3 # This file is from the cryptsetup package in arch. The only
4 # modification is this comment. It did not come with a license notice in
5 # the file, but I remember that it is GPLv2-or-later.
8 modprobe
-a -q dm-crypt
>/dev
/null
2>&1
9 [ "${quiet}" = "y" ] && CSQUIET
=">/dev/null"
11 # Get keyfile if specified
12 ckeyfile
="/crypto_keyfile.bin"
13 if [ -n "$cryptkey" ]; then
14 IFS
=: read ckdev ckarg1 ckarg2
<<EOF
18 if [ "$ckdev" = "rootfs" ]; then
20 elif resolved
=$
(resolve_device
"${ckdev}" ${rootdelay}); then
23 # Use a file on the device
24 # ckarg1 is not numeric: ckarg1=filesystem, ckarg2=path
26 mount
-r -t "$ckarg1" "$resolved" /ckey
27 dd if="/ckey/$ckarg2" of
="$ckeyfile" >/dev
/null
2>&1
31 # Read raw data from the block device
32 # ckarg1 is numeric: ckarg1=offset, ckarg2=length
33 dd if="$resolved" of
="$ckeyfile" bs
=1 skip
="$ckarg1" count
="$ckarg2" >/dev
/null
2>&1
37 [ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."
40 if [ -n "${cryptdevice}" ]; then
42 IFS
=: read cryptdev cryptname cryptoptions
<<EOF
52 echo "The syntax 'root=${root}' where '${root}' is an encrypted volume is deprecated"
53 echo "Use 'cryptdevice=${root}:root root=/dev/mapper/root' instead."
56 for cryptopt
in ${cryptoptions//,/ }; do
59 cryptargs
="${cryptargs} --allow-discards"
62 echo "Encryption option '${cryptopt}' not known, ignoring." >&2
67 if resolved
=$
(resolve_device
"${cryptdev}" ${rootdelay}); then
68 if cryptsetup isLuks
${resolved} >/dev
/null
2>&1; then
69 [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
71 # If keyfile exists, try to use that
72 if [ -f ${ckeyfile} ]; then
73 if eval cryptsetup
--key-file ${ckeyfile} open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; then
76 echo "Invalid keyfile. Reverting to passphrase."
79 # Ask for a passphrase
80 if [ ${dopassphrase} -gt 0 ]; then
82 echo "A password is required to access the ${cryptname} volume:"
84 #loop until we get a real password
85 while ! eval cryptsetup open
--type luks
${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; do
89 if [ -e "/dev/mapper/${cryptname}" ]; then
90 if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
91 export root
="/dev/mapper/root"
94 err
"Password succeeded, but ${cryptname} creation failed, aborting..."
97 elif [ -n "${crypto}" ]; then
98 [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
99 msg
"Non-LUKS encrypted device found..."
100 if echo "$crypto" |
awk -F: '{ exit(NF == 5) }'; then
101 err
"Verify parameter format: crypto=hash:cipher:keysize:offset:skip"
102 err
"Non-LUKS decryption not attempted..."
105 exe
="cryptsetup open --type plain $resolved $cryptname $cryptargs"
106 IFS
=: read c_hash c_cipher c_keysize c_offset c_skip
<<EOF
109 [ -n "$c_hash" ] && exe
="$exe --hash '$c_hash'"
110 [ -n "$c_cipher" ] && exe
="$exe --cipher '$c_cipher'"
111 [ -n "$c_keysize" ] && exe
="$exe --key-size '$c_keysize'"
112 [ -n "$c_offset" ] && exe
="$exe --offset '$c_offset'"
113 [ -n "$c_skip" ] && exe
="$exe --skip '$c_skip'"
114 if [ -f "$ckeyfile" ]; then
115 exe
="$exe --key-file $ckeyfile"
117 exe
="$exe --verify-passphrase"
119 echo "A password is required to access the ${cryptname} volume:"
123 if [ $?
-ne 0 ]; then
124 err
"Non-LUKS device decryption failed. verify format: "
125 err
" crypto=hash:cipher:keysize:offset:skip"
128 if [ -e "/dev/mapper/${cryptname}" ]; then
129 if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
130 export root
="/dev/mapper/root"
133 err
"Password succeeded, but ${cryptname} creation failed, aborting..."
137 err
"Failed to open encryption mapping: The device ${cryptdev} is not a LUKS volume and the crypto= paramater was not specified."
143 # vim: set ft=sh ts=4 sw=4 et: