From bf5c53a33f36d15a87297d4492624d137c3cd9fa Mon Sep 17 00:00:00 2001

From: Harald Hoyer <harald@hoyer.xyz>

Date: Mon, 9 Oct 2017 12:51:29 +0200

Subject: [PATCH] Merge pull request #290 from privb0x23/luks-detached

Add basic LUKS detached header support

---

 modules.d/90crypt/cryptroot-ask.sh | 20 ++++++++++++++++-

 modules.d/90crypt/module-setup.sh  | 46 ++++++++++++++++++++++++++++++--------

 modules.d/90crypt/parse-crypt.sh   | 33 ++++++++++++++++++++++++++-

 3 files changed, 88 insertions(+), 11 deletions(-)

diff --git a/modules.d/90crypt/cryptroot-ask.sh b/modules.d/90crypt/cryptroot-ask.sh

index 5b513638..9f635eb3 100755

--- a/modules.d/90crypt/cryptroot-ask.sh

+++ b/modules.d/90crypt/cryptroot-ask.sh

@@ -29,13 +29,27 @@ if [ -f /etc/crypttab ] && getargbool 1 rd.luks.crypttab -d -n rd_NO_CRYPTTAB; t

             continue

         fi

+        # PARTUUID used in crypttab

+        if [ "${dev%%=*}" = "PARTUUID" ]; then

+            if [ "luks-${dev##PARTUUID=}" = "$luksname" ]; then

+                luksname="$name"

+                break

+            fi

+

         # UUID used in crypttab

-        if [ "${dev%%=*}" = "UUID" ]; then

+        elif [ "${dev%%=*}" = "UUID" ]; then

             if [ "luks-${dev##UUID=}" = "$luksname" ]; then

                 luksname="$name"

                 break

             fi

+        # ID used in crypttab

+        elif [ "${dev%%=*}" = "ID" ]; then

+            if [ "luks-${dev##ID=}" = "$luksname" ]; then

+                luksname="$name"

+                break

+            fi

+

         # path used in crypttab

         else

             cdev=$(readlink -f $dev)

@@ -88,6 +102,10 @@ while [ $# -gt 0 ]; do

             ;;

         allow-discards)

             allowdiscards="--allow-discards"

+            ;;

+        header=*)

+            cryptsetupopts="${cryptsetupopts} --${1}"

+            ;;

     esac

     shift

 done

diff --git a/modules.d/90crypt/module-setup.sh b/modules.d/90crypt/module-setup.sh

index 9c1be998..69aceaab 100755

--- a/modules.d/90crypt/module-setup.sh

+++ b/modules.d/90crypt/module-setup.sh

@@ -68,22 +68,50 @@ install() {

     if [[ $hostonly ]] && [[ -f /etc/crypttab ]]; then

         # filter /etc/crypttab for the devices we need

-        while read _mapper _dev _rest || [ -n "$_mapper" ]; do

+        while read _mapper _dev _luksfile _luksoptions || [ -n "$_mapper" ]; do

             [[ $_mapper = \#* ]] && continue

             [[ $_dev ]] || continue

+            [[ $_dev == PARTUUID=* ]] && \

+                _dev="/dev/disk/by-partuuid/${_dev#PARTUUID=}"

+

             [[ $_dev == UUID=* ]] && \

                 _dev="/dev/disk/by-uuid/${_dev#UUID=}"

-            echo "$_dev $(blkid $_dev -s UUID -o value)" > /usr/lib/dracut/modules.d/90crypt/block_uuid.map

-

-            for _hdev in "${!host_fs_types[@]}"; do

-                [[ ${host_fs_types[$_hdev]} == "crypto_LUKS" ]] || continue

-                if [[ $_hdev -ef $_dev ]] || [[ /dev/block/$_hdev -ef $_dev ]]; then

-                    echo "$_mapper $_dev $_rest"

