Azure / Azure/azure-linux-extensions

[RFC] Improve how ADE handles unlocking of encrypted images

Open
#605 0 comments 0 reactions 2 assignees Claimed by @vermashi View on GitHub
Dominant language
Python
Stars
333
Forks
278
Avg merge
2d 9h
Merged PRs (30d)
4

Description

ADE provides dracut module that contains custom script to mount filesystem containing password file and then the script calls ```cryptsetup``` in order to unlock the encrypted disk.

While above scheme works it is unnecessarily complex. Hence, I propose to simplify the things a bit and relly more on systemd's built-in mechanisms. Basically, with the new scheme, we would have following,

1) ```/etc/fstab``` file in initrd containing one entry that would cause the mount of password file backing FS. This entry would specify the ordering requirement that corresponding mount unit (generated by ```systemd-fstab-generator```) is processed before ```cryptsetup-pre.target```. We should be able to achieve this using extra fstab option ```x-systemd.before=cryptsetup-pre.target```.

2) ```/etc/crypttab``` entry we have right now would be changed so that it references the password file. Presence of the password file should be handled by mount from 1). Note that in case when the entry uses password file the ```systemd-cryptsetup``` utility that actually unlocks the device doesn't employ ```systemd-ask-password```.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.