rc.d/init.d/cryptsetup

   1 #!/bin/sh
   2 # cryptsetup functions for rc-scripts
   3 # if invoked standalone, processes /etc/cryptab like on boot/shutdown
   4
   5 key_is_random() {
   6         [ "$1" = "/dev/urandom" -o "$1" = "/dev/hw_random" -o "$1" = "/dev/random" ]
   7 }
   8
   9 # Because of a chicken/egg problem, init_crypto must be run twice.  /var may be
  10 # encrypted but /var/lib/random-seed is needed to initialize swap.
  11 init_crypto() {
  12         local have_random dst src key opt mode owner params makeswap skip arg
  13         local param value rc ret mke2fs mdir
  14
  15         # call mknodes as the dm node could be missing if device was opened from
  16         # initrd.
  17         # XXX: shouldn't udev handle the nodes creation here?
  18         /sbin/dmsetup mknodes
  19
  20         ret=0
  21         have_random=$1
  22         while read dst src key opt; do
  23                 [ -z "$dst" -o "${dst#\#}" != "$dst" ] && continue
  24                 [ -b "/dev/mapper/$dst" ] && continue;
  25                 if [ "$have_random" = 0 ] && key_is_random "$key"; then
  26                         continue
  27                 fi
  28                 if [ -n "$key" -a "x$key" != "xnone" ]; then
  29                         if test -e "$key" ; then
  30                                 mode=$(ls -l "$key" | cut -c 5-10)
  31                                 owner=$(ls -l $key | awk '{ print $3 }')
  32                                 if [ "$mode" != "------" ] && ! key_is_random "$key"; then
  33                                         nls "INSECURE MODE FOR %s" "$key"
  34                                         ret=1
  35                                 fi
  36                                 if [ "$owner" != root ]; then
  37                                         nls "INSECURE OWNER FOR %s" "$key"
  38                                         ret=1
  39                                 fi
  40                         else
  41                                 nls "Key file for %s not found, skipping" "$dst"
  42                                 continue
  43                         fi
  44                 else
  45                         key=""
  46                 fi
  47                 params=""
  48                 makeswap=""
  49                 mke2fs=""
  50                 skip=""
  51                 # Parse the options field, convert to cryptsetup parameters
  52                 # and contruct the command line
  53                 while [ -n "$opt" ]; do
  54                         arg=${opt%%,*}
  55                         opt=${opt##$arg}
  56                         opt=${opt##,}
  57                         param=${arg%%=*}
  58                         value=${arg##$param=}
  59
  60                         case "$param" in
  61                         cipher)
  62                                 params="$params -c $value"
  63                                 if [ -z "$value" ]; then
  64                                         nls "%s: no value for cipher option, skipping" "$dst"
  65                                         skip="yes"
  66                                 fi
  67                         ;;
  68                         size)
  69                                 params="$params -s $value"
  70                                 if [ -z "$value" ]; then
  71                                         nls "%s: no value for size option, skipping" "$dst"
  72                                         skip="yes"
  73                                 fi
  74                         ;;
  75                         hash)
  76                                 params="$params -h $value"
  77                                 if [ -z "$value" ]; then
  78                                         nls "%s: no value for hash option, skipping" "$dst"
  79                                         skip="yes"
  80                                 fi
  81                         ;;
  82                         verify)
  83                                 params="$params -y"
  84                         ;;
  85                         swap)
  86                                 makeswap=yes
  87                         ;;
  88                         tmp)
  89                                 mke2fs=yes
  90                         esac
  91                 done
  92
  93                 if [ "$skip" = "yes" ]; then
  94                         ret=1
  95                         continue
  96                 fi
  97
  98                 if [ ! -b "$src"  ]; then
  99                         nls "$src: No such device"
 100                         ret=1
 101                         continue
 102                 fi
 103
 104                 if /sbin/cryptsetup isLuks "$src" 2>/dev/null; then
 105                         if key_is_random "$key"; then
 106                                 nls "%s: LUKS requires non-random key, skipping" "$dst"
 107                                 ret=1
 108                                 continue
 109                         fi
 110                         if [ -n "$params" ]; then
 111                                 nls "%s: options are invalid for LUKS partitions, ignoring them" "$dst"
 112                         fi
 113                         /sbin/cryptsetup ${key:+-d $key} luksOpen "$src" "$dst" <&1
 114                 else
 115                         /sbin/cryptsetup $params ${key:+-d $key} create "$dst" "$src" <&1 2>/dev/null
 116                 fi
 117                 rc=$?
 118                 if [ $rc -ne 0 ]; then
 119                         ret=1
 120                         continue
 121                 fi
 122                 if [ -b "/dev/mapper/$dst" ]; then
 123                         if [ "$makeswap" = "yes" ]; then
 124                                 mkswap "/dev/mapper/$dst" 2>/dev/null >/dev/null
 125                         fi
 126                         if [ "$mke2fs" = "yes" ]; then
 127                                 if mke2fs "/dev/mapper/$dst" 2>/dev/null >/dev/null \
 128                                         && mdir=$(mktemp -d /tmp/mountXXXXXX); then
 129                                         mount "/dev/mapper/$dst" "$mdir" && chmod 1777 "$mdir"
 130                                         umount "$mdir"
 131                                         rmdir "$mdir"
 132                                 fi
 133                         fi
 134                 fi
 135         done < /etc/crypttab
 136         return $ret
 137 }
 138
 139 halt_crypto() {
 140     local fnval=0 dst src key
 141     while read dst src key; do
 142         [ -z "$dst" -o "${dst#\#}" != "$dst" ] && continue
 143         if [ -b "/dev/mapper/$dst" ]; then
 144             if LC_ALL=C /sbin/dmsetup info "$dst" | grep -q '^Open count: *0$'; then
 145                 /sbin/cryptsetup remove "$dst"
 146             else
 147                 fnval=1
 148             fi
 149         fi
 150     done < /etc/crypttab
 151     return $fnval
 152 }
 153
 154 [ -f /etc/crypttab ] || return
 155
 156 # if not invoked directly, return to caller
 157 case "$0" in *cryptsetup);; *) return;; esac
 158
 159 . /etc/rc.d/init.d/functions
 160
 161 RETVAL=0
 162 # See how we were called.
 163 case "$1" in
 164   start)
 165         show "Starting disk encryption"; started
 166         init_crypto 1 && deltext; ok
 167         ;;
 168   stop)
 169         show "Stopping disk encryption"; started
 170         halt_crypto && deltext; ok
 171         ;;
 172   status)
 173         # this is way overkill, but at least we have some status output...
 174         if grep -qF dm_crypt /proc/modules; then
 175                 nls "dm-crypt module is loaded"
 176         else
 177                 nls "dm-crypt module is not loaded"
 178         fi
 179         ;;
 180   *)
 181         msg_usage "$0 {start|stop|status}"
 182         exit 3
 183 esac
 184
 185 exit $RETVAL