From: Daan De Meyer <daan@amutable.com>
Date: Fri, 3 Apr 2026 13:43:57 +0000 (+0000)
Subject: dissect-image: add crypto_LUKS and swap to blkid probe filter
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8f2ec658717bb3e43cd1a85b7313d60d1ba89c66;p=thirdparty%2Fsystemd.git

dissect-image: add crypto_LUKS and swap to blkid probe filter

allowed_fstypes() returns the list of filesystem types that we are
willing to mount. However, the blkid probe filter needs to detect
additional non-mountable types: crypto_LUKS (so that LUKS-encrypted
partitions can be identified and decrypted) and swap (so that swap
partitions can be identified).

Without these types in the BLKID_FLTR_ONLYIN filter, blkid reports
"No type detected" for encrypted and swap partitions, causing
image policy checks to fail (e.g. "encrypted was required") and
mount operations to fail with "File system type not supported".

Note that verity types (DM_verity_hash, verity_hash_signature) do
not need to be added here because their fstype is assigned directly
during partition table parsing, not via blkid probing.

Follow-up for e33eb053fb.
---

diff --git a/src/shared/dissect-image.c b/src/shared/dissect-image.c
index 2bef82dd34b..ef73b11014b 100644
--- a/src/shared/dissect-image.c
+++ b/src/shared/dissect-image.c
@@ -195,6 +195,13 @@ static int probe_blkid_filter(blkid_probe p) {
         if (r < 0)
                 return r;
 
+        /* allowed_fstypes() returns the list of filesystem types that we are willing to mount. For the
+         * blkid probe filter we additionally need to be able to detect crypto_LUKS (so that we can set up
+         * LUKS decryption for encrypted partitions) and swap (so that we can identify swap partitions). */
+        r = strv_extend_many(&fstypes, "crypto_LUKS", "swap");
+        if (r < 0)
+                return r;
+
         errno = 0;
         r = sym_blkid_probe_filter_superblocks_type(p, BLKID_FLTR_ONLYIN, fstypes);
         if (r != 0)