summaryrefslogtreecommitdiff
blob: 4d5f01e4727ce4348ec389bcc4a2d219131ec8ff (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
#!/sbin/openrc-run
# Copyright 1999-2015 Gentoo Foundation
# Distributed under the terms of the GNU General Public License v2
# $Id$

depend() {
	before checkfs fsck

	if grep -qs ^swap= "${conf_file}" ; then
		before swap
	fi
}

# We support multiple dmcrypt instances based on $SVCNAME
conf_file="/etc/conf.d/${SVCNAME}"

# Get splash helpers if available.
if [ -e /sbin/splash-functions.sh ] ; then
	. /sbin/splash-functions.sh
fi

# Setup mappings for an individual target/swap
# Note: This relies on variables localized in the main body below.
dm_crypt_execute() {
	local dev ret mode foo

	if [ -z "${target}" -a -z "${swap}" ] ; then
		return
	fi

	# Set up default values.
	: ${dmcrypt_key_timeout:=1}
	: ${dmcrypt_max_timeout:=300}
	: ${dmcrypt_retries:=5}

	# Handle automatic look up of the source path.
	if [ -z "${source}" -a -n "${loop_file}" ] ; then
		source=$(losetup --show -f "${loop_file}")
	fi
	case ${source} in
	*=*)
		source=$(blkid -l -t "${source}" -o device)
		;;
	esac
	if [ -z "${source}" ] || [ ! -e "${source}" ] ; then
		ewarn "source \"${source}\" for ${target} missing, skipping..."
		return
	fi

	if [ -n "${target}" ] ; then
		# let user set options, otherwise leave empty
		: ${options:=' '}
	elif [ -n "${swap}" ] ; then
		if cryptsetup isLuks ${source} 2>/dev/null ; then
			ewarn "The swap you have defined is a LUKS partition. Aborting crypt-swap setup."
			return
		fi
		target=${swap}
		# swap contents do not need to be preserved between boots, luks not required.
		# suspend2 users should have initramfs's init handling their swap partition either way.
		: ${options:='-c aes -h sha1 -d /dev/urandom'}
		: ${pre_mount:='mkswap ${dev}'}
	fi

	if [ -n "${loop_file}" ] ; then
		dev="/dev/mapper/${target}"
		ebegin "  Setting up loop device ${source}"
		losetup ${source} ${loop_file}
	fi

	# cryptsetup:
	# open   <device> <name>      # <device> is $source
	# create <name>   <device>    # <name>   is $target
	local arg1="create" arg2="${target}" arg3="${source}"
	if cryptsetup isLuks ${source} 2>/dev/null ; then
		arg1="open"
		arg2="${source}"
		arg3="${target}"
	fi

	# Older versions reported:
	#	${target} is active:
	# Newer versions report:
	#	${target} is active[ and is in use.]
	if cryptsetup status ${target} | egrep -q ' is active' ; then
		einfo "dm-crypt mapping ${target} is already configured"
		return
	fi
	splash svc_input_begin ${SVCNAME} >/dev/null 2>&1

	# Handle keys
	if [ -n "${key}" ] ; then
		read_abort() {
			# some colors
			local ans savetty resettty
			[ -z "${NORMAL}" ] && eval $(eval_ecolors)
			einfon "  $1? (${WARN}yes${NORMAL}/${GOOD}No${NORMAL}) "
			shift
			# This is ugly as s**t.  But POSIX doesn't provide `read -t`, so
			# we end up having to implement our own crap with stty/etc...
			savetty=$(stty -g)
			resettty='stty ${savetty}; trap - EXIT HUP INT TERM'
			trap 'eval "${resettty}"' EXIT HUP INT TERM
			stty -icanon
			stty min 0 time "$(( $2 * 10 ))"
			ans=$(dd count=1 bs=1 2>/dev/null) || ans=''
			eval "${resettty}"
			if [ -z "${ans}" ] ; then
				printf '\r'
			else
				echo
			fi
			case ${ans} in
				[yY]) return 0;;
				*) return 1;;
			esac
		}

