rc.d/init.d/cryptsetup

   1 #!/bin/sh
   2 # cryptsetup functions for rc-scripts
   3 # if invoked standalone, processes /etc/cryptab like on boot/shutdown
   4
   5 key_is_random() {
   6         [ "$1" = "/dev/urandom" -o "$1" = "/dev/hw_random" -o "$1" = "/dev/random" ]
   7 }
   8
   9 # Because of a chicken/egg problem, init_crypto must be run twice.  /var may be
  10 # encrypted but /var/lib/random-seed is needed to initialize swap.
  11 init_crypto() {
  12         local have_random dst src key opt mode owner params makeswap skip arg
  13         local param value rc ret mke2fs mdir
  14
  15         # call mknodes as the dm node could be missing if device was opened from
  16         # initrd.
  17         # XXX: shouldn't udev handle the nodes creation here?
  18         /sbin/dmsetup mknodes
  19
  20         ret=0
  21         have_random=$1
  22         while read dst src key opt; do
  23                 [ -z "$dst" -o "${dst#\#}" != "$dst" ] && continue
  24                 [ -b "/dev/mapper/$dst" ] && continue;
  25                 if [ "$have_random" = 0 ] && key_is_random "$key"; then
  26                         continue
  27                 fi
  28                 if [ -n "$key" -a "x$key" != "xnone" ]; then
  29                         if test -e "$key" ; then
  30                                 mode=$(ls -l "$key" | cut -c 5-10)
  31                                 owner=$(ls -l $key | awk '{ print $3 }')
  32                                 if [ "$mode" != "------" ] && ! key_is_random "$key"; then
  33                                         nls "INSECURE MODE FOR %s" "$key"
  34                                         ret=1
  35                                 fi
  36                                 if [ "$owner" != root ]; then
  37                                         nls "INSECURE OWNER FOR %s" "$key"
  38                                         ret=1
  39                                 fi
  40                         else
  41                                 nls "Key file for %s not found, skipping" "$dst"
  42                                 continue
  43                         fi
  44                 else
  45                         key=""
  46                 fi
  47                 params=""
  48                 makeswap=""
  49                 mke2fs=""
  50                 skip=""
  51                 # Parse the options field, convert to cryptsetup parameters
  52                 # and contruct the command line
  53                 while [ -n "$opt" ]; do
  54                         arg=${opt%%,*}
  55                         opt=${opt##$arg}
  56                         opt=${opt##,}
  57                         param=${arg%%=*}
  58                         value=${arg##$param=}
  59
  60                         case "$param" in
  61                         cipher)
  62                                 params="$params -c $value"
  63                                 if [ -z "$value" ]; then
  64                                         nls "%s: no value for cipher option, skipping" "$dst"
  65                                         skip="yes"
  66                                 fi
  67                         ;;
  68                         size)
  69                                 params="$params -s $value"
  70                                 if [ -z "$value" ]; then
  71                                         nls "%s: no value for size option, skipping" "$dst"
  72                                         skip="yes"
  73                                 fi
  74                         ;;
  75                         hash)
  76                                 params="$params -h $value"
  77                                 if [ -z "$value" ]; then
  78                                         nls "%s: no value for hash option, skipping" "$dst"
  79                                         skip="yes"
  80                                 fi
  81                         ;;
  82                         verify)
  83                                 params="$params -y"
  84                         ;;
  85                         swap)
  86                                 makeswap=yes
  87                         ;;
  88                         tmp)
  89                                 mke2fs=yes
  90                         esac
  91                 done
  92
  93                 if [ "$skip" = "yes" ]; then
  94                         ret=1
  95                         continue
  96                 fi
  97
  98                 if echo "$src" | grep -q -E "^UUID=" ; then
  99                         src="/dev/disk/by-uuid/${src##UUID=}"
 100                 fi
 101
 102                 if [ ! -b "$src"  ]; then
 103                         nls "$src: No such device"
 104                         ret=1
 105                         continue
 106                 fi
 107
 108                 if /sbin/cryptsetup isLuks "$src" 2>/dev/null; then
 109                         if key_is_random "$key"; then
 110                                 nls "%s: LUKS requires non-random key, skipping" "$dst"
 111                                 ret=1
 112                                 continue
 113                         fi
 114                         if [ -n "$params" ]; then
 115                                 nls "%s: options are invalid for LUKS partitions, ignoring them" "$dst"
 116                         fi
 117                         /sbin/cryptsetup ${key:+-d $key} luksOpen "$src" "$dst" <&1
 118                 else
 119                         /sbin/cryptsetup $params ${key:+-d $key} create "$dst" "$src" <&1 2>/dev/null
 120                 fi
 121                 rc=$?
 122                 if [ $rc -ne 0 ]; then
 123                         ret=1
 124                         continue
 125                 fi
 126                 if [ -b "/dev/mapper/$dst" ]; then
 127                         if [ "$makeswap" = "yes" ]; then
 128                                 mkswap "/dev/mapper/$dst" 2>/dev/null >/dev/null
 129                         fi
 130                         if [ "$mke2fs" = "yes" ]; then
 131                                 if mke2fs "/dev/mapper/$dst" 2>/dev/null >/dev/null \
 132                                         && mdir=$(mktemp -d /tmp/mountXXXXXX); then
 133                                         mount "/dev/mapper/$dst" "$mdir" && chmod 1777 "$mdir"
 134                                         umount "$mdir"
 135                                         rmdir "$mdir"
 136                                 fi
 137                         fi
 138                 fi
 139         done < /etc/crypttab
 140         return $ret
 141 }
 142
 143 halt_crypto() {
 144     local fnval=0 dst src key
 145     while read dst src key; do
 146         [ -z "$dst" -o "${dst#\#}" != "$dst" ] && continue
 147         if [ -b "/dev/mapper/$dst" ]; then
 148             if LC_ALL=C /sbin/dmsetup info "$dst" | grep -q '^Open count: *0$'; then
 149                 /sbin/cryptsetup remove "$dst"
 150             else
 151                 fnval=1
 152             fi
 153         fi
 154     done < /etc/crypttab
 155     return $fnval
 156 }
 157
 158 [ -f /etc/crypttab ] || return
 159
 160 # if not invoked directly, return to caller
 161 case "$0" in *cryptsetup);; *) return;; esac
 162
 163 . /etc/rc.d/init.d/functions
 164
 165 RETVAL=0
 166 # See how we were called.
 167 case "$1" in
 168   start)
 169         show "Starting disk encryption"; started
 170         init_crypto 1 && deltext; ok
 171         ;;
 172   stop)
 173         show "Stopping disk encryption"; started
 174         halt_crypto && deltext; ok
 175         ;;
 176   status)
 177         # this is way overkill, but at least we have some status output...
 178         if grep -qF dm_crypt /proc/modules; then
 179                 nls "dm-crypt module is loaded"
 180         else
 181                 nls "dm-crypt module is not loaded"
 182         fi
 183         ;;
 184   *)
 185         msg_usage "$0 {start|stop|status}"
 186         exit 3
 187 esac
 188
 189 exit $RETVAL