Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
dmcrypt - unable to create encrypted partition
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Installing Gentoo
View previous topic :: View next topic  
Author Message
lutel
Tux's lil' helper
Tux's lil' helper


Joined: 19 Oct 2003
Posts: 93
Location: Pomroczna

PostPosted: Thu Jun 19, 2014 6:07 pm    Post subject: dmcrypt - unable to create encrypted partition Reply with quote

Hi,

Could you help me with this one, i'm trying to create new partiton, but i get error:

device-mapper: reload ioctl on failed: Invalid argument
Failed to open temporary keystore device.


Here is full debug output

Code:

~ # cryptsetup --debug -h sha512 --cipher aes-xts-essiv:sha512 --key-size 512 --align-payload=4096 luksFormat /dev/md6

# cryptsetup 1.6.2 processing "cryptsetup --debug -h sha512 --cipher aes-xts-essiv:sha512 --key-size 512 --align-payload=4096 luksFormat /dev/md6"
# Running command luksFormat.
# Locking memory.
# Installing SIGINT/SIGTERM handler.
# Unblocking interruption on signal.

WARNING!
========
This will overwrite data on /dev/md6 irrevocably.

Are you sure? (Type uppercase yes): YES
# Allocating crypt device /dev/md6 context.
# Trying to open and read device /dev/md6.
# Initialising device-mapper backend library.
# Timeout set to 0 miliseconds.
# Iteration time set to 1000 miliseconds.
# Interactive passphrase entry requested.
Enter passphrase:
Verify passphrase:
# Formatting device /dev/md6 as type LUKS1.
# Crypto backend (gcrypt 1.5.3) initialized.
System is out of entropy while generating volume key.
Please move mouse or type some text in another window to gather some random events.
Generating key (95% done).
Generating key (95% done).
Generating key (95% done).
Generating key (95% done).
Generating key (95% done).
Generating key (95% done).
Generating key (100% done).
# Generating LUKS header version 1 using hash sha512, aes, xts-essiv:sha512, MK 64 bytes
# Crypto backend (gcrypt 1.5.3) initialized.
# KDF pbkdf2, hash sha512: 222155 iterations per second.
# Data offset 4096, UUID ba3d5282-ad91-47ba-8162-6f08eb6a2b47, digest iterations 27000
# Updating LUKS header of size 1024 on device /dev/md6
# Key length 64, device size 3753428864 sectors, header size 4036 sectors.
# Reading LUKS header of size 1024 from device /dev/md6
# Key length 64, device size 3753428864 sectors, header size 4036 sectors.
# Adding new keyslot -1 using volume key.
# Calculating data for key slot 0
# Crypto backend (gcrypt 1.5.3) initialized.
# KDF pbkdf2, hash sha512: 225986 iterations per second.
# Key slot 0 use 110344 password iterations.
# Using hash sha512 for AF in key slot 0, 4000 stripes
# Updating key slot 0 [0x1000] area.
# Calculated device size is 500 sectors (RW), offset 8.
# Detected kernel Linux 3.14.5-hardened-r2 x86_64.
# dm version   OF   [16384] (*1)
# dm versions   OF   [16384] (*1)
# Detected dm-crypt version 1.13.0, dm-ioctl version 4.27.0.
# Device-mapper backend running with UDEV support disabled.
# DM-UUID is CRYPT-TEMP-temporary-cryptsetup-1005
# dm create temporary-cryptsetup-1005 CRYPT-TEMP-temporary-cryptsetup-1005 OF   [16384] (*1)
# dm reload temporary-cryptsetup-1005  OFW    [16384] (*1)
device-mapper: reload ioctl on  failed: Invalid argument
# Cookie value is not set while trying to call DM_DEVICE_REMOVE ioctl. Please, consider using libdevmapper's udev synchronisation interface or disable it explicitly by calling dm_udev_set_sync_support(0).
# Switching off device-mapper and all subsystem related udev rules. Falling back to libdevmapper node creation.
# dm remove temporary-cryptsetup-1005  OFW    [16384] (*1)
# temporary-cryptsetup-1005: Stacking NODE_DEL
# temporary-cryptsetup-1005: Processing NODE_DEL
Failed to open temporary keystore device.
# Cookie value is not set while trying to call DM_DEVICE_REMOVE ioctl. Please, consider using libdevmapper's udev synchronisation interface or disable it explicitly by calling dm_udev_set_sync_support(0).
# Switching off device-mapper and all subsystem related udev rules. Falling back to libdevmapper node creation.
# dm remove temporary-cryptsetup-1005  OFT    [16384] (*1)
device-mapper: remove ioctl on temporary-cryptsetup-1005 failed: No such device or address
# WARNING: other process locked internal device temporary-cryptsetup-1005, retrying remove.
# dm reload temporary-cryptsetup-1005  NFR   [16384] (*1)
device-mapper: reload ioctl on temporary-cryptsetup-1005 failed: No such device or address
# Cookie value is not set while trying to call DM_DEVICE_REMOVE ioctl. Please, consider using libdevmapper's udev synchronisation interface or disable it explicitly by calling dm_udev_set_sync_support(0).
# Switching off device-mapper and all subsystem related udev rules. Falling back to libdevmapper node creation.
# dm remove temporary-cryptsetup-1005  OFT    [16384] (*1)
device-mapper: remove ioctl on temporary-cryptsetup-1005 failed: No such device or address
# WARNING: other process locked internal device temporary-cryptsetup-1005, retrying remove.
# Cookie value is not set while trying to call DM_DEVICE_REMOVE ioctl. Please, consider using libdevmapper's udev synchronisation interface or disable it explicitly by calling dm_udev_set_sync_support(0).
# Switching off device-mapper and all subsystem related udev rules. Falling back to libdevmapper node creation.
# dm remove temporary-cryptsetup-1005  OFT    [16384] (*1)
device-mapper: remove ioctl on temporary-cryptsetup-1005 failed: No such device or address
# WARNING: other process locked internal device temporary-cryptsetup-1005, retrying remove.
# Cookie value is not set while trying to call DM_DEVICE_REMOVE ioctl. Please, consider using libdevmapper's udev synchronisation interface or disable it explicitly by calling dm_udev_set_sync_support(0).
# Switching off device-mapper and all subsystem related udev rules. Falling back to libdevmapper node creation.
# dm remove temporary-cryptsetup-1005  OFT    [16384] (*1)
device-mapper: remove ioctl on temporary-cryptsetup-1005 failed: No such device or address
# WARNING: other process locked internal device temporary-cryptsetup-1005, retrying remove.
# Cookie value is not set while trying to call DM_DEVICE_REMOVE ioctl. Please, consider using libdevmapper's udev synchronisation interface or disable it explicitly by calling dm_udev_set_sync_support(0).
# Switching off device-mapper and all subsystem related udev rules. Falling back to libdevmapper node creation.
# dm remove temporary-cryptsetup-1005  OFT    [16384] (*1)
device-mapper: remove ioctl on temporary-cryptsetup-1005 failed: No such device or address
# Releasing crypt device /dev/md6 context.
# Releasing device-mapper backend.
# Unlocking memory.
Command failed with code 5: Input/output error


