|
|
a39032 |
diff -rupN cryptsetup-1.6.2.old/misc/dracut_90reencrypt/module-setup.sh cryptsetup-1.6.2/misc/dracut_90reencrypt/module-setup.sh
|
|
|
a39032 |
--- cryptsetup-1.6.2.old/misc/dracut_90reencrypt/module-setup.sh 2013-10-22 17:49:43.677906826 +0200
|
|
|
a39032 |
+++ cryptsetup-1.6.2/misc/dracut_90reencrypt/module-setup.sh 2013-10-22 17:53:11.214137892 +0200
|
|
|
a39032 |
@@ -7,14 +7,21 @@ check() {
|
|
|
a39032 |
|
|
|
a39032 |
depends() {
|
|
|
a39032 |
echo dm rootfs-block
|
|
|
a39032 |
- return 0
|
|
|
a39032 |
}
|
|
|
a39032 |
|
|
|
a39032 |
installkernel() {
|
|
|
a39032 |
- instmods dm_crypt =crypto
|
|
|
a39032 |
+ # requires hostonly='' override so that loop module is pulled in initramfs
|
|
|
a39032 |
+ # even if not loaded in actual kernel. dracut bug?
|
|
|
a39032 |
+ hostonly='' instmods dm_crypt =crypto loop
|
|
|
a39032 |
}
|
|
|
a39032 |
|
|
|
a39032 |
install() {
|
|
|
a39032 |
+ if dracut_module_included crypt; then
|
|
|
a39032 |
+ derror "'reencrypt' can't be installed together with 'crypt'."
|
|
|
a39032 |
+ derror "Add '-o crypt' option to install reencrypt module."
|
|
|
a39032 |
+ return 1
|
|
|
a39032 |
+ fi
|
|
|
a39032 |
+
|
|
|
a39032 |
dracut_install cryptsetup-reencrypt
|
|
|
a39032 |
|
|
|
a39032 |
inst_hook cmdline 30 "$moddir/parse-reencrypt.sh"
|
|
|
a39032 |
inst_simple "$moddir"/reencrypt.sh /sbin/reencrypt
|
|
|
a39032 |
diff -rupN cryptsetup-1.6.2.old/misc/dracut_90reencrypt/parse-reencrypt.sh cryptsetup-1.6.2/misc/dracut_90reencrypt/parse-reencrypt.sh
|
|
|
a39032 |
--- cryptsetup-1.6.2.old/misc/dracut_90reencrypt/parse-reencrypt.sh 2013-10-22 17:49:43.677906826 +0200
|
|
|
a39032 |
+++ cryptsetup-1.6.2/misc/dracut_90reencrypt/parse-reencrypt.sh 2013-10-22 17:57:58.391063270 +0200
|
|
|
a39032 |
@@ -1,10 +1,10 @@
|
|
|
a39032 |
#!/bin/sh
|
|
|
a39032 |
|
|
|
a39032 |
-REENC=$(getargs rd_REENCRYPT=)
|
|
|
a39032 |
+REENC=$(getargs rd.luks.reencrypt=)
|
|
|
a39032 |
REENC_DEV=$(echo $REENC | sed 's/:.*//')
|
|
|
a39032 |
REENC_SIZE=$(echo $REENC | sed -n 's/.*://p')
|
|
|
a39032 |
|
|
|
a39032 |
-REENC_KEY=$(getargs rd_REENCRYPT_KEY=)
|
|
|
a39032 |
+REENC_KEY=$(getargs rd.luks.reencrypt_key=)
|
|
|
a39032 |
if [ -z "$REENC_KEY" ] ; then
|
|
|
a39032 |
REENC_KEY=none
|
|
|
a39032 |
fi
|
|
|
a39032 |
diff -rupN cryptsetup-1.6.2.old/misc/dracut_90reencrypt/README cryptsetup-1.6.2/misc/dracut_90reencrypt/README
|
|
|
a39032 |
--- cryptsetup-1.6.2.old/misc/dracut_90reencrypt/README 2013-10-22 17:49:43.677906826 +0200
|
|
|
a39032 |
+++ cryptsetup-1.6.2/misc/dracut_90reencrypt/README 2013-10-22 18:01:08.224347499 +0200
|
|
|
a39032 |
@@ -2,10 +2,12 @@ Example of simple dracut module for reen
|
|
|
a39032 |
LUKS drive on-the-fly.
