rc.d/init.d/cryptsetup

   1 #!/bin/sh
   2 # cryptsetup functions for rc-scripts
   3 # if invoked standalone, processes /etc/cryptab like on boot/shutdown
   4
   5 key_is_random() {
   6         [ "$1" = "/dev/urandom" -o "$1" = "/dev/hw_random" -o "$1" = "/dev/random" ]
   7 }
   8
   9 # Because of a chicken/egg problem, init_crypto must be run twice.  /var may be
  10 # encrypted but /var/lib/random-seed is needed to initialize swap.
  11 init_crypto() {
  12         local have_random dst src key opt mode owner params makeswap skip arg
  13         local param value rc ret mke2fs mdir
  14
  15         # call mknodes as the dm node could be missing if device was opened from
  16         # initrd.
  17         # XXX: shouldn't udev handle the nodes creation here?
  18         /sbin/dmsetup mknodes
  19
  20         ret=0
  21         have_random=$1
  22         while read dst src key opt; do
  23                 [ -z "$dst" -o "${dst#\#}" != "$dst" ] && continue
  24                 [ -b "/dev/mapper/$dst" ] && continue;
  25                 if [ "$have_random" = 0 ] && key_is_random "$key"; then
  26                         continue
  27                 fi
  28                 if [ -n "$key" -a "x$key" != "xnone" ]; then
  29                         if test -e "$key" ; then
  30                                 mode=$(ls -l "$key" | cut -c 5-10)
  31                                 owner=$(ls -l $key | awk '{ print $3 }')
  32                                 if [ "$mode" != "------" ] && ! key_is_random "$key"; then
  33                                         nls "INSECURE MODE FOR %s" "$key"
  34                                         ret=1
  35                                 fi
  36                                 if [ "$owner" != root ]; then
  37                                         nls "INSECURE OWNER FOR %s" "$key"
  38                                         ret=1
  39                                 fi
  40                         else
  41                                 nls "Key file for %s not found, skipping" "$dst"
  42                                 continue
  43                         fi
  44                 else
  45                         key=""
  46                 fi
  47                 params=""
  48                 makeswap=""
  49                 mke2fs=""
  50                 skip=""
  51                 # Parse the options field, convert to cryptsetup parameters
  52                 # and contruct the command line
  53                 while [ -n "$opt" ]; do
  54                         arg=${opt%%,*}
  55                         opt=${opt##$arg}
  56                         opt=${opt##,}
  57                         param=${arg%%=*}
  58                         value=${arg##$param=}
  59
  60                         case "$param" in
  61                         cipher)
  62                                 params="$params -c $value"
  63                                 if [ -z "$value" ]; then
  64                                         nls "%s: no value for cipher option, skipping" "$dst"
  65                                         skip="yes"
  66                                 fi
  67                         ;;
  68                         size)
  69                                 params="$params -s $value"
  70                                 if [ -z "$value" ]; then
  71                                         nls "%s: no value for size option, skipping" "$dst"
  72                                         skip="yes"
  73                                 fi
  74                         ;;
  75                         hash)
  76                                 params="$params -h $value"
  77                                 if [ -z "$value" ]; then
  78                                         nls "%s: no value for hash option, skipping" "$dst"
  79                                         skip="yes"
  80                                 fi
  81                         ;;
  82                         verify)
  83                                 params="$params -y"
  84                         ;;
  85                         swap)
  86                                 makeswap=yes
  87                         ;;
  88                         tmp)
  89                                 mke2fs=yes
  90                         esac
  91                 done
  92
  93                 if [ "$skip" = "yes" ]; then
  94                         ret=1
  95                         continue
  96                 fi
  97
  98                 if echo "$src" | grep -q -E "^UUID=" ; then
  99                         src="/dev/disk/by-uuid/${src##UUID=}"
 100                 fi
 101
 102                 if [ ! -b "$src"  ]; then
 103                         nls "$src: No such device"
 104                         ret=1
 105                         continue
 106                 fi
 107
 108                 if /sbin/cryptsetup --disable-locks isLuks "$src" 2>/dev/null; then
 109                         if key_is_random "$key"; then
 110                                 nls "%s: LUKS requires non-random key, skipping" "$dst"
 111                                 ret=1
 112                                 continue
 113                         fi
 114                         if [ -n "$params" ]; then
 115                                 nls "%s: options are invalid for LUKS partitions, ignoring them" "$dst"
 116                         fi
 117                         /sbin/cryptsetup --disable-locks ${key:+-d $key} luksOpen "$src" "$dst" <&1
 118                 fi
 119                 rc=$?
 120                 if [ $rc -ne 0 ]; then
 121                         ret=1
 122                         continue
 123                 fi
 124                 if [ -b "/dev/mapper/$dst" ]; then
 125                         if [ "$makeswap" = "yes" ]; then
 126                                 mkswap "/dev/mapper/$dst" 2>/dev/null >/dev/null
 127                         fi
 128                         if [ "$mke2fs" = "yes" ]; then
 129                                 if mke2fs "/dev/mapper/$dst" 2>/dev/null >/dev/null \
 130                                         && mdir=$(mktemp -d /tmp/mountXXXXXX); then
 131                                         mount "/dev/mapper/$dst" "$mdir" && chmod 1777 "$mdir"
 132                                         umount "$mdir"
 133                                         rmdir "$mdir"
 134                                 fi
 135                         fi
 136                 fi
 137         done < /etc/crypttab
 138         return $ret
 139 }
 140
 141 halt_crypto() {
 142     local fnval=0 dst src key
 143     while read dst src key; do
 144         [ -z "$dst" -o "${dst#\#}" != "$dst" ] && continue
 145         if [ -b "/dev/mapper/$dst" ]; then
 146             if LC_ALL=C /sbin/dmsetup info "$dst" | grep -q '^Open count: *0$'; then
 147                 /sbin/cryptsetup --disable-locks remove "$dst"
 148             else
 149                 fnval=1
 150             fi
 151         fi
 152     done < /etc/crypttab
 153     return $fnval
 154 }
 155
 156 [ -f /etc/crypttab ] || return
 157
 158 # if not invoked directly, return to caller
 159 case "$0" in *cryptsetup);; *) return;; esac
 160
 161 . /etc/rc.d/init.d/functions
 162
 163 RETVAL=0
 164 # See how we were called.
 165 case "$1" in
 166   start)
 167         show "Starting disk encryption"; started
 168         init_crypto 1 && deltext; ok
 169         ;;
 170   stop)
 171         show "Stopping disk encryption"; started
 172         halt_crypto && deltext; ok
 173         ;;
 174   status)
 175         # this is way overkill, but at least we have some status output...
 176         if grep -qF dm_crypt /proc/modules; then
 177                 nls "dm-crypt module is loaded"
 178         else
 179                 nls "dm-crypt module is not loaded"
 180         fi
 181         ;;
 182   *)
 183         msg_usage "$0 {start|stop|status}"
 184         exit 3
 185 esac
 186
 187 exit $RETVAL