bugGNU GRUB - Bugs: bug #45889, cryptomount thinks locked device...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #45889: cryptomount thinks locked device is: already mounted as cryptoX

Submitted by:  TJ <intuitivenipple>
Submitted on:  Sun 06 Sep 2015 12:45:15 PM UTC  
 
Category: SecuritySeverity: Major
Priority: 5 - NormalItem Group: Software Error
Status: FixedPrivacy: Public
Assigned to: NoneOriginator Name: 
Open/Closed: ClosedRelease: 
Release: 2.02~beta1Reproducibility: Every Time
Planned Release: None

Sat 07 Nov 2015 03:55:17 PM UTC, comment #5:

Fixed in c7f93a20c47f712d45cd97fdfd43e0715ae855e3

Andrei Borzenkov <arvidjaar>
Project Member
Mon 07 Sep 2015 04:01:56 AM UTC, comment #4:

With the attached patch the mounts now work:

Attempting to decrypt master key...
Enter passphrase for hd0,gpt3 ( ...UUID...)
Slot 0 opened
disk/cryptodisk.c:718: insert 0, source 'hd0,gpt3', id 128, dev_id 0
grub rescue> ls
(hd0) (hd0,gpt5) (hd0,gpt4) (hd0,gpt3) (hd0,gpt2) (hd0,gpt1) (crypto0) (proc)
grub rescue> cryptomount hd0,gpt4
Attempting to decrypt master key...
Enter passphrase for hd0,gpt4 (...UUID...)
Slot 0 opened
disk/cryptodisk.c:718: insert 1, source 'hd0,gpt4', id 128, dev_id 0
grub rescue> cryptomount hd0,gpt5
Attempting to decrypt master key...
Enter passphrase for hd0,gpt5 (...UUID...)
Slot 0 opened
disk/cryptodisk.c:718: insert 2, source 'hd0,gpt4', id 128, dev_id 0
grub rescue> insmod lvm
grub rescue> ls
(lvm/VG_OS-x86_64.usr_local) (lvm/VG_OS-ubuntu_15.10_var) (lvm/VG_OS-ubuntu_15.10_rootfs) (lvm/VG_DATA-home) (hd0) (hd0,gpt5) (hd0,gpt4) (hd0,gpt3) (hd0,gpt2) (hd0,gpt1) (crypto2) (crypto1) (crypto0) (proc)

(file #34822)

TJ <intuitivenipple>
Sun 06 Sep 2015 11:52:38 PM UTC, comment #3:

disk/cryptodisk.c:716: insert 0, source 'hd0,gpt3', id 128, dev_id 0

That means the test in grub_cryptodisk_get_by_source_disk() will return the entry for the first unlocked partition on the same disk, even if that disk has 128 (GPT) encrypted partitions.

Looking at include/grub/cryptodisk.h::struct grub_cryptodisk
it seems the issue is the structure has no concept of partitions, and no test against dev->source string is done (the only place in the structure where the partition is stored ) but that isn't a good basis for such test if the device was opened by UUID name.

TJ <intuitivenipple>
Sun 06 Sep 2015 11:39:29 PM UTC, comment #2:

After adding a grub_dprintf() to grub_cryptodisk_insert() I see:

Attempting to decrypt master key...
Enter passphrase for hd0,gpt3 (...UUID...)
<<<< type bad pass phrase
error: access denied.
error: no such cryptodisk found.
Entering rescue mode...
grub rescue> set debug=cryptodisk
grub rescue> cryptomount hd0,gpt3
Enter passphrase for hd0,gpt3 (...UUID...)
<<< type good passphrase
Slot 0 opened

disk/cryptodisk.c:716: insert 0, source 'hd0,gpt3', id 128, dev_id 0

grub rescue> ls
(hd0) (hd0,gpt5) (hd0,gpt4) (hd0,gpt3) (hd0,gpt2) (hd0,gtp1)
disk/cryptodisk.c:524: Opening device crypto0
disk/cryptodisk.c:587: Reading 64 sectors from sector 0x0 with offset of 4096
disk/cryptodisk.c:543: Closing disk
(crypto0) (proc)

grub rescue> cryptomount hd0,gpt4

disk/cryptodisk.c:990: already mounted as crypto0

grub rescue>

TJ <intuitivenipple>
Sun 06 Sep 2015 02:35:33 PM UTC, comment #1:

Crucial typo in original report; unable to edit it. I tried to mount both the other partitions:

I try to

cryptomount hd0,gpt4
cryptomount hd0,gpt5

and see the message for both:

disk/cryptodisk.c:978: already mounted as crypto0

TJ <intuitivenipple>
Sun 06 Sep 2015 12:45:15 PM UTC, original submission:

Boot disk with 3 LUKS/dm-crypt GPT partitions

(hd0,gpt3) (hd0,gpt4) (hd0,gpt5)

grub is in (hd0,gpt3). The others have a LVM VG each.

Using GRUB_ENABLE_CRYPTODISK=y

I deliberately fail the first pass-phrase entry to get the rescue environment. I then

cryptomount hd0,gpt3

(crypto0) device is now present and prefix/root are set correctly.

I insmod some other modules (exploring available functions) and

set debug=cryptodisk

I try to

cryptomount hd0,gpt4
cryptomount hd0,gpt4

and see the message

disk/cryptodisk.c:978: already mounted as crypto0

But ls shows only (crypto0)

source-code in grub-core/disk/cryptodisk.c shows

dev = grub_cryptodisk_get_by_source_disk(disk)

must be returning a reference to the existing crypto0, which suggests a problem in grub_cryptodisk_insert() or grub_cryptodisk_get_by_source_disk()

TJ <intuitivenipple>

 

Attached Files
file #34822:  0001-cryptodisk-teach-grub_cryptodisk_insert-about-partit.patch added by intuitivenipple (2KiB - text/x-patch - Teach grub_cryptodisk_insert() about partitions)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by arvidjaar (Posted a comment)
  • -unavailable- added by intuitivenipple (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 07 Nov 2015 03:55:17 PM UTCarvidjaarStatusNone=>Fixed
      Open/ClosedOpen=>Closed
    Mon 07 Sep 2015 04:01:56 AM UTCintuitivenippleAttached File-=>Added 0001-cryptodisk-teach-grub_cryptodisk_insert-about-partit.patch, #34822

    Back to the top


    Powered by Savane 3.1-cleanup1