs
# sudo update-initramfs -u -k 'all'

- Reboot
# reboot

After the reboot you will be stuck at "Please unlock disk xxx:" until you enter the passphrase manually.

If you perform all the steps using only one disk it will work.

[Where problems could occur]
If something is wrong with the patch it will show up when clevis is unlocking a LUKS-encrypted disk during initramfs.

[Other Info]
This has been fixed in upstream (https://github.com/latchset/clevis, version 17, commit 0abdfbc7812c8ef588ee22fd35941b5e831fdce7 on Feb 24, 2021)

[dann frazier (dannf)]

Marking Fix-Committed because version 18 is in jammy-proposed.

[Niclas Morin (brydling)]

@dannf I thought I was filing a bug report for Ubuntu 20.04. Do bugfixes never get backported to previous releases?

[dann frazier (dannf)]

@brydling By default the bug is just for the current development release. You can add tasks for specific releases, which I've now done back to 20.04.

Please see https://wiki.ubuntu.com/StableReleaseUpdates for the process for fixing a bug in a released version of Ubuntu, specifically the SRU template requirements for the bug.

[Niclas Morin (brydling)]

@dannf Thank you very much for the help and the information!

[dann frazier (dannf)]

@brydling: I uploaded a test clevis build to https://launchpad.net/~dannf/+archive/ubuntu/test , which should complete building in about an hour or so. Would you mind trying it out in your setup when complete?

[Niclas Morin (brydling)]

@dannf I would love to! I can do it tomorrow at around this time. Looking forward to it!

[Niclas Morin (brydling)]

@dannf Works like a charm in my test case!

[dann frazier (dannf)]

Thanks for testing. I've uploaded fixes for hirsute & focal. Once approved, this bug will be updated with a request for verification testing.

[Robie Basak (racb)]

The uploads are missing Launchpad-Bugs-Fixed headers in the changes files, which breaks our SRU workflow tooling. Please reupload from Ubuntu (or set the vendor to Ubuntu on Debian, etc).

[Robie Basak (racb)]

> Please reupload from Ubuntu

Specifically regenerate the changes file on Ubuntu I mean. Just re-dput won't work.

[dann frazier (dannf)]

Ick, yeah - sorry about that @racb :)

[Robie Basak (racb)]

Hello Niclas, or anyone else affected,

Accepted clevis into hirsute-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/clevis/16-1ubuntu0.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-hirsute to verification-done-hirsute. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-hirsute. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Robie Basak (racb)]

Unsubscribing sponsors as I think there is nothing left to sponsor.

[Robie Basak (racb)]

Hello Niclas, or anyone else affected,

Accepted clevis into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/clevis/12-1ubuntu2.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Niclas Morin (brydling)]

Hi Robie!

12-1ubuntu2.3 from focal-proposed tested in a VM running focal installed using the root on zfs guide (for focal). Tested by using the nbde_client ansible role to install clevis and bind two LUKS-encrypted disks to a tang server. It worked as expected. Both disks unlocked during early boot.

[Niclas Morin (brydling)]

16-1ubuntu0.1 from hirsute-proposed tested in a VM running hirsute installed using the root on zfs guide (for focal, but replaced 'focal' with 'hirsute' in the sources.list and in the debootstrap command). Tested by using the nbde_client ansible role to install clevis and bind two LUKS-encrypted disks to a tang server. It worked as expected. Both disks unlocked during early boot.

[Launchpad Janitor (janitor)]

This bug was fixed in the package clevis - 16-1ubuntu0.1

---------------
clevis (16-1ubuntu0.1) hirsute; urgency=medium

  * Cherry-pick "Fix issue with multiple encrypted devices" (LP: #1948598)

 -- dann frazier <email address hidden> Tue, 26 Oct 2021 14:59:34 -0600

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for clevis has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package clevis - 12-1ubuntu2.3

---------------
clevis (12-1ubuntu2.3) focal; urgency=medium

  * Cherry-pick "Fix issue with multiple encrypted devices" (LP: #1948598)

 -- dann frazier <email address hidden> Tue, 26 Oct 2021 15:04:58 -0600