From patchwork Sun Mar 9 15:55:49 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?S=C3=B6ren_Tempel?= X-Patchwork-Id: 39969 Return-Path: X-Original-To: patchwork@mira.cbaines.net Delivered-To: patchwork@mira.cbaines.net Received: by mira.cbaines.net (Postfix, from userid 113) id D735327BBE9; Sun, 9 Mar 2025 15:59:26 +0000 (GMT) X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on mira.cbaines.net X-Spam-Level: X-Spam-Status: No, score=-7.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED, RCVD_IN_VALIDITY_CERTIFIED,RCVD_IN_VALIDITY_RPBL,RCVD_IN_VALIDITY_SAFE, SPF_HELO_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.6 Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mira.cbaines.net (Postfix) with ESMTPS id D87C727BBE2 for ; Sun, 9 Mar 2025 15:59:24 +0000 (GMT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1trJ3S-0005SD-N4; Sun, 09 Mar 2025 11:59:07 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1trJ3P-0005Rh-CX for guix-patches@gnu.org; Sun, 09 Mar 2025 11:59:03 -0400 Received: from debbugs.gnu.org ([2001:470:142:5::43]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1trJ3O-0002d9-GB; Sun, 09 Mar 2025 11:59:03 -0400 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debbugs.gnu.org; s=debbugs-gnu-org; h=MIME-Version:Date:From:To:In-Reply-To:References:Subject; bh=MBka6V2p49vR/4P0lRP0wPM2Fqwkh+be8OYQMPERQdI=; b=aPrNWuXw565X23480cmmFeLw96f969WIhEAgwczmaqzyxWtFYKub+uele3RNNyTMx67BuTBQ3JkvG0awBPpYPHQrArSkSAAWCT2jYUoUEMnq8PIAEiYFciu438TlG8buLWT46vJmd2g00jvFwtcvDUS2A9935NjMBSaVNjadru3pQkgz1Av4EOB8DCIqedc9cet8b1fk0ybxzz5uLzlOREsQDfTGkfEcJhhoxXKHuVBIjb92qVrh+1zUJSCbSIXYs8xBO8J/qr4BDEh1ueJJcn1dcbHOTpZ7Y1YKAl6GVg+HlFd/pC3K9vYmBF1DAUaAs3BhfVuwZu9wdQ3f8hjiLA==; Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1trJ3O-00020I-4U; Sun, 09 Mar 2025 11:59:02 -0400 X-Loop: help-debbugs@gnu.org Subject: [bug#73654] [PATCH v2] mapped-devices: luks: Support passing --allow-discards during open References: <20241006094239.7157-1-sisiutl@egregore.fun> In-Reply-To: <20241006094239.7157-1-sisiutl@egregore.fun> Resent-From: soeren@soeren-tempel.net Original-Sender: "Debbugs-submit" Resent-CC: ludo@gnu.org, maxim.cournoyer@gmail.com, guix-patches@gnu.org Resent-Date: Sun, 09 Mar 2025 15:59:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 73654 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 73654@debbugs.gnu.org Cc: sisiutl@egregore.fun, hako@ultrarare.space, ludo@gnu.org, Ludovic =?utf-8?q?Court=C3=A8s?= , Maxim Cournoyer X-Debbugs-Original-Xcc: Ludovic =?utf-8?q?Court=C3=A8s?= , Maxim Cournoyer Received: via spool by 73654-submit@debbugs.gnu.org id=B73654.17415358987623 (code B ref 73654); Sun, 09 Mar 2025 15:59:02 +0000 Received: (at 73654) by debbugs.gnu.org; 9 Mar 2025 15:58:18 +0000 Received: from localhost ([127.0.0.1]:33893 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1trJ2f-0001ys-Mc for submit@debbugs.gnu.org; Sun, 09 Mar 2025 11:58:18 -0400 Received: from magnesium.8pit.net ([45.76.88.171]:4895) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1trJ2c-0001yd-Am; Sun, 09 Mar 2025 11:58:15 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=opensmtpd; bh=MBka6V2p 49vR/4P0lRP0wPM2Fqwkh+be8OYQMPERQdI=; h=date:subject:cc:to:from; d=soeren-tempel.net; b=w0TwY5o2pAP1COCzMGmiBnkbeUEc2pPNwueCJ6NiF7y86iv HYgIgoy9GyOuiDLkoLhGvzbMHyDn8Uf/3KE/c4nY2CaiuHs3AsXgcgTC22W4o4UKdWEdtw 3TqGKvHTIbgsKRERaR/YfoTFaApizLtfYgxaBD4RnSgbERwvKhQQ6s= Received: from localhost ( [2a02:560:4d83:4d00:ac70:7d85:2260:9eec]) by magnesium.8pit.net (OpenSMTPD) with ESMTPSA id ba7763cc (TLSv1.3:TLS_AES_256_GCM_SHA384:256:YES); Sun, 9 Mar 2025 16:58:11 +0100 (CET) From: soeren@soeren-tempel.net Date: Sun, 9 Mar 2025 16:55:49 +0100 Message-ID: <175e49381c046e500d69a4dc655258d7692d84df.1741535749.git.soeren@soeren-tempel.net> X-Mailer: git-send-email 2.48.1 MIME-Version: 1.0 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: guix-patches@gnu.org List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org Sender: guix-patches-bounces+patchwork=mira.cbaines.net@gnu.org X-getmail-retrieved-from-mailbox: Patches From: Sisiutl * gnu/system/mapped-devices.scm (open-luks-device): Support opening LUKS devices with the --allow-discards option. * gnu/system/mapped-devices.scm (luks-device-mapping-with-options): Pass through the allow-discards? keyword argument. * doc/guix.texi (Mapped Devices): Update documentation for the luks-device-mapping-with-options procedure. Signed-off-by: Sören Tempel --- Not