From c280a16ab71b5b5e78c119c91f447832a08b0dc6 Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Wed, 3 Jun 2026 14:03:39 +0000 Subject: [PATCH] cryptsetup: document that keyfile-erase does not apply to auto-discovered key files keyfile-erase only erases a key file explicitly configured in the third field of crypttab. Key files automatically discovered in /etc/cryptsetup-keys.d/ and /run/cryptsetup-keys.d/ are considered shared resources not owned by an individual volume, and are never erased. Make this explicit in the documentation and add a code comment clarifying the intent. Fixes: https://github.com/systemd/systemd/issues/41127 Co-developed-by: Claude Opus 4.8 --- man/crypttab.xml | 7 +++++++ src/cryptsetup/cryptsetup.c | 3 +++ 2 files changed, 10 insertions(+) diff --git a/man/crypttab.xml b/man/crypttab.xml index d57823f88a..38ba4ceafb 100644 --- a/man/crypttab.xml +++ b/man/crypttab.xml @@ -232,6 +232,13 @@ activation (e.g. via a file in /run/, generated by a service running before activation), and shall be removed after use. Defaults to off. + Note that this option only applies to a key file explicitly configured in the third field, and + has no effect on key files that are automatically discovered in + /etc/cryptsetup-keys.d/ and /run/cryptsetup-keys.d/. The + latter are considered shared resources that are not owned by an individual volume, and hence are never + erased. To erase an automatically discovered key file, configure its path explicitly in the third + field. + diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c index 39562019e4..9c7b2006ba 100644 --- a/src/cryptsetup/cryptsetup.c +++ b/src/cryptsetup/cryptsetup.c @@ -2639,6 +2639,9 @@ static int verb_attach(int argc, char *argv[], uintptr_t _data, void *userdata) /* A delicious drop of snake oil */ (void) safe_mlockall(MCL_CURRENT|MCL_FUTURE|MCL_ONFAULT); + /* Only erase key files explicitly configured on the command line, never the ones we + * auto-discover in /etc/cryptsetup-keys.d/ and /run/cryptsetup-keys.d/: those are shared + * resources not owned by an individual volume. (key_file is NULL when auto-discovery is used.) */ if (key_file && arg_keyfile_erase) destroy_key_file = key_file; /* let's get this baby erased when we leave */