SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

repart: Let libcryptsetup calculate the volume key

Browse Source 
We also bump the volume key size to 512 bits.
This commit is contained in:
Daan De Meyer
2022-11-15 20:07:54 +01:00
parent bf3598beff
commit 98e0456ec0
1 changed files with 11 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/partition/repart.c
+11 -18
View File
@@ -90,6 +90,9 @@
/* LUKS2 takes off 16M of the partition size with its metadata by default */
#define LUKS2_METADATA_SIZE (16ULL*1024ULL*1024ULL)
/* LUKS2 volume key size. */
#define VOLUME_KEY_SIZE (512ULL/8ULL)
/* Note: When growing and placing new partitions we always align to 4K sector size. It's how newer hard disks
* are designed, and if everything is aligned to that performance is best. And for older hard disks with 512B
* sector size devices were generally assumed to have an even number of sectors, hence at the worst we'll
@@ -2991,9 +2994,7 @@ static int partition_encrypt(
int *ret_fd) {
#if HAVE_LIBCRYPTSETUP
_cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
_cleanup_(erase_and_freep) void *volume_key = NULL;
_cleanup_free_ char *dm_name = NULL, *vol = NULL;
size_t volume_key_size = 256 / 8;
sd_id128_t uuid;
int r;
@@ -3022,14 +3023,6 @@ static int partition_encrypt(
log_info("Encrypting future partition %" PRIu64 "...", p->partno);
volume_key = malloc(volume_key_size);
if (!volume_key)
return log_oom();
r = crypto_random_bytes(volume_key, volume_key_size);
if (r < 0)
return log_error_errno(r, "Failed to generate volume key: %m");
r = sym_crypt_init(&cd, node);
if (r < 0)
return log_error_errno(r, "Failed to allocate libcryptsetup context: %m");
@@ -3041,8 +3034,8 @@ static int partition_encrypt(
"aes",
"xts-plain64",
SD_ID128_TO_UUID_STRING(uuid),
volume_key,
volume_key_size,
NULL,
VOLUME_KEY_SIZE,
&(struct crypt_params_luks2) {
.label = strempty(p->new_label),
.sector_size = context->sector_size,
@@ -3054,8 +3047,8 @@ static int partition_encrypt(
r = sym_crypt_keyslot_add_by_volume_key(
cd,
CRYPT_ANY_SLOT,
volume_key,
volume_key_size,
NULL,
VOLUME_KEY_SIZE,
strempty(arg_key),
arg_key_size);
if (r < 0)
@@ -3108,8 +3101,8 @@ static int partition_encrypt(
keyslot = sym_crypt_keyslot_add_by_volume_key(
cd,
CRYPT_ANY_SLOT,
volume_key,
volume_key_size,
NULL,
VOLUME_KEY_SIZE,
base64_encoded,
strlen(base64_encoded));
if (keyslot < 0)
@@ -3141,8 +3134,8 @@ static int partition_encrypt(
r = sym_crypt_activate_by_volume_key(
cd,
dm_name,
volume_key,
volume_key_size,
NULL,
VOLUME_KEY_SIZE,
arg_discard ? CRYPT_ACTIVATE_ALLOW_DISCARDS : 0);
if (r < 0)
return log_error_errno(r, "Failed to activate LUKS superblock: %m");