cryptsetup

Password Prompt for yubikey not showing in Plymouth

Bug #1619921 reported by maxadamo on 2016-09-03

This bug affects 2 people

Affects		Status	Importance	Assigned to	Milestone
	cryptsetup	New	Undecided	Unassigned
	yubikey-luks (Ubuntu)	Confirmed	Undecided	Unassigned

Bug Description

I am able to open/decrypt the partition from a terminal, either using the passphrase on slot 0, or the using the yubikey passphrase obtained with: ykchalresp -2 <my-pin-here>

but from Plymouth I can only input the passphrase from slot 0.
It seems that the script ykluks-keyscript is not hooked at all.

I see the scripts inside the initrd:
lsinitramfs -l /boot/initrd.img-4.4.0-37-generic | egrep 'yk|yubi'
-rwxr-xr-x 1 root root 718 Oct 24 2015 scripts/local-bottom/yubikey-luks
-rwxr-xr-x 1 root root 256 Oct 24 2015 scripts/local-top/yubikey-luks
-rwxr-xr-x 1 root root 1090 Sep 3 16:36 sbin/ykluks-keyscript
lrwxrwxrwx 1 root root 21 Sep 3 16:36 usr/lib/x86_64-linux-gnu/libykpers-1.so.1 -> libykpers-1.so.1.17.2
-rw-r--r-- 1 root root 10296 May 7 2015 usr/lib/x86_64-linux-gnu/libyubikey.so.0.1.7
-rw-r--r-- 1 root root 74624 Oct 24 2015 usr/lib/x86_64-linux-gnu/libykpers-1.so.1.17.2
lrwxrwxrwx 1 root root 19 Sep 3 16:36 usr/lib/x86_64-linux-gnu/libyubikey.so.0 -> libyubikey.so.0.1.7
-rwxr-xr-x 1 root root 14744 Oct 24 2015 usr/bin/ykchalresp

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: yubikey-luks 0.3.3+3.ge11e4c1-1 [modified: usr/share/yubikey-luks/ykluks-keyscript]
ProcVersionSignature: Ubuntu 4.4.0-37.56-generic 4.4.19
Uname: Linux 4.4.0-37-generic x86_64
ApportVersion: 2.20.1-0ubuntu2.1
Architecture: amd64
CurrentDesktop: GNOME
Date: Sat Sep 3 16:56:20 2016
DistributionChannelDescriptor:
# This is a distribution channel descriptor
# For more information see http://wiki.ubuntu.com/DistributionChannelDescriptor
canonical-oem-somerville-trusty-amd64-osp1-20150720-0
InstallationDate: Installed on 2016-08-18 (16 days ago)
InstallationMedia: Ubuntu 14.04 "Trusty" - Build amd64 LIVE Binary 20150720-04:06
PackageArchitecture: all
SourcePackage: yubikey-luks
UpgradeStatus: Upgraded to xenial on 2016-08-29 (5 days ago)

Tags:

Revision history for this message

maxadamo (massimilianoadamo) wrote on 2016-09-03:

Dependencies.txt Edit (3.0 KiB, text/plain; charset="utf-8")
JournalErrors.txt Edit (119.4 KiB, text/plain; charset="utf-8")
ProcEnviron.txt Edit (326 bytes, text/plain; charset="utf-8")

summary:

- Password Prompt for yubikey not showing in Plymouty
+ Password Prompt for yubikey not showing in Plymouth

Revision history for this message

Launchpad Janitor (janitor) wrote on 2019-02-22:

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in yubikey-luks (Ubuntu):
status:	New → Confirmed

Revision history for this message

Jason Mills (virtualjmills) wrote on 2019-02-22:

Resurfaced in Cosmic (U18.10)

Revision history for this message

Jason Mills (virtualjmills) wrote on 2019-02-23:

Interesting tidbits from Cosmic (U18.10), running with `splash` removed from boot arguments (i.e. disable Plymouth splash).

Boot LUKS prompt display:

sed: /conf/conf.d/cryptroot: No such file or directory

... (unrelated LVMeta'd warning)

/scripts/local-top/cryptroot: line 218: fold: not found
Please unlock disk sda3_crypt:

Okay, still not clear why yubikey-luks isn't working, but at least there's an error or two now. :-)

I then tried both enabling chatty mode (`quiet` removed) and breaking before mount phase in initramfs bringup (`break=premount` added) to do some further digging.

The only reference within the as-built initramfs to `/conf/conf.d/cryptroot` anywhere in `/scripts/` is `/scripts/local-top/yubikey-luks`, and that file is noticeably absent from `/conf/conf.d/`. I saw that in bug 317442 (yes, old bug) that there may be situations where this file might not be created.

Line 218 of `/scripts/local-top/cryptroot` is the ending of an if-fi block, not clear yet what `fold` references.

Net-net, still digging.

Revision history for this message

Jason Mills (virtualjmills) wrote on 2019-02-23:

Conclusion thus far: What I am seeing might be a new breakage of yubikey-luks in U18.10/Cosmic.

I dug up an older Ubuntu system (U16.04.3 LTS) that is known-working with Yubikey LUKS + Plymouth, and `/conf/conf.d/cryptroot` is present in initramfs. Contents is one line, a target specification for the root FS. The line referencing it in `/scripts/local-top/yubikey-luks` looks substantially similar to the one in U18.10 / Cosmic.

Digging through various versions of cryptsetup imported from upstream (Debian), I see that between ubuntu/bionic and ubuntu/cosmic, generation of `/conf/conf.d/cryptroot` seems to have been retired. Specifically, as part of refactoring at:

debian/changelog
cryptsetup (2:2.0.3-2) unstable; urgency=medium

     [ Guilhem Moulin ]
     * debian/initramfs/*-hook: complete refactoring. Common functions are now in
       /lib/cryptsetup/functions (source-able from shell scripts).
       (Closes: #784881.)
       https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=784881

… subsequent to which, debian/initramfs/cryptroot-hook add_device() (the function which was responsible for constructing `/conf/conf.d/cryptroot`) disappears.

Also of note: I fully removed yubikey-luks (`apt-get --purge remove yubikey-luks`), and only the first of the two cryptroot errors I mentioned above has disappeared. -- Looks like the "line 218" one is unrelated to yubikey-luks.

Revision history for this message

Jason Mills (virtualjmills) wrote on 2019-02-23:

Possibly Guilhem (~7-guilhem / @7-guilhem here on Launchpad) could confirm `/conf/conf.d/cryptroot` is officially/intentionally retired?

Revision history for this message

Jason Mills (virtualjmills) wrote on 2019-02-23:

Took some additional digging, but already confirmed, and definitely yubikey-luks side of the fence... it was using a non-public interface.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=904162#15

Looks like there was some refactoring, and ostensibly this is fixed in a later iteration of yubikey-luks that is in U19.04/Disco but not U18.10/Cosmic at present

https://bugs.launchpad.net/ubuntu/+source/yubikey-luks/0.5.1+29.g5df2b95-1

U18.10/Cosmic, U18.04/Bionic, et al are on

https://bugs.launchpad.net/ubuntu/+source/yubikey-luks/0.3.3+3.ge11e4c1-1