		# Notes: sed not used to avoid case where /usr partition is encrypted.
		mode=${key##*:} && ( [ "${mode}" = "${key}" ] || [ -z "${mode}" ] ) && mode=reg
		key=${key%:*}
		case "${mode}" in
		gpg|reg)
			# handle key on removable device
			if [ -n "${remdev}" ] ; then
				# temp directory to mount removable device
				local mntrem="${RC_SVCDIR}/dm-crypt-remdev.$$"
				if [ ! -d "${mntrem}" ] ; then
					if ! mkdir -p "${mntrem}" ; then
						ewarn "${source} will not be decrypted ..."
						einfo "Reason: Unable to create temporary mount point '${mntrem}'"
						return
					fi
				fi
				i=0
				einfo "Please insert removable device for ${target}"
				while [ ${i} -lt ${dmcrypt_max_timeout} ] ; do
					foo=""
					if mount -n -o ro "${remdev}" "${mntrem}" 2>/dev/null >/dev/null ; then
						# keyfile exists?
						if [ ! -e "${mntrem}${key}" ] ; then
							umount -n "${mntrem}"
							rmdir "${mntrem}"
							einfo "Cannot find ${key} on removable media."
							read_abort "Abort" ${dmcrypt_key_timeout} && return
						else
							key="${mntrem}${key}"
							break
						fi
					else
						[ -e "${remdev}" ] \
							&& foo="mount failed" \
							|| foo="mount source not found"
					fi
					: $((i += 1))
					read_abort "Stop waiting after $i attempts (${foo})" -t 1 && return
				done
			else    # keyfile ! on removable device
				if [ ! -e "${key}" ] ; then
					ewarn "${source} will not be decrypted ..."
					einfo "Reason: keyfile ${key} does not exist."
					return
				fi
			fi
			;;
		*)
			ewarn "${source} will not be decrypted ..."
			einfo "Reason: mode ${mode} is invalid."
			return
			;;
		esac
	else
		mode=none
	fi
	ebegin "  ${target} using: ${options} ${arg1} ${arg2} ${arg3}"
	if [ "${mode}" = "gpg" ] ; then
		: ${gpg_options:='-q -d'}
		# gpg available ?
		if command -v gpg >/dev/null ; then
			i=0
			while [ ${i} -lt ${dmcrypt_retries} ] ; do
				# paranoid, don't store key in a variable, pipe it so it stays very little in ram unprotected.
				# save stdin stdout stderr "values"
				timeout ${dmcrypt_max_timeout} gpg ${gpg_options} ${key} 2>/dev/null | \
					cryptsetup --key-file - ${options} ${arg1} ${arg2} ${arg3}
				ret=$?
				# The timeout command exits 124 when it times out.
				[ ${ret} -eq 0 -o ${ret} -eq 124 ] && break
				: $(( i += 1 ))
			done
			eend ${ret} "failure running cryptsetup"
		else
			ewarn "${source} will not be decrypted ..."
			einfo "Reason: cannot find gpg application."
			einfo "You have to install app-crypt/gnupg first."
			einfo "If you have /usr on its own partition, try copying gpg to /bin ."
		fi
	else
		if [ "${mode}" = "reg" ] ; then
			cryptsetup ${options} -d ${key} ${arg1} ${arg2} ${arg3}
			ret=$?
			eend ${ret} "failure running cryptsetup"
		else
			cryptsetup ${options} ${arg1} ${arg2} ${arg3}
			ret=$?
			eend ${ret} "failure running cryptsetup"
		fi
	fi
	if [ -d "${mntrem}" ] ; then
		umount -n ${mntrem} 2>/dev/null >/dev/null
		rmdir ${mntrem} 2>/dev/null >/dev/null
	fi
	splash svc_input_end ${SVCNAME} >/dev/null 2>&1

	if [ ${ret} -ne 0 ] ; then
		cryptfs_status=1
	else
		if [ -n "${pre_mount}" ] ; then
			dev="/dev/mapper/${target}"
			eval ebegin \""    pre_mount: ${pre_mount}"\"
			eval "${pre_mount}" > /dev/null
			ewend $? || cryptfs_status=1
		fi
	fi
}

# Lookup optional bootparams
get_bootparam_val() {
	# We're given something like:
	#    foo=bar=cow
	# Return the "bar=cow" part.
	case $1 in
	*=*)
		echo "${1#*=}"
		;;
	esac
}

start() {
	local header=true cryptfs_status=0
	local gpg_options key loop_file target targetline options pre_mount post_mount source swap remdev

	local x
	for x in $(cat /proc/cmdline) ; do
		case "${x}" in
		key_timeout=*)
			dmcrypt_key_timeout=$(get_bootparam_val "${x}")
			;;
		esac
	done

	while read targetline <&3 ; do
		case ${targetline} in
		# skip comments and blank lines
		""|"#"*) continue ;;
		# skip service-specific openrc configs #377927
		rc_*) continue ;;
		esac

		${header} && ebegin "Setting up dm-crypt mappings"
		header=false

		# check for the start of a new target/swap
		case ${targetline} in
		target=*|swap=*)
			# If we have a target queued up, then execute it
			dm_crypt_execute

			# Prepare for the next target/swap by resetting variables
			unset gpg_options key loop_file target options pre_mount post_mount source swap remdev
			;;

		gpg_options=*|remdev=*|key=*|loop_file=*|options=*|pre_mount=*|post_mount=*|source=*)
			if [ -z "${target}${swap}" ] ; then
				ewarn "Ignoring setting outside target/swap section: ${targetline}"
				continue
			fi
			;;

		dmcrypt_*=*)
			# ignore global options
			continue
			;;

		*)
			ewarn "Skipping invalid line in ${conf_file}: ${targetline}"
			;;
		esac

		# Queue this setting for the next call to dm_crypt_execute
		eval "${targetline}"
	done 3< ${conf_file}

	# If we have a target queued up, then execute it
	dm_crypt_execute

	ewend ${cryptfs_status} "Failed to setup dm-crypt devices"
}

stop() {
	local line header

	# Break down all mappings
	header=true
	egrep "^(target|swap)=" ${conf_file} | \
	while read line ; do
		${header} && einfo "Removing dm-crypt mappings"
		header=false

		target= swap=
		eval ${line}

		[ -n "${swap}" ] && target=${swap}
		if [ -z "${target}" ] ; then
			ewarn "invalid line in ${conf_file}: ${line}"
			continue
		fi

		ebegin "  ${target}"
		cryptsetup remove ${target}
		eend $?
	done

	# Break down loop devices
	header=true
	grep '^source=./dev/loop' ${conf_file} | \
	while read line ; do
		${header} && einfo "Detaching dm-crypt loop devices"
		header=false

		source=
		eval ${line}

		ebegin "  ${source}"
		losetup -d "${source}"
		eend $?
	done

	return 0
}