iankelling.org Git - automated-distro-installer/blob - encrypt

   1 #!/usr/bin/ash
   2 run_hook() {
   3     set -x
   4     echo $0
   5     modprobe -a -q dm-crypt >/dev/null 2>&1
   6     [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"
   7
   8     # Get keyfile if specified
   9     ckeyfile="/crypto_keyfile.bin"
  10     if [ -n "$cryptkey" ]; then
  11         IFS=: read ckdev ckarg1 ckarg2 <<EOF
  12 $cryptkey
  13 EOF
  14
  15         if [ "$ckdev" = "rootfs" ]; then
  16             ckeyfile=$ckarg1
  17         elif resolved=$(resolve_device "${ckdev}" ${rootdelay}); then
  18             case ${ckarg1} in
  19                 *[!0-9]*)
  20                     # Use a file on the device
  21                     # ckarg1 is not numeric: ckarg1=filesystem, ckarg2=path
  22                     mkdir /ckey
  23                     mount -r -t "$ckarg1" "$resolved" /ckey
  24                     dd if="/ckey/$ckarg2" of="$ckeyfile" >/dev/null 2>&1
  25                     umount /ckey
  26                     ;;
  27                 *)
  28                     # Read raw data from the block device
  29                     # ckarg1 is numeric: ckarg1=offset, ckarg2=length
  30                     dd if="$resolved" of="$ckeyfile" bs=1 skip="$ckarg1" count="$ckarg2" >/dev/null 2>&1
  31                     ;;
  32             esac
  33         fi
  34         [ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."
  35     fi
  36
  37     for cryptdev in ${cryptdevices//,/ }; do
  38         cryptname=crypt_dev_${cryptdev##*/}
  39
  40         if [ -n "${cryptoptions}" ]; then
  41             cryptargs="${cryptargs} --allow-discards"
  42         fi
  43         for cryptopt in ${cryptoptions//,/ }; do
  44             case ${cryptopt} in
  45                 no-allow-discards)
  46                     cryptargs=""
  47                     ;;
  48                 *)
  49                     echo "Encryption option '${cryptopt}' not known, ignoring." >&2
  50                     ;;
  51             esac
  52         done
  53
  54         if resolved=$(resolve_device "${cryptdev}" ${rootdelay}); then
  55             if cryptsetup isLuks ${resolved} >/dev/null 2>&1; then
  56                 dopassphrase=1
  57                 # If keyfile exists, try to use that
  58                 if [ -f ${ckeyfile} ]; then
  59                     if eval cryptsetup --key-file ${ckeyfile} open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; then
  60                         dopassphrase=0
  61                     else
  62                         echo "Invalid keyfile. Reverting to passphrase."
  63                     fi
  64                 fi
  65                 # Ask for a passphrase
  66                 if [ ${dopassphrase} -gt 0 ]; then
  67                     echo ""
  68                     echo "A password is required to access the ${cryptname} volume:"
  69
  70                     #loop until we get a real password
  71                     while ! eval cryptsetup open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; do
  72                         sleep 2;
  73                     done
  74                 fi
  75                 if [ -e "/dev/mapper/${cryptname}" ]; then
  76                     if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
  77                         export root="/dev/mapper/root"
  78                     fi
  79                 else
  80                     err "Password succeeded, but ${cryptname} creation failed, aborting..."
  81                     exit 1
  82                 fi
  83             elif [ -n "${crypto}" ]; then
  84                 msg "Non-LUKS encrypted device found..."
  85                 if echo "$crypto" | awk -F: '{ exit(NF == 5) }'; then
  86                     err "Verify parameter format: crypto=hash:cipher:keysize:offset:skip"
  87                     err "Non-LUKS decryption not attempted..."
  88                     return 1
  89                 fi
  90                 exe="cryptsetup open --type plain $resolved $cryptname $cryptargs"
  91                 IFS=: read c_hash c_cipher c_keysize c_offset c_skip <<EOF
  92 $crypto
  93 EOF
  94                 [ -n "$c_hash" ]    && exe="$exe --hash '$c_hash'"
  95                 [ -n "$c_cipher" ]  && exe="$exe --cipher '$c_cipher'"
  96                 [ -n "$c_keysize" ] && exe="$exe --key-size '$c_keysize'"
  97                 [ -n "$c_offset" ]  && exe="$exe --offset '$c_offset'"
  98                 [ -n "$c_skip" ]    && exe="$exe --skip '$c_skip'"
  99                 if [ -f "$ckeyfile" ]; then
 100                     exe="$exe --key-file $ckeyfile"
 101                 else
 102                     exe="$exe --verify-passphrase"
 103                     echo ""
 104                     echo "A password is required to access the ${cryptname} volume:"
 105                 fi
 106                 eval "$exe $CSQUIET"
 107
 108                 if [ $? -ne 0 ]; then
 109                     err "Non-LUKS device decryption failed. verify format: "
 110                     err "      crypto=hash:cipher:keysize:offset:skip"
 111                     exit 1
 112                 fi
 113                 if [ -e "/dev/mapper/${cryptname}" ]; then
 114                     if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
 115                         export root="/dev/mapper/root"
 116                     fi
 117                 else
 118                     err "Password succeeded, but ${cryptname} creation failed, aborting..."
 119                     exit 1
 120                 fi
 121             else
 122                 err "Failed to open encryption mapping: The device ${cryptdev} is not a LUKS volume and the crypto= paramater was not specified."
 123             fi
 124         fi
 125     done
 126     rm -f ${ckeyfile}
 127 }
 128
 129 # vim: set ft=sh ts=4 sw=4 et: