Package: clevis-initramfs
Version: 19-2
Severity: important
Dear Maintainer,
I discovered, that clevis LUKS2 decrypt will block the possibility to enter a passphrase
if a clevis token is not bound to a LUKS2 keyslot.
After several decryption retries it will end up at the initramfs prompt.
The root cause is that in the initrd script scripts/local-top/clevis in function
luks2_decrypt existing unbound clevis tokens are not filtered but then decrypted
and passed to PASSFIFO.
It is reproducible with clevis luks bind, e.g.:
clevis luks bind -f -y -k <our-keyfile> -d <root_device> tpm2 <PCR_bind>
Then removing the keyslot of a token/keyslot pair with:
cryptsetup luksKillSlot <root_device> <keyslot number>
With cryptsetup luksDump <root_device> you would see then e.g.:
...
Tokens:
0: clevis
Digests:
...
After a reboot obviously clevis cannot decrypt but furthermore, it is impossible
to enter the passphrase.
Suggestion to fix: ---------------------------------------------------------------
--- /usr/share/initramfs-tools/scripts/local-top/clevis
+++ /usr/share/initramfs-tools/scripts/local-top/clevis
@@ -78,7 +78,8 @@ luks1_decrypt() {
luks2_decrypt() {
local CRYPTTAB_SOURCE=$1
local PASSFIFO=$2
- cryptsetup luksDump "$CRYPTTAB_SOURCE" | sed -rn 's|^\s+([0-9]+): clevis|\1|p' | while read -r
id; do
+ # Just utilise keyslot assigned token
+ cryptsetup luksDump "$CRYPTTAB_SOURCE" | awk '{ if( $1 == "Keyslot:" && token == "clevis" && id
= 0 && $2 >= 0 ) {printf( "%d\n", id);}; id = $1; token = $2 ;}' | while read -r id ; do
# jose jwe fmt -c outputs extra \n, so clean it up
cte=$(cryptsetup token export --token-id "$id" "$CRYPTTAB_SOURCE")
[ $? -eq 0 ] || continue ---------------------------------------------------------------
This could be also fixed with a bash loop without awk or sed if a newer bash syntax would be ok.
Cheers,
Wolf
-- System Information:
Debian Release: 12.11
APT prefers stable-security