[Openstack-security] [Bug 1372375] Re: Attaching LVM encrypted volumes (with LUKS) could cause data loss if LUKS headers get corrupted
Patrizio Tufarolo
patriziotufarolo at gmail.com
Thu Sep 25 16:57:39 UTC 2014
The bug I submitted wants to be related more to the flow of the volume encryption procedure than to the LUKS header backup, that is also important.
I have no idea, at the moment, on where to store luks headers' backup, I'm looking around.
However a backup of the whole volume could be sufficient, but in my opinion it could become expensive in some cases.
I focused on luksHeaderBackup and luksHeaderRestore to highlight on how formatting a volume is not a valid choice when the device is not recognized as valid luks.
I agree with the decision to format the device in Nova, but I think that Cinder should ask luksFormat to nova at the moment of volume creation, and not when attaching for the problem above.
--
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1372375
Title:
Attaching LVM encrypted volumes (with LUKS) could cause data loss if
LUKS headers get corrupted
Status in Cinder:
New
Status in OpenStack Compute (Nova):
Incomplete
Status in OpenStack Security Advisories:
Won't Fix
Bug description:
I have doubts about the flow of the volume attaching operation, as
defined in /usr/lib/python2.6/site-
packages/nova/volume/encryptors/luks.py.
If the device is not recognized to be a valid luks device, the script is luks formatting it! So if for some reason the luks header get corrupted, it erases the whole data.
To manage corrupted headers there are the
cryptsetup luksHeaderBackup
and
cryptsetup luksHeaderRestore
commands that respectively do the backup and the restore of the
headers.
I think that the process has to be reviewed, and the luksFormat
operation has to be performed during the volume creation.
To manage notifications about this bug go to:
https://bugs.launchpad.net/cinder/+bug/1372375/+subscriptions
More information about the Openstack-security
mailing list