Fallback detection if device is crypted.

[projects/geninitrd.git] / mod-luks.sh

#!/bin/sh
LUKS_RCSID='$Revision$ $Date::                            $'

# geninitrd mod: cryptsetup luks
USE_LUKS=${USE_LUKS:-yes}

# true if root device is crypted with cryptsetup luks
# and we should init cryptsetup luks at boot
have_luks=no

# device to use for name for cryptsetup luks
LUKSDEV=""

# setup geninitrd module
# @access	public
setup_mod_luks() {
	cryptsetup=$(find_tool $initrd_dir/cryptsetup /sbin/cryptsetup-initrd)

	if [ ! -x /sbin/cryptsetup ] || [ ! -x "$cryptsetup" ]; then
		USE_LUKS=no
	fi
}

# return true if node is cryptsetup luks encrypted
# @param	string $node device node to be examined
# @access	public
is_luks() {
	local node="$1"

	# luks not wanted
	if is_no "$USE_LUKS"; then
		return 1
	fi

	if [ ! -e "$node" ]; then
		warn "is_luks(): node $node doesn't exist!"
		return 1
	fi

	local dev dm_status dm_name=${node#/dev/mapper/}
	if [ "$node" = "$dm_name" ]; then
		debug "is_luks: $node is not device mapper name"
		return 1
	fi

	dev=$(/sbin/cryptsetup status $dm_name 2>/dev/null | awk '/device:/{print $2}')
	if [ "$dev" ]; then
		/sbin/cryptsetup isLuks $dev
		rc=$?
	else
		# If luks partition was activated using old cryptsetup (at initrd level)
		# then "device:" report could be missing from cryptsetup status above.
		# Fallback to dmsetup report in such case.
		dm_status=$(/sbin/dmsetup status --target crypt $dm_name 2>/dev/null)
		if [ -n "$dm_status" ]; then
			rc=0
		else
			rc=1
		fi
	fi

	if [ $rc = 0 ]; then
		debug "is_luks: $node is cryptsetup luks"
	else
		debug "is_luks: $node is not cryptsetup luks"
	fi
	return $rc
}

# find modules for $devpath
# @param	$devpath	device to be examined
# @access	public
find_modules_luks() {
	local devpath="$1"
	local dev

	local name=${devpath#/dev/mapper/}
	LUKSDEV=$(/sbin/cryptsetup status $name 2>/dev/null | awk '/device:/{print $2}')
	if [ -z "$LUKSDEV" ]; then
		die "Lost cryptsetup device meanwhile?"
	fi

	find_module "dm-crypt"

	# TODO: autodetect
	find_module "aes"
	find_module "cbc"

	have_luks=yes

	# recurse
	find_modules_for_devpath $LUKSDEV
}


# generate initrd fragment for cryptsetup luks init
# @access	public
initrd_gen_luks() {
	if ! is_yes "$have_luks"; then
		return
	fi

	inst_d /bin
	inst_exec $cryptsetup /bin/cryptsetup

	mount_dev
	mount_sys
	initrd_gen_devices
	# TODO: 'udevadm settle' is called by lukssetup, is udev optional?

	debug "luks: process /etc/crypttab $LUKSDEV"
	luks_crypttab $LUKSDEV
}


# PRIVATE METHODS
key_is_random() {
	[ "$1" = "/dev/urandom" -o "$1" = "/dev/hw_random" -o "$1" = "/dev/random" ]
}

# produce cryptsetup from $name from /etc/crypttab
luks_crypttab() {
	local LUKSDEV="$1"

	# copy from /etc/rc.d/init.d/cryptsetup
	local dst src key opt mode owner

	while read dst src key opt; do
		[ -z "$dst" -o "${dst#\#}" != "$dst" ] && continue
		[ "$src" != "$LUKSDEV" ] && [ "$(readlink -f $src)" != "$LUKSDEV" ] && continue

		if [ -n "$key" -a "x$key" != "xnone" ]; then
			if test -e "$key" ; then
				mode=$(LC_ALL=C ls -l "$key" | cut -c 5-10)
				owner=$(LC_ALL=C ls -l $key | awk '{ print $3 }')
				if [ "$mode" != "------" ] && ! key_is_random "$key"; then
					die "INSECURE MODE FOR $key"
				fi
				if [ "$owner" != root ]; then
					die "INSECURE OWNER FOR $key"
				fi
			else
				die "Key file for $dst not found"
			fi
		else
			key=""
		fi

		if /sbin/cryptsetup isLuks "$src" 2>/dev/null; then
			if key_is_random "$key"; then
				die "$dst: LUKS requires non-random key, skipping"
			fi
			if [ -n "$opt" ]; then
				warn "$dst: options are invalid for LUKS partitions, ignoring them"
			fi
			if [ "$key" ]; then
				keyfile=/etc/.$dst.key
				inst $key $keyfile
			fi

			debug "+ cryptsetup ${keyfile:+-d $keyfile} luksOpen '$src' '$dst'"
			add_linuxrc <<-EOF
			# cryptsetup can be called twice and in case on crypt on lvm only second
			# will succeed because there will be no src device in first cryptsetup call
			# this can be called multiple times, before lvm and after lvm.
			luksdev='$src'
			if [ \${luksdev##/dev/disk/by-uuid/} != \${luksdev} ]; then
			        src_uuid=\${luksdev##/dev/disk/by-uuid/}
			        while read x y z name; do
			                found_uuid=\$(cryptsetup luksUUID /dev/\${name} 2>/dev/null)
			                if [ "\$found_uuid" = "\$src_uuid" ]; then
			                        luksdev=/dev/\$name
			                        break
			                fi
			        done < /proc/partitions
			fi

			if [ -e "\$luksdev" ]; then
				crypt_status=\$(cryptsetup status '$dst')
				if [ "\${crypt_status%%is inactive.}" != "\$crypt_status" ]; then
					# is inactive
					cryptsetup ${keyfile:+-d $keyfile} luksOpen "\$luksdev" '$dst' <&1
				fi
			fi

			debugshell
			EOF
		else
			die "$dst: only LUKS encryption supported"
		fi
	done < /etc/crypttab
}