mod-luks.sh

   1 #!/bin/sh
   2 # geninitrd mod: cryptsetup luks
   3 USE_LUKS=${USE_LUKS:-yes}
   4
   5 # true if root device is crypted with cryptsetup luks
   6 # and we should init cryptsetup luks at boot
   7 have_luks=no
   8
   9 # device to use for name for cryptsetup luks
  10 LUKSNAME=""
  11
  12 # setup geninitrd module
  13 # @access       public
  14 setup_mod_luks() {
  15         cryptsetup=$(find_tool $initrd_dir/cryptsetup /sbin/cryptsetup-initrd)
  16
  17         if [ ! -x /sbin/cryptsetup ] || [ ! -x "$cryptsetup" ]; then
  18                 USE_LUKS=no
  19         fi
  20 }
  21
  22 # return true if node is cryptsetup luks encrypted
  23 # @param        string $node device node to be examined
  24 # @access       public
  25 is_luks() {
  26         local node="$1"
  27
  28         # luks not wanted
  29         if is_no "$USE_LUKS"; then
  30                 return 1
  31         fi
  32
  33         local dev dm_name=${node#/dev/mapper/}
  34         if [ "$node" = "$dm_name" ]; then
  35                 verbose "is_luks: $node is not device mapper name"
  36                 return 1
  37         fi
  38
  39         dev=$(awk -vdm_name="$dm_name" '$1 == dm_name { print $2 }' /etc/crypttab)
  40         if [ "$dev" ]; then
  41                 dev=$(find_devname "$dev")
  42                 /sbin/cryptsetup isLuks $dev
  43                 rc=$?
  44         else
  45                 rc=1
  46         fi
  47
  48         if [ $rc = 0 ]; then
  49                 verbose "is_luks: $node is cryptsetup luks"
  50         else
  51                 verbose "is_luks: $node is not cryptsetup luks"
  52         fi
  53         return $rc
  54 }
  55
  56 # find modules for $devpath
  57 # @param        $devpath        device to be examined
  58 # @access       public
  59 find_modules_luks() {
  60         local devpath="$1"
  61         local dev=""
  62
  63         LUKSNAME=${devpath#/dev/mapper/}
  64
  65         find_module "dm-crypt"
  66
  67         # TODO: autodetect
  68         find_module "-aes"
  69         find_module "-cbc"
  70         find_module "-cbc(aes)"
  71         find_module "-xts(aes)"
  72         find_module "-af-alg"
  73         find_module "-algif_hash"
  74         find_module "-algif_skcipher"
  75         find_module "-loop"
  76
  77         # recurse
  78         dev=$(awk -vLUKSNAME="$LUKSNAME" '$1 == LUKSNAME { print $2 }' /etc/crypttab)
  79         if [ -n "$dev" ]; then
  80                 dev=$(find_devname "$dev")
  81                 find_modules_for_devpath $dev
  82                 have_luks=yes
  83         else
  84                 die "Cannot find '$LUKSNAME' in /etc/crypttab"
  85         fi
  86 }
  87
  88
  89 # generate initrd fragment for cryptsetup luks init
  90 # @access       public
  91 initrd_gen_luks() {
  92         if ! is_yes "$have_luks"; then
  93                 return
  94         fi
  95
  96         inst_d /bin
  97         inst_exec $cryptsetup /bin/cryptsetup
  98         inst_d /var/run/cryptsetup
  99
 100         mount_dev
 101         mount_sys
 102         initrd_gen_devices
 103         # TODO: 'udevadm settle' is called by lukssetup, is udev optional?
