On 07/22/2015 03:46 PM, Karol Babioch wrote: > Hi list, > > I'm wondering how safe it is to specify a device size when re-encrypting > a block device using cryptsetup-reencrypt. In particular I would like to > know if specifying a size smaller than the underlying block device might > actually corrupt data? It may corrupt data just if used wrongly. 1) if you have already LUKS there (and you are not increasing header size) the --device-size <X> says to perform reencryption only for <X> data size. If <X> is too small, it will keep part of data not reencrypted, IOW destroys that not reencrypted part practically. 2) If adding new LUKS encryption the --reduce-device-size <X> will shift data to create <X> sized space for header and keyslots (IOW always destroys <X> area in the end of device). (Be sure which units you are using, it can do both - SI or 1024 based, see man page). > The man page mentions some warnings in regards to this option. In our > use case the underlying block device is ~ 100G, while only 11G are > actually used by filesystems on top of the block device. To speed things > up we were thinking about a device size, e.g. something like 16G, so not > the whole device needs to be re-encrypted. If there is already LUKS you should be ok this way. Anyway, better test it first on some other disk. (We had installation which used similar approach with layered LVM, it had small LV which was reencrypted and then resized to cover full disk.) > I'm not familiar enough with the LUKS internals, but I'm pretty sure > that it is not filesystem aware, so it will only reencrypt the first > 16GB of the device, while LVM and any filesystems may actually put data > anywhere on the device. You do not need LUKS internals at all. For LVM you can use pvmove to "defragment" area, but it is very tricky sometimes (if extents are moved on the same PV device). In LVM use "pvs -o+devices" to quickly check which area LVM uses (number in bracket is starting extent for the given segment, it should be 0 if it is really in the beginning of PV). > So am I right in assuming that providing a device size smaller than the > actual block device size might lead to data corruption or is it safe to > use it in the way described above? It should be problematic only if it is smaller than really used area. (It is nothing more than just stop reencryption after specified size.) But anyway, I would suggest to reencrypt whole 100G, it is not so big and you will have wiped all resident plaintext data in unused area this way. Milan _______________________________________________ dm-crypt mailing list dm-crypt@xxxxxxxx http://www.saout.de/mailman/listinfo/dm-crypt
