Re: [dm-crypt] Question on LUKS master key digest and its effect on security

[Milan Broz <mbroz@redhat.com>]

Heinz Diehl wrote:
> On 18.09.2009, Milan Broz wrote: 
> 
> As reported some weeks ago, the buffer i/o errors are still present with
> the latest svn code (from today):
> 
> [....]
> Sep 19 18:33:05 liesel kernel: Buffer I/O error on device dm-4, logical block 32

This is not cryptsetup bug but interference with badly written
udev rules or programs reacting to uevents (like DeviceKit etc) which tries
to open/scan temporary/keyslot cryptstetup devices (I see this messages too
with dracut in Fedora).
(In 1.0.7 was 1 sec timeout which was removed, that caused these messages to appear
more often. But this timeout slowed down keyslot scan unnecessarily.)

You can easily verify that - run command which produces this messages
like cryptsetup luksOpen with --debug, and if you see
WARNING: other process locked internal device ... it is this problem.

These messages are ugly, but there is actually no problem - if cryptsetup
detects that someone locks internal keyslot device by opening it (usually it is blkid),
it remaps it to error target, so that program receives io errors on read
and quickly closes it. (unfortunately kernel log this read error to syslog.)

(I hope that udev problems will be solved soon by switching device-mapper
to use udev directly and maintain its own, correctly written, rules.)

Milan