#1108201 fwupdmgr security reports unencrypted swap with plain dm-crypt'ed swap

Package:
fwupd
Source:
fwupd
Description:
Firmware update daemon
Submitter:
Huey Chen
Date:
2026-07-27 21:21:02 UTC
Severity:
normal
#1108201#5
Date:
2025-06-23 00:50:53 UTC
From:
To:
Dear Maintainer,

I have a swap partition that uses plain dm-crypt encryption with a random password as cannot be supported.
`/etc/crypttab`:
```
# <name>      <device>             <password>    <options>
cryptswap     PARTLABEL=cryptswap  /dev/urandom  swap,plain,cipher=aes-xts-plain64,size=512,sector-size=4096
```
However, running `fwupdmgr security` shows `✘ Linux swap:                    Unencrypted` even though it is encrypted, though it is not encrypted with LUKS2.
That should report that swap is encrypted when it is encrypted with plain dm-crypt.

Sincerely,
Huey Chen
#1108201#10
Date:
2025-06-23 01:27:40 UTC
From:
To:
This is currently expected behavior both in Debian and upstream fwupd.

It's tracked here:

https://github.com/fwupd/fwupd/issues/4969

It's looking for someone to help contribute patches.  If you have the
ability and interest in fixing this please work on it upstream and we'll
bring the solution into Debian after it's finished upstream.
#1108201#15
Date:
2025-06-23 01:27:40 UTC
From:
To:
This is currently expected behavior both in Debian and upstream fwupd.

It's tracked here:

https://github.com/fwupd/fwupd/issues/4969

It's looking for someone to help contribute patches.  If you have the
ability and interest in fixing this please work on it upstream and we'll
bring the solution into Debian after it's finished upstream.
#1108201#20
Date:
2026-07-27 21:18:48 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
fwupd, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1108201@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mario Limonciello <superm1@debian.org> (supplier of updated fwupd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 27 Jul 2026 16:00:45 -0500
Source: fwupd
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 2.1.7-1
Distribution: unstable
Urgency: medium
Maintainer: Debian EFI <debian-efi@lists.debian.org>
Changed-By: Mario Limonciello <superm1@debian.org>
Closes: 1108201 1137540 1139344 1141569 1141921 1141944 1142129
Changes:
 fwupd (2.1.7-1) unstable; urgency=medium
 .
   * New upstream version (2.1.7)
   * Merge packaging with upstream.
     - Update python package deps (Closes: #1141944)
     - Update shebang (Closes: #1141921)
     - Detects unencrypted swap in more situations (Closes: #1108201)
     - Don't show errors from fwupd-refresh.service (Closes: #1141569, #1139344)
     - Don't show warnings for version command (Closes: #1137540)
     - Fixes regression in d/control (Closes: #1142129)
Checksums-Sha1:
 625002ed8366b328b77b1dca52fc65d69772c48e 3557 fwupd_2.1.7-1.dsc
 2c70ac202d4e653871daf1ca2bdcaabacbeb061c 7127883 fwupd_2.1.7.orig.tar.gz
 0728b4e0407366f3c6656d8b044595788f741cb6 30464 fwupd_2.1.7-1.debian.tar.xz
 20fc5dbdee01492194e509dc00a810ee950915b2 17930 fwupd_2.1.7-1_source.buildinfo
Checksums-Sha256:
 27dea9e5322708f23b3b650b7373657061a4469d3d129016f7b8841d58fcc1f0 3557 fwupd_2.1.7-1.dsc
 338ea5b139f9a37447ff2215d0a8d2cf23851fb5a39fba7b1b0ded52a40240cc 7127883 fwupd_2.1.7.orig.tar.gz
 bd20a926e68c97102113859b19e59d734eabf70bbaae4c095608bdd46365b7dc 30464 fwupd_2.1.7-1.debian.tar.xz
 57894a4e76351b86fdf0780dae42f4cc27cc751803b785d45b256977870214ed 17930 fwupd_2.1.7-1_source.buildinfo
Files:
 d09229c8351bdfdbd0445340c0816403 3557 admin optional fwupd_2.1.7-1.dsc
 e113d1ffd2898bbccb6729ae7867f1d2 7127883 admin optional fwupd_2.1.7.orig.tar.gz
 70ea165c2509cdd34c28807b6a708cfb 30464 admin optional fwupd_2.1.7-1.debian.tar.xz
 092799c47af28c0731ad5e24658a50f2 17930 admin optional fwupd_2.1.7-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJHBAEBCgAxFiEECwtuSU6dXvs5GA2aLRkspiR3AnYFAmpnxx4THHN1cGVybTFA
ZGViaWFuLm9yZwAKCRAtGSymJHcCdkjgEACA68eqClkZ9zztkolVp5rvfVzSvsiL
uf32wnKcsnR/IUmylWrW8dDyrd2sJQqGXFaM7w5zpYGRdEpnu+8kvIOvxi304AyC
BtdAsxdH0UvU6wlYLzCjtF6hC0MWOBdv+SZaJdoDzUHxVvBGBibT3PJJplzBsUUu
u2JX5J3V90wu8+xYSACLT/AI5xVXlcQ6vBzSql9+O25zpUh84e2oNBbRk/unIQR8
xYFK1s3fYVX6HhgL+ODK+4qdyOimRfRGS8Smhe2J8NUQhovwPosyrA6mNo9ltiq9
FN9LMTDao4mf1bUypnPoatwBLj8E+rvM5VBOoV4ay4Li7XEPu/ppU8xxMdR11XBp
J/BYYHPkdI49Ki2Uacn8iKCkgifCVssDrxfMkyosxRdrLLHmt3SrL//kEsZ3Skq9
LpchKSyDJ2Imhq7htyigqVYUORbA/glW0/hNwmkJwLC2VC/PwaLJxnRsCbZ5WA6L
Y3RJV6SLETmx7OmLql8dS5yFG27lmMYrT/AeQTTYJ3To6mL/5+obQR7P1H2fJIqf
2KKbUU9fqnxrl2tzxhAFhuVpSkJDlWlZlg8cB3ZSrWge/oB2aApb0tJ55q6P4nKg
H9I7RdqvtB7qViBJ9HwTyTA6tygl+rq56Vl5K1RtQ6Iefz6kS5s1017DBYK7L4pa
ohIdJ9Jo00ofdg==
=lQaA
-----END PGP SIGNATURE-----