the author of the original patchset, but I needed this for my own setup as well so I might as well pick up the slack. I made the following changes since the v1: * Mention allow-discards? in the docstring of open-luks-device. * Reference the new option in luks-device-mapping-with-options. * Expand the related documentation in doc/guix.texi. * Revise the commit message slightly. * Restore the linefeed. doc/guix.texi | 11 +++++++++- gnu/system/mapped-devices.scm | 39 ++++++++++++++++++++--------------- 2 files changed, 32 insertions(+), 18 deletions(-) base-commit: c4f297a664869a18126b66eb5209de1fcceb42d8 diff --git a/doc/guix.texi b/doc/guix.texi index 05c855c5ea..bc3ba1f2ed 100644 --- a/doc/guix.texi +++ b/doc/guix.texi @@ -18461,7 +18461,7 @@ Mapped Devices @code{dm-crypt} Linux kernel module. @end defvar -@deffn {Procedure} luks-device-mapping-with-options [#:key-file] +@deffn {Procedure} luks-device-mapping-with-options [#:key-file #:allow-discards?] Return a @code{luks-device-mapping} object, which defines LUKS block device encryption using the @command{cryptsetup} command from the package with the same name. It relies on the @code{dm-crypt} Linux @@ -18483,6 +18483,15 @@ Mapped Devices (type (luks-device-mapping-with-options #:key-file "/crypto.key"))) @end lisp + +If @code{allow-discards?} is provided, then the use of discard (TRIM) +requests is allowed for the underlying device. This is useful for +Solid State Drives. However, this option can have a negative security +impact because it can make filesystem-level operations visible on the +physical device. For more information, refer to the description of +the @code{--allow-discards} option in the @code{cryptsetup-open(8)} +man page. + @end deffn @defvar raid-device-mapping diff --git a/gnu/system/mapped-devices.scm b/gnu/system/mapped-devices.scm index 931c371425..c3eaf9ff6e 100644 --- a/gnu/system/mapped-devices.scm +++ b/gnu/system/mapped-devices.scm @@ -194,9 +194,10 @@ (define (check-device-initrd-modules device linux-modules location) ;;; Common device mappings. ;;; -(define* (open-luks-device source targets #:key key-file) +(define* (open-luks-device source targets #:key key-file allow-discards?) "Return a gexp that maps SOURCE to TARGET as a LUKS device, using -'cryptsetup'." +'cryptsetup'. When ALLOW-DISCARDS? is true, the use of discard (TRIM) requests is +allowed for the underlying device." (with-imported-modules (source-module-closure '((gnu build file-systems) (guix build utils))) ;; For mkdir-p @@ -234,17 +235,19 @@ (define* (open-luks-device source targets #:key key-file) (loop (- tries-left 1)))))) (error "LUKS partition not found" source)) source))) - ;; We want to fallback to the password unlock if the keyfile fails. - (or (and keyfile - (zero? (system*/tty - #$(file-append cryptsetup-static "/sbin/cryptsetup") - "open" "--type" "luks" - "--key-file" keyfile - partition #$target))) - (zero? (system*/tty - #$(file-append cryptsetup-static "/sbin/cryptsetup") - "open" "--type" "luks" - partition #$target))))))))) + (let* ((cryptsetup-flags (list "open" "--type" "luks" partition #$target)) + (cryptsetup-flags (if allow-discards? + (cons "--allow-discards" cryptsetup-flags) + cryptsetup-flags))) + ;; We want to fallback to the password unlock if the keyfile fails. + (or (and keyfile + (zero? (apply system*/tty + #$(file-append cryptsetup-static "/sbin/cryptsetup") + "--key-file" keyfile + cryptsetup-flags))) + (zero? (apply system*/tty + #$(file-append cryptsetup-static "/sbin/cryptsetup") + cryptsetup-flags)))))))))) (define (close-luks-device source targets) "Return a gexp that closes TARGET, a LUKS device." @@ -286,13 +289,15 @@ (define luks-device-mapping ((gnu build file-systems) #:select (find-partition-by-luks-uuid system*/tty)))))) -(define* (luks-device-mapping-with-options #:key key-file) +(define* (luks-device-mapping-with-options #:key key-file allow-discards?) "Return a luks-device-mapping object with open modified to pass the arguments -into the open-luks-device procedure." +(key-file and allow-discards?) into the open-luks-device procedure." (mapped-device-kind (inherit luks-device-mapping) - (open (λ (source targets) (open-luks-device source targets - #:key-file key-file))))) + (open (λ (source targets) + (open-luks-device source targets + #:key-file key-file + #:allow-discards? allow-discards?))))) (define (open-raid-device sources targets) "Return a gexp that assembles SOURCES (a list of devices) to the RAID device