|
|
|
a39032 |
|
|
|
a39032 |
Install in /usr/[share|lib]/dracut/modules.d/90reencrypt, then
|
|
|
a39032 |
-rebuild intramfs "with dracut -f -a reencrypt".
|
|
|
a39032 |
+build special intramfs "with dracut -a reencrypt -o crypt".
|
|
|
a39032 |
+Reencrypt module doesn't work (has a conflict) with crypt module as
|
|
|
a39032 |
+of now. After successfull reencryption reboot using original initramfs.
|
|
|
a39032 |
|
|
|
a39032 |
-Dracut then recognize argument rd_REENCRYPT=name:size,
|
|
|
a39032 |
-e.g. rd_REENCRYPT=sda2:52G means only 52G of device
|
|
|
a39032 |
+Dracut then recognize argument rd.luks.reencrypt=name:size,
|
|
|
a39032 |
+e.g. rd.luks.reencrypt=sda2:52G means only 52G of device
|
|
|
a39032 |
will be reencrypted (default is whole device).
|
|
|
a39032 |
(Name is kernel name of device.)
|
|
|
a39032 |
|
|
|
a39032 |
diff -rupN cryptsetup-1.6.2.old/misc/dracut_90reencrypt/reencrypt.sh cryptsetup-1.6.2/misc/dracut_90reencrypt/reencrypt.sh
|
|
|
a39032 |
--- cryptsetup-1.6.2.old/misc/dracut_90reencrypt/reencrypt.sh 2013-10-22 17:49:43.677906826 +0200
|
|
|
a39032 |
+++ cryptsetup-1.6.2/misc/dracut_90reencrypt/reencrypt.sh 2013-10-22 18:00:18.871533944 +0200
|
|
|
a39032 |
@@ -5,6 +5,8 @@
|
|
|
a39032 |
|
|
|
a39032 |
[ -d /sys/module/dm_crypt ] || modprobe dm_crypt
|
|
|
a39032 |
|
|
|
a39032 |
+[ -d /sys/module/loop ] || modprobe loop
|
|
|
a39032 |
+
|
|
|
a39032 |
[ -f /tmp/reencrypted ] && exit 0
|
|
|
a39032 |
|
|
|
a39032 |
. /lib/dracut-lib.sh
|
|
|
a39032 |
@@ -43,6 +45,7 @@ reenc_run() {
|
|
|
a39032 |
info "REENCRYPT using key $1"
|
|
|
a39032 |
reenc_readkey "$1" | /sbin/cryptsetup-reencrypt -d - $PARAMS
|
|
|
a39032 |
fi
|
|
|
a39032 |
+ _ret=$?
|
|
|
a39032 |
cd $cwd
|
|
|
a39032 |
}
|
|
|
a39032 |
|
|
|
a39032 |
@@ -50,9 +53,18 @@ info "REENCRYPT $device requested"
|
|
|
a39032 |
# flock against other interactive activities
|
|
|
a39032 |
{ flock -s 9;
|
|
|
a39032 |
reenc_run $2
|
|
|
a39032 |
-} 9>/.console.lock
|
|
|
a39032 |
+} 9>/.console_lock
|
|
|
a39032 |
+
|
|
|
a39032 |
+if [ $_ret -eq 0 ]; then
|
|
|
a39032 |
+ # do not ask again
|
|
|
a39032 |
+ >> /tmp/reencrypted
|
|
|
a39032 |
+ warn "Reencryption of device $device has finished successfully. Use previous"
|
|
|
a39032 |
+ warn "initramfs image (without reencrypt module) to boot the system. When"
|
|
|
a39032 |
+ warn "you leave the emergency shell, the system will reboot."
|
|
|
a39032 |
|
|
|
a39032 |
-# do not ask again
|
|
|
a39032 |
->> /tmp/reencrypted
|
|
|
a39032 |
+ emergency_shell -n "(reboot)"
|
|
|
a39032 |
+ /usr/bin/systemctl reboot
|
|
|
a39032 |
+fi
|
|
|
a39032 |
|
|
|
a39032 |
-exit 0
|
|
|
a39032 |
+# panic the kernel otherwise
|
|
|
a39032 |
+exit 1
|