打开:内存中的密码设置(“没有足够的可用内存来打开密钥槽”)。

Question

我正在编写yocto发行版，包括2.3.2版本中的密码设置

我在一个有1GB内存的板上运行这样的发行版，并且在打开加密分区时出现了一个“内存不足”错误，无法正确调试。有什么想法吗？

我的发行版是从有3个分区的mSD上运行的；第三个分区(30 MB)是加密的。

我使用ArchLinux指南中描述的步骤加密该分区，使用ext3而不是ext4。

# cryptsetup -y -v luksFormat /dev/sda2
# cryptsetup open /dev/sda2 cryptroot
# mkfs.ext3 /dev/mapper/cryptroot

但是试图在我的板上打开这个分区会引发一个错误：

cryptsetup --debug open /dev/mmcblk0p3  cryptroot
# cryptsetup 2.3.2 processing "cryptsetup --debug open /dev/mmcblk0p3 cryptroot"
# Running command open.
# Locking memory.
# Installing SIGINT/SIGTERM handler.
# Unblocking interruption on signal.
# Allocating context for crypt device /dev/mmcblk0p3.
# Trying to open and read device /dev/mmcblk0p3 with direct-io.
# Initialising device-mapper backend library.
# Trying to load any crypt type from device /dev/mmcblk0p3.
# Crypto backend (OpenSSL 1.1.1k  25 Mar 2021) initialized in cryptsetup library version 2.3.2.
# Detected kernel Linux 4.1.35-rt41 ppc.
# Loading LUKS2 header (repair disabled).
# Acquiring read lock for device /dev/mmcblk0p3.
# Opening lock resource file /run/cryptsetup/L_179:3
# Verifying lock handle for /dev/mmcblk0p3.
# Device /dev/mmcblk0p3 READ lock taken.
# Trying to read primary LUKS2 header at offset 0x0.
# Opening locked device /dev/mmcblk0p3
# Veryfing locked device handle (bdev)
# LUKS2 header version 2 of size 16384 bytes, checksum sha256.
# Checksum:43e122216ab19330fdfb6d2f9d7b586c4e5189884aef24be884e7159228e9ee5 (on-disk)
# Checksum:43e122216ab19330fdfb6d2f9d7b586c4e5189884aef24be884e7159228e9ee5 (in-memory)
# Trying to read secondary LUKS2 header at offset 0x4000.
# Reusing open ro fd on device /dev/mmcblk0p3
# LUKS2 header version 2 of size 16384 bytes, checksum sha256.
# Checksum:4ed9a44c22fde04c4b59a638c20eba6da3a13e591a6a1cfe7e0fec4437dc14cc (on-disk)
# Checksum:4ed9a44c22fde04c4b59a638c20eba6da3a13e591a6a1cfe7e0fec4437dc14cc (in-memory)
# Device size 32505856, offset 16777216.
# Device /dev/mmcblk0p3 READ lock released.
# Only 1 active CPUs detected, PBKDF threads decreased from 4 to 1.
# Not enough physical memory detected, PBKDF max memory decreased from 1048576kB to 255596kB.
# PBKDF argon2i, time_ms 2000 (iterations 0), max_memory_kb 255596, parallel_threads 1.
# Activating volume cryptroot using token -1.
# Interactive passphrase entry requested.
Enter passphrase for /dev/mmcblk0p3:
# Activating volume cryptroot [keyslot -1] using passphrase.
device-mapper: ioctl: 4.31.0-ioctl (2015-3-12) initialised: dm-devel@redhat.com
# dm version   [ opencount flush ]   [16384] (*1)
# dm versions   [ opencount flush ]   [16384] (*1)
# Detected dm-ioctl version 4.31.0.
# Device-mapper backend running with UDEV support enabled.
# dm status cryptroot  [ opencount noflush ]   [16384] (*1)
# Keyslot 0 priority 1 != 2 (required), skipped.
# Trying to open LUKS2 keyslot 0.
# Keyslot 0 (luks2) open failed with -12.
Not enough available memory to open a keyslot.
# Releasing crypt device /dev/mmcblk0p3 context.
# Releasing device-mapper backend.
# Closing read only fd for /dev/mmcblk0p3.
# Unlocking memory.
Command failed with code -3 (out of memory).

Answer 1

LUKS2使用Argon2i密钥派生函数，它是内存硬的，这意味着它需要大量内存来打开设备，以防止(或至少使其更难)使用GPU进行野蛮攻击。您可以检查使用cryptsetup luksDump /dev/sda2打开设备所需的内存，在Keyslots下查找行Memory: 755294。

在创建设备时，cryptsetup会检查可用内存的大小，并相应地调整打开它所需的内存，但是如果您确实从另一台计算机(例如，在桌面上格式化SD卡时)或即使在具有更多可用内存的同一台计算机上创建了LUKS设备，那么您现在可能就没有足够的内存了。我们只讨论RAM，在这种情况下不使用交换。

我建议用--pbkdf pbkdf2重新创建LUKS设备，以切换到“LUKS1中默认的”密钥派生函数PBKDF2，它不需要额外的内存。或者，您也可以使用--pbkdf-memory <num>来强制默认Argon2i的内存量更低。

Answer 2

除了上面的答案，我想在这里放弃这个。使用内存更多的机器，您可以通过以下方式减少对现有密钥的内存需求。内存需求以KB为单位。如果磁盘上已经有数据，这是有用的。

cryptsetup luksConvertKey --key-file /path/to/keyfile --pbkdf-memory=10240 /dev/<device>

Answer 3

系统“冻结”通常是由于运行了太多、太大的程序和可用内存不足造成的。使用free查看是否有交换空间，阅读man mkswap swapon fstab来创建一些。传统上，交换空间为1.5×RAM，而YMMV则是推荐的。如果您不打算休眠您的系统，您可以有少于1.0×RAM。