-                    break

-                fi

+            [[ $_dev == ID=* ]] && \

+                _dev="/dev/disk/by-id/${_dev#ID=}"

+

+            echo "$_dev $(blkid $_dev -s UUID -o value)" >> /usr/lib/dracut/modules.d/90crypt/block_uuid.map

+

+            # loop through the options to check for the force option

+            luksoptions=${_luksoptions}

+            OLD_IFS="${IFS}"

+            IFS=,

+            set -- ${luksoptions}

+            IFS="${OLD_IFS}"

+

+            while [ $# -gt 0 ]; do

+                case $1 in

+                    force)

+                        forceentry="yes"

+                        break

+                        ;;

+                esac

+                shift

             done

+

+            # include the entry regardless

+            if [ "${forceentry}" = "yes" ]; then

+                echo "$_mapper $_dev $_luksfile $_luksoptions"

+            else

+                for _hdev in "${!host_fs_types[@]}"; do

+                    [[ ${host_fs_types[$_hdev]} == "crypto_LUKS" ]] || continue

+                    if [[ $_hdev -ef $_dev ]] || [[ /dev/block/$_hdev -ef $_dev ]]; then

+                        echo "$_mapper $_dev $_luksfile $_luksoptions"

+                        break

+                    fi

+                done

+            fi

         done < /etc/crypttab > $initdir/etc/crypttab

         mark_hostonly /etc/crypttab

     fi

diff --git a/modules.d/90crypt/parse-crypt.sh b/modules.d/90crypt/parse-crypt.sh

index 8a0db02b..f0a4fba9 100755

--- a/modules.d/90crypt/parse-crypt.sh

+++ b/modules.d/90crypt/parse-crypt.sh

@@ -35,6 +35,7 @@ else

         echo 'ACTION!="add|change", GOTO="luks_end"'

     } > /etc/udev/rules.d/70-luks.rules.new

+    SERIAL=$(getargs rd.luks.serial -d rd_LUKS_SERIAL)

     LUKS=$(getargs rd.luks.uuid -d rd_LUKS_UUID)

     tout=$(getarg rd.luks.key.tout)

@@ -44,7 +45,37 @@ else

         done < /etc/crypttab

     fi

-    if [ -n "$LUKS" ]; then

+    if [ -n "$SERIAL" ]; then

+        for serialid in $SERIAL; do

+

+            serialid=${serialid##luks-}

+            if luksname=$(_cryptgetargsname "rd.luks.name=$serialid="); then

+                luksname="${luksname#$serialid=}"

+            else

+                luksname="luks-$serialid"

+            fi

+

+            if [ -z "$DRACUT_SYSTEMD" ]; then

+                {

+                    printf -- 'ENV{ID_SERIAL_SHORT}=="*%s*", ' "$serialid"

+                    printf -- 'RUN+="%s --settled --unique --onetime ' "$(command -v initqueue)"

+                    printf -- '--name cryptroot-ask-%%k %s ' "$(command -v cryptroot-ask)"

+                    printf -- '$env{DEVNAME} %s %s"\n' "$luksname" "$tout"

+                } >> /etc/udev/rules.d/70-luks.rules.new

+            else

+                luksname=$(dev_unit_name "$luksname")

+                if ! crypttab_contains "$serialid"; then

+                    {

+                        printf -- 'ENV{ID_SERIAL_SHORT}=="*%s*", ' "$serialid"

+                        printf -- 'RUN+="%s --settled --unique --onetime ' "$(command -v initqueue)"

+                        printf -- '--name systemd-cryptsetup-%%k %s start ' "$(command -v systemctl)"

+                        printf -- 'systemd-cryptsetup@%s.service"\n' "$luksname"

+                    } >> /etc/udev/rules.d/70-luks.rules.new

+                fi

+            fi

+        done

+

+    elif [ -n "$LUKS" ]; then

         for luksid in $LUKS; do

             luksid=${luksid##luks-}