alter-stable/i686/plymouth/plymouth.encrypt_hook

   1 #!/bin/bash
   2
   3 run_hook() {
   4     modprobe -a -q dm-crypt >/dev/null 2>&1
   5     [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"
   6
   7     # Get keyfile if specified
   8     ckeyfile="/crypto_keyfile.bin"
   9     if [ -n "$cryptkey" ]; then
  10         IFS=: read ckdev ckarg1 ckarg2 <<EOF
  11 $cryptkey
  12 EOF
  13
  14         if [ "$ckdev" = "rootfs" ]; then
  15             ckeyfile=$ckarg1
  16         elif resolved=$(resolve_device "${ckdev}" ${rootdelay}); then
  17             case ${ckarg1} in
  18                 *[!0-9]*)
  19                     # Use a file on the device
  20                     # ckarg1 is not numeric: ckarg1=filesystem, ckarg2=path
  21                     mkdir /ckey
  22                     mount -r -t "$ckarg1" "$resolved" /ckey
  23                     dd if="/ckey/$ckarg2" of="$ckeyfile" >/dev/null 2>&1
  24                     umount /ckey
  25                     ;;
  26                 *)
  27                     # Read raw data from the block device
  28                     # ckarg1 is numeric: ckarg1=offset, ckarg2=length
  29                     dd if="$resolved" of="$ckeyfile" bs=1 skip="$ckarg1" count="$ckarg2" >/dev/null 2>&1
  30                     ;;
  31             esac
  32         fi
  33         [ ! -f ${ckeyfile} ] && echo "Keyfile could not be opened. Reverting to passphrase."
  34     fi
  35
  36     if [ -n "${cryptdevice}" ]; then
  37         DEPRECATED_CRYPT=0
  38         IFS=: read cryptdev cryptname cryptoptions <<EOF
  39 $cryptdevice
  40 EOF
  41     else
  42         DEPRECATED_CRYPT=1
  43         cryptdev="${root}"
  44         cryptname="root"
  45     fi
  46
  47     warn_deprecated() {
  48         echo "The syntax 'root=${root}' where '${root}' is an encrypted volume is deprecated"
  49         echo "Use 'cryptdevice=${root}:root root=/dev/mapper/root' instead."
  50     }
  51
  52     for cryptopt in ${cryptoptions//,/ }; do
  53         case ${cryptopt} in
  54             allow-discards)
  55                 cryptargs="${cryptargs} --allow-discards"
  56                 ;;
  57             *)
  58                 echo "Encryption option '${cryptopt}' not known, ignoring." >&2
  59                 ;;
  60         esac
  61     done
  62
  63     if resolved=$(resolve_device "${cryptdev}" ${rootdelay}); then
  64         if cryptsetup isLuks ${resolved} >/dev/null 2>&1; then
  65             [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
  66             dopassphrase=1
  67             # If keyfile exists, try to use that
  68             if [ -f ${ckeyfile} ]; then
  69                 if eval cryptsetup --key-file ${ckeyfile} luksOpen ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; then
  70                     dopassphrase=0
  71                 else
  72                     echo "Invalid keyfile. Reverting to passphrase."
  73                 fi
  74             fi
  75             # Ask for a passphrase
  76             if [ ${dopassphrase} -gt 0 ]; then
  77                 echo
  78                 echo "A password is required to access the ${cryptname} volume:"
  79                 plymouth ask-for-password --prompt="Password for ${cryptname} volume" --dont-pause-progress --number-of-tries=5 --command="/sbin/cryptsetup luksOpen --key-file=- ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}"
  80                 sleep 2
  81             fi
  82             if [ -e "/dev/mapper/${cryptname}" ]; then
  83                 if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
  84                     export root="/dev/mapper/root"
  85                 fi
  86             else
  87                 err "Password succeeded, but ${cryptname} creation failed, aborting..."
  88                 exit 1
  89             fi
  90         elif [ -n "${crypto}" ]; then
  91             [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
  92             msg "Non-LUKS encrypted device found..."
  93             if echo "$crypto" | awk -F: '{ exit(NF == 5) }'; then
  94                 err "Verify parameter format: crypto=hash:cipher:keysize:offset:skip"
  95                 err "Non-LUKS decryption not attempted..."
  96                 return 1
  97             fi
  98             exe="cryptsetup create $cryptname $resolved $cryptargs"
  99             IFS=: read c_hash c_cipher c_keysize c_offset c_skip <<EOF
 100 $crypto
 101 EOF
 102             [ -n "$c_hash" ]    && exe="$exe --hash '$c_hash'"
 103             [ -n "$c_cipher" ]  && exe="$exe --cipher '$c_cipher'"
 104             [ -n "$c_keysize" ] && exe="$exe --key-size '$c_keysize'"
 105             [ -n "$c_offset" ]  && exe="$exe --offset '$c_offset'"
 106             [ -n "$c_skip" ]    && exe="$exe --skip '$c_skip'"
 107             if [ -f "$ckeyfile" ]; then
 108                 exe="$exe --key-file $ckeyfile"
 109             else
 110                 exe="$exe --verify-passphrase"
 111                 echo ""
 112                 echo "A password is required to access the ${cryptname} volume:"
 113             fi
 114             eval "$exe $CSQUIET"
 115
 116             if [ $? -ne 0 ]; then
 117                 err "Non-LUKS device decryption failed. verify format: "
 118                 err "      crypto=hash:cipher:keysize:offset:skip"
 119                 exit 1
 120             fi
 121             if [ -e "/dev/mapper/${cryptname}" ]; then
 122                 if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
 123                     export root="/dev/mapper/root"
 124                 fi
 125             else
 126                 err "Password succeeded, but ${cryptname} creation failed, aborting..."
 127                 exit 1
 128             fi
 129         else
 130             err "Failed to open encryption mapping: The device ${cryptdev} is not a LUKS volume and the crypto= paramater was not specified."
 131         fi
 132     fi
 133     rm -f ${ckeyfile}
 134 }