2bf77a8fa4
Adds patches fixing the pinned thread keyring issue. Reinstate skipped gating tests due to missing crypto-check test utility. - Resolves: RHEL-193183
69 lines
2.4 KiB
Diff
69 lines
2.4 KiB
Diff
From 04ef07a7070fc8f71dc8da57d6cc23423e1b632e Mon Sep 17 00:00:00 2001
|
|
From: Ondrej Kozina <okozina@redhat.com>
|
|
Date: Fri, 19 Jun 2026 16:45:49 +0200
|
|
Subject: [PATCH 03/48] Use unique intermediary keyring name per device.
|
|
|
|
Replace the static "cryptsetup-keyring" name with
|
|
"cryptsetup-<uuid_prefix>-<random>" to avoid collisions when
|
|
multiple LUKS devices are opened by the same process.
|
|
|
|
Fixes: #993.
|
|
|
|
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
---
|
|
lib/setup.c | 23 +++++++++++++++++------
|
|
1 file changed, 17 insertions(+), 6 deletions(-)
|
|
|
|
diff --git a/lib/setup.c b/lib/setup.c
|
|
index 4b051e57..1c0f21e6 100644
|
|
--- a/lib/setup.c
|
|
+++ b/lib/setup.c
|
|
@@ -7673,6 +7673,9 @@ int crypt_volume_key_keyring(struct crypt_device *cd __attribute__((unused)), in
|
|
int crypt_volume_key_load_in_keyring(struct crypt_device *cd, struct volume_key *vk)
|
|
{
|
|
key_serial_t keyring_id;
|
|
+ char *keyring_description;
|
|
+ char rnd[4];
|
|
+ const char *uuid;
|
|
|
|
if (!vk || !cd)
|
|
return -EINVAL;
|
|
@@ -7683,20 +7686,28 @@ int crypt_volume_key_load_in_keyring(struct crypt_device *cd, struct volume_key
|
|
}
|
|
|
|
if (!cd->keyring_description) {
|
|
- cd->keyring_description = strdup("cryptsetup-keyring");
|
|
- if (!cd->keyring_description)
|
|
+ uuid = crypt_get_uuid(cd);
|
|
+ if (!uuid)
|
|
+ return -EINVAL;
|
|
+
|
|
+ if (crypt_random_get(cd, rnd, sizeof(rnd), CRYPT_RND_NORMAL) < 0)
|
|
+ return -EINVAL;
|
|
+
|
|
+ if (asprintf(&keyring_description, "cryptsetup-%.8s-%02x%02x%02x%02x",
|
|
+ uuid, (unsigned char)rnd[0], (unsigned char)rnd[1],
|
|
+ (unsigned char)rnd[2], (unsigned char)rnd[3]) < 0)
|
|
return -ENOMEM;
|
|
|
|
- log_dbg(cd, "Loading key (type keyring, name %s) in thread keyring.", cd->keyring_description);
|
|
- keyring_id = keyring_add_key_in_thread_keyring(KEYRING_KEY, cd->keyring_description, NULL, 0);
|
|
+ log_dbg(cd, "Loading key (type keyring, name %s) in thread keyring.", keyring_description);
|
|
+ keyring_id = keyring_add_key_in_thread_keyring(KEYRING_KEY, keyring_description, NULL, 0);
|
|
if (keyring_id < 0) {
|
|
- free(CONST_CAST(void*)cd->keyring_description);
|
|
- cd->keyring_description = NULL;
|
|
+ free(keyring_description);
|
|
log_dbg(cd, "keyring_add_key_in_thread_keyring failed (error %d)", errno);
|
|
log_err(cd, _("Failed to load key in kernel keyring."));
|
|
return -EINVAL;
|
|
}
|
|
cd->keyring_id = keyring_id;
|
|
+ cd->keyring_description = keyring_description;
|
|
}
|
|
|
|
log_dbg(cd, "Loading key (type logon, name %s) in %s keyring.",
|
|
--
|
|
2.55.0
|
|
|