diff -rupN cryptsetup-1.6.2.old/misc/dracut_90reencrypt/module-setup.sh cryptsetup-1.6.2/misc/dracut_90reencrypt/module-setup.sh
--- cryptsetup-1.6.2.old/misc/dracut_90reencrypt/module-setup.sh 2013-10-22 17:49:43.677906826 +0200
+++ cryptsetup-1.6.2/misc/dracut_90reencrypt/module-setup.sh 2013-10-22 17:53:11.214137892 +0200
@@ -7,14 +7,21 @@ check() {
depends() {
echo dm rootfs-block
- return 0
}
installkernel() {
- instmods dm_crypt =crypto
+ # requires hostonly='' override so that loop module is pulled in initramfs
+ # even if not loaded in actual kernel. dracut bug?
+ hostonly='' instmods dm_crypt =crypto loop
}
install() {
+ if dracut_module_included crypt; then
+ derror "'reencrypt' can't be installed together with 'crypt'."
+ derror "Add '-o crypt' option to install reencrypt module."
+ return 1
+ fi
+
dracut_install cryptsetup-reencrypt
inst_hook cmdline 30 "$moddir/parse-reencrypt.sh"
inst_simple "$moddir"/reencrypt.sh /sbin/reencrypt
diff -rupN cryptsetup-1.6.2.old/misc/dracut_90reencrypt/parse-reencrypt.sh cryptsetup-1.6.2/misc/dracut_90reencrypt/parse-reencrypt.sh
--- cryptsetup-1.6.2.old/misc/dracut_90reencrypt/parse-reencrypt.sh 2013-10-22 17:49:43.677906826 +0200
+++ cryptsetup-1.6.2/misc/dracut_90reencrypt/parse-reencrypt.sh 2013-10-22 17:57:58.391063270 +0200
@@ -1,10 +1,10 @@
#!/bin/sh
-REENC=$(getargs rd_REENCRYPT=)
+REENC=$(getargs rd.luks.reencrypt=)
REENC_DEV=$(echo $REENC | sed 's/:.*//')
REENC_SIZE=$(echo $REENC | sed -n 's/.*://p')
-REENC_KEY=$(getargs rd_REENCRYPT_KEY=)
+REENC_KEY=$(getargs rd.luks.reencrypt_key=)
if [ -z "$REENC_KEY" ] ; then
REENC_KEY=none
fi
diff -rupN cryptsetup-1.6.2.old/misc/dracut_90reencrypt/README cryptsetup-1.6.2/misc/dracut_90reencrypt/README
--- cryptsetup-1.6.2.old/misc/dracut_90reencrypt/README 2013-10-22 17:49:43.677906826 +0200
+++ cryptsetup-1.6.2/misc/dracut_90reencrypt/README 2013-10-22 18:01:08.224347499 +0200
@@ -2,10 +2,12 @@ Example of simple dracut module for reen
LUKS drive on-the-fly.
Install in /usr/[share|lib]/dracut/modules.d/90reencrypt, then
-rebuild intramfs "with dracut -f -a reencrypt".
+build special intramfs "with dracut -a reencrypt -o crypt".
+Reencrypt module doesn't work (has a conflict) with crypt module as
+of now. After successfull reencryption reboot using original initramfs.
-Dracut then recognize argument rd_REENCRYPT=name:size,
-e.g. rd_REENCRYPT=sda2:52G means only 52G of device
+Dracut then recognize argument rd.luks.reencrypt=name:size,
+e.g. rd.luks.reencrypt=sda2:52G means only 52G of device
will be reencrypted (default is whole device).
(Name is kernel name of device.)
diff -rupN cryptsetup-1.6.2.old/misc/dracut_90reencrypt/reencrypt.sh cryptsetup-1.6.2/misc/dracut_90reencrypt/reencrypt.sh
--- cryptsetup-1.6.2.old/misc/dracut_90reencrypt/reencrypt.sh 2013-10-22 17:49:43.677906826 +0200
+++ cryptsetup-1.6.2/misc/dracut_90reencrypt/reencrypt.sh 2013-10-22 18:00:18.871533944 +0200
@@ -5,6 +5,8 @@
[ -d /sys/module/dm_crypt ] || modprobe dm_crypt
+[ -d /sys/module/loop ] || modprobe loop
+
[ -f /tmp/reencrypted ] && exit 0
. /lib/dracut-lib.sh
@@ -43,6 +45,7 @@ reenc_run() {
info "REENCRYPT using key $1"
reenc_readkey "$1" | /sbin/cryptsetup-reencrypt -d - $PARAMS
fi
+ _ret=$?
cd $cwd
}
@@ -50,9 +53,18 @@ info "REENCRYPT $device requested"
# flock against other interactive activities
{ flock -s 9;
reenc_run $2
-} 9>/.console.lock
+} 9>/.console_lock
+
+if [ $_ret -eq 0 ]; then
+ # do not ask again
+ >> /tmp/reencrypted
+ warn "Reencryption of device $device has finished successfully. Use previous"
+ warn "initramfs image (without reencrypt module) to boot the system. When"
+ warn "you leave the emergency shell, the system will reboot."
-# do not ask again
->> /tmp/reencrypted
+ emergency_shell -n "(reboot)"
+ /usr/bin/systemctl reboot
+fi
-exit 0
+# panic the kernel otherwise
+exit 1