173 lines
6.4 KiB
Diff
173 lines
6.4 KiB
Diff
From bf5c53a33f36d15a87297d4492624d137c3cd9fa Mon Sep 17 00:00:00 2001
|
|
From: Harald Hoyer <harald@hoyer.xyz>
|
|
Date: Mon, 9 Oct 2017 12:51:29 +0200
|
|
Subject: [PATCH] Merge pull request #290 from privb0x23/luks-detached
|
|
|
|
Add basic LUKS detached header support
|
|
---
|
|
modules.d/90crypt/cryptroot-ask.sh | 20 ++++++++++++++++-
|
|
modules.d/90crypt/module-setup.sh | 46 ++++++++++++++++++++++++++++++--------
|
|
modules.d/90crypt/parse-crypt.sh | 33 ++++++++++++++++++++++++++-
|
|
3 files changed, 88 insertions(+), 11 deletions(-)
|
|
|
|
diff --git a/modules.d/90crypt/cryptroot-ask.sh b/modules.d/90crypt/cryptroot-ask.sh
|
|
index 5b513638..9f635eb3 100755
|
|
--- a/modules.d/90crypt/cryptroot-ask.sh
|
|
+++ b/modules.d/90crypt/cryptroot-ask.sh
|
|
@@ -29,13 +29,27 @@ if [ -f /etc/crypttab ] && getargbool 1 rd.luks.crypttab -d -n rd_NO_CRYPTTAB; t
|
|
continue
|
|
fi
|
|
|
|
+ # PARTUUID used in crypttab
|
|
+ if [ "${dev%%=*}" = "PARTUUID" ]; then
|
|
+ if [ "luks-${dev##PARTUUID=}" = "$luksname" ]; then
|
|
+ luksname="$name"
|
|
+ break
|
|
+ fi
|
|
+
|
|
# UUID used in crypttab
|
|
- if [ "${dev%%=*}" = "UUID" ]; then
|
|
+ elif [ "${dev%%=*}" = "UUID" ]; then
|
|
if [ "luks-${dev##UUID=}" = "$luksname" ]; then
|
|
luksname="$name"
|
|
break
|
|
fi
|
|
|
|
+ # ID used in crypttab
|
|
+ elif [ "${dev%%=*}" = "ID" ]; then
|
|
+ if [ "luks-${dev##ID=}" = "$luksname" ]; then
|
|
+ luksname="$name"
|
|
+ break
|
|
+ fi
|
|
+
|
|
# path used in crypttab
|
|
else
|
|
cdev=$(readlink -f $dev)
|
|
@@ -88,6 +102,10 @@ while [ $# -gt 0 ]; do
|
|
;;
|
|
allow-discards)
|
|
allowdiscards="--allow-discards"
|
|
+ ;;
|
|
+ header=*)
|
|
+ cryptsetupopts="${cryptsetupopts} --${1}"
|
|
+ ;;
|
|
esac
|
|
shift
|
|
done
|
|
diff --git a/modules.d/90crypt/module-setup.sh b/modules.d/90crypt/module-setup.sh
|
|
index 9c1be998..69aceaab 100755
|
|
--- a/modules.d/90crypt/module-setup.sh
|
|
+++ b/modules.d/90crypt/module-setup.sh
|
|
@@ -68,22 +68,50 @@ install() {
|
|
|
|
if [[ $hostonly ]] && [[ -f /etc/crypttab ]]; then
|
|
# filter /etc/crypttab for the devices we need
|
|
- while read _mapper _dev _rest || [ -n "$_mapper" ]; do
|
|
+ while read _mapper _dev _luksfile _luksoptions || [ -n "$_mapper" ]; do
|
|
[[ $_mapper = \#* ]] && continue
|
|
[[ $_dev ]] || continue
|
|
|
|
+ [[ $_dev == PARTUUID=* ]] && \
|
|
+ _dev="/dev/disk/by-partuuid/${_dev#PARTUUID=}"
|
|
+
|
|
[[ $_dev == UUID=* ]] && \
|
|
_dev="/dev/disk/by-uuid/${_dev#UUID=}"
|
|
|
|
- echo "$_dev $(blkid $_dev -s UUID -o value)" > /usr/lib/dracut/modules.d/90crypt/block_uuid.map
|
|
-
|
|
- for _hdev in "${!host_fs_types[@]}"; do
|
|
- [[ ${host_fs_types[$_hdev]} == "crypto_LUKS" ]] || continue
|
|
- if [[ $_hdev -ef $_dev ]] || [[ /dev/block/$_hdev -ef $_dev ]]; then
|
|
- echo "$_mapper $_dev $_rest"
|
|
- break
|
|
- fi
|
|
+ [[ $_dev == ID=* ]] && \
|
|
+ _dev="/dev/disk/by-id/${_dev#ID=}"
|
|
+
|
|
+ echo "$_dev $(blkid $_dev -s UUID -o value)" >> /usr/lib/dracut/modules.d/90crypt/block_uuid.map
|
|
+
|
|
+ # loop through the options to check for the force option
|
|
+ luksoptions=${_luksoptions}
|
|
+ OLD_IFS="${IFS}"
|
|
+ IFS=,
|
|
+ set -- ${luksoptions}
|
|
+ IFS="${OLD_IFS}"
|
|
+
|
|
+ while [ $# -gt 0 ]; do
|
|
+ case $1 in
|
|
+ force)
|
|
+ forceentry="yes"
|
|
+ break
|
|
+ ;;
|
|
+ esac
|
|
+ shift
|
|
done
|
|
+
|
|
+ # include the entry regardless
|
|
+ if [ "${forceentry}" = "yes" ]; then
|
|
+ echo "$_mapper $_dev $_luksfile $_luksoptions"
|
|
+ else
|
|
+ for _hdev in "${!host_fs_types[@]}"; do
|
|
+ [[ ${host_fs_types[$_hdev]} == "crypto_LUKS" ]] || continue
|
|
+ if [[ $_hdev -ef $_dev ]] || [[ /dev/block/$_hdev -ef $_dev ]]; then
|
|
+ echo "$_mapper $_dev $_luksfile $_luksoptions"
|
|
+ break
|
|
+ fi
|
|
+ done
|
|
+ fi
|
|
done < /etc/crypttab > $initdir/etc/crypttab
|
|
mark_hostonly /etc/crypttab
|
|
fi
|
|
diff --git a/modules.d/90crypt/parse-crypt.sh b/modules.d/90crypt/parse-crypt.sh
|
|
index 8a0db02b..f0a4fba9 100755
|
|
--- a/modules.d/90crypt/parse-crypt.sh
|
|
+++ b/modules.d/90crypt/parse-crypt.sh
|
|
@@ -35,6 +35,7 @@ else
|
|
echo 'ACTION!="add|change", GOTO="luks_end"'
|
|
} > /etc/udev/rules.d/70-luks.rules.new
|
|
|
|
+ SERIAL=$(getargs rd.luks.serial -d rd_LUKS_SERIAL)
|
|
LUKS=$(getargs rd.luks.uuid -d rd_LUKS_UUID)
|
|
tout=$(getarg rd.luks.key.tout)
|
|
|
|
@@ -44,7 +45,37 @@ else
|
|
done < /etc/crypttab
|
|
fi
|
|
|
|
- if [ -n "$LUKS" ]; then
|
|
+ if [ -n "$SERIAL" ]; then
|
|
+ for serialid in $SERIAL; do
|
|
+
|
|
+ serialid=${serialid##luks-}
|
|
+ if luksname=$(_cryptgetargsname "rd.luks.name=$serialid="); then
|
|
+ luksname="${luksname#$serialid=}"
|
|
+ else
|
|
+ luksname="luks-$serialid"
|
|
+ fi
|
|
+
|
|
+ if [ -z "$DRACUT_SYSTEMD" ]; then
|
|
+ {
|
|
+ printf -- 'ENV{ID_SERIAL_SHORT}=="*%s*", ' "$serialid"
|
|
+ printf -- 'RUN+="%s --settled --unique --onetime ' "$(command -v initqueue)"
|
|
+ printf -- '--name cryptroot-ask-%%k %s ' "$(command -v cryptroot-ask)"
|
|
+ printf -- '$env{DEVNAME} %s %s"\n' "$luksname" "$tout"
|
|
+ } >> /etc/udev/rules.d/70-luks.rules.new
|
|
+ else
|
|
+ luksname=$(dev_unit_name "$luksname")
|
|
+ if ! crypttab_contains "$serialid"; then
|
|
+ {
|
|
+ printf -- 'ENV{ID_SERIAL_SHORT}=="*%s*", ' "$serialid"
|
|
+ printf -- 'RUN+="%s --settled --unique --onetime ' "$(command -v initqueue)"
|
|
+ printf -- '--name systemd-cryptsetup-%%k %s start ' "$(command -v systemctl)"
|
|
+ printf -- 'systemd-cryptsetup@%s.service"\n' "$luksname"
|
|
+ } >> /etc/udev/rules.d/70-luks.rules.new
|
|
+ fi
|
|
+ fi
|
|
+ done
|
|
+
|
|
+ elif [ -n "$LUKS" ]; then
|
|
for luksid in $LUKS; do
|
|
|
|
luksid=${luksid##luks-}
|
|
|