mod-luks.sh

   1 #!/bin/sh
   2 # geninitrd mod: cryptsetup luks
   3 USE_LUKS=${USE_LUKS:-yes}
   4
   5 # true if root device is crypted with cryptsetup luks
   6 # and we should init cryptsetup luks at boot
   7 have_luks=no
   8
   9 # device to use for name for cryptsetup luks
  10 LUKSNAME=""
  11
  12 # setup geninitrd module
  13 # @access       public
  14 setup_mod_luks() {
  15         cryptsetup=$(find_tool $initrd_dir/cryptsetup /sbin/cryptsetup-initrd)
  16
  17         if [ ! -x /sbin/cryptsetup ] || [ ! -x "$cryptsetup" ]; then
  18                 USE_LUKS=no
  19         fi
  20 }
  21
  22 # return true if node is cryptsetup luks encrypted
  23 # @param        string $node device node to be examined
  24 # @access       public
  25 is_luks() {
  26         local node="$1"
  27
  28         # luks not wanted
  29         if is_no "$USE_LUKS"; then
  30                 return 1
  31         fi
  32
  33         local dev dm_name=${node#/dev/mapper/}
  34         if [ "$node" = "$dm_name" ]; then
  35                 verbose "is_luks: $node is not device mapper name"
  36                 return 1
  37         fi
  38
  39         dev=$(awk -vdm_name="$dm_name" '$1 == dm_name { print $2 }' /etc/crypttab)
  40         if [ "$dev" ]; then
  41                 dev=$(find_devname "$dev")
  42                 /sbin/cryptsetup isLuks $dev
  43                 rc=$?
  44         else
  45                 rc=1
  46         fi
  47
  48         if [ $rc = 0 ]; then
  49                 verbose "is_luks: $node is cryptsetup luks"
  50         else
  51                 verbose "is_luks: $node is not cryptsetup luks"
  52         fi
  53         return $rc
  54 }
  55
  56 # find modules for $devpath
  57 # @param        $devpath        device to be examined
  58 # @access       public
  59 find_modules_luks() {
  60         local devpath="$1"
  61         local dev=""
  62
  63         LUKSNAME=${devpath#/dev/mapper/}
  64
  65         find_module "dm-crypt"
  66
  67         # TODO: autodetect
  68         find_module "aes"
  69         find_module "cbc"
  70
  71         # recurse
  72         dev=$(awk -vLUKSNAME="$LUKSNAME" '$1 == LUKSNAME { print $2 }' /etc/crypttab)
  73         if [ -n "$dev" ]; then
  74                 dev=$(find_devname "$dev")
  75                 find_modules_for_devpath $dev
  76                 have_luks=yes
  77         else
  78                 die "Cannot find '$LUKSNAME' in /etc/crypttab"
  79         fi
  80 }
  81
  82
  83 # generate initrd fragment for cryptsetup luks init
  84 # @access       public
  85 initrd_gen_luks() {
  86         if ! is_yes "$have_luks"; then
  87                 return
  88         fi
  89
  90         inst_d /bin
  91         inst_exec $cryptsetup /bin/cryptsetup
  92
  93         mount_dev
  94         mount_sys
  95         initrd_gen_devices
  96         # TODO: 'udevadm settle' is called by lukssetup, is udev optional?
  97
  98         verbose "luks: process /etc/crypttab $LUKSNAME"
  99         luks_crypttab $LUKSNAME
 100 }
 101
 102
 103 # PRIVATE METHODS
 104 key_is_random() {
 105         [ "$1" = "/dev/urandom" -o "$1" = "/dev/hw_random" -o "$1" = "/dev/random" ]
 106 }
 107
 108 # produce cryptsetup from $name from /etc/crypttab
 109 luks_crypttab() {
 110         local LUKSNAME="$1"
 111
 112         # copy from /etc/rc.d/init.d/cryptsetup
 113         local dst src key opt mode owner
 114
 115         while read dst src key opt; do
 116                 [ "$dst" != "$LUKSNAME" ] && continue
 117
 118                 if [ -n "$key" -a "x$key" != "xnone" ]; then
 119                         if test -e "$key" ; then
 120                                 mode=$(LC_ALL=C ls -l "$key" | cut -c 5-10)
 121                                 owner=$(LC_ALL=C ls -l $key | awk '{ print $3 }')
 122                                 if [ "$mode" != "------" ] && ! key_is_random "$key"; then
 123                                         die "INSECURE MODE FOR $key"
 124                                 fi
 125                                 if [ "$owner" != root ]; then
 126                                         die "INSECURE OWNER FOR $key"
 127                                 fi
 128                         else
 129                                 die "Key file for $dst not found"
 130                         fi
 131                 else
 132                         key=""
 133                 fi
 134
 135                 src=$(find_devname "$src")
 136                 if /sbin/cryptsetup isLuks "$src" 2>/dev/null; then
 137                         if key_is_random "$key"; then
 138                                 die "$dst: LUKS requires non-random key, skipping"
 139                         fi
 140                         if [ "$key" ]; then
 141                                 keyfile=/etc/.$dst.key
 142                                 inst $key $keyfile
 143                         fi
 144
 145                         crypttab_opt=""
 146                         old_IFS="$IFS"
 147                         IFS=","
 148                         for option in $opt; do
 149                                 case "$option" in
 150                                         discard|allow-discards)
 151                                                 crypttab_opt="$crypttab_opt --allow-discards"
 152                                                 ;;
 153                                         *)
 154                                                 warn "$dst: option \'$opt\' is invalid for LUKS partitions, ignored"
 155                                                 ;;
 156                                 esac
 157                         done
 158                         IFS="$old_IFS"
 159
 160                         verbose "+ cryptsetup ${keyfile:+-d $keyfile} open --type luks $crypttab_opt '$src' '$dst'"
 161                         add_linuxrc <<-EOF
 162                         debugshell
 163
 164                         cryptsetup_opt=""
 165                         if [ "\$DEBUGINITRD" ]; then
 166                                 cryptsetup_opt="--debug"
 167                         fi
 168                         # cryptsetup can be called twice and in case on crypt on lvm only second
 169                         # will succeed because there will be no src device in first cryptsetup call
 170                         # this can be called multiple times, before lvm and after lvm.
 171                         luksdev='$src'
 172                         if [ \${luksdev##/dev/disk/by-uuid/} != \${luksdev} ]; then
 173                                 src_uuid=\${luksdev##/dev/disk/by-uuid/}
 174                                 while read x y z name; do
 175                                         found_uuid=\$(cryptsetup \$cryptsetup_opt luksUUID /dev/\${name} 2>/dev/null)
 176                                         if [ "\$found_uuid" = "\$src_uuid" ]; then
 177                                                 luksdev=/dev/\$name
 178                                                 break
 179                                         fi
 180                                 done < /proc/partitions
 181                         fi
 182
 183                         if [ -e "\$luksdev" ]; then
 184                                 crypt_status=\$(cryptsetup \$cryptsetup_opt status '$dst')
 185                                 if [ "\${crypt_status%%is inactive.}" != "\$crypt_status" ]; then
 186                                         # is inactive
 187                                         cryptsetup \$cryptsetup_opt ${keyfile:+-d $keyfile} open --type luks $crypttab_opt "\$luksdev" '$dst' <&1
 188                                 fi
 189                         fi
 190
 191                         debugshell
 192                         EOF
 193                 else
 194                         die "$dst: only LUKS encryption supported"
 195                 fi
 196         done < /etc/crypttab
 197 }