Your message dated Wed, 21 Jul 2010 11:09:31 +0200
with message-id
<1279703371.25386.29.ca...@etppc09.garching.physik.uni-muenchen.de>
and subject line Re: [pkg-cryptsetup-devel] Bug#589641: Bug#589686: cryptsetup:
split out keyscript in separate packages
has caused the Debian Bug report #589641,
regarding cryptsetup: keyscripts depending on /usr/* content fail when /usr is
encrypted and not on the root-filesystem
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
589641: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=589641
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: cryptsetup
Version: 2:1.1.3-1
Severity: important
Hi.
I have not tried this out, nevertheless I'm quite sure it happens as I describe:
- In Debian, it's totally ok, to have /usr on non-root-filesystems (even remote
filesystems are ok,
but I guess that's rather stupid when it comes to disk encryption.
- It's also completely ok (and very reasonable in order to secure against
offline attacks)
to encrypt /usr.
- Many keyscripts depend on content within /usr, e.g. my personal OpenPGP key
scripts, or openct,
opensc and openssl)
It's quite obvious that this will fail:
The root-fs itself can be well decrypted (everything needed is in the
initramfs), but then
we pivot root, and all that stuff is gone... as soon as we try to decrypt any
other device which
uses a keyscript with dependecies in /usr,.. (e.g. /usr-fs itself)... we'll
fail.
I guess there is no solution but one:
Decrypt all such devices in the initramfs image.
But this has of course many problems:
a) In case we support multilayered block devices,... (as described here:
http://wiki.debian.org/AdvancedStartupShutdownWithMultilayeredBlockDevices )
we're fucked ^^... well at least everything gets extremely complicated
b) If we'd already mount more than just root-fs during initramfs... will the
normal init-system boot break?
Cheers,
Chris.
--- End Message ---
--- Begin Message ---
Seems I've misunderstood how the control server works,... therefore
closing them this way, for the "reasons" laid out above.
Chris.
--- End Message ---
