From: Julien Lepiller <julien@lepiller.eu>
To: dm-crypt@saout.de
Subject: Re: [dm-crypt] unknown version
Date: Sat, 23 Apr 2016 21:22:31 +0200 [thread overview]
Message-ID: <20160423212231.7b625069@polymos> (raw)
In-Reply-To: <571BA828.6060405@gmail.com>
On Sat, 23 Apr 2016 18:51:52 +0200
Milan Broz <gmazyland@gmail.com> wrote:
> On 04/23/2016 03:17 PM, Julien Lepiller wrote:
> > On Sat, 23 Apr 2016 10:45:52 +0200
> > Milan Broz <gmazyland@gmail.com> wrote:
> >
> >> On 04/22/2016 02:01 PM, Julien Lepiller wrote:
> >>> Hello,
> >>>
> >>> I am trying to use cryptsetup with a disk that has been encrypted
> >>> some time ago. I'm using Linux From Scratch, and built cryptsetup
> >>> myself. What I see when I run luksOpen is the following (all
> >>> commands are run as root) :
> >>>
> >>> # cryptsetup 1.7.1 processing "cryptsetup --debug
> >>> luksOpen /dev/sda1 hdd"
> >> ...
> >>> # Activating volume hdd [keyslot -1] using [none] passphrase.
> >>> # dm version OF [16384] (*1)
> >>> # device-mapper: version ioctl on failed: Permission denied
> >>
> >> This looks like you cannot access something (/dev/mapper/control?)
> >> and then it just fails because of this initial failure.
> >>
> >> Do you have SElinux switched on?
> >>
> >> What is output of "dmsetup version" - does it work?
> >>
> >> Milan
> >
> > Thank you for your answer, the output of the command is:
> >
> > Library version: 1.02.121 (2016-04-01)
> > Driver version: 4.34.0
> >
> > Selinux is switched off (I tried to use it, so I have the libraries,
> > but it just does not work at all), and their is nothing in
> > journald.
>
> Ok, so device mapper works.
>
> So if it is not SElinux, something is preventing ioctl to run.
> (The error is internal libdevmapper error.)
>
> Do you compile libgcrypt yourself with POSIX capabilities enabled?
>
> If so, gcrypt drops privileges for the whole calling process...
> see comment in lib/crypto_backend/crypto_gcrypt.c:
>
> /* FIXME: If gcrypt compiled to support POSIX 1003.1e capabilities,
> * it drops all privileges during secure memory initialisation.
> * For now, the only workaround is to disable secure memory in gcrypt.
> * cryptsetup always need at least cap_sys_admin privilege for
> dm-ioctl
> * and it locks its memory space anyway.
> */
> #if 0
>
>
> If it is your case, please do not use capabilities in gcrypt or
> try to change define above in cryptsetup source as a workaroung and
> recompile it.
>
> Thanks,
> Milan
I rebuilt libgcrypt without posix capabilities, and it now works. Thank
you so much for your help!
prev parent reply other threads:[~2016-04-23 19:23 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-04-22 12:01 [dm-crypt] unknown version Julien Lepiller
2016-04-23 8:45 ` Milan Broz
2016-04-23 13:17 ` Julien Lepiller
2016-04-23 16:51 ` Milan Broz
2016-04-23 19:22 ` Julien Lepiller [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160423212231.7b625069@polymos \
--to=julien@lepiller.eu \
--cc=dm-crypt@saout.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox