Add LUKS support via Clevis TPM 2 token #1200

danzatt · 2024-04-16T15:17:37Z

tldr; Add a LuksScanner actor which scans all crypt devices using cryptsetup luksDump. Don't inhibit, when all devices are LUKS2 with clevs TPM2 token.

So far, upgrades with encrypted drives were not supported. Encrypted
drives require interactively typing unlock passphrases, which is not
suitable for automatic upgrades using Leapp. We add a feature, where
systems with all drives configured with automatic unlock method can be
upgraded.

Currently, we only support drives configured with Clevis/TPM2 token,
because networking is not configured during Leapp upgrade (excluding
NBDE).

We consume LuksDumps message to decide whether the upgrade process
should be inhibited. If there is at least one LUKS2 device without
Clevis TPM2 binding, we inhibit the upgrade because we cannot tell if
the device is not a part of a more complex storage stack and the failure
to unlock the device migt cause boot problem.

Note that IPU 7 -> 8 with encrypted devices stays unsupported / inhibited.
The new solution is applied only for upgrades from RHEL 8+.

jira: RHEL-3294

This PR introduces new shortened URLs:

/cc @pirat89

github-actions · 2024-04-16T15:17:48Z

Thank you for contributing to the Leapp project!

Please note that every PR needs to comply with the Leapp Guidelines and must pass all tests in order to be mergeable.
If you want to request a review or rebuild a package in copr, you can use following commands as a comment:

review please @oamg/developers to notify leapp developers of the review request
/packit copr-build to submit a public copr build using packit

Packit will automatically schedule regression tests for this PR's build and latest upstream leapp build. If you need a different version of leapp, e.g. from PR#42, use /packit test oamg/leapp#42
Note that first time contributors cannot run tests automatically - they will be started by a reviewer.

It is possible to schedule specific on-demand tests as well. Currently 2 test sets are supported, beaker-minimal and kernel-rt, both can be used to be run on all upgrade paths or just a couple of specific ones.
To launch on-demand tests with packit:

/packit test --labels kernel-rt to schedule kernel-rt tests set for all upgrade paths
/packit test --labels beaker-minimal-8.10to9.4,kernel-rt-8.10to9.4 to schedule kernel-rt and beaker-minimal test sets for 8.10->9.4 upgrade path

See other labels for particular jobs defined in the .packit.yaml file.

Please open ticket in case you experience technical problem with the CI. (RH internal only)

Note: In case there are problems with tests not being triggered automatically on new PR/commit or pending for a long time, please contact leapp-infra.

pirat89 · 2024-04-17T07:09:51Z

repos/system_upgrade/common/actors/inhibitwhenluks/actor.py

+CLEVIS_RHEL8_DOC_URL = 'https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening#configuring-manual-enrollment-of-volumes-using-tpm2_configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption'  # noqa: E501; pylint: disable=line-too-long
+CLEVIS_RHEL9_DOC_URL = 'https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption_security-hardening#configuring-manual-enrollment-of-volumes-using-tpm2_configuring-automated-unlocking-of-encrypted-volumes-using-policy-based-decryption'  # noqa: E501; pylint: disable=line-too-long
+LUKS2_CONVERT_RHEL8_DOC_URL = 'https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/encrypting-block-devices-using-luks_security-hardening#luks-versions-in-rhel_encrypting-block-devices-using-luks'  # noqa: E501; pylint: disable=line-too-long
+LUKS2_CONVERT_RHEL9_DOC_URL = 'https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/encrypting-block-devices-using-luks_security-hardening#luks-versions-in-rhel_encrypting-block-devices-using-luks'  # noqa: E501; pylint: disable=line-too-long
+


candidates for shortened URLs

shortened URLs allow us to react on possible changes in access.redhat.com which could result in 404 errors, etc. you do not need to care about shortened URLs now, we will create them later when wanted.

pirat89 · 2024-04-22T10:48:17Z

@danzatt Hi Dan \o most likely I will get to the review during early May or later June. We are dealing now with additional stuff.

pirat89 · 2024-05-10T12:25:38Z

/packit test

repos/system_upgrade/common/actors/inhibitwhenluks/actor.py

repos/system_upgrade/common/models/luksdump.py

pirat89 · 2024-05-22T08:08:49Z

@danzatt I haven't went through the whole code yet, but covered most of it. I found some things that could be changed, and some that needs to be changed. I do not expect I will find anything else in the rest of the code (and not sure when I will get to it), but i am letting you know about that in advance, in case you would like to wait for the full review.

danzatt · 2024-06-24T17:07:53Z

Hello @pirat89 thanks for the review! I've hopefully addressed all your remarks now.

repos/system_upgrade/common/actors/inhibitwhenluks/libraries/inhibitwhenluks.py

pirat89

It's mostly ok. Just some minor changes should be done. Let's sync during the day to discuss it.

