dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-10 17:14:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

cryptsetup: document that keyfile-erase does not apply to auto-discovered key files

Browse Source 
keyfile-erase only erases a key file explicitly configured in the third
field of crypttab. Key files automatically discovered in
/etc/cryptsetup-keys.d/ and /run/cryptsetup-keys.d/ are considered shared
resources not owned by an individual volume, and are never erased. Make
this explicit in the documentation and add a code comment clarifying the
intent.

Fixes: https://github.com/systemd/systemd/issues/41127
Co-developed-by: Claude Opus 4.8 <noreply@anthropic.com>
(cherry picked from commit c280a16ab7)
(cherry picked from commit d10acbe6be)
(cherry picked from commit d62e2be6ef)
This commit is contained in:
Daan De Meyer
2026-06-03 14:03:39 +00:00
committed by Luca Boccassi
parent 7bfa9a21a9
commit 68e90fd666
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
man/crypttab.xml
View File

@@ -232,6 +232,13 @@
activation (e.g. via a file in <filename>/run/</filename>, generated by a service running before
activation), and shall be removed after use. Defaults to off.</para>
<para>Note that this option only applies to a key file explicitly configured in the third field, and
has no effect on key files that are automatically discovered in
<filename>/etc/cryptsetup-keys.d/</filename> and <filename>/run/cryptsetup-keys.d/</filename>. The
latter are considered shared resources that are not owned by an individual volume, and hence are never
erased. To erase an automatically discovered key file, configure its path explicitly in the third
field.</para>
<xi:include href="version-info.xml" xpointer="v246"/></listitem>
</varlistentry>

3
src/cryptsetup/cryptsetup.c
View File

@@ -2433,6 +2433,9 @@ static int verb_attach(int argc, char *argv[], void *userdata) {
/* A delicious drop of snake oil */
(void) safe_mlockall(MCL_CURRENT|MCL_FUTURE|MCL_ONFAULT);
/* Only erase key files explicitly configured on the command line, never the ones we
* auto-discover in /etc/cryptsetup-keys.d/ and /run/cryptsetup-keys.d/: those are shared
* resources not owned by an individual volume. (key_file is NULL when auto-discovery is used.) */
if (key_file && arg_keyfile_erase)
destroy_key_file = key_file; /* let's get this baby erased when we leave */