mod-luks.sh

   1 #!/bin/sh
   2 # geninitrd mod: cryptsetup luks
   3 USE_LUKS=${USE_LUKS:-yes}
   4
   5 # true if root device is crypted with cryptsetup luks
   6 # and we should init cryptsetup luks at boot
   7 have_luks=no
   8
   9 # device to use for name for cryptsetup luks
  10 LUKSNAME=""
  11
  12 # setup geninitrd module
  13 # @access       public
  14 setup_mod_luks() {
  15         cryptsetup=$(find_tool $initrd_dir/cryptsetup /sbin/cryptsetup-initrd)
  16
  17         if [ ! -x /sbin/cryptsetup ] || [ ! -x "$cryptsetup" ]; then
  18                 USE_LUKS=no
  19         fi
  20 }
  21
  22 # return true if node is cryptsetup luks encrypted
  23 # @param        string $node device node to be examined
  24 # @access       public
  25 is_luks() {
  26         local node="$1"
  27
  28         # luks not wanted
  29         if is_no "$USE_LUKS"; then
  30                 return 1
  31         fi
  32
  33         local dev dm_name=${node#/dev/mapper/}
  34         if [ "$node" = "$dm_name" ]; then
  35                 verbose "is_luks: $node is not device mapper name"
  36                 return 1
  37         fi
  38
  39         dev=$(awk -vdm_name="$dm_name" '$1 == dm_name { print $2 }' /etc/crypttab)
  40         if [ "$dev" ]; then
  41                 dev=$(find_devname "$dev")
  42                 /sbin/cryptsetup isLuks $dev
  43                 rc=$?
  44         else
  45                 rc=1
  46         fi
  47
  48         if [ $rc = 0 ]; then
  49                 verbose "is_luks: $node is cryptsetup luks"
  50         else
  51                 verbose "is_luks: $node is not cryptsetup luks"
  52         fi
  53         return $rc
  54 }
  55
  56 # find modules for $devpath
  57 # @param        $devpath        device to be examined
  58 # @access       public
  59 find_modules_luks() {
  60         local devpath="$1"
  61         local dev=""
  62
  63         LUKSNAME=${devpath#/dev/mapper/}
  64
  65         find_module "dm-crypt"
  66
  67         # TODO: autodetect
  68         find_module "aes"
  69         find_module "cbc"
  70         find_module "-af-alg"
  71         find_module "-algif_hash"
  72         find_module "-algif_skcipher"
  73         find_module "-loop"
  74
  75         # recurse
  76         dev=$(awk -vLUKSNAME="$LUKSNAME" '$1 == LUKSNAME { print $2 }' /etc/crypttab)
  77         if [ -n "$dev" ]; then
  78                 dev=$(find_devname "$dev")
  79                 find_modules_for_devpath $dev
  80                 have_luks=yes
  81         else
  82                 die "Cannot find '$LUKSNAME' in /etc/crypttab"
  83         fi
  84 }
  85
  86
  87 # generate initrd fragment for cryptsetup luks init
  88 # @access       public
  89 initrd_gen_luks() {
  90         if ! is_yes "$have_luks"; then
  91                 return
  92         fi
  93
  94         inst_d /bin
  95         inst_exec $cryptsetup /bin/cryptsetup
  96         inst_d /var/run/cryptsetup
  97
  98         mount_dev
  99         mount_sys
 100         initrd_gen_devices
 101         # TODO: 'udevadm settle' is called by lukssetup, is udev optional?
