From 94404a17a1e89284acd7d116d6d6bda4c353323b Mon Sep 17 00:00:00 2001 From: Petr Bokoc Date: May 23 2019 09:16:35 +0000 Subject: 292 - libcrypt.so.1 changes --- diff --git a/modules/release-notes/pages/sysadmin/Security.adoc b/modules/release-notes/pages/sysadmin/Security.adoc index cb3318f..17d42fb 100644 --- a/modules/release-notes/pages/sysadmin/Security.adoc +++ b/modules/release-notes/pages/sysadmin/Security.adoc @@ -17,3 +17,11 @@ LUKS2 is an evolution of the standard that enables new features such as the Argo LUKS1 continues to be supported. Note that older boot media (Fedora 27 and earlier) do not provide a version of cryptsetup that can unlock LUKS2-encrypted volumes. This means a Fedora 27 or earlier installation ISO can not be used to rescue a system with LUKS2 encryption. + +== Changes to libcrypt.so.1 + +The version of the `libcrypt.so.1` library included with Fedora 30 for POSIX compatibility has entirely removed the functionality of the `encrypt`, `encrypt_r`, `setkey`, `setkey_r`, and `fcrypt` functions, while keeping fully binary compatibility with existing (third party) applications possibly still using those functions. If such an application attempts to call one of these functions, the corresponding function will indicate that it is not supported by the system in a POSIX-compliant way. + +For security reasons, the `encrypt{,r}` functions will also overwrite their data-block argument with random bits. + +All existing binary executables linked against glibc's `libcrypt` should work unmodified with this version of the `libcrypt.so.1` library supplied by the `libxcrypt-compat` package.