iankelling.org Git - automated-distro-installer/blob - encrypt.upstream

   1 #!/usr/bin/ash
   2
   3 # This file is from the cryptsetup package in arch. The only
   4 # modification is this comment. It did not come with a license notice in
   5 # the file, but I remember that it is GPLv2-or-later.
   6
   7 run_hook() {
   8     modprobe -a -q dm-crypt >/dev/null 2>&1
   9     [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"
  10
  11     # Get keyfile if specified
  12     ckeyfile="/crypto_keyfile.bin"
  13     if [ -n "$cryptkey" ]; then
  14         IFS=: read ckdev ckarg1 ckarg2 <<EOF
  15 $cryptkey
  16 EOF
  17
  18         if [ "$ckdev" = "rootfs" ]; then
  19             ckeyfile=$ckarg1
  20         elif resolved=$(resolve_device "${ckdev}" ${rootdelay}); then
  21             case ${ckarg1} in
  22                 *[!0-9]*)
  23                     # Use a file on the device
  24                     # ckarg1 is not numeric: ckarg1=filesystem, ckarg2=path
  25                     mkdir /ckey
  26                     mount -r -t "$ckarg1" "$resolved" /ckey
  27                     dd if="/ckey/$ckarg2" of="$ckeyfile" >/dev/null 2>&1
  28                     umount /ckey
  29                     ;;
  30                 *)
  31                     # Read raw data from the block device
  32                     # ckarg1 is numeric: ckarg1=offset, ckarg2=length
  33                     dd if="$resolved" of="$ckeyfile" bs=1 skip="$ckarg1" count="$ckarg2" >/dev/null 2>&1
  34                     ;;
  35             esac
  36         fi
  37         [ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."
  38     fi
  39
  40     if [ -n "${cryptdevice}" ]; then
  41         DEPRECATED_CRYPT=0
  42         IFS=: read cryptdev cryptname cryptoptions <<EOF
  43 $cryptdevice
  44 EOF
  45     else
  46         DEPRECATED_CRYPT=1
  47         cryptdev="${root}"
  48         cryptname="root"
  49     fi
  50
  51     warn_deprecated() {
  52         echo "The syntax 'root=${root}' where '${root}' is an encrypted volume is deprecated"
  53         echo "Use 'cryptdevice=${root}:root root=/dev/mapper/root' instead."
  54     }
  55
  56     for cryptopt in ${cryptoptions//,/ }; do
  57         case ${cryptopt} in
  58             allow-discards)
  59                 cryptargs="${cryptargs} --allow-discards"
  60                 ;;
  61             *)
  62                 echo "Encryption option '${cryptopt}' not known, ignoring." >&2
  63                 ;;
  64         esac
  65     done
  66
  67     if resolved=$(resolve_device "${cryptdev}" ${rootdelay}); then
  68         if cryptsetup isLuks ${resolved} >/dev/null 2>&1; then
  69             [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
  70             dopassphrase=1
  71             # If keyfile exists, try to use that
  72             if [ -f ${ckeyfile} ]; then
  73                 if eval cryptsetup --key-file ${ckeyfile} open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; then
  74                     dopassphrase=0
  75                 else
  76                     echo "Invalid keyfile. Reverting to passphrase."
  77                 fi
  78             fi
  79             # Ask for a passphrase
  80             if [ ${dopassphrase} -gt 0 ]; then
  81                 echo ""
  82                 echo "A password is required to access the ${cryptname} volume:"
  83
  84                 #loop until we get a real password
  85                 while ! eval cryptsetup open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; do
  86                     sleep 2;
  87                 done
  88             fi
  89             if [ -e "/dev/mapper/${cryptname}" ]; then
  90                 if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
  91                     export root="/dev/mapper/root"
  92                 fi
  93             else
  94                 err "Password succeeded, but ${cryptname} creation failed, aborting..."
  95                 exit 1
  96             fi
  97         elif [ -n "${crypto}" ]; then
  98             [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
  99             msg "Non-LUKS encrypted device found..."
 100             if echo "$crypto" | awk -F: '{ exit(NF == 5) }'; then
 101                 err "Verify parameter format: crypto=hash:cipher:keysize:offset:skip"
 102                 err "Non-LUKS decryption not attempted..."
 103                 return 1
 104             fi
 105             exe="cryptsetup open --type plain $resolved $cryptname $cryptargs"
 106             IFS=: read c_hash c_cipher c_keysize c_offset c_skip <<EOF
 107 $crypto
 108 EOF
 109             [ -n "$c_hash" ]    && exe="$exe --hash '$c_hash'"
 110             [ -n "$c_cipher" ]  && exe="$exe --cipher '$c_cipher'"
 111             [ -n "$c_keysize" ] && exe="$exe --key-size '$c_keysize'"
 112             [ -n "$c_offset" ]  && exe="$exe --offset '$c_offset'"
 113             [ -n "$c_skip" ]    && exe="$exe --skip '$c_skip'"
 114             if [ -f "$ckeyfile" ]; then
 115                 exe="$exe --key-file $ckeyfile"
 116             else
 117                 exe="$exe --verify-passphrase"
 118                 echo ""
 119                 echo "A password is required to access the ${cryptname} volume:"
 120             fi
 121             eval "$exe $CSQUIET"
 122
 123             if [ $? -ne 0 ]; then
 124                 err "Non-LUKS device decryption failed. verify format: "
 125                 err "      crypto=hash:cipher:keysize:offset:skip"
 126                 exit 1
 127             fi
 128             if [ -e "/dev/mapper/${cryptname}" ]; then
 129                 if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
 130                     export root="/dev/mapper/root"
 131                 fi
 132             else
 133                 err "Password succeeded, but ${cryptname} creation failed, aborting..."
 134                 exit 1
 135             fi
 136         else
 137             err "Failed to open encryption mapping: The device ${cryptdev} is not a LUKS volume and the crypto= paramater was not specified."
 138         fi
 139     fi
 140     rm -f ${ckeyfile}
 141 }
 142
 143 # vim: set ft=sh ts=4 sw=4 et: