cryptdisk sets up partitions by index/device instead of uuid

[Flávio Etrusco]

Binary package hint: cryptsetup

It's obvious cryptsetup should map partitions by UUID instead of dev entries (e.g. /dev/sda5) -- and it's obvious I don't know how difficult it is ;-) --, even more while cryptdisks service doesn't do enough validation on the partition used (https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/509952).

[Steve Langasek (vorlon)]

cryptsetup does map partitions by UUID, if that's how you specify them in /etc/crypttab. In the case of bug #509952, clearly you didn't do this, so of course cryptsetup wasn't mapping by UUID.

An entirely separate question is whether the parent device *has* a UUID. If you're not using LUKS, I think the answer is going to be 'no'.

[Flávio Etrusco (etrusco)]

By "cryptsetup" I mean the installer (see that I use "cryptdisks" later to refer to the script the "loads" the loopback/mapper). I just chose the encrypt my home folder and Ubuntu set up a encrypted swap partition automatically.

[Steve Langasek (vorlon)]

Ah - reopening and reassigning to partman-crypto, then. However, the concern about random crypted swap devices not having a UUID still stands, so I'm not sure whether we can fix this with the currently available solutions.

[AleksanderAdamowski (aadamowski)]

I've developed a solution to random crypted swap devices not having a UUID, at least for GPT (Guid Partition Tables).

The cryptswap partitions indeed don't have an ordinary UUID, but if they are GPT partitions, they do have a persistent PARTUUID (UUID assigned to partition) and are available through /dev/disk/by-partuuid/ .

Arch Linux guys have patched their cryptsetup functions to support this format: https://patchwork.archlinux.org/patch/389/

I've applied similar approach to /lib/cryptsetup/cryptdisks.functions as seen in the patch below:

--- cryptdisks.functions.orig 2013-12-20 19:42:02.048667466 +0100
+++ cryptdisks.functions.olo.partuuid.2013-12-20 2013-12-20 19:49:37.876503582 +0100
@@ -488,6 +488,9 @@
        # parse UUID= symlinks
        if [ "${src#UUID=}" != "$src" ]; then
                src="/dev/disk/by-uuid/${src#UUID=}"
+ elif [ "${src#PARTUUID=}" != "$src" ]; then
+ # inspired by https://patchwork.archlinux.org/patch/389/
+ src="/dev/disk/by-partuuid/${src#PARTUUID=}"
        elif [ "${src#LABEL=}" != "$src" ]; then
                src="/dev/disk/by-label/${src#LABEL=}"
        fi
@@ -599,6 +602,9 @@
        egrep -v "^[[:space:]]*(#|$)" "$TABFILE" | while read dst src key opts; do
                if [ "xUUID=$ID_FS_UUID" = "x$src" ]; then
                        src="/dev/disk/by-uuid/${src#UUID=}"
+ elif [ "xPARTUUID=$ID_PART_ENTRY_UUID" = "x$src" ]; then
+ # inspired by https://patchwork.archlinux.org/patch/389/
+ src="/dev/disk/by-partuuid/${src#PARTUUID=}"
                elif [ "xLABEL=$ID_FS_LABEL_ENC" = "x$src" ]; then
                        src="/dev/disk/by-label/${src#LABEL=}"
                elif [ "x$1" != "x$src" ]; then

This enables the following format for crypttab:

cryptswap1 PARTUUID=c352d0c2-3584-44a1-9de7-c2bfdb9c58f8 /dev/urandom swap,cipher=aes-cbc-essiv:sha256

Obviously, this has to also be documented in crypttab manpage (man 5 crypttab).

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "Patch for PARTUUID support in crypttab" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Robie Basak (racb)]

I wanted PARTUUID support for crypttab and found this bug.

I think there are two separate bugs here. 1) A wishlist bug to support PARTUUID in /etc/crypttab, for which a patch is available. It looks like this could be sent to Debian (currently it looks like Debian doesn't have PARTUUID support either) and incorporated in Ubuntu pretty easily. 2) Support for using these in partman-crypto. I've not looked into this end.

[Dimitri John Ledkov (xnox)]

Also PARTUUID support needs to be added in systemd-cryptsetup too, as that is yet another crypttab parser implementation used in boot.