crypt:dev=/dev/vdb parameter does not work with randomly generated passphrase
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| cloud-initramfs-tools (Ubuntu) |
Fix Released
|
High
|
Scott Moser | ||
| Xenial |
Fix Released
|
Medium
|
Scott Moser | ||
| Yakkety |
Fix Released
|
Medium
|
Scott Moser | ||
Bug Description
=== Begin SRU Template ===
[Impact]
Using overlay to put overlay data onto an encrypted volume with a randomly
generated password does not function as documented.
[Test Case]
The following should work, but currently does not.
Note, to test the fix, between step 1 and 2, you'll need to enable
proposed and install overlayroot.
1. Start an instance of a cloud image with 2 disks.
One disk is the root disk, one disk is the target.
This can be done locally with qemu or within openstack or any other cloud.
2. configure overlayroot to write to target disk, reboot
# remove the entry in /etc/fstab for the device we're using
$ sudo sed -i.dist '/comment=
$ target=/dev/vdb
$ echo "overlayroot=
$ sudo reboot
3. log back in and look around
a.) check that 'overlayroot' is in /proc/mounts
$ awk '$1 == "overlayroot" { print $0 }' /proc/mounts
overlayroot / overlay rw,relatime,
b.) check that the upperdir listed (/media/root-rw) is encrypted
$ df -h /media/root-rw/
Filesystem Size Used Avail Use% Mounted on
c.) check /run/initramfs/
$ grep success /run/initramfs/
[success]: configured root with 'crypt:
d.) show password file.
$ pf=$(echo /run/initramfs/
$ for f in $pf; do ls -l $f; sudo cat $f; done
-rw------- 1 root root 128 Nov 29 20:22 /run/initramfs/
[Regression Potential]
The most likely path for failure on this I would think is related to setting
of PERSIST_DIR. If PERSIST_DIR was not set correctly, then the logging
would likely fail and the password file would not be created.
That should be caught and logged with:
log_fail "failed creation of password file";
[Other Info]
The full overlayroot/
specific change that fixed the issue is in revision 126 at [2]
[1] http://
[2] http://
=== End SRU Template ===
For the life of me I cannot get the parameter crypt:dev=/dev/vdb to work in /etc/overlayroo
I have tried the line
overlayroot=
Which works when I create the LUKS device ahead of time, and set the passphrase 'somepass'. But when I try
overlayroot=
or just
overlayroot=
I get no overlay after reboot. I have also tried the "debug=1" parameter and I'm not getting any debug output either. Where are the logs and/or where should I be able to see the debug output?
As Dustin has so eloquently documented, it defeats the privacy of your encryption if you have to specify the passphrase in clear text in your unencrypted read-only directory. So the only way I will be using this is if I can use the simple "overlayroot=
Related branches
| Alexander Chepurko (alexander-chepurko) wrote | #1 |
| Alexander Chepurko (alexander-chepurko) wrote | #2 |
| Alexander Chepurko (alexander-chepurko) wrote | #3 |
| Scott Moser (smoser) wrote | #4 |
| Changed in cloud-initramfs-tools (Ubuntu): | |
| assignee: | nobody → Scott Moser (smoser) |
| importance: | Undecided → High |
| status: | New → In Progress |
| Launchpad Janitor (janitor) wrote | #5 |
| Changed in cloud-initramfs-tools (Ubuntu): | |
| status: | In Progress → Fix Released |
| Changed in cloud-initramfs-tools (Ubuntu Xenial): | |
| status: | New → Confirmed |
| Changed in cloud-initramfs-tools (Ubuntu Yakkety): | |
| status: | New → Confirmed |
| Changed in cloud-initramfs-tools (Ubuntu Xenial): | |
| importance: | Undecided → Medium |
| Changed in cloud-initramfs-tools (Ubuntu Yakkety): | |
| importance: | Undecided → Medium |
| Changed in cloud-initramfs-tools (Ubuntu Xenial): | |
| status: | Confirmed → In Progress |
| Changed in cloud-initramfs-tools (Ubuntu Yakkety): | |
| status: | Confirmed → In Progress |
| Changed in cloud-initramfs-tools (Ubuntu Xenial): | |
| assignee: | nobody → Scott Moser (smoser) |
| Changed in cloud-initramfs-tools (Ubuntu Yakkety): | |
| assignee: | nobody → Scott Moser (smoser) |
| description: | updated |
| Chris Halse Rogers (raof) wrote Please test proposed package | #6 |
| Changed in cloud-initramfs-tools (Ubuntu Xenial): | |
| status: | In Progress → Fix Committed |
| tags: | added: verification-needed |
| Chris Halse Rogers (raof) wrote | #7 |
| Changed in cloud-initramfs-tools (Ubuntu Yakkety): | |
| status: | In Progress → Fix Committed |
| Scott Moser (smoser) wrote | #8 |
| description: | updated |
| tags: |
added: verification-done-xenial removed: verification-needed |
| Scott Moser (smoser) wrote | #9 |
| tags: | added: verification-done-yakkety |
| Launchpad Janitor (janitor) wrote | #10 |
| Changed in cloud-initramfs-tools (Ubuntu Xenial): | |
| status: | Fix Committed → Fix Released |
| Robie Basak (racb) wrote Update Released | #11 |
| Launchpad Janitor (janitor) wrote | #12 |
| Changed in cloud-initramfs-tools (Ubuntu Yakkety): | |
| status: | Fix Committed → Fix Released |
This is on a fresh Ubuntu 16.04 cloud instance at an OpenStack host, launched from the typical Ubuntu cloud image with overlayroot already included.