Fedora 24 Critical: Calamares Keyfile Issue In Initramfs

Calamares is a distribution-independent installer framework, designed to install

from a live CD/DVD/USB environment to a hard disk. It includes a graphical

installation program based on Qt 5. This package includes the Calamares

framework and the required configuration files to produce a working replacement

for Anaconda's liveinst.

A security update that fixes Calamares bug CAL-405: When installing with a LUKS-encrypted `/` partition, Calamares was always creating a keyfile to decode `/` and storing it in the initramfs. It did that even with an unencrypted separate `/boot` partition. As a result, the keyfile would be stored in cleartext on the `/boot` partition, and it was possible to unlock the `/` partition without ever entering a passphrase. This completely defeated the security of LUKS. Please note that this only affects manual partitioning. The automatic partitioning never leaves `/boot` unencrypted (and it is, in fact, recommended to also always encrypt `/boot` when doing manual partitioning). This update fixes the `dracutlukscfg` module to not add the keyfile to `install_items` in the `dracut` configuration (so that `dracut` will not include it onto the initramfs) if `/boot` is separate and unencrypted.