fix(partitioning): use printf instead of here-string for secure LUKS password handling
- commit
- 4909acec0b84dd2a04072efc684eac3029e4f91d
- author
- bnema · · 2025-10-20 18:44 UTC
- parent
- fa93e6f
- signature
- unsigned
1 file · +4 -3
M install/partitioning/format.sh +4 -3
| @@ -27,19 +27,20 @@ if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then | |||
| 27 | 27 | wipefs -af "$ARCHUP_ROOT_PART" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 28 | 28 | ||
| 29 | 29 | # Setup LUKS with Argon2id and 2000ms iteration time (using user password) | |
| 30 | - | cryptsetup luksFormat \ | |
| 30 | + | # Use printf to avoid trailing newline that <<< adds | |
| 31 | + | printf '%s' "$ARCHUP_PASSWORD" | cryptsetup luksFormat \ | |
| 31 | 32 | --type luks2 \ | |
| 32 | 33 | --batch-mode \ | |
| 33 | 34 | --pbkdf argon2id \ | |
| 34 | 35 | --iter-time 2000 \ | |
| 35 | 36 | --label ARCHUP_LUKS \ | |
| 36 | 37 | --key-file - \ | |
| 37 | - | "$ARCHUP_ROOT_PART" <<< "$ARCHUP_PASSWORD" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 38 | + | "$ARCHUP_ROOT_PART" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 38 | 39 | ||
| 39 | 40 | echo "LUKS container created" >> "$ARCHUP_INSTALL_LOG_FILE" | |
| 40 | 41 | ||
| 41 | 42 | # Open the encrypted container | |
| 42 | - | cryptsetup open --key-file=- "$ARCHUP_ROOT_PART" cryptroot <<< "$ARCHUP_PASSWORD" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 43 | + | printf '%s' "$ARCHUP_PASSWORD" | cryptsetup open --key-file=- "$ARCHUP_ROOT_PART" cryptroot >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | |
| 43 | 44 | ||
| 44 | 45 | echo "LUKS container opened" >> "$ARCHUP_INSTALL_LOG_FILE" | |
| 45 | 46 | ||
| @@ -27,19 +27,20 @@ if [ "$ARCHUP_ENCRYPTION" = "enabled" ]; then | |||||
| 27 | wipefs -af "$ARCHUP_ROOT_PART" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | 27 | wipefs -af "$ARCHUP_ROOT_PART" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | ||
| 28 | 28 | ||||
| 29 | # Setup LUKS with Argon2id and 2000ms iteration time (using user password) | 29 | # Setup LUKS with Argon2id and 2000ms iteration time (using user password) | ||
| 30 | - | cryptsetup luksFormat \ | 30 | + | # Use printf to avoid trailing newline that <<< adds |
| 31 | + | printf '%s' "$ARCHUP_PASSWORD" | cryptsetup luksFormat \ | |||
| 31 | --type luks2 \ | 32 | --type luks2 \ | ||
| 32 | --batch-mode \ | 33 | --batch-mode \ | ||
| 33 | --pbkdf argon2id \ | 34 | --pbkdf argon2id \ | ||
| 34 | --iter-time 2000 \ | 35 | --iter-time 2000 \ | ||
| 35 | --label ARCHUP_LUKS \ | 36 | --label ARCHUP_LUKS \ | ||
| 36 | --key-file - \ | 37 | --key-file - \ | ||
| 37 | - | "$ARCHUP_ROOT_PART" <<< "$ARCHUP_PASSWORD" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | 38 | + | "$ARCHUP_ROOT_PART" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 |
| 38 | 39 | ||||
| 39 | echo "LUKS container created" >> "$ARCHUP_INSTALL_LOG_FILE" | 40 | echo "LUKS container created" >> "$ARCHUP_INSTALL_LOG_FILE" | ||
| 40 | 41 | ||||
| 41 | # Open the encrypted container | 42 | # Open the encrypted container | ||
| 42 | - | cryptsetup open --key-file=- "$ARCHUP_ROOT_PART" cryptroot <<< "$ARCHUP_PASSWORD" >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 | 43 | + | printf '%s' "$ARCHUP_PASSWORD" | cryptsetup open --key-file=- "$ARCHUP_ROOT_PART" cryptroot >> "$ARCHUP_INSTALL_LOG_FILE" 2>&1 |
| 43 | 44 | ||||
| 44 | echo "LUKS container opened" >> "$ARCHUP_INSTALL_LOG_FILE" | 45 | echo "LUKS container opened" >> "$ARCHUP_INSTALL_LOG_FILE" | ||
| 45 | 46 | ||||