blob: 4d5f01e4727ce4348ec389bcc4a2d219131ec8ff (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
|
#!/sbin/openrc-run
# Copyright 1999-2015 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Id$
depend() {
before checkfs fsck
if grep -qs ^swap= "${conf_file}" ; then
before swap
fi
}
# We support multiple dmcrypt instances based on $SVCNAME
conf_file="/etc/conf.d/${SVCNAME}"
# Get splash helpers if available.
if [ -e /sbin/splash-functions.sh ] ; then
. /sbin/splash-functions.sh
fi
# Setup mappings for an individual target/swap
# Note: This relies on variables localized in the main body below.
dm_crypt_execute() {
local dev ret mode foo
if [ -z "${target}" -a -z "${swap}" ] ; then
return
fi
# Set up default values.
: ${dmcrypt_key_timeout:=1}
: ${dmcrypt_max_timeout:=300}
: ${dmcrypt_retries:=5}
# Handle automatic look up of the source path.
if [ -z "${source}" -a -n "${loop_file}" ] ; then
source=$(losetup --show -f "${loop_file}")
fi
case ${source} in
*=*)
source=$(blkid -l -t "${source}" -o device)
;;
esac
if [ -z "${source}" ] || [ ! -e "${source}" ] ; then
ewarn "source \"${source}\" for ${target} missing, skipping..."
return
fi
if [ -n "${target}" ] ; then
# let user set options, otherwise leave empty
: ${options:=' '}
elif [ -n "${swap}" ] ; then
if cryptsetup isLuks ${source} 2>/dev/null ; then
ewarn "The swap you have defined is a LUKS partition. Aborting crypt-swap setup."
return
fi
target=${swap}
# swap contents do not need to be preserved between boots, luks not required.
# suspend2 users should have initramfs's init handling their swap partition either way.
: ${options:='-c aes -h sha1 -d /dev/urandom'}
: ${pre_mount:='mkswap ${dev}'}
fi
if [ -n "${loop_file}" ] ; then
dev="/dev/mapper/${target}"
ebegin " Setting up loop device ${source}"
losetup ${source} ${loop_file}
fi
# cryptsetup:
# open <device> <name> # <device> is $source
# create <name> <device> # <name> is $target
local arg1="create" arg2="${target}" arg3="${source}"
if cryptsetup isLuks ${source} 2>/dev/null ; then
arg1="open"
arg2="${source}"
arg3="${target}"
fi
# Older versions reported:
# ${target} is active:
# Newer versions report:
# ${target} is active[ and is in use.]
if cryptsetup status ${target} | egrep -q ' is active' ; then
einfo "dm-crypt mapping ${target} is already configured"
return
fi
splash svc_input_begin ${SVCNAME} >/dev/null 2>&1
# Handle keys
if [ -n "${key}" ] ; then
read_abort() {
# some colors
local ans savetty resettty
[ -z "${NORMAL}" ] && eval $(eval_ecolors)
einfon " $1? (${WARN}yes${NORMAL}/${GOOD}No${NORMAL}) "
shift
# This is ugly as s**t. But POSIX doesn't provide `read -t`, so
# we end up having to implement our own crap with stty/etc...
savetty=$(stty -g)
resettty='stty ${savetty}; trap - EXIT HUP INT TERM'
trap 'eval "${resettty}"' EXIT HUP INT TERM
stty -icanon
stty min 0 time "$(( $2 * 10 ))"
ans=$(dd count=1 bs=1 2>/dev/null) || ans=''
eval "${resettty}"
if [ -z "${ans}" ] ; then
printf '\r'
else
echo
fi
case ${ans} in
[yY]) return 0;;
*) return 1;;
esac
}
# Notes: sed not used to avoid case where /usr partition is encrypted.
mode=${key##*:} && ( [ "${mode}" = "${key}" ] || [ -z "${mode}" ] ) && mode=reg
key=${key%:*}
case "${mode}" in
gpg|reg)
# handle key on removable device
if [ -n "${remdev}" ] ; then
# temp directory to mount removable device
local mntrem="${RC_SVCDIR}/dm-crypt-remdev.$$"
if [ ! -d "${mntrem}" ] ; then
if ! mkdir -p "${mntrem}" ; then
ewarn "${source} will not be decrypted ..."
einfo "Reason: Unable to create temporary mount point '${mntrem}'"
return
fi
fi
i=0
einfo "Please insert removable device for ${target}"
while [ ${i} -lt ${dmcrypt_max_timeout} ] ; do
foo=""
if mount -n -o ro "${remdev}" "${mntrem}" 2>/dev/null >/dev/null ; then
# keyfile exists?
if [ ! -e "${mntrem}${key}" ] ; then
umount -n "${mntrem}"
rmdir "${mntrem}"
einfo "Cannot find ${key} on removable media."
read_abort "Abort" ${dmcrypt_key_timeout} && return
else
key="${mntrem}${key}"
break
fi
else
[ -e "${remdev}" ] \
&& foo="mount failed" \
|| foo="mount source not found"
fi
: $((i += 1))
read_abort "Stop waiting after $i attempts (${foo})" -t 1 && return
done
else # keyfile ! on removable device
if [ ! -e "${key}" ] ; then
ewarn "${source} will not be decrypted ..."
