From 2e66ead142ffa77aa5dab8372b8d17950b600b24 Mon Sep 17 00:00:00 2001 From: "Gary T. Giesen" Date: Wed, 24 Jun 2026 09:34:09 -0400 Subject: [PATCH] installer: Feed the LUKS passphrase via stdin, not a shell pipe create_partitions() built 'echo -n | cryptsetup ...' and ran it through os.system(), i.e. sh -c 'echo -n | cryptsetup ...'. The passphrase was the shlex-quoted argument of that shell, so it was briefly visible in the process table to any local user running ps during an encrypted install. cryptsetup reads the key from stdin with --key-file -; pass it there via subprocess.run(input=). The passphrase is now never a command argument: not in ps, not in any log. --- usr/lib/live-installer/installer.py | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/usr/lib/live-installer/installer.py b/usr/lib/live-installer/installer.py index f90a8a49..90f84859 100644 --- a/usr/lib/live-installer/installer.py +++ b/usr/lib/live-installer/installer.py @@ -5,7 +5,6 @@ import gettext import parted import partitioning -import shlex from functools import cmp_to_key gettext.install("live-installer", "/usr/share/locale") @@ -442,12 +441,18 @@ def create_partitions(self): disk_device = parted.getDevice(self.setup.disk) partitioning.full_disk_format(disk_device, create_boot=(self.auto_boot_partition is not None), create_swap=(self.auto_swap_partition is not None)) - # Encrypt root partition + # Encrypt root partition. The passphrase is fed to cryptsetup on + # stdin (--key-file -), never as a command argument: this keeps it + # out of the process table (ps) and out of any logs. Previously the + # engine built 'echo -n | cryptsetup ...', so the passphrase + # was briefly visible to any local user running ps. if self.setup.luks: print(" --> Encrypting root partition %s" % self.auto_root_partition) - os.system("echo -n %s | cryptsetup luksFormat -c aes-xts-plain64 -h sha256 -s 512 %s" % (shlex.quote(self.setup.passphrase1), self.auto_root_partition)) + subprocess.run("cryptsetup luksFormat -c aes-xts-plain64 -h sha256 -s 512 --key-file - %s" % self.auto_root_partition, + shell=True, input=self.setup.passphrase1.encode("utf-8")) print(" --> Opening root partition %s" % self.auto_root_partition) - os.system("echo -n %s | cryptsetup luksOpen %s lvmmint" % (shlex.quote(self.setup.passphrase1), self.auto_root_partition)) + subprocess.run("cryptsetup luksOpen --key-file - %s lvmmint" % self.auto_root_partition, + shell=True, input=self.setup.passphrase1.encode("utf-8")) self.auto_root_partition = "/dev/mapper/lvmmint" # Setup LVM