[PATCH 2/2] Require min entropy for 'part --encrypted' devices (#1162695)

Samantha N. Bueno sbueno+anaconda at redhat.com
Wed Nov 12 19:30:56 UTC 2014


On Wed, Nov 12, 2014 at 02:42:43PM +0100, Vratislav Podzimek wrote:
> We require minimum amount of random data entropy when doing encrypted autopart
> so this makes the 'part --encrypted' command work the same.

I think this looks ok. I tested this with Jan's provided ks file in the
bug; for whatever reason, with the %pre block, the amount of entropy
keeps getting reset after reaching ~24%. Without the %pre block, this
works perfectly fine though. I'm not really sure why that might be, or
if you want to consider that a bug.

> 
> Signed-off-by: Vratislav Podzimek <vpodzime at redhat.com>
> ---
>  pyanaconda/kickstart.py | 14 +++++++++-----
>  1 file changed, 9 insertions(+), 5 deletions(-)
> 
> diff --git a/pyanaconda/kickstart.py b/pyanaconda/kickstart.py
> index 8d1ed12..379a573 100644
> --- a/pyanaconda/kickstart.py
> +++ b/pyanaconda/kickstart.py
> @@ -22,6 +22,7 @@ from pyanaconda.errors import ScriptError, errorHandler
>  from blivet.deviceaction import ActionCreateFormat, ActionDestroyFormat, ActionResizeDevice, ActionResizeFormat
>  from blivet.devices import LUKSDevice
>  from blivet.devicelibs.lvm import getPossiblePhysicalExtents, LVM_PE_SIZE, KNOWN_THPOOL_PROFILES
> +from blivet.devicelibs.crypto import MIN_CREATE_ENTROPY
>  from blivet.devicelibs import swap as swap_lib
>  from blivet.formats import getFormat
>  from blivet.partitioning import doPartitioning
> @@ -284,7 +285,6 @@ class AutoPart(commands.autopart.RHEL7_AutoPart):
>      def execute(self, storage, ksdata, instClass):
>          from blivet.partitioning import doAutoPartition
>          from blivet.partitioning import sanityCheck
> -        from blivet.devicelibs.crypto import MIN_CREATE_ENTROPY
>  
>          if not self.autopart:
>              return
> @@ -970,13 +970,15 @@ class LogVolData(commands.logvol.RHEL7_LogVolData):
>                                            add_backup_passphrase=self.backuppassphrase)
>                  luksdev = LUKSDevice("luks%d" % storage.nextID,
>                                       fmt=luksformat,
> -                                     parents=device)
> +                                     parents=device,
> +                                     min_luks_entropy=MIN_CREATE_ENTROPY)
>              else:
>                  luksformat = request.format
>                  request.format = getFormat("luks", passphrase=self.passphrase,
>                                             cipher=self.cipher,
>                                             escrow_cert=cert,
> -                                           add_backup_passphrase=self.backuppassphrase)
> +                                           add_backup_passphrase=self.backuppassphrase,
> +                                           min_luks_entropy=MIN_CREATE_ENTROPY)
>                  luksdev = LUKSDevice("luks%d" % storage.nextID,
>                                       fmt=luksformat,
>                                       parents=request)
> @@ -1249,7 +1251,8 @@ class PartitionData(commands.partition.F18_PartData):
>                  device.format = getFormat("luks", passphrase=self.passphrase, device=device.path,
>                                            cipher=self.cipher,
>                                            escrow_cert=cert,
> -                                          add_backup_passphrase=self.backuppassphrase)
> +                                          add_backup_passphrase=self.backuppassphrase,
> +                                          min_luks_entropy=MIN_CREATE_ENTROPY)
>                  luksdev = LUKSDevice("luks%d" % storage.nextID,
>                                       fmt=luksformat,
>                                       parents=device)
> @@ -1258,7 +1261,8 @@ class PartitionData(commands.partition.F18_PartData):
>                  request.format = getFormat("luks", passphrase=self.passphrase,
>                                             cipher=self.cipher,
>                                             escrow_cert=cert,
> -                                           add_backup_passphrase=self.backuppassphrase)
> +                                           add_backup_passphrase=self.backuppassphrase,
> +                                           min_luks_entropy=MIN_CREATE_ENTROPY)
>                  luksdev = LUKSDevice("luks%d" % storage.nextID,
>                                       fmt=luksformat,
>                                       parents=request)
> -- 
> 1.9.3
> 
> _______________________________________________
> anaconda-patches mailing list
> anaconda-patches at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/anaconda-patches


More information about the anaconda-patches mailing list