Public bug reported:
Source package: clevis (binary package: clevis-initramfs)
1) Release of Ubuntu
Ubuntu 24.04.4 LTS
2) Version of the package
clevis-initramfs 20-1ubuntu0.24.04.1
clevis 20-1ubuntu0.24.04.1
cryptsetup 2.7.0
3) What I expected to happen
On a LUKS2 root with a working clevis pin, when clevis successfully decrypts the
passphrase and writes it to the askpass FIFO, luks2_decrypt() should return
success,
its caller should print "Unlocked <device> with clevis", and the retry loop
should
stop attempting that device.
4) What happened instead
The volume unlocks correctly, but the success message never appears on the
console or
in "journalctl -b", and the retry loop continues as though the attempt had
failed.
Cause
In /usr/share/initramfs-tools/scripts/local-top/clevis, luks2_decrypt()
iterates LUKS2
tokens with a while-loop on the right-hand side of a pipeline:
luks2_decrypt() {
local CRYPTTAB_SOURCE=$1
local PASSFIFO=$2
cryptsetup luksDump "$CRYPTTAB_SOURCE" | sed -rn 's|^\s+([0-9]+):
clevis|\1|p' | while read -r id; do
...
echo -n "${decrypted}" >"$PASSFIFO"
return 0
done
return 1
}
The right-hand side of a pipeline runs in a subshell, so "return 0" exits the
subshell
rather than luks2_decrypt(). Control always falls through to the trailing
"return 1",
and the function can never report success. luks1_decrypt() has the identical
structure
via "luksmeta show | while read".
The caller branches on that value, so the success path is unreachable:
if luks2_decrypt "${CRYPTTAB_SOURCE}" "${PASSFIFO}"; then
echo "Unlocked ${CRYPTTAB_SOURCE} with clevis"
else
OLD_CRYPTTAB_SOURCE=""
sleep 5
fi
Consequences
* "Unlocked <device> with clevis" is never printed, so an operator has no
positive
signal that clevis did the work.
* Every attempt, including successful ones, resets OLD_CRYPTTAB_SOURCE and
sleeps 5
seconds before looping.
* The retry loop is structurally unable to distinguish success from failure.
On a healthy boot the fault is masked, because local-bottom/clevis kills the
loop once
the volume is open. It becomes visible on any host where a pin cannot be
satisfied.
Confirmation that the shipped file is unmodified
$ dpkg --verify clevis-initramfs
(no output)
The installed file's md5sum is identical to the entry in
/var/lib/dpkg/info/clevis-initramfs.md5sums.
Minimal reproduction of the shell semantics, run on the affected host under
/bin/sh (dash), and also confirmed under bash:
shipped() {
printf '2\n4\n' | while read -r id; do
return 0
done
return 1
}
shipped; echo "exit=$?" # prints exit=1
fixed() {
ids=$(printf '2\n4\n')
for id in $ids; do
return 0
done
return 1
}
fixed; echo "exit=$?" # prints exit=0
Reproducer on a real system
1. Ubuntu 24.04.4, LUKS2 root, clevis-initramfs installed.
2. Bind a working pin, e.g.
clevis luks bind -d /dev/sdaX tpm2 '{"pcr_ids":"7"}'
3. update-initramfs -u -k all, then reboot.
4. The volume unlocks, but "Unlocked /dev/sdaX with clevis" never appears on the
console or in journalctl -b.
Suggested fix
Feed the loop without a pipeline so the function's own return is
reachable:
luks2_decrypt() {
local CRYPTTAB_SOURCE=$1
local PASSFIFO=$2
local ids
ids=$(cryptsetup luksDump "$CRYPTTAB_SOURCE" | sed -rn 's|^\s+([0-9]+):
clevis|\1|p')
for id in $ids; do
...
echo -n "${decrypted}" >"$PASSFIFO"
return 0
done
return 1
}
The same change applies to luks1_decrypt().
Not applicable upstream
This file is Debian-family packaging; initramfs-tools does not exist upstream,
which
ships dracut modules with a different implementation. The report belongs
against the
Ubuntu/Debian clevis source package, not latchset/clevis.
When a clevis pin can be satisfied, the volume unlocks promptly and correctly -
measured at a 6.4 to 6.9 second kernel phase on a test host. No key material is
exposed, no unauthorised unlock is possible, and no cryptographic property is
weakened. The user-visible effects are a missing log message and a retry loop
that
cannot distinguish success from failure.
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: clevis-initramfs 20-1ubuntu0.24.04.1
ProcVersionSignature: Ubuntu 6.8.0-137.137-generic 6.8.12
Uname: Linux 6.8.0-137-generic x86_64
ApportVersion: 2.28.1-0ubuntu3.8
Architecture: amd64
CasperMD5CheckResult: pass
Date: Mon Aug 10 17:26:50 2026
InstallationDate: Installed on 2026-08-09 (2 days ago)
InstallationMedia: Ubuntu-Server 24.04.4 LTS "Noble Numbat" - Release amd64
(20260210)
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm-256color
XDG_RUNTIME_DIR=<set>
SourcePackage: clevis
UpgradeStatus: No upgrade log present (probably fresh install)
** Affects: clevis (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2163190
Title:
luks2_decrypt() always returns 1, even when it writes the passphrase
to the FIFO
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/clevis/+bug/2163190/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
