[systemd-bugs] [Bug 84409] New: Opening an encrypted device can time out during passpharse entry

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=84409

          Priority: medium
            Bug ID: 84409
          Assignee: systemd-bugs at lists.freedesktop.org
           Summary: Opening an encrypted device can time out during
                    passpharse entry
        QA Contact: systemd-bugs at lists.freedesktop.org
          Severity: normal
    Classification: Unclassified
                OS: Linux (All)
          Reporter: dw23.devel at gmail.com
          Hardware: All
            Status: NEW
           Version: unspecified
         Component: general
           Product: systemd

Attempting to "start" an encrypted device unit will time out after 90 seconds
if no passphrase is entered.

The device entry in /etc/crypttab:
data_sec    UUID=[some UUID]   -

Steps to reproduce:
1) Run "systemd start dev-mapper-data_sec.device"
2) A password agent should ask for a password. Just leave it as is for 90
seconds (assuming your default JobTimeoutSec is 90).
3) The operation times out.
The expected behavior is that it should wait forever until the user types in
the right passphrase or exceeds the maximum tries number.

Distribution: ArchLinux ARM
systemd version:
  systemd 216
  +PAM -AUDIT -SELINUX -IMA -APPARMOR +SMACK -SYSVINIT +LIBCRYPTSETUP +GCRYPT
+GNUTLS +ACL +XZ -LZ4 +SECCOMP +BLKID -ELFUTILS +KMOD -IDN 

Syslog output:
Sep 28 02:10:43 arch systemd[1]: Starting Cryptography Setup for data_sec...
Sep 28 02:10:44 arch systemd[1]: Failed to reset devices.list on /system.slice:
Invalid argument
Sep 28 02:10:44 arch systemd[1]: Expecting device dev-mapper-data_sec.device...
Sep 28 02:10:44 arch systemd[1]: Started Forward Password Requests to Wall.
Sep 28 02:12:13 arch systemd[1]: Job dev-mapper-data_sec.device/start timed
out.
Sep 28 02:12:13 arch systemd[1]: Timed out waiting for device
dev-mapper-data_sec.device.
Sep 28 02:12:13 arch systemd[1]: Dependency failed for /mnt/data_sec.
Sep 28 02:12:13 arch systemd[1]: Dependency failed for Cryptography Setup for
data_sec.
Sep 28 02:12:13 arch systemd[1]: Dependency failed for File System Check on
/dev/mapper/data_sec.


If we take a closer look at the files generated by systemd-cryptsetup-generator
(I removed unrelated files from the list):
/run/systemd/generator:
drwxr-xr-x 2 root root  60 28 sept. 00:48 cryptsetup.target.requires
drwxr-xr-x 2 root root  60 28 sept. 00:48 data_sec.d
drwxr-xr-x 2 root root  60 28 sept. 00:48 dev-disk-by\x2duuid-[some
UUID].device.wants
drwxr-xr-x 2 root root  60 28 sept. 00:48 dev-mapper-data_sec.device.requires
-rw-r--r-- 1 root root 882 28 sept. 00:48 systemd-cryptsetup at data_sec.service

/run/systemd/generator/cryptsetup.target.requires:
lrwxrwxrwx 1 root root 38 28 sept. 00:48 systemd-cryptsetup at data_sec.service ->
../systemd-cryptsetup at data_sec.service

/run/systemd/generator/data_sec.d:
-rw-r--r-- 1 root root 83 28 sept. 00:48 90-device-timeout.conf


The "data_sec.d" contains the drop-in configuration file we need to disable
device timeout, but the name of the directory is wrong.
It should be "dev-mapper-data_sec.device.d" instead of just "data_sec.d".

Looking at the source file src/cryptsetup/cryptsetup-generator.c, near the end
of the create_disk() function (l. 249),
we can notice that the second parameter (unit name) of the write_drop_in()
function is the first field from /etc/crypttab, which is the
dm device name witout the /dev/mapper prefix. Moreover, the name isn't escaped,
so entering "../oops" in /etc/crypttab will cause
systemd-cryptsetup-generator to create a oops.d directory in /run/systemd.

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/systemd-bugs/attachments/20140928/1ddbff45/attachment.html>