And here is my dmesg (SELinux running in permissive mode)

Code:
[ 1242.987866] audit: type=1400 audit(1403207775.460:240): avc:  denied  { read } for  pid=10457 comm="cryptsetup" name="ld.so.cache" dev="md1" ino=785512 scontext=root:sysadm_r:lvm_t tcontext=root:object_r:unlabeled_t tclass=file
[ 1242.987873] audit: type=1400 audit(1403207775.460:241): avc:  denied  { open } for  pid=10457 comm="cryptsetup" path="/etc/ld.so.cache" dev="md1" ino=785512 scontext=root:sysadm_r:lvm_t tcontext=root:object_r:unlabeled_t tclass=file
[ 1242.987876] audit: type=1400 audit(1403207775.460:242): avc:  denied  { getattr } for  pid=10457 comm="cryptsetup" path="/etc/ld.so.cache" dev="md1" ino=785512 scontext=root:sysadm_r:lvm_t tcontext=root:object_r:unlabeled_t tclass=file
[ 1246.687687] audit: type=1400 audit(1403207779.150:243): avc:  denied  { create } for  pid=10457 comm="cryptsetup" scontext=root:sysadm_r:lvm_t tcontext=root:sysadm_r:lvm_t tclass=socket
[ 1246.687694] audit: type=1400 audit(1403207779.150:244): avc:  denied  { bind } for  pid=10457 comm="cryptsetup" scontext=root:sysadm_r:lvm_t tcontext=root:sysadm_r:lvm_t tclass=socket
[ 1246.688228] audit: type=1400 audit(1403207779.150:245): avc:  denied  { accept } for  pid=10457 comm="cryptsetup" scontext=root:sysadm_r:lvm_t tcontext=root:sysadm_r:lvm_t tclass=socket
[ 1246.688244] audit: type=1400 audit(1403207779.150:246): avc:  denied  { setopt } for  pid=10457 comm="cryptsetup" scontext=root:sysadm_r:lvm_t tcontext=root:sysadm_r:lvm_t tclass=socket
[ 1246.688255] audit: type=1400 audit(1403207779.150:247): avc:  denied  { write } for  pid=10457 comm="cryptsetup" scontext=root:sysadm_r:lvm_t tcontext=system_u:object_r:unlabeled_t tclass=socket
[ 1246.688282] audit: type=1400 audit(1403207779.150:248): avc:  denied  { read } for  pid=10457 comm="cryptsetup" path="socket:[13081]" dev="sockfs" ino=13081 scontext=root:sysadm_r:lvm_t tcontext=root:sysadm_r:lvm_t tclass=socket
[ 1246.688285] audit: type=1400 audit(1403207779.150:249): avc:  denied  { read } for  pid=10457 comm="cryptsetup" scontext=root:sysadm_r:lvm_t tcontext=system_u:object_r:unlabeled_t tclass=socket
[ 1276.952829] audit: type=1400 audit(1403207809.410:250): avc:  denied  { read } for  pid=10473 comm="mdadm" name="mdadm.conf" dev="md1" ino=818093 scontext=system_u:system_r:mdadm_t tcontext=system_u:object_r:unlabeled_t tclass=file
[ 1276.952834] audit: type=1400 audit(1403207809.410:251): avc:  denied  { open } for  pid=10473 comm="mdadm" path="/etc/mdadm.conf" dev="md1" ino=818093 scontext=system_u:system_r:mdadm_t tcontext=system_u:object_r:unlabeled_t tclass=file
[ 1277.809650] audit: type=1400 audit(1403207810.250:252): avc:  denied  { getattr } for  pid=10471 comm="cryptsetup" name="/" dev="devtmpfs" ino=1025 scontext=root:sysadm_r:lvm_t tcontext=system_u:object_r:device_t tclass=filesystem
[ 1279.222408] audit: type=1400 audit(1403207811.670:253): avc:  denied  { setattr } for  pid=39 comm="kdevtmpfs" name="dm-0" dev="devtmpfs" ino=17479 scontext=system_u:system_r:kernel_t tcontext=system_u:object_r:device_t tclass=blk_file
[ 1279.222581] device-mapper: table: 253:0: crypt: Error creating IV
