3 # This file is a modification of the file encrypt in cryptsetup package
4 # in arch. The original version is encrypt.upstream in the repo at
5 # https://iankelling.org/git/?p=automated-distro-installer. It did not
6 # come with a license notice in the file, but I remember that it is
12 modprobe
-a -q dm-crypt
>/dev
/null
2>&1
13 [ "${quiet}" = "y" ] && CSQUIET
=">/dev/null"
15 # Get keyfile if specified
16 ckeyfile
="/crypto_keyfile.bin"
17 if [ -n "$cryptkey" ]; then
18 IFS
=: read ckdev ckarg1 ckarg2
<<EOF
22 if [ "$ckdev" = "rootfs" ]; then
24 elif resolved
=$
(resolve_device
"${ckdev}" ${rootdelay}); then
27 # Use a file on the device
28 # ckarg1 is not numeric: ckarg1=filesystem, ckarg2=path
30 mount
-r -t "$ckarg1" "$resolved" /ckey
31 dd if="/ckey/$ckarg2" of
="$ckeyfile" >/dev
/null
2>&1
35 # Read raw data from the block device
36 # ckarg1 is numeric: ckarg1=offset, ckarg2=length
37 dd if="$resolved" of
="$ckeyfile" bs
=1 skip
="$ckarg1" count
="$ckarg2" >/dev
/null
2>&1
41 [ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."
44 for cryptdev
in ${cryptdevices//,/ }; do
45 cryptname
=crypt_dev_
${cryptdev##*/}
47 if [ -n "${cryptoptions}" ]; then
48 cryptargs
="${cryptargs} --allow-discards"
50 for cryptopt
in ${cryptoptions//,/ }; do
56 echo "Encryption option '${cryptopt}' not known, ignoring." >&2
61 if resolved
=$
(resolve_device
"${cryptdev}" ${rootdelay}); then
62 if cryptsetup isLuks
${resolved} >/dev
/null
2>&1; then
64 # If keyfile exists, try to use that
65 if [ -f ${ckeyfile} ]; then
66 if eval cryptsetup
--key-file ${ckeyfile} open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; then
69 echo "Invalid keyfile. Reverting to passphrase."
72 # Ask for a passphrase
73 if [ ${dopassphrase} -gt 0 ]; then
75 echo "A password is required to access the ${cryptname} volume:"
77 #loop until we get a real password
78 while ! eval cryptsetup open
--type luks
${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; do
82 if [ -e "/dev/mapper/${cryptname}" ]; then
83 if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
84 export root
="/dev/mapper/root"
87 err
"Password succeeded, but ${cryptname} creation failed, aborting..."
90 elif [ -n "${crypto}" ]; then
91 msg
"Non-LUKS encrypted device found..."
92 if echo "$crypto" |
awk -F: '{ exit(NF == 5) }'; then
93 err
"Verify parameter format: crypto=hash:cipher:keysize:offset:skip"
94 err
"Non-LUKS decryption not attempted..."
97 exe
="cryptsetup open --type plain $resolved $cryptname $cryptargs"
98 IFS
=: read c_hash c_cipher c_keysize c_offset c_skip
<<EOF
101 [ -n "$c_hash" ] && exe
="$exe --hash '$c_hash'"
102 [ -n "$c_cipher" ] && exe
="$exe --cipher '$c_cipher'"
103 [ -n "$c_keysize" ] && exe
="$exe --key-size '$c_keysize'"
104 [ -n "$c_offset" ] && exe
="$exe --offset '$c_offset'"
105 [ -n "$c_skip" ] && exe
="$exe --skip '$c_skip'"
106 if [ -f "$ckeyfile" ]; then
107 exe
="$exe --key-file $ckeyfile"
109 exe
="$exe --verify-passphrase"
111 echo "A password is required to access the ${cryptname} volume:"
115 if [ $?
-ne 0 ]; then
116 err
"Non-LUKS device decryption failed. verify format: "
117 err
" crypto=hash:cipher:keysize:offset:skip"
120 if [ -e "/dev/mapper/${cryptname}" ]; then
121 if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
122 export root
="/dev/mapper/root"
125 err
"Password succeeded, but ${cryptname} creation failed, aborting..."
129 err
"Failed to open encryption mapping: The device ${cryptdev} is not a LUKS volume and the crypto= paramater was not specified."
136 # vim: set ft=sh ts=4 sw=4 et: