Leapp upgrde support for fully encrypted disks

[Naranthiran]

Hi Team,

Will we get an update in future so that we can perform an upgrade on a fully encrypted HDD(bind using TMP).

Regards
Naranthiran Duraisamy

[pirat89]

Hi @Naranthiran \o,
thank you for the question. My comment below is my personal POV so do not take it as an official statement or something what is written in stone.

I cannot say. I mean, it is in our team backlog for years - basically since the beginning, but we have very limited resources so we need to prioritize the work - and priority is affected e.g. by number of customers asking for some feature or bugfix. I can only tell you that this topic has been raised recently again and we discuss what has higher priority from all the stuff on the table. I can say that we count to deliver this feature, but I have no idea when it happens.

From that point, I cannot say even whether it will be delivered for upgrades 7 -> 8, as the last planned release in rhel 7 will happen on May and it is not expected to deliver another features after that date.

If someone opens PR with the solution, possibly it could be delivered, but if it is not tested & reviewed by SMEs in RH, most likely such a feature will be allowed only in an unsupported mode - e.g. using:

LEAPP_UNSUPPORTED=1 LEAPP_DEVEL_ALLOW_DISK_ENCRYPTION=1 leapp upgrade

So it would be at least available for experienced users that are able to handle all possible issues on their own; or for experimenting - so we could get feedback from users to see whether such a solution is reliable or not.

Also I am aware that many customers are using services, like Clevis, to unlock encrypted disks/partitions, which at least in some cases (in combination with Tang) requires network connection that is not available during the whole upgrade process - which is another big feature that is hard to deliver. And I am confident to say that both these features will not be delivered in the same release. So from my POV, in the best scenario, in-place upgrades (IPU) 7 -> 8 will have at least one of these features - if any. But I am more optimistic about the timeline of IPU 8 -> 9 development.

[Naranthiran]

Hi Petr,
Thanks for your reply.

I was trying to upgrade the fully encrypted disks(root partition) using the leapp application. The disks were bind with TMP so that the disk are decrypted automatically during the boot.

I am made the following changes after installing the leapp app on the upgrade system and was able to successfully upgrade from RHEL 8.6 to 9.2.

I have skipped the disk encryption validation on the below file.

File 1: cat /usr/share/leapp-repository/repositories/system_upgrade/common/actors/inhibitwhenluks/actor.py
from leapp.actors import Actor
from leapp.models import StorageInfo
from leapp.reporting import Report, create_report
from leapp import reporting
from leapp.tags import ChecksPhaseTag, IPUWorkflowTag

class InhibitWhenLuks(Actor):
"""
Check if any encrypted partitions is in use. If yes, inhibit the upgrade process.

Upgrading system with encrypted partition is not supported.
"""

name = 'check_luks_and_inhibit'
consumes = (StorageInfo,)
produces = (Report,)
tags = (ChecksPhaseTag, IPUWorkflowTag)

def process(self):
for storage_info in self.consume(StorageInfo):
for blk in storage_info.lsblk:
if blk.tp == 'crypt':
create_report([
reporting.Title('LUKS encrypted partition detected'),
reporting.Summary('Upgrading system with encrypted partitions is not supported'),
reporting.Severity(reporting.Severity.HIGH),
reporting.Tags([reporting.Tags.BOOT, reporting.Tags.ENCRYPTION]),
reporting.Flags([reporting.Flags.INHIBITOR]),
])
break

Added the packaged released tp TPM for automatic description.

File 2: /usr/share/leapp-repository/repositories/system_upgrade/common/actors/commonleappdracutmodules/libraries/modscan.py

import os
import re

from leapp.libraries.common.config import architecture, version
from leapp.libraries.stdlib import api
from leapp.models import (
DracutModule,
RequiredUpgradeInitramPackages, # deprecated
TargetUserSpaceUpgradeTasks,
UpgradeDracutModule, # deprecated
UpgradeInitramfsTasks,
)
from leapp.utils.deprecation import suppress_deprecation

_REQUIRED_PACKAGES = [
'binutils',
'cifs-utils',
'device-mapper-multipath',
'dracut',
'dracut-config-generic',
'dracut-config-rescue',
'dracut-network',
'dracut-tools',
'fcoe-utils',
'hostname',
'iscsi-initiator-utils',
'kbd',
'kernel',
'kernel-core',
'kernel-modules',
'keyutils',
'lldpad',
'lvm2',
'mdadm',
'nfs-utils',
'openssh-clients',
'plymouth',
'rpcbind',
'systemd-container',
'tar',
'clevis',
'clevis-dracut',
'clevis-systemd',
'clevis-udisks2',
'clevis-luks',
'cryptsetup',
'tpm2-tss',
'tpm2-tools',
'tpm2-abrmd'
]

I am not sure about the actual impact on other hardware.

If I set the variable as below I will able to perform the fully encrypted disk right? And I don't need to modify the file /usr/share/leapp-repository/repositories/system_upgrade/common/actors/inhibitwhenluks/actor.py. But still, clevis, cryptsetup, and tmp2 packages are required for automatic disk decryption when the system is rebooted for an upgrade.

LEAPP_UNSUPPORTED=1 LEAPP_DEVEL_ALLOW_DISK_ENCRYPTION=1 leapp upgrade

Regards
Naranthiran

[pirat89]

@Naranthiran Thanks for sharing. Well, in the snippet you shared, there is not implemented any check for the envar - the check itself is skipped if I understand your change correctly. And I am not sure how the machine will behave with various HWs, but I am happy to hear it worked in your case. I would update your code in the way it does something like this: #1100

It's not finished as it's missing updated unit tests and I haven't tested it at all. But something like this would be the solution we spoke about based on your changes. WDYT?

[Naranthiran]

Hi Petr,
Yes, The disk type check was skipped, I was not aware of these two parameters.
LEAPP_UNSUPPORTED=1 LEAPP_DEVEL_ALLOW_DISK_ENCRYPTION=1.

Regards
Naranthiran Duraisamy

[pirat89]

Well, the LEAPP_DEVEL_ALLOW_DISK_ENCRYPTION environment variable does not exist anywhere except the PR I opened. Unless the PR is merged prior the upstream next release (Aug), the envar will not have any effect in the official RHEL release in november.

[pirat89]

FYI, the support for LUKS will be implemented for IPU 8 -> 9. Here is initial PR: #1200.