[ 1279.222582] device-mapper: ioctl: error adding target to table
[ 1279.223135] audit: type=1400 audit(1403207811.670:254): avc:  denied  { read } for  pid=10481 comm="dmsetup" name="ld.so.cache" dev="md1" ino=785512 scontext=system_u:system_r:lvm_t tcontext=root:object_r:unlabeled_t tclass=file
[ 1279.223139] audit: type=1400 audit(1403207811.670:255): avc:  denied  { open } for  pid=10481 comm="dmsetup" path="/etc/ld.so.cache" dev="md1" ino=785512 scontext=system_u:system_r:lvm_t tcontext=root:object_r:unlabeled_t tclass=file
[ 1279.223142] audit: type=1400 audit(1403207811.670:256): avc:  denied  { getattr } for  pid=10481 comm="dmsetup" path="/etc/ld.so.cache" dev="md1" ino=785512 scontext=system_u:system_r:lvm_t tcontext=root:object_r:unlabeled_t tclass=file
[ 1851.808949] device-mapper: table: 253:0: crypt: Error creating IV
[ 1851.808950] device-mapper: ioctl: error adding target to table
[ 1902.292569] audit: type=1400 audit(1403208434.490:257): avc:  denied  { read } for  pid=10496 comm="dmesg" name="kmsg" dev="devtmpfs" ino=1034 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kmsg_device_t tclass=chr_file
[ 1902.292575] audit: type=1400 audit(1403208434.490:258): avc:  denied  { open } for  pid=10496 comm="dmesg" path="/dev/kmsg" dev="devtmpfs" ino=1034 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kmsg_device_t tclass=chr_file
Back to top
View user's profile Send private message
Tractor Girl
Apprentice
Apprentice


Joined: 16 May 2013
Posts: 159

PostPosted: Thu Jun 19, 2014 6:35 pm    Post subject: Reply with quote

Does it work with default options?
Code:
cryptsetup luksFormat /dev/XXX
Back to top
View user's profile Send private message
lutel
Tux's lil' helper
Tux's lil' helper


Joined: 19 Oct 2003
Posts: 93
Location: Pomroczna

PostPosted: Thu Jun 19, 2014 6:39 pm    Post subject: Reply with quote

yes it does! thank you :)

It works with aes-xts-plain64
but not with aes-xts-essiv:sha256

Is there any security drawback on this?
Back to top
View user's profile Send private message
khayyam
Watchman
Watchman


Joined: 07 Jun 2012
Posts: 6228
Location: Room 101

PostPosted: Thu Jun 19, 2014 6:46 pm    Post subject: Reply with quote

lutel wrote:
Code:
Please, consider using libdevmapper's udev synchronisation interface or disable it explicitly by calling dm_udev_set_sync_support(0).

lutel ...

No idea about SELinux but this just seems to be a udev issue, try the following:

/etc/lvm/lvm.conf
Code:
#udev_sync = 1
udev_sync = 0

HTH & best ... khay
Back to top
View user's profile Send private message
lutel
Tux's lil' helper
Tux's lil' helper


Joined: 19 Oct 2003
Posts: 93
Location: Pomroczna

PostPosted: Thu Jun 19, 2014 6:50 pm    Post subject: Reply with quote

khayyam - thanks, it works with tractorgirl advice!
Back to top
View user's profile Send private message
Tractor Girl
Apprentice
Apprentice


Joined: 16 May 2013
Posts: 159

PostPosted: Thu Jun 19, 2014 7:47 pm    Post subject: Reply with quote

lutel wrote:

Is there any security drawback on this?

Here's the answer:
http://seclists.org/basics/2009/May/253
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Installing Gentoo All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum