[PATCH 2/2] Require min entropy for 'part --encrypted' devices (#1162695)
Samantha N. Bueno
sbueno+anaconda at redhat.com
Wed Nov 12 19:30:56 UTC 2014
On Wed, Nov 12, 2014 at 02:42:43PM +0100, Vratislav Podzimek wrote:
> We require minimum amount of random data entropy when doing encrypted autopart
> so this makes the 'part --encrypted' command work the same.
I think this looks ok. I tested this with Jan's provided ks file in the
bug; for whatever reason, with the %pre block, the amount of entropy
keeps getting reset after reaching ~24%. Without the %pre block, this
works perfectly fine though. I'm not really sure why that might be, or
if you want to consider that a bug.
>
> Signed-off-by: Vratislav Podzimek <vpodzime at redhat.com>
> ---
> pyanaconda/kickstart.py | 14 +++++++++-----
> 1 file changed, 9 insertions(+), 5 deletions(-)
>
> diff --git a/pyanaconda/kickstart.py b/pyanaconda/kickstart.py
> index 8d1ed12..379a573 100644
> --- a/pyanaconda/kickstart.py
> +++ b/pyanaconda/kickstart.py
> @@ -22,6 +22,7 @@ from pyanaconda.errors import ScriptError, errorHandler
> from blivet.deviceaction import ActionCreateFormat, ActionDestroyFormat, ActionResizeDevice, ActionResizeFormat
> from blivet.devices import LUKSDevice
> from blivet.devicelibs.lvm import getPossiblePhysicalExtents, LVM_PE_SIZE, KNOWN_THPOOL_PROFILES
> +from blivet.devicelibs.crypto import MIN_CREATE_ENTROPY
> from blivet.devicelibs import swap as swap_lib
> from blivet.formats import getFormat
> from blivet.partitioning import doPartitioning
> @@ -284,7 +285,6 @@ class AutoPart(commands.autopart.RHEL7_AutoPart):
> def execute(self, storage, ksdata, instClass):
> from blivet.partitioning import doAutoPartition
> from blivet.partitioning import sanityCheck
> - from blivet.devicelibs.crypto import MIN_CREATE_ENTROPY
>
> if not self.autopart:
> return
> @@ -970,13 +970,15 @@ class LogVolData(commands.logvol.RHEL7_LogVolData):
> add_backup_passphrase=self.backuppassphrase)
> luksdev = LUKSDevice("luks%d" % storage.nextID,
> fmt=luksformat,
> - parents=device)
> + parents=device,
> + min_luks_entropy=MIN_CREATE_ENTROPY)
> else:
> luksformat = request.format
> request.format = getFormat("luks", passphrase=self.passphrase,
> cipher=self.cipher,
> escrow_cert=cert,
> - add_backup_passphrase=self.backuppassphrase)
> + add_backup_passphrase=self.backuppassphrase,
> + min_luks_entropy=MIN_CREATE_ENTROPY)
> luksdev = LUKSDevice("luks%d" % storage.nextID,
> fmt=luksformat,
> parents=request)
> @@ -1249,7 +1251,8 @@ class PartitionData(commands.partition.F18_PartData):
> device.format = getFormat("luks", passphrase=self.passphrase, device=device.path,
> cipher=self.cipher,
> escrow_cert=cert,
> - add_backup_passphrase=self.backuppassphrase)
> + add_backup_passphrase=self.backuppassphrase,
> + min_luks_entropy=MIN_CREATE_ENTROPY)
> luksdev = LUKSDevice("luks%d" % storage.nextID,
> fmt=luksformat,
> parents=device)
> @@ -1258,7 +1261,8 @@ class PartitionData(commands.partition.F18_PartData):
> request.format = getFormat("luks", passphrase=self.passphrase,
> cipher=self.cipher,
> escrow_cert=cert,
> - add_backup_passphrase=self.backuppassphrase)
> + add_backup_passphrase=self.backuppassphrase,
> + min_luks_entropy=MIN_CREATE_ENTROPY)
> luksdev = LUKSDevice("luks%d" % storage.nextID,
> fmt=luksformat,
> parents=request)
> --
> 1.9.3
>
> _______________________________________________
> anaconda-patches mailing list
> anaconda-patches at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/anaconda-patches
More information about the anaconda-patches
mailing list