 102
 103         verbose "luks: process /etc/crypttab $LUKSNAME"
 104         luks_crypttab $LUKSNAME
 105 }
 106
 107
 108 # PRIVATE METHODS
 109 key_is_random() {
 110         [ "$1" = "/dev/urandom" -o "$1" = "/dev/hw_random" -o "$1" = "/dev/random" ]
 111 }
 112
 113 # produce cryptsetup from $name from /etc/crypttab
 114 luks_crypttab() {
 115         local LUKSNAME="$1"
 116
 117         # copy from /etc/rc.d/init.d/cryptsetup
 118         local dst src key opt mode owner
 119
 120         while read dst src key opt; do
 121                 [ "$dst" != "$LUKSNAME" ] && continue
 122
 123                 if [ -n "$key" -a "x$key" != "xnone" ]; then
 124                         if test -e "$key" ; then
 125                                 mode=$(LC_ALL=C ls -l "$key" | cut -c 5-10)
 126                                 owner=$(LC_ALL=C ls -l $key | awk '{ print $3 }')
 127                                 if [ "$mode" != "------" ] && ! key_is_random "$key"; then
 128                                         die "INSECURE MODE FOR $key"
 129                                 fi
 130                                 if [ "$owner" != root ]; then
 131                                         die "INSECURE OWNER FOR $key"
 132                                 fi
 133                         else
 134                                 die "Key file for $dst not found"
 135                         fi
 136                 else
 137                         key=""
 138                 fi
 139
 140                 src=$(find_devname "$src")
 141                 if /sbin/cryptsetup isLuks "$src" 2>/dev/null; then
 142                         if key_is_random "$key"; then
 143                                 die "$dst: LUKS requires non-random key, skipping"
 144                         fi
 145                         if [ "$key" ]; then
 146                                 keyfile=/etc/.$dst.key
 147                                 inst $key $keyfile
 148                         fi
 149
 150                         crypttab_opt=""
 151                         old_IFS="$IFS"
 152                         IFS=","
 153                         for option in $opt; do
 154                                 case "$option" in
 155                                         discard|allow-discards)
 156                                                 crypttab_opt="$crypttab_opt --allow-discards"
 157                                                 ;;
 158                                         *)
 159                                                 warn "$dst: option \'$opt\' is invalid for LUKS partitions, ignored"
 160                                                 ;;
 161                                 esac
 162                         done
 163                         IFS="$old_IFS"
 164
 165                         verbose "+ cryptsetup ${keyfile:+-d $keyfile} open $crypttab_opt '$src' '$dst'"
 166                         add_linuxrc <<-EOF
 167                         debugshell
 168
 169                         cryptsetup_opt=""
 170                         if [ "\$DEBUGINITRD" ]; then
 171                                 cryptsetup_opt="--debug"
 172                         fi
 173                         # cryptsetup can be called twice and in case on crypt on lvm only second
 174                         # will succeed because there will be no src device in first cryptsetup call
 175                         # this can be called multiple times, before lvm and after lvm.
 176                         luksdev='$src'
 177                         if [ \${luksdev##/dev/disk/by-uuid/} != \${luksdev} ]; then
 178                                 src_uuid=\${luksdev##/dev/disk/by-uuid/}
 179                                 while read x y z name; do
 180                                         found_uuid=\$(cryptsetup \$cryptsetup_opt luksUUID /dev/\${name} 2>/dev/null)
 181                                         if [ "\$found_uuid" = "\$src_uuid" ]; then
 182                                                 luksdev=/dev/\$name
 183                                                 break
 184                                         fi
 185                                 done < /proc/partitions
 186                         fi
 187
 188                         if [ -e "\$luksdev" ]; then
 189                                 crypt_status=\$(cryptsetup \$cryptsetup_opt status '$dst')
 190                                 if [ "\${crypt_status%%is inactive*}" != "\$crypt_status" ]; then
 191                                         # is inactive
 192                                         cryptsetup \$cryptsetup_opt ${keyfile:+-d $keyfile} open $crypttab_opt "\$luksdev" '$dst' <&1
 193                                 fi
 194                         fi
 195
 196                         debugshell
 197                         EOF
 198                 else
 199                         die "$dst: only LUKS encryption supported"
 200                 fi
 201         done < /etc/crypttab
 202 }