luks: initial support for luks2 tokens

tested with fido2 token only. to disable set USE_LUKS_TOKEN=no

systemd fido2 and tpm2 tokens need dlopened libraries for respective
functionality (systemd avoids hard dependency on external deps)

diff --git a/mod-luks.sh b/mod-luks.sh
index 94b649954832e58035ac143a98d091f04b561201..468489afbb3c6d67bcefd941c34200b22b7b3bb2 100644 (file)
--- a/mod-luks.sh
+++ b/mod-luks.sh
@@ -117,7 +117,7 @@ luks_crypttab() {
        local LUKSNAME="$1"
 
        # copy from /etc/rc.d/init.d/cryptsetup
-       local dst src key opt mode owner failsafe
+       local dst src key opt mode owner failsafe token libdir cryptdir
 
        while read dst src key opt; do
                [ "$dst" != "$LUKSNAME" ] && continue
@@ -153,6 +153,33 @@ luks_crypttab() {
                                keyfile=/etc/.$dst.key
                                inst $key $keyfile
                        fi
+                       for libdir in $(get_libdir /usr/LIBDIR); do
+                               if [ -d $libdir/cryptsetup ]; then
+                                       cryptdir=$libdir/cryptsetup
+                                       break
+                               fi
+                       done
+                       if ! is_no "$USE_LUKS_TOKEN" && [ -n "$cryptdir" ]; then
+                               for token in $(/sbin/cryptsetup luksDump $src | sed -n -e '/^Tokens:/,/^[^[:space:]]/ { /^[[:space:]]*[[:digit:]]*:/ { s/^[[:space:]]*[[:digit:]]*:[[:space:]]*// p } }'); do
+                                       verbose "Found cryptsetup token: $token"
+                                       case "$token" in
+                                               systemd-fido2)
+                                                       inst_d $cryptdir
+                                                       inst_exec $cryptdir/libcryptsetup-token-$token.so $cryptdir
+                                                       inst_exec $libdir/libfido2.so.1 $libdir
+                                                       ;;
+                                               systemd-tpm2)
+                                                       inst_d $cryptdir
+                                                       inst_exec $cryptdir/libcryptsetup-token-$token.so $cryptdir
+                                                       inst_exec $libdir/libtss2-esys.so.0 $libdir/libtss2-rc.so.0 $libdir/libtss2-mu.so.0 $libdir
+                                                       ;;
+                                               *)
+                                                       inst_d $cryptdir
+                                                       inst_exec $cryptdir/libcryptsetup-token-$token.so $cryptdir
+                                                       ;;
+                                       esac
+                               done
+                       fi
 
                        crypttab_opt=""
                        old_IFS="$IFS"