diff -rupN cryptsetup-1.6.2.old/misc/dracut_90reencrypt/module-setup.sh cryptsetup-1.6.2/misc/dracut_90reencrypt/module-setup.sh --- cryptsetup-1.6.2.old/misc/dracut_90reencrypt/module-setup.sh 2013-10-22 17:49:43.677906826 +0200 +++ cryptsetup-1.6.2/misc/dracut_90reencrypt/module-setup.sh 2013-10-22 17:53:11.214137892 +0200 @@ -7,14 +7,21 @@ check() { depends() { echo dm rootfs-block - return 0 } installkernel() { - instmods dm_crypt =crypto + # requires hostonly='' override so that loop module is pulled in initramfs + # even if not loaded in actual kernel. dracut bug? + hostonly='' instmods dm_crypt =crypto loop } install() { + if dracut_module_included crypt; then + derror "'reencrypt' can't be installed together with 'crypt'." + derror "Add '-o crypt' option to install reencrypt module." + return 1 + fi + dracut_install cryptsetup-reencrypt inst_hook cmdline 30 "$moddir/parse-reencrypt.sh" inst_simple "$moddir"/reencrypt.sh /sbin/reencrypt diff -rupN cryptsetup-1.6.2.old/misc/dracut_90reencrypt/parse-reencrypt.sh cryptsetup-1.6.2/misc/dracut_90reencrypt/parse-reencrypt.sh --- cryptsetup-1.6.2.old/misc/dracut_90reencrypt/parse-reencrypt.sh 2013-10-22 17:49:43.677906826 +0200 +++ cryptsetup-1.6.2/misc/dracut_90reencrypt/parse-reencrypt.sh 2013-10-22 17:57:58.391063270 +0200 @@ -1,10 +1,10 @@ #!/bin/sh -REENC=$(getargs rd_REENCRYPT=) +REENC=$(getargs rd.luks.reencrypt=) REENC_DEV=$(echo $REENC | sed 's/:.*//') REENC_SIZE=$(echo $REENC | sed -n 's/.*://p') -REENC_KEY=$(getargs rd_REENCRYPT_KEY=) +REENC_KEY=$(getargs rd.luks.reencrypt_key=) if [ -z "$REENC_KEY" ] ; then REENC_KEY=none fi diff -rupN cryptsetup-1.6.2.old/misc/dracut_90reencrypt/README cryptsetup-1.6.2/misc/dracut_90reencrypt/README --- cryptsetup-1.6.2.old/misc/dracut_90reencrypt/README 2013-10-22 17:49:43.677906826 +0200 +++ cryptsetup-1.6.2/misc/dracut_90reencrypt/README 2013-10-22 18:01:08.224347499 +0200 @@ -2,10 +2,12 @@ Example of simple dracut module for reen LUKS drive on-the-fly. Install in /usr/[share|lib]/dracut/modules.d/90reencrypt, then -rebuild intramfs "with dracut -f -a reencrypt". +build special intramfs "with dracut -a reencrypt -o crypt". +Reencrypt module doesn't work (has a conflict) with crypt module as +of now. After successfull reencryption reboot using original initramfs. -Dracut then recognize argument rd_REENCRYPT=name:size, -e.g. rd_REENCRYPT=sda2:52G means only 52G of device +Dracut then recognize argument rd.luks.reencrypt=name:size, +e.g. rd.luks.reencrypt=sda2:52G means only 52G of device will be reencrypted (default is whole device). (Name is kernel name of device.) diff -rupN cryptsetup-1.6.2.old/misc/dracut_90reencrypt/reencrypt.sh cryptsetup-1.6.2/misc/dracut_90reencrypt/reencrypt.sh --- cryptsetup-1.6.2.old/misc/dracut_90reencrypt/reencrypt.sh 2013-10-22 17:49:43.677906826 +0200 +++ cryptsetup-1.6.2/misc/dracut_90reencrypt/reencrypt.sh 2013-10-22 18:00:18.871533944 +0200 @@ -5,6 +5,8 @@ [ -d /sys/module/dm_crypt ] || modprobe dm_crypt +[ -d /sys/module/loop ] || modprobe loop + [ -f /tmp/reencrypted ] && exit 0 . /lib/dracut-lib.sh @@ -43,6 +45,7 @@ reenc_run() { info "REENCRYPT using key $1" reenc_readkey "$1" | /sbin/cryptsetup-reencrypt -d - $PARAMS fi + _ret=$? cd $cwd } @@ -50,9 +53,18 @@ info "REENCRYPT $device requested" # flock against other interactive activities { flock -s 9; reenc_run $2 -} 9>/.console.lock +} 9>/.console_lock + +if [ $_ret -eq 0 ]; then + # do not ask again + >> /tmp/reencrypted + warn "Reencryption of device $device has finished successfully. Use previous" + warn "initramfs image (without reencrypt module) to boot the system. When" + warn "you leave the emergency shell, the system will reboot." -# do not ask again ->> /tmp/reencrypted + emergency_shell -n "(reboot)" + /usr/bin/systemctl reboot +fi -exit 0 +# panic the kernel otherwise +exit 1