Summary
During an encrypted install the LUKS passphrase is passed through a shell command line, so it is briefly readable from the process table (ps) by any local user while the disk is being encrypted.
Affected path
GUI "Automated Installation — erase a disk and install" with the Encrypt checkbox enabled (setup.luks). finish_installation() → create_partitions() runs cryptsetup luksFormat then luksOpen on the root partition.
Impact
Local disclosure of the disk-encryption passphrase. Any unprivileged local account on the live session that runs ps during the luksFormat/luksOpen window reads the passphrase the operator typed. shlex.quote only guards shell metacharacters; it does not keep the value out of the process table.
Root cause
create_partitions() builds os.system("echo -n %s | cryptsetup luksFormat ..." % shlex.quote(passphrase)). os.system runs /bin/sh -c "<string>", so the whole command string — passphrase included — sits in /bin/sh's argv and is visible to ps for the duration of the cryptsetup call. Both the luksFormat and luksOpen calls are affected.
Found while developing #180. Fix in the linked PR.
Summary
During an encrypted install the LUKS passphrase is passed through a shell command line, so it is briefly readable from the process table (
ps) by any local user while the disk is being encrypted.Affected path
GUI "Automated Installation — erase a disk and install" with the Encrypt checkbox enabled (
setup.luks).finish_installation()→create_partitions()runscryptsetup luksFormatthenluksOpenon the root partition.Impact
Local disclosure of the disk-encryption passphrase. Any unprivileged local account on the live session that runs
psduring theluksFormat/luksOpenwindow reads the passphrase the operator typed.shlex.quoteonly guards shell metacharacters; it does not keep the value out of the process table.Root cause
create_partitions()buildsos.system("echo -n %s | cryptsetup luksFormat ..." % shlex.quote(passphrase)).os.systemruns/bin/sh -c "<string>", so the whole command string — passphrase included — sits in/bin/sh's argv and is visible topsfor the duration of the cryptsetup call. Both theluksFormatandluksOpencalls are affected.Found while developing #180. Fix in the linked PR.