add devbyid dependency
[automated-distro-installer] / encrypt
1 #!/usr/bin/ash
2 run_hook() {
3 set -x
4 echo $0
5 modprobe -a -q dm-crypt >/dev/null 2>&1
6 [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"
7
8 # Get keyfile if specified
9 ckeyfile="/crypto_keyfile.bin"
10 if [ -n "$cryptkey" ]; then
11 IFS=: read ckdev ckarg1 ckarg2 <<EOF
12 $cryptkey
13 EOF
14
15 if [ "$ckdev" = "rootfs" ]; then
16 ckeyfile=$ckarg1
17 elif resolved=$(resolve_device "${ckdev}" ${rootdelay}); then
18 case ${ckarg1} in
19 *[!0-9]*)
20 # Use a file on the device
21 # ckarg1 is not numeric: ckarg1=filesystem, ckarg2=path
22 mkdir /ckey
23 mount -r -t "$ckarg1" "$resolved" /ckey
24 dd if="/ckey/$ckarg2" of="$ckeyfile" >/dev/null 2>&1
25 umount /ckey
26 ;;
27 *)
28 # Read raw data from the block device
29 # ckarg1 is numeric: ckarg1=offset, ckarg2=length
30 dd if="$resolved" of="$ckeyfile" bs=1 skip="$ckarg1" count="$ckarg2" >/dev/null 2>&1
31 ;;
32 esac
33 fi
34 [ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."
35 fi
36
37 for cryptdev in ${cryptdevices//,/ }; do
38 cryptname=crypt_dev_${cryptdev##*/}
39
40 if [ -n "${cryptoptions}" ]; then
41 cryptargs="${cryptargs} --allow-discards"
42 fi
43 for cryptopt in ${cryptoptions//,/ }; do
44 case ${cryptopt} in
45 no-allow-discards)
46 cryptargs=""
47 ;;
48 *)
49 echo "Encryption option '${cryptopt}' not known, ignoring." >&2
50 ;;
51 esac
52 done
53
54 if resolved=$(resolve_device "${cryptdev}" ${rootdelay}); then
55 if cryptsetup isLuks ${resolved} >/dev/null 2>&1; then
56 dopassphrase=1
57 # If keyfile exists, try to use that
58 if [ -f ${ckeyfile} ]; then
59 if eval cryptsetup --key-file ${ckeyfile} open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; then
60 dopassphrase=0
61 else
62 echo "Invalid keyfile. Reverting to passphrase."
63 fi
64 fi
65 # Ask for a passphrase
66 if [ ${dopassphrase} -gt 0 ]; then
67 echo ""
68 echo "A password is required to access the ${cryptname} volume:"
69
70 #loop until we get a real password
71 while ! eval cryptsetup open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; do
72 sleep 2;
73 done
74 fi
75 if [ -e "/dev/mapper/${cryptname}" ]; then
76 if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
77 export root="/dev/mapper/root"
78 fi
79 else
80 err "Password succeeded, but ${cryptname} creation failed, aborting..."
81 exit 1
82 fi
83 elif [ -n "${crypto}" ]; then
84 msg "Non-LUKS encrypted device found..."
85 if echo "$crypto" | awk -F: '{ exit(NF == 5) }'; then
86 err "Verify parameter format: crypto=hash:cipher:keysize:offset:skip"
87 err "Non-LUKS decryption not attempted..."
88 return 1
89 fi
90 exe="cryptsetup open --type plain $resolved $cryptname $cryptargs"
91 IFS=: read c_hash c_cipher c_keysize c_offset c_skip <<EOF
92 $crypto
93 EOF
94 [ -n "$c_hash" ] && exe="$exe --hash '$c_hash'"
95 [ -n "$c_cipher" ] && exe="$exe --cipher '$c_cipher'"
96 [ -n "$c_keysize" ] && exe="$exe --key-size '$c_keysize'"
97 [ -n "$c_offset" ] && exe="$exe --offset '$c_offset'"
98 [ -n "$c_skip" ] && exe="$exe --skip '$c_skip'"
99 if [ -f "$ckeyfile" ]; then
100 exe="$exe --key-file $ckeyfile"
101 else
102 exe="$exe --verify-passphrase"
103 echo ""
104 echo "A password is required to access the ${cryptname} volume:"
105 fi
106 eval "$exe $CSQUIET"
107
108 if [ $? -ne 0 ]; then
109 err "Non-LUKS device decryption failed. verify format: "
110 err " crypto=hash:cipher:keysize:offset:skip"
111 exit 1
112 fi
113 if [ -e "/dev/mapper/${cryptname}" ]; then
114 if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
115 export root="/dev/mapper/root"
116 fi
117 else
118 err "Password succeeded, but ${cryptname} creation failed, aborting..."
119 exit 1
120 fi
121 else
122 err "Failed to open encryption mapping: The device ${cryptdev} is not a LUKS volume and the crypto= paramater was not specified."
123 fi
124 fi
125 done
126 rm -f ${ckeyfile}
127 }
128
129 # vim: set ft=sh ts=4 sw=4 et: