- fix die() stderr redirection

[projects/geninitrd.git] / mod-luks.sh

#!/bin/sh
#
# geninitrd mod: cryptsetup luks

# true if root device is crypted with cryptsetup luks
# and we should init cryptsetup luks at boot
have_luks=no

if [ -x /sbin/cryptsetup ]; then
	USE_LUKS=yes
else
	USE_LUKS=no
fi

# device to use for name for cryptsetup luks
LUKSDEV=""

# return true if node is cryptsetup luks encrypted
# @param	string $node device node to be examined
# @access	public
is_luks() {
	local node="$1"

	# luks not wanted
	if is_no "$USE_LUKS"; then
		return 1
	fi

	if [ ! -e "$node" ]; then
		warn "is_luks(): node $node doesn't exist!"
		return 1
	fi

	local dev dm_name=${node#/dev/mapper/}
	if [ "$node" = "$dm_name" ]; then
		debug "is_luks: $node is not device mapper name"
		return 1
	fi

	dev=$(cryptsetup status $dm_name 2>/dev/null | awk '/device:/{print $2}')
	/sbin/cryptsetup isLuks $dev
	rc=$?

	if [ $rc = 0 ]; then
		debug "is_luks: $node is cryptsetup luks"
	else
		debug "is_luks: $node is not cryptsetup luks"
	fi
	return $rc
}

# find modules for $devpath
# @param	$devpath	device to be examined
# @access	public
find_modules_luks() {
	local devpath="$1"
	local dev

	local name=${devpath#/dev/mapper/}
	LUKSDEV=$(/sbin/cryptsetup status $name 2>/dev/null | awk '/device:/{print $2}')
	if [ -z "$LUKSDEV" ]; then
		die "Lost cryptsetup device meanwhile?"
	fi

	findmodule "dm-crypt"

	# TODO: autodetect
	findmodule "aes"
	findmodule "cbc"

	have_luks=yes

	# recurse
	find_modules_for_devpath $LUKSDEV
}


# generate initrd fragment for cryptsetup luks init
# @access	public
initrd_gen_luks() {
	if [ ! -x /sbin/cryptsetup-initrd ]; then
		die "/sbin/cryptsetup-initrd is missing!"
	fi

	inst_d /bin
	inst_exec /sbin/cryptsetup-initrd /bin/cryptsetup

	mount_dev
	mount_sys
	initrd_gen_devices
	# TODO: 'udevadm settle' is called by lukssetup, is udev optional?

	debug "luks: process /etc/crypttab $LUKSDEV"
	luks_crypttab $LUKSDEV
}


# PRIVATE METHODS
key_is_random() {
	[ "$1" = "/dev/urandom" -o "$1" = "/dev/hw_random" -o "$1" = "/dev/random" ]
}

# produce cryptsetup from $name from /etc/crypttab
luks_crypttab() {
	local LUKSDEV="$1"

	# copy from /etc/rc.d/init.d/cryptsetup
	local dst src key opt mode owner

	while read dst src key opt; do
		[ -z "$dst" -o "${dst#\#}" != "$dst" ] && continue
		[ "$src" != "$LUKSDEV" ] && continue

		if [ -n "$key" -a "x$key" != "xnone" ]; then
			if test -e "$key" ; then
				mode=$(LC_ALL=C ls -l "$key" | cut -c 5-10)
				owner=$(LC_ALL=C ls -l $key | awk '{ print $3 }')
				if [ "$mode" != "------" ] && ! key_is_random "$key"; then
					die "INSECURE MODE FOR $key"
				fi
				if [ "$owner" != root ]; then
					die "INSECURE OWNER FOR $key"
				fi
			else
				die "Key file for $dst not found"
			fi
		else
			key=""
		fi

		if /sbin/cryptsetup isLuks "$src" 2>/dev/null; then
			if key_is_random "$key"; then
				die "$dst: LUKS requires non-random key, skipping"
			fi
			if [ -n "$opt" ]; then
				warn "$dst: options are invalid for LUKS partitions, ignoring them"
			fi
			if [ "$key" ]; then
				keyfile=/etc/.$dst.key
				inst $key $keyfile
			fi

			debug "+ cryptsetup ${keyfile:+-d $keyfile} luksOpen '$src' '$dst'"
			add_linuxrc <<-EOF
			cryptsetup ${keyfile:+-d $keyfile} luksOpen '$src' '$dst' <&1

			debugshell
			EOF
		else
			die "$dst: only LUKS encryption supported"
		fi
	done < /etc/crypttab
}