]> TLD Linux GIT Repositories - rc-scripts.git/blob - rc.d/init.d/cryptsetup
- version 0.5.4
[rc-scripts.git] / rc.d / init.d / cryptsetup
1 #!/bin/sh
2 # cryptsetup functions for rc-scripts
3 # if invoked standalone, processes /etc/cryptab like on boot/shutdown
4
5 key_is_random() {
6         [ "$1" = "/dev/urandom" -o "$1" = "/dev/hw_random" -o "$1" = "/dev/random" ]
7 }
8
9 # Because of a chicken/egg problem, init_crypto must be run twice.  /var may be
10 # encrypted but /var/lib/random-seed is needed to initialize swap.
11 init_crypto() {
12         local have_random dst src key opt mode owner params makeswap skip arg
13         local param value rc ret mke2fs mdir
14
15         # call mknodes as the dm node could be missing if device was opened from
16         # initrd.
17         # XXX: shouldn't udev handle the nodes creation here?
18         /sbin/dmsetup mknodes
19
20         ret=0
21         have_random=$1
22         while read dst src key opt; do
23                 [ -z "$dst" -o "${dst#\#}" != "$dst" ] && continue
24                 [ -b "/dev/mapper/$dst" ] && continue;
25                 if [ "$have_random" = 0 ] && key_is_random "$key"; then
26                         continue
27                 fi
28                 if [ -n "$key" -a "x$key" != "xnone" ]; then
29                         if test -e "$key" ; then
30                                 mode=$(ls -l "$key" | cut -c 5-10)
31                                 owner=$(ls -l $key | awk '{ print $3 }')
32                                 if [ "$mode" != "------" ] && ! key_is_random "$key"; then
33                                         nls "INSECURE MODE FOR %s" "$key"
34                                         ret=1
35                                 fi
36                                 if [ "$owner" != root ]; then
37                                         nls "INSECURE OWNER FOR %s" "$key"
38                                         ret=1
39                                 fi
40                         else
41                                 nls "Key file for %s not found, skipping" "$dst"
42                                 continue
43                         fi
44                 else
45                         key=""
46                 fi
47                 params=""
48                 makeswap=""
49                 mke2fs=""
50                 skip=""
51                 # Parse the options field, convert to cryptsetup parameters
52                 # and contruct the command line
53                 while [ -n "$opt" ]; do
54                         arg=${opt%%,*}
55                         opt=${opt##$arg}
56                         opt=${opt##,}
57                         param=${arg%%=*}
58                         value=${arg##$param=}
59
60                         case "$param" in
61                         cipher)
62                                 params="$params -c $value"
63                                 if [ -z "$value" ]; then
64                                         nls "%s: no value for cipher option, skipping" "$dst"
65                                         skip="yes"
66                                 fi
67                         ;;
68                         size)
69                                 params="$params -s $value"
70                                 if [ -z "$value" ]; then
71                                         nls "%s: no value for size option, skipping" "$dst"
72                                         skip="yes"
73                                 fi
74                         ;;
75                         hash)
76                                 params="$params -h $value"
77                                 if [ -z "$value" ]; then
78                                         nls "%s: no value for hash option, skipping" "$dst"
79                                         skip="yes"
80                                 fi
81                         ;;
82                         verify)
83                                 params="$params -y"
84                         ;;
85                         swap)
86                                 makeswap=yes
87                         ;;
88                         tmp)
89                                 mke2fs=yes
90                         esac
91                 done
92
93                 if [ "$skip" = "yes" ]; then
94                         ret=1
95                         continue
96                 fi
97
98                 if echo "$src" | grep -q -E "^UUID=" ; then
99                         src="/dev/disk/by-uuid/${src##UUID=}"
100                 fi
101
102                 if [ ! -b "$src"  ]; then
103                         nls "$src: No such device"
104                         ret=1
105                         continue
106                 fi
107
108                 if /sbin/cryptsetup --disable-locks isLuks "$src" 2>/dev/null; then
109                         if key_is_random "$key"; then
110                                 nls "%s: LUKS requires non-random key, skipping" "$dst"
111                                 ret=1
112                                 continue
113                         fi
114                         if [ -n "$params" ]; then
115                                 nls "%s: options are invalid for LUKS partitions, ignoring them" "$dst"
116                         fi
117                         /sbin/cryptsetup --disable-locks ${key:+-d $key} luksOpen "$src" "$dst" <&1
118                 fi
119                 rc=$?
120                 if [ $rc -ne 0 ]; then
121                         ret=1
122                         continue
123                 fi
124                 if [ -b "/dev/mapper/$dst" ]; then
125                         if [ "$makeswap" = "yes" ]; then
126                                 mkswap "/dev/mapper/$dst" 2>/dev/null >/dev/null
127                         fi
128                         if [ "$mke2fs" = "yes" ]; then
129                                 if mke2fs "/dev/mapper/$dst" 2>/dev/null >/dev/null \
130                                         && mdir=$(mktemp -d /tmp/mountXXXXXX); then
131                                         mount "/dev/mapper/$dst" "$mdir" && chmod 1777 "$mdir"
132                                         umount "$mdir"
133                                         rmdir "$mdir"
134                                 fi
135                         fi
136                 fi
137         done < /etc/crypttab
138         return $ret
139 }
140
141 halt_crypto() {
142     local fnval=0 dst src key
143     while read dst src key; do
144         [ -z "$dst" -o "${dst#\#}" != "$dst" ] && continue
145         if [ -b "/dev/mapper/$dst" ]; then
146             if LC_ALL=C /sbin/dmsetup info "$dst" | grep -q '^Open count: *0$'; then
147                 /sbin/cryptsetup --disable-locks remove "$dst"
148             else
149                 fnval=1
150             fi
151         fi
152     done < /etc/crypttab
153     return $fnval
154 }
155
156 [ -f /etc/crypttab ] || return
157
158 # if not invoked directly, return to caller
159 case "$0" in *cryptsetup);; *) return;; esac
160
161 . /etc/rc.d/init.d/functions
162
163 RETVAL=0
164 # See how we were called.
165 case "$1" in
166   start)
167         show "Starting disk encryption"; started
168         init_crypto 1 && deltext; ok
169         ;;
170   stop)
171         show "Stopping disk encryption"; started
172         halt_crypto && deltext; ok
173         ;;
174   status)
175         # this is way overkill, but at least we have some status output...
176         if grep -qF dm_crypt /proc/modules; then
177                 nls "dm-crypt module is loaded"
178         else
179                 nls "dm-crypt module is not loaded"
180         fi
181         ;;
182   *)
183         msg_usage "$0 {start|stop|status}"
184         exit 3
185 esac
186
187 exit $RETVAL