crypt: Wait for udev to settle before unlocking disk

PATCH In review James Lee 2 participants 2 messages Jul 29, 2013 – Jul 31, 2013 1 message not in the archive

Share & tools

James Lee

author

2013-07-29 20:10 UTC #0 lore raw

PATCH 1/1 crypt: Wait for udev to settle before unlocking disk

To eliminate a race condition that occurs when unlocking one device depends on the result of unlocking a device before it, the crypt module must wait for udev to settle between each unlock attempt.

Example

/etc/crypttab:

keyfile /dev/md1 none luks
sda4_crypt /dev/sda4 /dev/mapper/keyfile luks
sdb4_crypt /dev/sdb4 /dev/mapper/keyfile luks

Without this patch, sometimes /dev/sda4 fails to unlock because udev doesn't have time to create /dev/mapper/keyfile before it's needed.

---
 modules.d/90crypt/parse-crypt.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

modules.d/90crypt/parse-crypt.sh +4 -4

index 961ec61..4e42d59 100755
@@ -23,7 +23,7 @@ else
                 {
                     printf -- 'ENV{ID_FS_TYPE}=="crypto_LUKS", '
                     printf -- 'ENV{ID_FS_UUID}=="*%s*", ' $luksid
-                    printf -- 'RUN+="%s --unique --onetime ' $(command -v initqueue)
+                    printf -- 'RUN+="%s --settled --unique --onetime ' $(command -v initqueue)
                     printf -- '--name cryptroot-ask-%%k %s ' $(command -v cryptroot-ask)
                     printf -- '$env{DEVNAME} luks-$env{ID_FS_UUID} %s"\n' $tout
                 } >> /etc/udev/rules.d/70-luks.rules.new

@@ -31,7 +31,7 @@ else
                 {
                     printf -- 'ENV{ID_FS_TYPE}=="crypto_LUKS", '
                     printf -- 'ENV{ID_FS_UUID}=="*%s*", ' $luksid
-                    printf -- 'RUN+="%s --unique --onetime ' $(command -v initqueue)
+                    printf -- 'RUN+="%s --settled --unique --onetime ' $(command -v initqueue)
                     printf -- '--name systemd-cryptsetup-%%k %s start ' $(command -v systemctl)
                     printf -- 'systemd-cryptsetup@luks$$(dev_unit_name -$env{ID_FS_UUID}).service"\n'
                 } >> /etc/udev/rules.d/70-luks.rules.new

@@ -51,13 +51,13 @@ else
         if [ -z "$DRACUT_SYSTEMD" ]; then
             {
                 printf -- 'ENV{ID_FS_TYPE}=="crypto_LUKS", RUN+="%s ' $(command -v initqueue)
-                printf -- '--unique --onetime --name cryptroot-ask-%%k '
+                printf -- '--unique --settled --onetime --name cryptroot-ask-%%k '
                 printf -- '%s $env{DEVNAME} luks-$env{ID_FS_UUID} %s"\n' $(command -v cryptroot-ask) $tout
             } >> /etc/udev/rules.d/70-luks.rules.new
         else
             {
                 printf -- 'ENV{ID_FS_TYPE}=="crypto_LUKS", RUN+="%s ' $(command -v initqueue)
-                printf -- '--unique --onetime --name crypt-run-generator-%%k '
+                printf -- '--unique --settled --onetime --name crypt-run-generator-%%k '
                 printf -- '%s $env{DEVNAME} luks-$env{ID_FS_UUID}"\n' $(command -v crypt-run-generator)
             } >> /etc/udev/rules.d/70-luks.rules.new
         fi

Signature · 1 line

1.8.1.2

A message that is not in the archive (sent off-list or not yet received): 1375128622-8307-1-git-send-email-jlee-RWYTM8lfiZY4k1Tz1RznXQC/[email protected]

Harald Hoyer

2013-07-31 13:51 UTC #2 lore raw

Quoted 47 lines · James Lee

To eliminate a race condition that occurs when unlocking one device depends on the result of unlocking a device before it, the crypt module must wait for udev to settle between each unlock attempt.

Example

/etc/crypttab:

keyfile /dev/md1 none luks
sda4_crypt /dev/sda4 /dev/mapper/keyfile luks
sdb4_crypt /dev/sdb4 /dev/mapper/keyfile luks

Without this patch, sometimes /dev/sda4 fails to unlock because udev doesn't have time to create /dev/mapper/keyfile before it's needed.

---
 modules.d/90crypt/parse-crypt.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

modules.d/90crypt/parse-crypt.sh +3 -3

index 961ec61..4e42d59 100755
@@ -23,7 +23,7 @@ else
                 {
                     printf -- 'ENV{ID_FS_TYPE}=="crypto_LUKS", '
                     printf -- 'ENV{ID_FS_UUID}=="*%s*", ' $luksid
-                    printf -- 'RUN+="%s --unique --onetime ' $(command -v initqueue)
+                    printf -- 'RUN+="%s --settled --unique --onetime ' $(command -v initqueue)
                     printf -- '--name cryptroot-ask-%%k %s ' $(command -v cryptroot-ask)
                     printf -- '$env{DEVNAME} luks-$env{ID_FS_UUID} %s"\n' $tout
                 } >> /etc/udev/rules.d/70-luks.rules.new

@@ -31,7 +31,7 @@ else
                 {
                     printf -- 'ENV{ID_FS_TYPE}=="crypto_LUKS", '
                     printf -- 'ENV{ID_FS_UUID}=="*%s*", ' $luksid
-                    printf -- 'RUN+="%s --unique --onetime ' $(command -v initqueue)
+                    printf -- 'RUN+="%s --settled --unique --onetime ' $(command -v initqueue)
                     printf -- '--name systemd-cryptsetup-%%k %s start ' $(command -v systemctl)
                     printf -- 'systemd-cryptsetup@luks$$(dev_unit_name -$env{ID_FS_UUID}).service"\n'
                 } >> /etc/udev/rules.d/70-luks.rules.new

@@ -51,13 +51,13 @@ else
         if [ -z "$DRACUT_SYSTEMD" ]; then
             {
                 printf -- 'ENV{ID_FS_TYPE}=="crypto_LUKS", RUN+="%s ' $(command -v initqueue)
-                printf -- '--unique --onetime --name cryptroot-ask-%%k '
+                printf -- '--unique --settled --onetime --name cryptroot-ask-%%k '

modules.d/90crypt/parse-crypt.sh else · line 63

Quoted 10 lines

modules.d/90crypt/parse-crypt.sh +1 -1

                 printf -- '%s $env{DEVNAME} luks-$env{ID_FS_UUID} %s"\n' $(command -v cryptroot-ask) $tout
             } >> /etc/udev/rules.d/70-luks.rules.new
         else
             {
                 printf -- 'ENV{ID_FS_TYPE}=="crypto_LUKS", RUN+="%s ' $(command -v initqueue)
-                printf -- '--unique --onetime --name crypt-run-generator-%%k '
+                printf -- '--unique --settled --onetime --name crypt-run-generator-%%k '
                 printf -- '%s $env{DEVNAME} luks-$env{ID_FS_UUID}"\n' $(command -v crypt-run-generator)
             } >> /etc/udev/rules.d/70-luks.rules.new
         fi

thanks! pushed