repos/system_upgrade/common/actors/inhibitwhenluks/libraries/inhibitwhenluks.py

repos/system_upgrade/common/actors/luksscanner/libraries/luksscanner.py

pirat89 · 2024-08-02T06:14:15Z

/packit copr-build

pirat89 · 2024-08-02T08:05:39Z

/packit copr-build

pirat89 · 2024-08-06T16:13:46Z

/packit copr-build

pirat89 · 2024-10-09T20:31:10Z

/packit copr-build

pirat89

I will wait for another co-review before merging as I helped with some parts of the code but for now I consider it ready to merge from my side. I will possibly do some additional testing before the merge too.

repos/system_upgrade/common/models/luksdump.py

Modify the StorageInfo model to include path and name of the parent device. Use StorageScanner to collect this information. Morover fix lsblk test, there should be a full device path in "lsblk -pbnr" output (just names were used in the original test).

pirat89 · 2024-10-15T12:10:30Z

/packit copr-build

matejmatuska

Codewise okay, just a few non-blocking minor suggestions :).

repos/system_upgrade/common/actors/luksscanner/libraries/luksscanner.py

repos/system_upgrade/common/actors/inhibitwhenluks/libraries/inhibitwhenluks.py

dkubek · 2024-10-17T09:20:18Z

repos/system_upgrade/common/actors/luksscanner/libraries/luksdump_parser.py

+            self.text = indented_line.strip()
+
+        def add_children(self, nodes):
+            childlevel = nodes[0].level


nodes[0] asumes non-empty list. This is probably not a problem, since we assume non-empty output from the command, but this fails otherwise

thinking about it twice. I do not know whether to use hard blocker (raising an error anyway) or whether to just log a warning and return from the function. let's add for now a comment note and discuss it later.

repos/system_upgrade/common/actors/inhibitwhenluks/actor.py

dkubek · 2024-10-17T10:51:25Z

I went over the code and up to some details it looks good. I manually tested that the upgrade is inhibited on 8->9. Also performed a successful upgrade on a VM with TPM.

Add LuksScanner actor that runs 'cryptsetup luksDump' for all 'crypt' from lsblk output. The output is then parsed and filled into LuksDump and LuksToken models. The LuksDump model contains information about LUKS version, device UUID, corresponding device path, name of the backing device (which contains the LUKS header) and a list of LuksToken models. LuksToken model represents a token associated with the given LUKS device. It contains token ID, IDs of associated keyslot and token type. If the token type is "clevis", we use "clevis luks list" command to determine the clevis-specific subtype and append it to the token name. E.g. if there is a "clevis" token and "clevis luks list" returns "tpm2", the token type will be "clevis-tpm2".

So far, upgrades with encrypted drives were not supported. Encrypted drives require interactively typing unlock passphrases, which is not suitable for automatic upgrades using Leapp. We add a feature, where systems with all drives configured with automatic unlock method can be upgraded. Currently, we only support drives configured with Clevis/TPM2 token, because networking is not configured during Leapp upgrade (excluding NBDE). We consume LuksDumps message to decide whether the upgrade process should be inhibited. If there is at least one LUKS2 device without Clevis TPM2 binding, we inhibit the upgrade because we cannot tell if the device is not a part of a more complex storage stack and the failure to unlock the device migt cause boot problem. Co-authored-by: Petr Stodůlka <pstodulk@redhat.com>

The actor nowadays does more then just inhibiting the upgrade when LUKS is detected. Let's rename it to respect current behaviour.

pirat89 · 2024-10-18T05:35:59Z

/packit copr-build

pirat89 reviewed Apr 17, 2024

View reviewed changes

danzatt force-pushed the add-luks-support branch 4 times, most recently from 9fa57ae to f8346e4 Compare April 19, 2024 14:22

danzatt changed the title ~~[WIP] Add LUKS support~~ Add LUKS support Apr 22, 2024

danzatt changed the title ~~Add LUKS support~~ Add LUKS support via Clevis TPM 2 token Apr 24, 2024

pirat89 added the enhancement New feature or request label May 10, 2024

danzatt force-pushed the add-luks-support branch from f8346e4 to d7693a8 Compare May 21, 2024 13:31

pirat89 requested changes May 22, 2024

View reviewed changes

danzatt force-pushed the add-luks-support branch from d7693a8 to ff4adae Compare June 24, 2024 17:06

pirat89 added this to the 8.10/9.6 milestone Jul 2, 2024

pirat89 mentioned this pull request Jul 2, 2024

Experimental (unsupported) enable of upgrades for encrypted devices #1100

Closed

pirat89 self-requested a review August 2, 2024 05:19

pirat89 reviewed Aug 2, 2024

View reviewed changes

repos/system_upgrade/common/actors/inhibitwhenluks/libraries/inhibitwhenluks.py Outdated Show resolved Hide resolved

pirat89 requested changes Aug 2, 2024

View reviewed changes

pirat89 force-pushed the add-luks-support branch from ff4adae to ffcb92b Compare August 2, 2024 08:05

pirat89 force-pushed the add-luks-support branch 2 times, most recently from 24a3baa to 6e3163d Compare August 2, 2024 11:59

danzatt force-pushed the add-luks-support branch from 6e3163d to 93b48ca Compare August 6, 2024 15:43

pirat89 force-pushed the add-luks-support branch from 93b48ca to ffa0be6 Compare August 6, 2024 19:55

pirat89 added the report Any reports have been added / removed / changed in the PR label Aug 6, 2024

pirat89 added the shortened-urls PR is introducing new shortened red.ht URLs label Aug 6, 2024

pirat89 force-pushed the add-luks-support branch from ffa0be6 to fa20b5b Compare August 6, 2024 20:05

pirat89 force-pushed the add-luks-support branch from fa20b5b to b4517c2 Compare October 9, 2024 20:07

pirat89 requested a review from a team October 9, 2024 20:08

pirat89 force-pushed the add-luks-support branch 2 times, most recently from 22c1022 to e7120a1 Compare October 9, 2024 20:26

pirat89 previously approved these changes Oct 9, 2024

View reviewed changes

dkubek reviewed Oct 14, 2024

View reviewed changes

repos/system_upgrade/common/models/luksdump.py Outdated Show resolved Hide resolved

danzatt added 2 commits October 15, 2024 14:09

InhibitWhenLuks: simplify the logic

2b866a2

pirat89 dismissed their stale review via 111213e October 15, 2024 12:09

pirat89 force-pushed the add-luks-support branch from e7120a1 to 111213e Compare October 15, 2024 12:09

pirat89 previously approved these changes Oct 15, 2024

View reviewed changes

matejmatuska reviewed Oct 15, 2024

View reviewed changes

dkubek reviewed Oct 17, 2024

View reviewed changes

repos/system_upgrade/common/actors/inhibitwhenluks/libraries/inhibitwhenluks.py Outdated Show resolved Hide resolved

dkubek reviewed Oct 17, 2024

View reviewed changes

repos/system_upgrade/common/actors/inhibitwhenluks/actor.py Outdated Show resolved Hide resolved

danzatt and others added 3 commits October 18, 2024 07:34

Rename inhibitwhenluks actor to checkluks

722b4d7

The actor nowadays does more then just inhibiting the upgrade when LUKS is detected. Let's rename it to respect current behaviour.

pirat89 dismissed their stale review via 722b4d7 October 18, 2024 05:34

pirat89 force-pushed the add-luks-support branch from 111213e to 722b4d7 Compare October 18, 2024 05:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add LUKS support via Clevis TPM 2 token #1200

Add LUKS support via Clevis TPM 2 token #1200

danzatt commented Apr 16, 2024 •

edited by pirat89

Loading

github-actions bot commented Apr 16, 2024

pirat89 Apr 17, 2024

pirat89 commented Apr 22, 2024

pirat89 commented May 10, 2024

pirat89 commented May 22, 2024 •

edited

Loading

danzatt commented Jun 24, 2024

pirat89 left a comment

pirat89 commented Aug 2, 2024

pirat89 commented Aug 2, 2024

pirat89 commented Aug 6, 2024

pirat89 commented Oct 9, 2024

pirat89 left a comment

pirat89 commented Oct 15, 2024

matejmatuska left a comment

dkubek Oct 17, 2024

pirat89 Oct 18, 2024

dkubek commented Oct 17, 2024

pirat89 commented Oct 18, 2024

Add LUKS support via Clevis TPM 2 token #1200

Are you sure you want to change the base?

Add LUKS support via Clevis TPM 2 token #1200

Conversation

danzatt commented Apr 16, 2024 • edited by pirat89 Loading

github-actions bot commented Apr 16, 2024

Thank you for contributing to the Leapp project!

pirat89 Apr 17, 2024

Choose a reason for hiding this comment

pirat89 commented Apr 22, 2024

pirat89 commented May 10, 2024

pirat89 commented May 22, 2024 • edited Loading

danzatt commented Jun 24, 2024

pirat89 left a comment

Choose a reason for hiding this comment

pirat89 commented Aug 2, 2024

pirat89 commented Aug 2, 2024

pirat89 commented Aug 6, 2024

pirat89 commented Oct 9, 2024

pirat89 left a comment

Choose a reason for hiding this comment

pirat89 commented Oct 15, 2024

matejmatuska left a comment

Choose a reason for hiding this comment

dkubek Oct 17, 2024

Choose a reason for hiding this comment

pirat89 Oct 18, 2024

Choose a reason for hiding this comment

dkubek commented Oct 17, 2024

pirat89 commented Oct 18, 2024

danzatt commented Apr 16, 2024 •

edited by pirat89

Loading

pirat89 commented May 22, 2024 •

edited

Loading