From 4f74a4ac01a1b6506b1216c3b9ef4106915ca82d Mon Sep 17 00:00:00 2001 From: Valentin David Date: Wed, 7 Oct 2026 15:48:32 +0200 Subject: [PATCH] luks2: allow discard on activated containers Disabling discard uses up solid-state hardware and does not have that much benefits security-wise. --- internal/luks2/activate.go | 2 +- internal/luks2/activate_test.go | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/internal/luks2/activate.go b/internal/luks2/activate.go index fac74641..87dc2a0d 100644 --- a/internal/luks2/activate.go +++ b/internal/luks2/activate.go @@ -42,7 +42,7 @@ func Activate(volumeName, sourceDevicePath string, key []byte, slot int) error { // read key from stdin "/dev/stdin", // hardcode luks, one try and specify the keyslot to use - fmt.Sprintf("luks,keyslot=%d,tries=1", slot)) + fmt.Sprintf("luks,keyslot=%d,tries=1,discard", slot)) cmd.Env = os.Environ() cmd.Env = append(cmd.Env, "SYSTEMD_LOG_TARGET=console") cmd.Stdin = bytes.NewReader(key) diff --git a/internal/luks2/activate_test.go b/internal/luks2/activate_test.go index 89543037..85c7f249 100644 --- a/internal/luks2/activate_test.go +++ b/internal/luks2/activate_test.go @@ -96,7 +96,7 @@ func (s *activateSuite) testActivate(c *C, data *testActivateData) { c.Assert(s.mockSdCryptsetup.Calls(), HasLen, 1) c.Assert(s.mockSdCryptsetup.Calls()[0], HasLen, 6) - c.Check(s.mockSdCryptsetup.Calls()[0], DeepEquals, []string{"systemd-cryptsetup", "attach", data.volumeName, data.sourceDevicePath, "/dev/stdin", fmt.Sprintf("luks,keyslot=%d,tries=1", data.slot)}) + c.Check(s.mockSdCryptsetup.Calls()[0], DeepEquals, []string{"systemd-cryptsetup", "attach", data.volumeName, data.sourceDevicePath, "/dev/stdin", fmt.Sprintf("luks,keyslot=%d,tries=1,discard", data.slot)}) } func (s *activateSuite) TestActivate(c *C) { @@ -136,7 +136,7 @@ func (s *activateSuite) TestActivateWrongKey(c *C) { c.Assert(s.mockSdCryptsetup.Calls(), HasLen, 1) c.Assert(s.mockSdCryptsetup.Calls()[0], HasLen, 6) - c.Check(s.mockSdCryptsetup.Calls()[0], DeepEquals, []string{"systemd-cryptsetup", "attach", "data", "/dev/sda1", "/dev/stdin", "luks,keyslot=-1,tries=1"}) + c.Check(s.mockSdCryptsetup.Calls()[0], DeepEquals, []string{"systemd-cryptsetup", "attach", "data", "/dev/sda1", "/dev/stdin", "luks,keyslot=-1,tries=1,discard"}) } func (s *activateSuite) TestDeactivate(c *C) {