'\" t
.\"     Title: clevis-luks-bind
.\"    Author: [see the "AUTHOR(S)" section]
.\" Generator: Asciidoctor 1.5.8
.\"    Manual: \ \&
.\"    Source: \ \&
.\"  Language: English
.\"
.TH "CLEVIS\-LUKS\-BIND" "1" "" "\ \&" "\ \&"
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.ss \n[.ss] 0
.nh
.ad l
.de URL
\fI\\$2\fP <\\$1>\\$3
..
.als MTO URL
.if \n[.g] \{\
.  mso www.tmac
.  am URL
.    ad l
.  .
.  am MTO
.    ad l
.  .
.  LINKSTYLE blue R < >
.\}
.SH "NAME"
clevis\-luks\-bind \- Bind a LUKSv1 device using the specified policy
.SH "SYNOPSIS"
.sp
\fBclevis luks bind\fP [\-f] \-d DEV [\-s SLT] [\-k KEY] PIN CFG
.SH "OVERVIEW"
.sp
The \fBclevis luks bind\fP command binds a LUKSv1 device using the specified
policy. This is accomplished with a simple command:
.sp
.if n .RS 4
.nf
$ clevis luks bind \-d /dev/sda tang \(aq{"url":...}\(aq
.fi
.if n .RE
.sp
This command performs four steps:
.sp
.RS 4
.ie n \{\
\h'-04' 1.\h'+01'\c
.\}
.el \{\
.  sp -1
.  IP " 1." 4.2
.\}
Creates a new key with the same entropy as the LUKS master key.
.RE
.sp
.RS 4
.ie n \{\
\h'-04' 2.\h'+01'\c
.\}
.el \{\
.  sp -1
.  IP " 2." 4.2
.\}
Encrypts the new key with Clevis.
.RE
.sp
.RS 4
.ie n \{\
\h'-04' 3.\h'+01'\c
.\}
.el \{\
.  sp -1
.  IP " 3." 4.2
.\}
Stores the Clevis JWE in the LUKS header with LUKSMeta.
.RE
.sp
.RS 4
.ie n \{\
\h'-04' 4.\h'+01'\c
.\}
.el \{\
.  sp -1
.  IP " 4." 4.2
.\}
Enables the new key for use with LUKS.
.RE
.sp
This disk can now be unlocked with your existing password as well as with
the Clevis policy. You will additionally need to enable one or more of the
Clevis LUKS unlockers. See \c
.URL "clevis\-luks\-unlockers.7.adoc" "\fBclevis\-luks\-unlockers\fP(7)" "."
.SH "OPTIONS"
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.  sp -1
.  IP \(bu 2.3
.\}
\fB\-f\fP :
Do not prompt for LUKSMeta initialization
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.  sp -1
.  IP \(bu 2.3
.\}
\fB\-d\fP \fIDEV\fP :
The LUKS device on which to perform binding
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.  sp -1
.  IP \(bu 2.3
.\}
\fB\-s\fP \fISLT\fP :
The LUKSMeta slot to use for metadata storage
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.  sp -1
.  IP \(bu 2.3
.\}
\fB\-k\fP \fIKEY\fP :
Non\-interactively read LUKS password from KEY file
.RE
.sp
.RS 4
.ie n \{\
\h'-04'\(bu\h'+03'\c
.\}
.el \{\
.  sp -1
.  IP \(bu 2.3
.\}
\fB\-k\fP \- :
Non\-interactively read LUKS password from standard input
.RE
.SH "CAVEATS"
.sp
This command does not change the LUKS master key. This implies that if you
create a LUKS\-encrypted image for use in a Virtual Machine or Cloud
environment, all the instances that run this image will share a master key.
This is extremely dangerous and should be avoided at all cost.
.sp
This is not a limitation of Clevis but a design principle of LUKS. If you wish
to have encrypted root volumes in the cloud, you will need to make sure that
you perform the OS install method for each instance in the cloud as well.
The images cannot be shared without also sharing a master key.
.SH "SEE ALSO"
.sp
.URL "clevis\-luks\-unlockers.7.adoc" "\fBclevis\-luks\-unlockers\fP(7)" ","
.URL "clevis\-encrypt\-tang.1.adoc" "\fBclevis\-encrypt\-tang\fP(1)" ","
.URL "clevis\-encrypt\-sss.1.adoc" "\fBclevis\-encrypt\-sss\fP(1)" ","
.URL "clevis\-decrypt.1.adoc" "\fBclevis\-decrypt\fP(1)" ""