mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-05-30 13:00:02 +00:00
Code Issues Projects Releases Wiki Activity

cryptsetup: set the default luks format to LUKS1

Browse Source 
The cryptsetup 2.1 uses LUKS2 format as the default LUKS format. This
change introduced the following issues:

* LUKS2 requires kernel userspace crypto API to be available
  (CONFIG_CRYPTO_USER_API and CONFIG_CRYPTO_USER_API_SKCIPHER). But
  linux-yocto doesn't enable these options by default. If missing these
  kernel modules, the cryptsetup will fall back to using dmcrypt-device
  for keyslot processing.

  $ cryptsetup --debug --type luks luksFormat /dev/sda3
    [snip]
    Checking if cipher aes-xts-plain64 is usable.
    Userspace crypto wrapper cannot use aes-xts-plain64 (-95).
    Using dmcrypt to access keyslot area.
    [snip]

* The grub can not decrypt a LUKS2 encrypted boot partition because it
  doesn't support LUKS2 now.
  See grub bug: https://savannah.gnu.org/bugs/?55093

Add a PACKAGCONFIG for luks format and set the default LUKS format to
LUKS1. The users can specify '--type luks2' in cryptsetup command line
if they want to use LUKS2.

Signed-off-by: Yi Zhao <yi.zhao@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Yi Zhao
2019-07-11 15:26:50 +08:00
committed by Khem Raj
parent 41f6815e08
commit 11ff107a85
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-crypto/cryptsetup/cryptsetup_2.1.0.bb
+1
View File
@@ -65,6 +65,7 @@ PACKAGECONFIG[gcrypt] = "--with-crypto_backend=gcrypt,,libgcrypt"
PACKAGECONFIG[nss] = "--with-crypto_backend=nss,,nss"
PACKAGECONFIG[kernel] = "--with-crypto_backend=kernel"
PACKAGECONFIG[nettle] = "--with-crypto_backend=nettle,,nettle"
PACKAGECONFIG[luks2] = "--with-default-luks-format=LUKS2,--with-default-luks-format=LUKS1"
RRECOMMENDS_${PN} = "kernel-module-aes-generic \
kernel-module-dm-crypt \