iankelling.org Git - automated-distro-installer/blob - encrypt

   1 #!/usr/bin/ash
   2
   3 # This file is a modification of the file encrypt in cryptsetup package
   4 # in arch. The original version is encrypt.upstream in the repo at
   5 # https://iankelling.org/git/?p=automated-distro-installer. It did not
   6 # come with a license notice in the file, but I remember that it is
   7 # GPLv2-or-later.
   8
   9 run_hook() {
  10     set -x
  11     echo $0
  12     modprobe -a -q dm-crypt >/dev/null 2>&1
  13     [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"
  14
  15     # Get keyfile if specified
  16     ckeyfile="/crypto_keyfile.bin"
  17     if [ -n "$cryptkey" ]; then
  18         IFS=: read ckdev ckarg1 ckarg2 <<EOF
  19 $cryptkey
  20 EOF
  21
  22         if [ "$ckdev" = "rootfs" ]; then
  23             ckeyfile=$ckarg1
  24         elif resolved=$(resolve_device "${ckdev}" ${rootdelay}); then
  25             case ${ckarg1} in
  26                 *[!0-9]*)
  27                     # Use a file on the device
  28                     # ckarg1 is not numeric: ckarg1=filesystem, ckarg2=path
  29                     mkdir /ckey
  30                     mount -r -t "$ckarg1" "$resolved" /ckey
  31                     dd if="/ckey/$ckarg2" of="$ckeyfile" >/dev/null 2>&1
  32                     umount /ckey
  33                     ;;
  34                 *)
  35                     # Read raw data from the block device
  36                     # ckarg1 is numeric: ckarg1=offset, ckarg2=length
  37                     dd if="$resolved" of="$ckeyfile" bs=1 skip="$ckarg1" count="$ckarg2" >/dev/null 2>&1
  38                     ;;
  39             esac
  40         fi
  41         [ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."
  42     fi
  43
  44     for cryptdev in ${cryptdevices//,/ }; do
  45         cryptname=crypt_dev_${cryptdev##*/}
  46
  47         if [ -n "${cryptoptions}" ]; then
  48             cryptargs="${cryptargs} --allow-discards"
  49         fi
  50         for cryptopt in ${cryptoptions//,/ }; do
  51             case ${cryptopt} in
  52                 no-allow-discards)
  53                     cryptargs=""
  54                     ;;
  55                 *)
  56                     echo "Encryption option '${cryptopt}' not known, ignoring." >&2
  57                     ;;
  58             esac
  59         done
  60
  61         if resolved=$(resolve_device "${cryptdev}" ${rootdelay}); then
  62             if cryptsetup isLuks ${resolved} >/dev/null 2>&1; then
  63                 dopassphrase=1
  64                 # If keyfile exists, try to use that
  65                 if [ -f ${ckeyfile} ]; then
  66                     if eval cryptsetup --key-file ${ckeyfile} open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; then
  67                         dopassphrase=0
  68                     else
  69                         echo "Invalid keyfile. Reverting to passphrase."
  70                     fi
  71                 fi
  72                 # Ask for a passphrase
  73                 if [ ${dopassphrase} -gt 0 ]; then
  74                     echo ""
  75                     echo "A password is required to access the ${cryptname} volume:"
  76
  77                     #loop until we get a real password
  78                     while ! eval cryptsetup open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; do
  79                         sleep 2;
  80                     done
  81                 fi
  82                 if [ -e "/dev/mapper/${cryptname}" ]; then
  83                     if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
  84                         export root="/dev/mapper/root"
  85                     fi
  86                 else
  87                     err "Password succeeded, but ${cryptname} creation failed, aborting..."
  88                     exit 1
  89                 fi
  90             elif [ -n "${crypto}" ]; then
  91                 msg "Non-LUKS encrypted device found..."
  92                 if echo "$crypto" | awk -F: '{ exit(NF == 5) }'; then
  93                     err "Verify parameter format: crypto=hash:cipher:keysize:offset:skip"
  94                     err "Non-LUKS decryption not attempted..."
  95                     return 1
  96                 fi
  97                 exe="cryptsetup open --type plain $resolved $cryptname $cryptargs"
  98                 IFS=: read c_hash c_cipher c_keysize c_offset c_skip <<EOF
  99 $crypto
 100 EOF
 101                 [ -n "$c_hash" ]    && exe="$exe --hash '$c_hash'"
 102                 [ -n "$c_cipher" ]  && exe="$exe --cipher '$c_cipher'"
 103                 [ -n "$c_keysize" ] && exe="$exe --key-size '$c_keysize'"
 104                 [ -n "$c_offset" ]  && exe="$exe --offset '$c_offset'"
 105                 [ -n "$c_skip" ]    && exe="$exe --skip '$c_skip'"
 106                 if [ -f "$ckeyfile" ]; then
 107                     exe="$exe --key-file $ckeyfile"
 108                 else
 109                     exe="$exe --verify-passphrase"
 110                     echo ""
 111                     echo "A password is required to access the ${cryptname} volume:"
 112                 fi
 113                 eval "$exe $CSQUIET"
 114
 115                 if [ $? -ne 0 ]; then
 116                     err "Non-LUKS device decryption failed. verify format: "
 117                     err "      crypto=hash:cipher:keysize:offset:skip"
 118                     exit 1
 119                 fi
 120                 if [ -e "/dev/mapper/${cryptname}" ]; then
 121                     if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
 122                         export root="/dev/mapper/root"
 123                     fi
 124                 else
 125                     err "Password succeeded, but ${cryptname} creation failed, aborting..."
 126                     exit 1
 127                 fi
 128             else
 129                 err "Failed to open encryption mapping: The device ${cryptdev} is not a LUKS volume and the crypto= paramater was not specified."
 130             fi
 131         fi
 132     done
 133     rm -f ${ckeyfile}
 134 }
 135
 136 # vim: set ft=sh ts=4 sw=4 et: