A security update that fixes Calamares bug CAL-405: https://calamares.io/bugs/browse/CAL-405
When installing with a LUKS-encrypted / partition, Calamares was always creating a keyfile to decode / and storing it in the initramfs. It did that even with an unencrypted separate /boot partition. As a result, the keyfile would be stored in cleartext on the /boot partition, and it was possible to unlock the / partition without ever entering a passphrase. This completely defeated the security of LUKS.
Please note that this only affects manual partitioning. The automatic partitioning never leaves /boot unencrypted (and it is, in fact, recommended to also always encrypt /boot when doing manual partitioning).
This update fixes the dracutlukscfg module to not add the keyfile to install_items in the dracut configuration (so that dracut will not include it onto the initramfs) if /boot is separate and unencrypted.
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2016-5c7e9b8778Please login to add feedback.
This update has been submitted for testing by kkofler.
kkofler edited this update.
This update has been pushed to testing.
This update has been submitted for stable by kkofler.
This update has been pushed to stable.