{"action":"created","issue":{"url":"https://api.github.com/repos/zfsonlinux/zfs/issues/3430","labels_url":"https://api.github.com/repos/zfsonlinux/zfs/issues/3430/labels{/name}","comments_url":"https://api.github.com/repos/zfsonlinux/zfs/issues/3430/comments","events_url":"https://api.github.com/repos/zfsonlinux/zfs/issues/3430/events","html_url":"https://github.com/zfsonlinux/zfs/issues/3430","id":78060803,"number":3430,"title":"ZFS and LUKS may corrupt LUKS Header: Suggestion for magic header detection.","user":{"login":"turrini","id":1717170,"avatar_url":"https://avatars.githubusercontent.com/u/1717170?v=3","gravatar_id":"","url":"https://api.github.com/users/turrini","html_url":"https://github.com/turrini","followers_url":"https://api.github.com/users/turrini/followers","following_url":"https://api.github.com/users/turrini/following{/other_user}","gists_url":"https://api.github.com/users/turrini/gists{/gist_id}","starred_url":"https://api.github.com/users/turrini/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/turrini/subscriptions","organizations_url":"https://api.github.com/users/turrini/orgs","repos_url":"https://api.github.com/users/turrini/repos","events_url":"https://api.github.com/users/turrini/events{/privacy}","received_events_url":"https://api.github.com/users/turrini/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-05-19T12:07:30Z","updated_at":"2015-05-19T13:50:13Z","closed_at":null,"body":"Suggestion: ZFS should check if partition starts with 'LUKS' + 0xBA 0xBE (LUKS Magic) since it may cause corruption in some specific cases.\r\n\r\nSteps to reproduce:\r\n\r\nPreparation:\r\n\r\n`dd if=/dev/zero of=/tmp/disk.img bs=10M count=10`\r\n\r\n1) `zpool create tank /tmp/disk.img` (GUID: 17281385454692588068)\r\n(Ooops, forgot to encrypt drive first **OR** the partition/drive **had** an old pool before!)\r\n1.1) `zpool export tank`\r\n\r\n2) `cryptsetup luksFormat /tmp/disk.img`\r\n\r\n3) `cryptsetup luksOpen /tmp/disk.img luks-tank`\r\n\r\n4) `zpool create tank /dev/mapper/luks-tank` (new GUID 6114133284129971711)\r\n\r\n... user populate pool with data ...\r\n\r\n6) `zpool export tank && cryptsetup luksClose luks-tank`\r\n\r\nNow, if user tries to zpool import tank (/tmp/disk.img) **BEFORE** opening it with cryptsetup, zfs will corrupt luks header because of reminiscences of old pool (GUID: 17281385454692588068) first created on step 1.\r\n\r\n`zpool import -d /tmp/ tank` (LUKS header gets corrupted as ZFS tries to import old pool)\r\n\r\nIt may happen on boot, since cryptsetup will ask 3 times for a valid password. If an user miss, zfs will try to mount it anyway, corrupting luks header.\r\n\r\nSince its user obligation to do a proper luks header backup, he will need to restore that header every time he misses his password for more than three times (eg: initramfs zfs root pool script).\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/zfsonlinux/zfs/issues/comments/103502911","html_url":"https://github.com/zfsonlinux/zfs/issues/3430#issuecomment-103502911","issue_url":"https://api.github.com/repos/zfsonlinux/zfs/issues/3430","id":103502911,"user":{"login":"beren12","id":455631,"avatar_url":"https://avatars.githubusercontent.com/u/455631?v=3","gravatar_id":"","url":"https://api.github.com/users/beren12","html_url":"https://github.com/beren12","followers_url":"https://api.github.com/users/beren12/followers","following_url":"https://api.github.com/users/beren12/following{/other_user}","gists_url":"https://api.github.com/users/beren12/gists{/gist_id}","starred_url":"https://api.github.com/users/beren12/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/beren12/subscriptions","organizations_url":"https://api.github.com/users/beren12/orgs","repos_url":"https://api.github.com/users/beren12/repos","events_url":"https://api.github.com/users/beren12/events{/privacy}","received_events_url":"https://api.github.com/users/beren12/received_events","type":"User","site_admin":false},"created_at":"2015-05-19T13:50:13Z","updated_at":"2015-05-19T13:50:13Z","body":"seems like it should be cryptsetup that should detect ZFS and remove the labels if found..."}}