initramfs cryptroot with keyscript and binary passphrase

Bug #1397049 reported by d4
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
cryptsetup (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

cryptsetup --key-file=-
is not the same as
cryptsetup --key-file=/dev/stdin

I use initramfs cryptroot script to set up an encrypted device early, and i have a keyscript that decrypts a keyfile and writes the decrypted key to stdout. (binary key 512 bytes long)

# /etc/crypttab was this before running update-initramfs -u #
swap /dev/disk/by-partlabel/swap /etc/key.enc cipher=aes-cbc-essiv:sha256,size=256,hash=sha256,swap,tries=1,keyscript=/etc/initramfs-tools/decrypt-key,precheck=un_blkid,noauto

But despite the decrypt-key keyscript workes fine inside the initramfs environment, and the decrypted key it produces is correct, cryptroot script failes with "unknown fs type" error.
I used keyscript manually to decrypt the key to a file, then call cryptsetup with --key-file=key.decrypted along with the appropirate options, and it successfully opened the drive with a valid fstype.

I've discovered that by replacing a part of the initramfs script "cryptroot"
$cryptkeyscript "$cryptkey" | $cryptcreate --key-file=- ;
to
$cryptkeyscript "$cryptkey" | $cryptcreate --key-file=/dev/stdin ;
fixed the problem. (/scripts/local-top/cryptroot around line 263)

I could reproduce the problem in initramfs environment with a /conf/conf.d/cryptroot like this:
target=swap,source=/dev/disk/by-partlabel/swap,key=/etc/key,cipher=aes-cbc-essiv:sha256,size=256,hash=sha256,tries=1,keyscript=/bin/cat
Where /etc/key is a 512 byte binary keyfile (already decrypted).
(try /bin/dd if /bin/cat is missing in your initramfs environment or ln -s /bin/busybox /bin/cat)

My Quick-Fix was:
cp /usr/share/initramfs-tools/scripts/local-top/cryptroot to /etc/initramfs-tools/scripts/local-top/cryptroot
Edit and replace --key-file=- with --key-file=/dev/stdin around line 263.
update-initramfs -u

Description: Ubuntu 14.04.1 LTS
Release: 14.04

Package: cryptsetup
Version: 2:1.6.1-1ubuntu1
Architecture: amd64

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in cryptsetup (Ubuntu):
status: New → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.