Use lsblk instead of cryptsetup for the full-disk-encryption check

[smlx]

lsblk is part of util-linux and provides much more convenient JSON output for parsing compared to cryptsetup status. It is also a much safer command and requires fewer privileges.

For example, here's a check for "does the / partition use full disk encryption?":

lsblk -fJ | jq '.blockdevices[].children[] | select(.children) | select(.children[].mountpoints | index("/")) | .fstype == "crypto_LUKS"'

The other advantage of lsblk is that it allows sandboxing of the Kolide launcher to only allow access to "/" and disallow access to other sensitive mount points. Because it requires more permissions, cryptsetup fails in this kind of sandbox.

[directionless]

Thank you for the suggestion! We'll try to investigate whether using lsblk is suitable for our purposes here.

(Meanwhile, I'm closing this issue, as launcher exposes both already. But I've added a note in our backlog to evaluate this as a sql update)