 104
 105         verbose "luks: process /etc/crypttab $LUKSNAME"
 106         luks_crypttab $LUKSNAME
 107 }
 108
 109
 110 # PRIVATE METHODS
 111 key_is_random() {
 112         [ "$1" = "/dev/urandom" -o "$1" = "/dev/hw_random" -o "$1" = "/dev/random" ]
 113 }
 114
 115 # produce cryptsetup from $name from /etc/crypttab
 116 luks_crypttab() {
 117         local LUKSNAME="$1"
 118
 119         # copy from /etc/rc.d/init.d/cryptsetup
 120         local dst src key opt mode owner failsafe
 121
 122         while read dst src key opt; do
 123                 [ "$dst" != "$LUKSNAME" ] && continue
 124
 125                 failsafe=""
 126
 127                 if [ -z "$key" ] || [ "x$key" = "xnone" ] || [ "x$key" = "x-" ]; then
 128                         failsafe=1
 129                         key="/etc/cryptsetup-keys.d/$LUKSNAME.key"
 130                 fi
 131
 132                 if test -e "$key" ; then
 133                         mode=$(LC_ALL=C ls -l "$key" | cut -c 5-10)
 134                         owner=$(LC_ALL=C ls -l $key | awk '{ print $3 }')
 135                         if [ "$mode" != "------" ] && ! key_is_random "$key"; then
 136                                 die "INSECURE MODE FOR $key"
 137                         fi
 138                         if [ "$owner" != root ]; then
 139                                 die "INSECURE OWNER FOR $key"
 140                         fi
 141                 elif [ -n "$failsafe" ]; then
 142                         key=""
 143                 else
 144                         die "Key file for $dst not found"
 145                 fi
 146
 147                 src=$(find_devname "$src")
 148                 if /sbin/cryptsetup isLuks "$src" 2>/dev/null; then
 149                         if key_is_random "$key"; then
 150                                 die "$dst: LUKS requires non-random key, skipping"
 151                         fi
 152                         if [ "$key" ]; then
 153                                 keyfile=/etc/.$dst.key
 154                                 inst $key $keyfile
 155                         fi
 156
 157                         crypttab_opt=""
 158                         old_IFS="$IFS"
 159                         IFS=","
 160                         for option in $opt; do
 161                                 case "$option" in
 162                                         discard|allow-discards)
 163                                                 crypttab_opt="$crypttab_opt --allow-discards"
 164                                                 ;;
 165                                         *)
 166                                                 warn "$dst: option \'$opt\' is invalid for LUKS partitions, ignored"
 167                                                 ;;
 168                                 esac
 169                         done
 170                         IFS="$old_IFS"
 171
 172                         verbose "+ cryptsetup ${keyfile:+-d $keyfile} open $crypttab_opt '$src' '$dst'"
 173                         add_linuxrc <<-EOF
 174                         debugshell
 175
 176                         cryptsetup_opt=""
 177                         if [ "\$DEBUGINITRD" ]; then
 178                                 cryptsetup_opt="--debug"
 179                         fi
 180                         # cryptsetup can be called twice and in case on crypt on lvm only second
 181                         # will succeed because there will be no src device in first cryptsetup call
 182                         # this can be called multiple times, before lvm and after lvm.
 183                         luksdev='$src'
 184                         if [ \${luksdev##/dev/disk/by-uuid/} != \${luksdev} ]; then
 185                                 src_uuid=\${luksdev##/dev/disk/by-uuid/}
 186                                 while read x y z name; do
 187                                         found_uuid=\$(cryptsetup \$cryptsetup_opt luksUUID /dev/\${name} 2>/dev/null)
 188                                         if [ "\$found_uuid" = "\$src_uuid" ]; then
 189                                                 luksdev=/dev/\$name
 190                                                 break
 191                                         fi
 192                                 done < /proc/partitions
 193                         fi
 194
 195                         if [ -e "\$luksdev" ]; then
 196                                 crypt_status=\$(cryptsetup \$cryptsetup_opt status '$dst')
 197                                 if [ "\${crypt_status%%is inactive*}" != "\$crypt_status" ]; then
 198                                         # is inactive
 199                                         cryptsetup \$cryptsetup_opt ${keyfile:+-d $keyfile} open $crypttab_opt "\$luksdev" '$dst' <&1
 200                                 fi
 201                         fi
 202
 203                         debugshell
 204                         EOF
 205                 else
 206                         die "$dst: only LUKS encryption supported"
 207                 fi
 208         done < /etc/crypttab
 209 }