installer: Feed LUKS passphrase to cryptsetup on stdin#185
Open
ggiesen wants to merge 1 commit into
Open
Conversation
create_partitions() built 'echo -n <pass> | cryptsetup ...' and ran it through os.system(), i.e. sh -c 'echo -n <pass> | cryptsetup ...'. The passphrase was the shlex-quoted argument of that shell, so it was briefly visible in the process table to any local user running ps during an encrypted install. cryptsetup reads the key from stdin with --key-file -; pass it there via subprocess.run(input=). The passphrase is now never a command argument: not in ps, not in any log.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
During an encrypted install
create_partitions()ranos.system("echo -n <pass> | cryptsetup luksFormat/luksOpen ...").os.systemruns/bin/sh -c "<string>", so the passphrase sat in the shell's argv and was readable from the process table (ps) by any local user during the encrypt window.Fix: pass the passphrase to cryptsetup on stdin via
--key-file -, usingsubprocess.run(..., input=passphrase.encode("utf-8")), so it is never a command argument.luksFormatandluksOpenchange identically, so the derived key is unchanged (same bytes, no trailing newline, read until EOF as with the oldecho -n). The now-unusedshleximport is dropped; the change is confined to the existingif self.setup.luks:block.Testing (LMDE 7, QEMU/KVM): instrumented
psacrossluksFormat/luksOpenduring an encrypted install. The oldecho | cryptsetupform shows the passphrase in the process table; the stdin form does not (11k+ samples). The install completes and the volume unlocks with the chosen passphrase.Split out of #180 so it can land independently.
Fixes #182