sts-sponsors team mailing list archive

[Launchpad Bug Tracker <1898129@xxxxxxxxxxxxxxxxxx>]

You have been subscribed to a public bug by Mauricio Faria de Oliveira (mfo):

[Impact]

 * Users cannot specify options for 'cryptsetup luksFormat'
   that is used by the installer.

 * Some deployments need the installed disks in LUKS1 format
   for backward compatibility with older releases that don't
   support LUKS2, for backup/audit/management purposes.

 * However, on Focal and later, cryptsetup defaults to LUKS2,
   which broke that functionality.
   
 * Currently it's not possible to request the LUKS format in
   the installer, so this patch allows for that w/ a preseed
   option ('partman-crypto/luksformat_options') for the user.

[Test Case]

 * Default behavior: LUKS2
 
   - Install Ubuntu (Focal/later); check LUKS header version:
   
     $ sudo cryptsetup luksDump /dev/vda4
     LUKS header information
     Version: 2
     ...
     
 * Opt-in behavior: LUKS1 (for example; can use other options)
 
   - Install Ubuntu (Focal/later) with preseed file/option:

     ubiquity partman-crypto/luksformat_options string \
       --type luks1

   - Check LUKS header version:
   
     $ sudo cryptsetup luksDump /dev/vda4
     LUKS header information for /dev/vda4
     Version: 1
     ...

   - Check install logs for confirmation:
   
     $ grep luksFormat /var/log/partman
     /usr/bin/autopartition-crypto: Additional options for luksFormat: '--type luks1'
   
[Where problems could occur]

 * The changes are contained within the partman-crypto functionality,
   so only install with encrypted disks should be affected by issues.

 * Any additional options specified to 'cryptsetup luksFormat' are
   opt-in _and_ specified by the user via the preseed option, thus
   errors are probably tied to particular options (mis) used.

 * If the preseed option is not specified, original behavior remains.

[Other Info]
 
 * This patch is applied in Hirsute.
 * This patch is not needed in Groovy (rationale in comment #15.)
 * This patch is targeted at Focal (cryptsetup defaulted to LUKS2.)
 * This patch is not needed in Bionic/earlier (^defaults to LUKS1.)

[Original Description]
Most users should be fine with the options to
'cryptsetup luksFormat' used by the installer.

However, some users may have reasons to use
other options, and that is not possible now.

Let's provide a new preseed option for that:
'partman-crypto/luksformat_options'

** Affects: partman-crypto (Ubuntu)
     Importance: Undecided
         Status: Invalid

** Affects: ubiquity (Ubuntu)
     Importance: Medium
     Assignee: Mauricio Faria de Oliveira (mfo)
         Status: Fix Released

** Affects: partman-crypto (Ubuntu Focal)
     Importance: Undecided
     Assignee: Mauricio Faria de Oliveira (mfo)
         Status: In Progress

** Affects: ubiquity (Ubuntu Focal)
     Importance: Undecided
         Status: In Progress

** Affects: partman-crypto (Ubuntu Groovy)
     Importance: Undecided
         Status: Invalid

** Affects: ubiquity (Ubuntu Groovy)
     Importance: Undecided
         Status: Won't Fix

** Affects: partman-crypto (Ubuntu Hirsute)
     Importance: Undecided
         Status: Invalid

** Affects: ubiquity (Ubuntu Hirsute)
     Importance: Medium
     Assignee: Mauricio Faria de Oliveira (mfo)
         Status: Fix Released

** Affects: partman-crypto (Debian)
     Importance: Unknown
         Status: Unknown


** Tags: fr-933 patch sts sts-sponsor-mfo
-- 
Cannot configure 'cryptsetup luksFormat' at install time
https://bugs.launchpad.net/bugs/1898129
You received this bug notification because you are a member of STS Sponsors, which is subscribed to the bug report.