Azure / Azure/azure-linux-extensions
[RFC] Improve how ADE handles unlocking of encrypted images
- Dominant language
- Python
- Stars
- 333
- Forks
- 278
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 4
Description
ADE provides dracut module that contains custom script to mount filesystem containing password file and then the script calls ```cryptsetup``` in order to unlock the encrypted disk.
While above scheme works it is unnecessarily complex. Hence, I propose to simplify the things a bit and relly more on systemd's built-in mechanisms. Basically, with the new scheme, we would have following,
1) ```/etc/fstab``` file in initrd containing one entry that would cause the mount of password file backing FS. This entry would specify the ordering requirement that corresponding mount unit (generated by ```systemd-fstab-generator```) is processed before ```cryptsetup-pre.target```. We should be able to achieve this using extra fstab option ```x-systemd.before=cryptsetup-pre.target```.
2) ```/etc/crypttab``` entry we have right now would be changed so that it references the password file. Presence of the password file should be handled by mount from 1). Note that in case when the entry uses password file the ```systemd-cryptsetup``` utility that actually unlocks the device doesn't employ ```systemd-ask-password```.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.