From d62e2be6eff192309bfa39aa293a5113eb0a5552 Mon Sep 17 00:00:00 2001 From: Daan De Meyer Date: Wed, 3 Jun 2026 14:03:39 +0000 Subject: [PATCH] cryptsetup: document that keyfile-erase does not apply to auto-discovered key files keyfile-erase only erases a key file explicitly configured in the third field of crypttab. Key files automatically discovered in /etc/cryptsetup-keys.d/ and /run/cryptsetup-keys.d/ are considered shared resources not owned by an individual volume, and are never erased. Make this explicit in the documentation and add a code comment clarifying the intent. Fixes: https://github.com/systemd/systemd/issues/41127 Co-developed-by: Claude Opus 4.8 (cherry picked from commit c280a16ab71b5b5e78c119c91f447832a08b0dc6) (cherry picked from commit d10acbe6be0ad837e0c0fd79fd99392b70472602) --- man/crypttab.xml | 7 +++++++ src/cryptsetup/cryptsetup.c | 3 +++ 2 files changed, 10 insertions(+) diff --git a/man/crypttab.xml b/man/crypttab.xml index a8a8242a62f..5295709b474 100644 --- a/man/crypttab.xml +++ b/man/crypttab.xml @@ -232,6 +232,13 @@ activation (e.g. via a file in /run/, generated by a service running before activation), and shall be removed after use. Defaults to off. + Note that this option only applies to a key file explicitly configured in the third field, and + has no effect on key files that are automatically discovered in + /etc/cryptsetup-keys.d/ and /run/cryptsetup-keys.d/. The + latter are considered shared resources that are not owned by an individual volume, and hence are never + erased. To erase an automatically discovered key file, configure its path explicitly in the third + field. + diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c index 9ad67d80d1c..5697d6fdc21 100644 --- a/src/cryptsetup/cryptsetup.c +++ b/src/cryptsetup/cryptsetup.c @@ -2590,6 +2590,9 @@ static int verb_attach(int argc, char *argv[], void *userdata) { /* A delicious drop of snake oil */ (void) safe_mlockall(MCL_CURRENT|MCL_FUTURE|MCL_ONFAULT); + /* Only erase key files explicitly configured on the command line, never the ones we + * auto-discover in /etc/cryptsetup-keys.d/ and /run/cryptsetup-keys.d/: those are shared + * resources not owned by an individual volume. (key_file is NULL when auto-discovery is used.) */ if (key_file && arg_keyfile_erase) destroy_key_file = key_file; /* let's get this baby erased when we leave */