mirror of
https://github.com/linuxboot/heads.git
synced 2024-12-18 20:47:55 +00:00
0cef8e1edc
cryptsetup2 2.6.1 is a new release that supports reencryption of Q4.2 release LUKS2 volumes created at installation.
This is a critical feature for the Qubes OS 4.2 release for added data at rest protection
Cryptsetup 2.6.x internal changes:
- Argon2 used externally and internally: requires a lot of RAM and CPU to derivate passphrase to key validated in key slots.
- This is used to rate limit efficiently bruteforcing of LUKS key slots, requiring each offline brute force attempt to consume ~15-30 seconds per attempt
- OF course, strong passphrases are still recommended, but bruteforcing LUKSv2 containers with Argon2 would require immense time, ram and CPU even to bruteforce low entropy passphrase/PINs.
- passphrase change doesn't permit LUKS key slot specification anymore: key slot rotates (new one consusumed per op: then old one wiped internally. EG: LUKS key slot 1 created, then 0 deleted)
- reencryption doesn't permit old call arguments. No more direct-io; inadmissively slow through AIO (async) calls, need workarounds for good enough perfs (arguments + newer kernel with cloudfare fixes in tree)
cryptsetup 2.6.1 requires:
- lvm2 2.03.23, which is also included in this PR.
- requires libaio, which is also included in this PR (could be hacked out but deep dependency at first sight: left in)
- requires util-linux 2.39
- patches for reproducible builds are included for above 3 packages.
luks-functions was updated to support the new cryptsetup2 version calls/changes
- reencryption happen in direct-io, offline mode and without locking, requiring linux 5.10.9+ to bypass linux queues
- from tests, this is best for performance and reliability in single-user mode
- LUKS container ops now validate Disk Recovery Key (DRK) passphrase prior and DRK key slot prior of going forward if needed, failing early.
- Heads don't expect DRK to be in static key slot anymore, and finds the DRK key slot dynamically.
- If reencrytipn/passphrase change: make sure all LUKS containers on same block device can be unlocked with same DRK
- Reencryption: requires to know which key slot to reencrypt.
- Find LUKS key slot that unlocks with DRK passphrase unlock prior of reencrypt call
- Passphrase change: no slot can be passed, but key slot of DRK rotates.
kexec-seal-key
- TPM LUKS Disk Unlock Key key slots have changed to be set in max slots per LUKS version (LUKSv1:7 /LUKSv2: 31)
- If key slot != default LUKS version's keyslot outside of DRK key slot: prompt the user before wiping that key slot, otherwise wipe automatically
- This takes for granted that the DRK key slot alone is needed on the system and Heads controls the LUKS key slots.
- If user has something else going on, ie: Using USB Security dongle + TPM DUK, then the user will need to say no when wiping keys.
- It was suggested to leave LUKS key slots outside of DRK alone, but then: what to do when all key slots would be used?
- Alternative implementation could be to only prompt users to wipe keyslots other then DRK when key slots are all used (LUKSv1: 0-7, LUKSv2: 0-31)
- But then cleanup would need to happen prior of operations (LUKS passphrase change, TPM DUK setup) and could be problematic.
- LUKS containers now checked to be same LUKS version prior of permitting to set TPM DUK and will refuse to go forward of different versions.
TODO:
- async (AIO) calls are not used. direct-io is used instead. libaio could be hacked out
- this could be subject to future work
Notes:
- time to deprecated legacy boards the do not enough space for the new space requirements
- x230-legacy, x230-legacy-flash, x230-hotp-legacy
- t430-legacy, t430-legacy-flash, t430-hotp-legacy already deprecated
Unrelated:
- typos fixes found along the way
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
61 lines
1.5 KiB
Makefile
61 lines
1.5 KiB
Makefile
modules-$(CONFIG_LVM2) += lvm2
|
|
|
|
lvm2_version := 2.03.23
|
|
lvm2_dir := lvm2.$(lvm2_version)
|
|
lvm2_tar := LVM2.$(lvm2_version).tgz
|
|
lvm2_url := https://mirrors.kernel.org/sourceware/lvm2/$(lvm2_tar)
|
|
lvm2_hash := 74e794a9e9dee1bcf8a2065f65b9196c44fdf321e22d63b98ed7de8c9aa17a5d
|
|
|
|
# cross compiling test assumes malloc/realloc aren't glibc compat
|
|
# so we force it via the configure cache.
|
|
lvm2_configure := \
|
|
$(CROSS_TOOLS) \
|
|
ac_cv_func_malloc_0_nonnull=yes \
|
|
ac_cv_func_realloc_0_nonnull=yes \
|
|
./configure \
|
|
--host $(MUSL_ARCH)-elf-linux \
|
|
--prefix "" \
|
|
--libexecdir "/bin" \
|
|
--with-optimisation=-Os \
|
|
--enable-devmapper \
|
|
--disable-selinux \
|
|
--without-systemd \
|
|
--disable-lvmimportvdo \
|
|
--disable-realtime \
|
|
--disable-dmfilemapd \
|
|
--disable-dmeventd \
|
|
--disable-lvmpolld \
|
|
--disable-readline \
|
|
--disable-udev_sync \
|
|
--enable-static_link \
|
|
--disable-use-lvmlockd \
|
|
--disable-use-lvmpolld \
|
|
--disable-dmfilemapd \
|
|
--disable-cmirrord \
|
|
--disable-cache_check_needs_check \
|
|
--disable-thin_check_needs_check \
|
|
--with-cluster=none \
|
|
--with-thin-check= \
|
|
|
|
# not sure why LIB_SUFFIX is not defined in the cross build
|
|
lvm2_target := \
|
|
$(MAKE_JOBS) \
|
|
$(CROSS_TOOLS) \
|
|
DESTDIR="$(INSTALL)" \
|
|
all \
|
|
&& \
|
|
$(MAKE) \
|
|
-C "$(build)/$(lvm2_dir)" \
|
|
$(MAKE_JOBS) \
|
|
$(CROSS_TOOLS) \
|
|
DESTDIR="$(INSTALL)" \
|
|
install_device-mapper \
|
|
|
|
lvm2_libraries := libdm/ioctl/libdevmapper.so.1.02
|
|
|
|
lvm2_output := \
|
|
./libdm/dm-tools/dmsetup \
|
|
tools/lvm \
|
|
|
|
lvm2_depends := util-linux libaio $(musl_dep)
|