Bug#905920: (no subject)

From	Nazar Mokrynskyi <nazar@mokrynskyi.com>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#905920: (no subject)
Date	2018-08-11 20:30 +0200
Message-ID	<wlGOe-8ip-5@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

Package: initramfs-tools
Version: 0.131ubuntu8
Severity: normal
Tags: security

I have fully encrypted (UEFI, LUKS, BTRFS) system and in order to avoid typing password for the second time after GRUB2 added `keyscript` option to `/etc/crypttab`.
Keyscript file is only readable by root, however, resulting `initrd.img*` file is readable by anyone, which I think is a security issue.
I'd like to see `initrd.img*` files to also be readable by root user only.

-- Package-specific info:
-- initramfs sizes
-rw-r--r-- 1 root root 53M Aug 11 19:50 /boot/initrd.img-4.17.0-5-generic
-rw-r--r-- 1 root root 53M Aug 11 19:49 /boot/initrd.img-4.17.0-6-generic
-rw-r--r-- 1 root root 53M Aug 11 19:49 /boot/initrd.img-4.17.0-7-generic
-- /proc/cmdline
BOOT_IMAGE=/root/boot/vmlinuz-4.17.0-5-generic root=UUID=5170aca4-061a-4c6c-ab00-bd7fc8ae6030 ro rootflags=subvol=root nosplash intel_pstate=disable scsi_mod.use_blk_mq=1 intel_iommu=on i915.fastboot=1

-- /etc/crypttab
# <target name>	<source device>		<key file>	<options>
system UUID=739967f1-9770-470a-a031-8d8b8bcdb350 none luks,discard,keyscript=/etc/cryptroot/system.64.sh

-- System Information:
Debian Release: buster/sid
  APT prefers cosmic-proposed
  APT policy: (500, 'cosmic-proposed'), (500, 'cosmic')
Architecture: amd64 (x86_64)

Back to linux.debian.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#905920: (no subject) Nazar Mokrynskyi <nazar@mokrynskyi.com> - 2018-08-11 20:30 +0200
  Bug#905920: marked as done ((no subject)) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2018-08-11 22:00 +0200

csiph-web