[Bug 1979159] Re: Cannot unlock encrypted root after upgrading to 22.04

[Benjamin Drung]

I tried to reproduce it in a Ubuntu 22.04 VM by preparing disks with
following options:

```
sudo apt install cryptsetup-bin cryptsetup-initramfs
sudo cryptsetup luksFormat --cipher=aes-cbc-essiv:sha256 --hash=sha1 /dev/vdb
sudo cryptsetup luksFormat --cipher=aes-cbc-essiv:sha256 /dev/vdc
sudo cryptsetup luksFormat --hash=sha1 /dev/vdd
```

Then added break=bottom to the kernel options:

```
sudo vim /etc/default/grub
-> GRUB_CMDLINE_LINUX_DEFAULT="quiet splash break=bottom"
sudo update-grub
```

Rebooted and tried to open the disks in the initramfs:

```
cryptsetup luksOpen /dev/vdb vdb
cryptsetup luksOpen /dev/vdc vdc
cryptsetup luksOpen /dev/vdd vdd
```

All opened fine. Need to further investigate. It does look like it's the
cipher mode or hash spec.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to cryptsetup in Ubuntu.
https://bugs.launchpad.net/bugs/1979159

Title:
  Cannot unlock encrypted root after upgrading to 22.04

Status in cryptsetup package in Ubuntu:
  Confirmed
Status in cryptsetup source package in Jammy:
  Confirmed
Status in cryptsetup source package in Kinetic:
  Confirmed

Bug description:
  After upgrading to Ubuntu 22.04 with an encrypted root filesystem, the
  root drive can no longer be unlocked at the "Please unlock disk
  <diskname>" prompt on boot.

  The encrypted root disk can be unlocked fine from the liveCD, but not
  from the initramfs environment on boot.

  The issue is caused by support for various luks encryption protocols
  now being missing from the initramfs environment due to changes
  introduced in OpenSSL 3.0 and Ubuntu pre-release testing not including
  a test-case of upgrading older Ubuntu versions with an encrypted root
  to the new version.

  The issue can be worked-around by:
  1.  Booting from the 22.04 liveCD.
  2.  chrooting into the target system's root.
         See https://help.ubuntu.com/community/ManualFullSystemEncryption/Troubleshooting
  3.  Creating a file /etc/initramfs-tools/hooks/custom-add-openssl-compat.conf containing:
  ---
  . /usr/share/initramfs-tools/hook-functions
  copy_exec /usr/lib/x86_64-linux-gnu/ossl-modules/legacy.so /usr/lib/x86_64-linux-gnu/ossl-modules/
  ---
  4.  Mark the file as executable: chmod +x /etc/initramfs-tools/hooks/custom-add-openssl-compat.conf
  5.  Regenerating the initramfs.  ie. update-initramfs -k all -u

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/cryptsetup/+bug/1979159/+subscriptions