bugGNU GRUB - Bugs: bug #45889, cryptomount thinks locked device...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #45889: cryptomount thinks locked device is: already mounted as cryptoX

Submitter:  TJ <intuitivenipple>
Submitted:  Sun 06 Sep 2015 12:45:15 PM UTC
   
 
Category:  Security Severity:  Major
Priority:  5 - Normal Item Group:  Software Error
Status:  Fixed Privacy:  Public
Assigned to:  None Originator Name: 
Open/Closed:  Closed Release:  2.02~beta1
Release:  Reproducibility:  Every Time
Planned Release:  None

Sat 07 Nov 2015 03:55:17 PM UTC, comment #5: 

Fixed in c7f93a20c47f712d45cd97fdfd43e0715ae855e3

Andrei Borzenkov <arvidjaar>
Group Member
Mon 07 Sep 2015 04:01:56 AM UTC, comment #4: 

With the attached patch the mounts now work:

Attempting to decrypt master key...
Enter passphrase for hd0,gpt3 ( ...UUID...)
Slot 0 opened
disk/cryptodisk.c:718: insert 0, source 'hd0,gpt3', id 128, dev_id 0
grub rescue> ls
(hd0) (hd0,gpt5) (hd0,gpt4) (hd0,gpt3) (hd0,gpt2) (hd0,gpt1) (crypto0) (proc)
grub rescue> cryptomount hd0,gpt4
Attempting to decrypt master key...
Enter passphrase for hd0,gpt4 (...UUID...)
Slot 0 opened
disk/cryptodisk.c:718: insert 1, source 'hd0,gpt4', id 128, dev_id 0
grub rescue> cryptomount hd0,gpt5
Attempting to decrypt master key...
Enter passphrase for hd0,gpt5 (...UUID...)
Slot 0 opened
disk/cryptodisk.c:718: insert 2, source 'hd0,gpt4', id 128, dev_id 0
grub rescue> insmod lvm
grub rescue> ls
(lvm/VG_OS-x86_64.usr_local) (lvm/VG_OS-ubuntu_15.10_var) (lvm/VG_OS-ubuntu_15.10_rootfs) (lvm/VG_DATA-home) (hd0)  (hd0,gpt5) (hd0,gpt4) (hd0,gpt3) (hd0,gpt2) (hd0,gpt1) (crypto2) (crypto1) (crypto0) (proc)



(file #34822)

TJ <intuitivenipple>
Sun 06 Sep 2015 11:52:38 PM UTC, comment #3: 

disk/cryptodisk.c:716: insert 0, source 'hd0,gpt3', id 128, dev_id 0

That means the test in grub_cryptodisk_get_by_source_disk() will return the entry for the first unlocked partition on the same disk, even if that disk has 128 (GPT) encrypted partitions.

Looking at include/grub/cryptodisk.h::struct grub_cryptodisk
it seems the issue is the structure has no concept of partitions, and no test against dev->source string is done (the only place in the structure where the partition is stored ) but that isn't a good basis for such test if the device was opened by UUID name.


TJ <intuitivenipple>
Sun 06 Sep 2015 11:39:29 PM UTC, comment #2: 

After adding a grub_dprintf() to grub_cryptodisk_insert() I see:

Attempting to decrypt master key...
Enter passphrase for hd0,gpt3 (...UUID...)
<<<< type bad pass phrase
error: access denied.
error: no such cryptodisk found.
Entering rescue mode...
grub rescue> set debug=cryptodisk
grub rescue> cryptomount hd0,gpt3
Enter passphrase for hd0,gpt3 (...UUID...)
<<< type good passphrase
Slot 0 opened

disk/cryptodisk.c:716: insert 0, source 'hd0,gpt3', id 128, dev_id 0

grub rescue> ls
(hd0) (hd0,gpt5) (hd0,gpt4) (hd0,gpt3) (hd0,gpt2) (hd0,gtp1)
disk/cryptodisk.c:524: Opening device crypto0
disk/cryptodisk.c:587: Reading 64 sectors from sector 0x0 with offset of 4096
disk/cryptodisk.c:543: Closing disk
(crypto0) (proc)

grub rescue> cryptomount hd0,gpt4

disk/cryptodisk.c:990: already mounted as crypto0

grub rescue>

TJ <intuitivenipple>
Sun 06 Sep 2015 02:35:33 PM UTC, comment #1: 

Crucial typo in original report; unable to edit it. I tried to mount both the other partitions:

I try to

cryptomount hd0,gpt4
cryptomount hd0,gpt5

and see the message for both:

disk/cryptodisk.c:978: already mounted as crypto0

TJ <intuitivenipple>
Sun 06 Sep 2015 12:45:15 PM UTC, original submission:  

Boot disk with 3 LUKS/dm-crypt GPT partitions

(hd0,gpt3) (hd0,gpt4) (hd0,gpt5)

grub is in (hd0,gpt3). The others have a LVM VG each.

Using GRUB_ENABLE_CRYPTODISK=y

I deliberately fail the first pass-phrase entry to get the rescue environment. I then

cryptomount hd0,gpt3
 
(crypto0) device is now present and prefix/root are set correctly.

I insmod some other modules (exploring available functions) and

set debug=cryptodisk

I try to

cryptomount hd0,gpt4
cryptomount hd0,gpt4

and see the message

disk/cryptodisk.c:978: already mounted as crypto0

But ls shows only (crypto0)

source-code in grub-core/disk/cryptodisk.c shows

dev = grub_cryptodisk_get_by_source_disk(disk)

must be returning a reference to the existing crypto0, which suggests a problem in grub_cryptodisk_insert() or grub_cryptodisk_get_by_source_disk()

TJ <intuitivenipple>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #34822:  0001-cryptodisk-teach-grub_cryptodisk_insert-about-partit.patch added by intuitivenipple (2KiB - text/x-patch - Teach grub_cryptodisk_insert() about partitions)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by arvidjaar (Posted a comment)
  • -email is unavailable- added by intuitivenipple (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-11-07 arvidjaar StatusNone Fixed
        Open/ClosedOpen Closed
    2015-09-07 intuitivenipple Attached File- Added 0001-cryptodisk-teach-grub_cryptodisk_insert-about-partit.patch, #34822

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code