Load configured font and do it early.

[projects/geninitrd.git] / mod-luks.sh

diff --git a/mod-luks.sh b/mod-luks.sh
index 44dd705c572deb93c71abdaac1b68e13e200397c..8cd9959c3342218234578860c51224154791e6df 100644 (file)
--- a/mod-luks.sh
+++ b/mod-luks.sh
@@ -1,19 +1,23 @@
 #!/bin/sh
-#
 # geninitrd mod: cryptsetup luks
+USE_LUKS=${USE_LUKS:-yes}
 
 # true if root device is crypted with cryptsetup luks
 # and we should init cryptsetup luks at boot
 have_luks=no
 
-if [ -x /sbin/cryptsetup ]; then
-       USE_LUKS=yes
-else
-       USE_LUKS=no
-fi
-
 # device to use for name for cryptsetup luks
-LUKSDEV=""
+LUKSNAME=""
+
+# setup geninitrd module
+# @access      public
+setup_mod_luks() {
+       cryptsetup=$(find_tool $initrd_dir/cryptsetup /sbin/cryptsetup-initrd)
+
+       if [ ! -x /sbin/cryptsetup ] || [ ! -x "$cryptsetup" ]; then
+               USE_LUKS=no
+       fi
+}
 
 # return true if node is cryptsetup luks encrypted
 # @param       string $node device node to be examined
@@ -26,25 +30,24 @@ is_luks() {
                return 1
        fi
 
-       if [ ! -e "$node" ]; then
-               warn "is_luks(): node $node doesn't exist!"
-               return 1
-       fi
-
        local dev dm_name=${node#/dev/mapper/}
        if [ "$node" = "$dm_name" ]; then
-               debug "is_luks: $node is not device mapper name"
+               verbose "is_luks: $node is not device mapper name"
                return 1
        fi
 
-       dev=$(/sbin/cryptsetup status $dm_name 2>/dev/null | awk '/device:/{print $2}')
-       /sbin/cryptsetup isLuks $dev
-       rc=$?
+       dev=$(awk -vdm_name="$dm_name" '$1 == dm_name { print $2 }' /etc/crypttab)
+       if [ "$dev" ]; then
+               /sbin/cryptsetup isLuks $dev
+               rc=$?
+       else
+               rc=1
+       fi
 
        if [ $rc = 0 ]; then
-               debug "is_luks: $node is cryptsetup luks"
+               verbose "is_luks: $node is cryptsetup luks"
        else
-               debug "is_luks: $node is not cryptsetup luks"
+               verbose "is_luks: $node is not cryptsetup luks"
        fi
        return $rc
 }
@@ -54,13 +57,9 @@ is_luks() {
 # @access      public
 find_modules_luks() {
        local devpath="$1"
-       local dev
+       local dev=""
 
-       local name=${devpath#/dev/mapper/}
-       LUKSDEV=$(/sbin/cryptsetup status $name 2>/dev/null | awk '/device:/{print $2}')
-       if [ -z "$LUKSDEV" ]; then
-               die "Lost cryptsetup device meanwhile?"
-       fi
+       LUKSNAME=${devpath#/dev/mapper/}
 
        find_module "dm-crypt"
 
@@ -68,30 +67,34 @@ find_modules_luks() {
        find_module "aes"
        find_module "cbc"
 
-       have_luks=yes
-
        # recurse
-       find_modules_for_devpath $LUKSDEV
+       dev=$(awk -vLUKSNAME="$LUKSNAME" '$1 == LUKSNAME { print $2 }' /etc/crypttab)
+       if [ -n "$dev" ]; then
+               find_modules_for_devpath $dev
+               have_luks=yes
+       else
+               die "Cannot find '$LUKSNAME' in /etc/crypttab"
+       fi
 }
 
 
 # generate initrd fragment for cryptsetup luks init
 # @access      public
 initrd_gen_luks() {
-       if [ ! -x /sbin/cryptsetup-initrd ]; then
-               die "/sbin/cryptsetup-initrd is missing!"
+       if ! is_yes "$have_luks"; then
+               return
        fi
 
        inst_d /bin
-       inst_exec /sbin/cryptsetup-initrd /bin/cryptsetup
+       inst_exec $cryptsetup /bin/cryptsetup
 
        mount_dev
        mount_sys
        initrd_gen_devices
        # TODO: 'udevadm settle' is called by lukssetup, is udev optional?
 
-       debug "luks: process /etc/crypttab $LUKSDEV"
-       luks_crypttab $LUKSDEV
+       verbose "luks: process /etc/crypttab $LUKSNAME"
+       luks_crypttab $LUKSNAME
 }
 
 
@@ -102,14 +105,13 @@ key_is_random() {
 
 # produce cryptsetup from $name from /etc/crypttab
 luks_crypttab() {
-       local LUKSDEV="$1"
+       local LUKSNAME="$1"
 
        # copy from /etc/rc.d/init.d/cryptsetup
        local dst src key opt mode owner
 
        while read dst src key opt; do
-               [ -z "$dst" -o "${dst#\#}" != "$dst" ] && continue
-               [ "$src" != "$LUKSDEV" ] && continue
+               [ "$dst" != "$LUKSNAME" ] && continue
 
                if [ -n "$key" -a "x$key" != "xnone" ]; then
                        if test -e "$key" ; then
@@ -140,9 +142,36 @@ luks_crypttab() {
                                inst $key $keyfile
                        fi
 
-                       debug "+ cryptsetup ${keyfile:+-d $keyfile} luksOpen '$src' '$dst'"
+                       verbose "+ cryptsetup ${keyfile:+-d $keyfile} luksOpen '$src' '$dst'"
                        add_linuxrc <<-EOF
-                       cryptsetup ${keyfile:+-d $keyfile} luksOpen '$src' '$dst' <&1
+                       debugshell
+
+                       cryptsetup_opt=""
+                       if [ "\$DEBUGINITRD" ]; then
+                               cryptsetup_opt="--debug"
+                       fi
+                       # cryptsetup can be called twice and in case on crypt on lvm only second
+                       # will succeed because there will be no src device in first cryptsetup call
+                       # this can be called multiple times, before lvm and after lvm.
+                       luksdev='$src'
+                       if [ \${luksdev##/dev/disk/by-uuid/} != \${luksdev} ]; then
+                               src_uuid=\${luksdev##/dev/disk/by-uuid/}
+                               while read x y z name; do
+                                       found_uuid=\$(cryptsetup \$cryptsetup_opt luksUUID /dev/\${name} 2>/dev/null)
+                                       if [ "\$found_uuid" = "\$src_uuid" ]; then
+                                               luksdev=/dev/\$name
+                                               break
+                                       fi
+                               done < /proc/partitions
+                       fi
+
+                       if [ -e "\$luksdev" ]; then
+                               crypt_status=\$(cryptsetup \$cryptsetup_opt status '$dst')
+                               if [ "\${crypt_status%%is inactive.}" != "\$crypt_status" ]; then
+                                       # is inactive
+                                       cryptsetup \$cryptsetup_opt ${keyfile:+-d $keyfile} luksOpen "\$luksdev" '$dst' <&1
+                               fi
+                       fi
 
                        debugshell
                        EOF