From fea952abb79cb470c50729af1b6848c417cc6ce1 Mon Sep 17 00:00:00 2001From: leho <leho@kraav.com>Date: Sat, 23 Apr 2011 00:41:20 +0300Subject: [PATCH] (wip) implement fetching LUKS keyfile from a LUKS-encrypted loop file--- dracut.kernel.7.xml | 3 ++- modules.d/90crypt-loopkey/module-setup.sh | 11 +++++++++++ modules.d/90crypt/crypt-lib.sh | 11 ++++++++++- modules.d/90crypt/parse-keydev.sh | 21 +++++++++++++++------ modules.d/90crypt/probe-keydev.sh | 15 +++++++++++---- 5 files changed, 49 insertions(+), 12 deletions(-) create mode 100644 modules.d/90crypt-loopkey/module-setup.shdiff --git a/dracut.kernel.7.xml b/dracut.kernel.7.xmlindex c251094..2a89007 100644--- a/dracut.kernel.7.xml+++ b/dracut.kernel.7.xml@@ -314,12 +314,13 @@ This parameter can be specified multiple times.</para> <variablelist> <varlistentry> <term>- <envar>rd.luks.key=</envar><replaceable><keypath>:<keydev>:<luksdev></replaceable>+ <envar>rd.luks.key=</envar><replaceable><keypath>:<keydev>:<luksdev>:<mode></replaceable> </term> <listitem> <para><replaceable>keypath</replaceable> is a path to key file to look for. It's REQUIRED.</para> <para><replaceable>keydev</replaceable> is a device on which key file resides. It might be kernel name of devices (should start with "/dev/"), UUID (prefixed with "UUID=") or label (prefix with "LABEL="). You don't have to specify full UUID. Just its beginning will suffice, even if its ambiguous. All matching devices will be probed. This parameter is recommended, but not required. If not present, all block devices will be probed, which may significantly increase boot time.</para> <para>If <replaceable>luksdev</replaceable> is given, the specified key will only be applied for that LUKS device. Possible values are the same as for <replaceable>keydev</replaceable>. Unless you have several LUKS devices, you don't have to specify this parameter.</para>+ <para><replaceable>mode</replaceable> is for special procedures for unlocking the keyfile, before it can be used to unlock your root filesystem. Examples include passing the keyfile through gpg or opening a LUKS-encrypted loop file. Currently only <replaceable>loop</replaceable> mode is supported. You need to enable "crypt-keyloop" module for this. </para> <para>The simplest usage is:</para> <programlisting>rd.luks.key=/foo/bar.key</programlisting> <para>As you see, you can skip colons in such case.</para>diff --git a/modules.d/90crypt-loopkey/module-setup.sh b/modules.d/90crypt-loopkey/module-setup.shnew file mode 100644index 0000000..4c3b6d4--- /dev/null+++ b/modules.d/90crypt-loopkey/module-setup.sh@@ -0,0 +1,11 @@+check() {+ [ -n $hostonly ] && return 0 || return 255+}++depends() {+ echo "crypt"+}++install() {+ inst losetup+}diff --git a/modules.d/90crypt/crypt-lib.sh b/modules.d/90crypt/crypt-lib.shindex 26f9950..42d6ce7 100644--- a/modules.d/90crypt/crypt-lib.sh+++ b/modules.d/90crypt/crypt-lib.sh@@ -10,7 +10,7 @@ type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh # example: # test_dev -f LABEL="nice label" /some/file1 test_dev() {- local test_op=$1; local dev="$2"; local f="$3"+ local test_op=$1; local dev="$2"; local f="$3"; local m="$4" local ret=1; local mount_point=$(mkuniqdir /mnt testdev) local path@@ -20,6 +20,15 @@ test_dev() { if mount -r "$dev" "$mount_point" >/dev/null 2>&1; then test $test_op "${mount_point}/${f}" ret=$?++ if [ -n $m ]; then+ local nl+ nl=$(losetup -f)+ losetup "$nl" "${mount_point}/${f}"+ ret=$?+ losetup -d "$nl"+ fi+ umount "$mount_point" fidiff --git a/modules.d/90crypt/parse-keydev.sh b/modules.d/90crypt/parse-keydev.shindex 01cca58..ea8183f 100644--- a/modules.d/90crypt/parse-keydev.sh+++ b/modules.d/90crypt/parse-keydev.sh@@ -9,10 +9,10 @@ if getargbool 1 rd.luks -n rd_NO_LUKS && \ echo 'ACTION!="add|change", GOTO="luks_keydev_end"' >&7 for arg in $(getargs rd.luks.key); do- unset keypath keydev luksdev- splitsep : "$arg" keypath keydev luksdev+ unset keypath keydev luksdev mode+ splitsep : "$arg" keypath keydev luksdev mode- info "rd.luks.key: keypath='$keypath' keydev='$keydev' luksdev='$luksdev'"+ info "rd.luks.key: keypath='$keypath' keydev='$keydev' luksdev='$luksdev' mode='$mode'" if [ -z "$keypath" ]; then warn 'keypath required!'@@ -27,14 +27,23 @@ if getargbool 1 rd.luks -n rd_NO_LUKS && \ printf ', ' >&7 fi+ if [ -n "$mode" ]; then+ if [ "$mode" = "loop" ]; then+ info "loop mode, prepare for losetup magic!"+ else+ warn "unrecognized mode $mode!"+ continue+ fi+ fi+ { printf -- 'RUN+="%s --unique --onetime ' $(command -v initqueue) printf -- '--name probe-keydev-%%k '- printf -- '%s /dev/%%k %s %s"\n' \- $(command -v probe-keydev) "${keypath}" "${luksdev}"+ printf -- '%s /dev/%%k %s %s %s"\n' \+ $(command -v probe-keydev) "${keypath}" "${luksdev:-''}" "${mode}" } >&7 done- unset arg keypath keydev luksdev+ unset arg keypath keydev luksdev mode echo 'LABEL="luks_keydev_end"' >&7 exec 7>&-diff --git a/modules.d/90crypt/probe-keydev.sh b/modules.d/90crypt/probe-keydev.shindex 67a62f7..71f5a0d 100755--- a/modules.d/90crypt/probe-keydev.sh+++ b/modules.d/90crypt/probe-keydev.sh@@ -5,13 +5,20 @@ . /lib/dracut-crypt-lib.sh-real_keydev="$1"; keypath="$2"; luksdev="$3"+real_keydev="$1"; keypath="$2"; luksdev="$3"; mode="$4"++info "real_keydev 1: $1"+info "keypath 2: $2"+info "luksdev: $3"+info "mode: $4" [ -z "$real_keydev" -o -z "$keypath" ] && die 'probe-keydev: wrong usage!' [ -z "$luksdev" ] && luksdev='*'-info "Probing $real_keydev for $keypath..."-test_dev -f "$real_keydev" "$keypath" || exit 1+[ ! -z "$mode" ] && modestring="in mode $mode"++info "Probing $real_keydev for $keypath $modestring..."+test_dev -f "$real_keydev" "$keypath" "$mode" || exit 1 info "Found $keypath on $real_keydev"-echo "$luksdev:$real_keydev:$keypath" >> /tmp/luks.keys+echo "$luksdev:$real_keydev:$keypath:$mode" >> /tmp/luks.keys-- 1.7.3.4