einfo "Reason: keyfile ${key} does not exist."
return
fi
fi
;;
*)
ewarn "${source} will not be decrypted ..."
einfo "Reason: mode ${mode} is invalid."
return
;;
esac
else
mode=none
fi
ebegin " ${target} using: ${options} ${arg1} ${arg2} ${arg3}"
if [ "${mode}" = "gpg" ] ; then
: ${gpg_options:='-q -d'}
# gpg available ?
if command -v gpg >/dev/null ; then
i=0
while [ ${i} -lt ${dmcrypt_retries} ] ; do
# paranoid, don't store key in a variable, pipe it so it stays very little in ram unprotected.
# save stdin stdout stderr "values"
timeout ${dmcrypt_max_timeout} gpg ${gpg_options} ${key} 2>/dev/null | \
cryptsetup --key-file - ${options} ${arg1} ${arg2} ${arg3}
ret=$?
# The timeout command exits 124 when it times out.
[ ${ret} -eq 0 -o ${ret} -eq 124 ] && break
: $(( i += 1 ))
done
eend ${ret} "failure running cryptsetup"
else
ewarn "${source} will not be decrypted ..."
einfo "Reason: cannot find gpg application."
einfo "You have to install app-crypt/gnupg first."
einfo "If you have /usr on its own partition, try copying gpg to /bin ."
fi
else
if [ "${mode}" = "reg" ] ; then
cryptsetup ${options} -d ${key} ${arg1} ${arg2} ${arg3}
ret=$?
eend ${ret} "failure running cryptsetup"
else
cryptsetup ${options} ${arg1} ${arg2} ${arg3}
ret=$?
eend ${ret} "failure running cryptsetup"
fi
fi
if [ -d "${mntrem}" ] ; then
umount -n ${mntrem} 2>/dev/null >/dev/null
rmdir ${mntrem} 2>/dev/null >/dev/null
fi
splash svc_input_end ${SVCNAME} >/dev/null 2>&1
if [ ${ret} -ne 0 ] ; then
cryptfs_status=1
else
if [ -n "${pre_mount}" ] ; then
dev="/dev/mapper/${target}"
eval ebegin \"" pre_mount: ${pre_mount}"\"
eval "${pre_mount}" > /dev/null
ewend $? || cryptfs_status=1
fi
fi
}
# Lookup optional bootparams
get_bootparam_val() {
# We're given something like:
# foo=bar=cow
# Return the "bar=cow" part.
case $1 in
*=*)
echo "${1#*=}"
;;
esac
}
start() {
local header=true cryptfs_status=0
local gpg_options key loop_file target targetline options pre_mount post_mount source swap remdev
local x
for x in $(cat /proc/cmdline) ; do
case "${x}" in
key_timeout=*)
dmcrypt_key_timeout=$(get_bootparam_val "${x}")
;;
esac
done
while read targetline <&3 ; do
case ${targetline} in
# skip comments and blank lines
""|"#"*) continue ;;
# skip service-specific openrc configs #377927
rc_*) continue ;;
esac
${header} && ebegin "Setting up dm-crypt mappings"
header=false
# check for the start of a new target/swap
case ${targetline} in
target=*|swap=*)
# If we have a target queued up, then execute it
dm_crypt_execute
# Prepare for the next target/swap by resetting variables
unset gpg_options key loop_file target options pre_mount post_mount source swap remdev
;;
gpg_options=*|remdev=*|key=*|loop_file=*|options=*|pre_mount=*|post_mount=*|source=*)
if [ -z "${target}${swap}" ] ; then
ewarn "Ignoring setting outside target/swap section: ${targetline}"
continue
fi
;;
dmcrypt_*=*)
# ignore global options
continue
;;
*)
ewarn "Skipping invalid line in ${conf_file}: ${targetline}"
;;
esac
# Queue this setting for the next call to dm_crypt_execute
eval "${targetline}"
done 3< ${conf_file}
# If we have a target queued up, then execute it
dm_crypt_execute
ewend ${cryptfs_status} "Failed to setup dm-crypt devices"
}
stop() {
local line header
# Break down all mappings
header=true
egrep "^(target|swap)=" ${conf_file} | \
while read line ; do
${header} && einfo "Removing dm-crypt mappings"
header=false
target= swap=
eval ${line}
[ -n "${swap}" ] && target=${swap}
if [ -z "${target}" ] ; then
ewarn "invalid line in ${conf_file}: ${line}"
continue
fi
ebegin " ${target}"
cryptsetup remove ${target}
eend $?
done
# Break down loop devices
header=true
grep '^source=./dev/loop' ${conf_file} | \
while read line ; do
${header} && einfo "Detaching dm-crypt loop devices"
header=false
source=
eval ${line}
ebegin " ${source}"
losetup -d "${source}"
eend $?
done
return 0
}
|