bug#70826: luks-device-mapping-with-options breaks bootloader

bug#70826: luks-device-mapping-with-options breaks bootloader

[Tadhg McDonald-Jensen]

[-- Attachment #1: Type: text/plain, Size: 827 bytes --]

using the `luks-device-mapping-with-options` mapped device type defined in
(gnu system mapped-devices) causes grub or other bootloaders to not
properly attempt to mount the encrypted drive. This is caused by the
commit 39a9404 which identifies luks mapped devices by checking if the type
is equal to `luks-device-mapping`, so by using a different routine that is
a proxy to that one it doesn't forward it to grub in the
store-crypto-devices list.

For anyone who finds this before it is fixed, you can boot your device by
hitting 'c' in grub and typing these commands:
grub> insmod luks
grub> insmod luks2
grub> cryptomount (XXX)
grub> set root=(crypto)
grub> configfile (YYY)/grub/grub.cfg

Where (XXX) is the encrypted partition and (YYY) is the boot partition with
the grub config, these can be found by doing `ls` command.

[-- Attachment #2: Type: text/html, Size: 976 bytes --]

bug#70826: luks-device-mapping-with-options breaks bootloader

[Ludovic Courtès]

[-- Attachment #1: Type: text/plain, Size: 561 bytes --]

Hi,

Tadhg McDonald-Jensen <tadhgmister@gmail.com> skribis:

> using the `luks-device-mapping-with-options` mapped device type defined in
> (gnu system mapped-devices) causes grub or other bootloaders to not
> properly attempt to mount the encrypted drive. This is caused by the
> commit 39a9404 which identifies luks mapped devices by checking if the type
> is equal to `luks-device-mapping`, so by using a different routine that is
> a proxy to that one it doesn't forward it to grub in the
> store-crypto-devices list.

Ouch, indeed.  The immediate fix is:


[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: Type: text/x-patch, Size: 1058 bytes --]

diff --git a/gnu/system.scm b/gnu/system.scm
index c76f4d7c502..bb851b1b75f 100644
--- a/gnu/system.scm
+++ b/gnu/system.scm
@@ -667,10 +667,13 @@ (define (operating-system-boot-mapped-devices os)
 (define operating-system-bootloader-crypto-devices
   (mlambdaq (os)                        ;to avoid duplicated output
     "Return the sources of the LUKS mapped devices specified by UUID."
+    (define (luks-device? m)
+      (memq (mapped-device-type m)
+            (list luks-device-mapping-with-options
+                  luks-device-mapping)))
+
     ;; XXX: Device ordering is important, we trust the returned one.
-    (let* ((luks-devices (filter (lambda (m)
-                                   (eq? luks-device-mapping
-                                        (mapped-device-type m)))
+    (let* ((luks-devices (filter luks-device?
                                  (operating-system-boot-mapped-devices os)))
            (uuid-crypto-devices non-uuid-crypto-devices
                                 (partition (compose uuid? mapped-device-source)

[-- Attachment #3: Type: text/plain, Size: 126 bytes --]


Not ideal, but it fixes the problem.

I’ll go ahead with this patch if there are no objections.

Thanks!

Ludo’.

bug#70826: luks-device-mapping-with-options breaks bootloader

[Tadhg McDonald-Jensen]

That unfortunately doesn't fix the problem, 
`luks-device-mapping-with-options` is a routine that returns the 
`mapped-device-kind` so it won't check by equality.

A possible solution is to check whether the `mapped-device-kind-close` 
routines are the same as these are shared.


diff --git a/gnu/system.scm b/gnu/system.scm
index cb6e719ca6..b564bf3788 100644
--- a/gnu/system.scm
+++ b/gnu/system.scm
@@ -661,10 +661,12 @@ (define (operating-system-boot-mapped-devices os)
  (define operating-system-bootloader-crypto-devices
    (mlambdaq (os)                        ;to avoid duplicated output
      "Return the sources of the LUKS mapped devices specified by UUID."
+    (define (luks-device? m)
+      (eq? (mapped-device-kind-close (mapped-device-type m))
+           (mapped-device-kind-close luks-device-mapping)))
+
      ;; XXX: Device ordering is important, we trust the returned one.
-    (let* ((luks-devices (filter (lambda (m)
-                                   (eq? luks-device-mapping
-                                        (mapped-device-type m)))
+    (let* ((luks-devices (filter luks-device?
                                   (operating-system-boot-mapped-devices 
os)))
             (uuid-crypto-devices non-uuid-crypto-devices
                                  (partition (compose uuid? 
mapped-device-source)



(I apologize if my email client is adding line wraps to the diffs, I 
will look into it after sending this)

I tried to implement this initially but it didn't work on my previous 
attempt so I abandoned trying to submit a patch, but this version does 
do the trick even if it seems inelegant.

On 2024-05-25 5:47 a.m., Ludovic Courtès wrote:
> Hi,
> 
> Tadhg McDonald-Jensen <tadhgmister@gmail.com> skribis:
> 
>> using the `luks-device-mapping-with-options` mapped device type defined in
>> (gnu system mapped-devices) causes grub or other bootloaders to not
>> properly attempt to mount the encrypted drive. This is caused by the
>> commit 39a9404 which identifies luks mapped devices by checking if the type
>> is equal to `luks-device-mapping`, so by using a different routine that is
>> a proxy to that one it doesn't forward it to grub in the
>> store-crypto-devices list.
> 
> Ouch, indeed.  The immediate fix is:
> 
> 
> diff --git a/gnu/system.scm b/gnu/system.scm
> index c76f4d7c502..bb851b1b75f 100644
> --- a/gnu/system.scm
> +++ b/gnu/system.scm
> @@ -667,10 +667,13 @@ (define (operating-system-boot-mapped-devices os)
>   (define operating-system-bootloader-crypto-devices
>     (mlambdaq (os)                        ;to avoid duplicated output
>       "Return the sources of the LUKS mapped devices specified by UUID."
> +    (define (luks-device? m)
> +      (memq (mapped-device-type m)
> +            (list luks-device-mapping-with-options
> +                  luks-device-mapping)))
> +
>       ;; XXX: Device ordering is important, we trust the returned one.
> -    (let* ((luks-devices (filter (lambda (m)
> -                                   (eq? luks-device-mapping
> -                                        (mapped-device-type m)))
> +    (let* ((luks-devices (filter luks-device?
>                                    (operating-system-boot-mapped-devices os)))
>              (uuid-crypto-devices non-uuid-crypto-devices
>                                   (partition (compose uuid? mapped-device-source)
> 
> 
> 
> Not ideal, but it fixes the problem.
> 
> I’ll go ahead with this patch if there are no objections.
> 
> Thanks!
> 
> Ludo’.