summarylogtreecommitdiffstats
path: root/plymouth.encrypt_hook
blob: 1b83cdcaae41f3d59e471dd0409be2b7cf2fe3d8 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
#!/usr/bin/ash
# shellcheck shell=dash

_get_key() {
    msg ":: getting key for encrypted device..."
    IFS=: read ckdev ckarg1 ckarg2 <<EOF
$cryptkey
EOF
    # shellcheck disable=SC2154
    if [ "$ckdev" = "rootfs" ]; then
        ckeyfile=$ckarg1
    elif resolved=$(resolve_device "${ckdev}" ${rootdelay}); then
        case ${ckarg1} in
            *[!0-9]*)
                # Use a file on the device
                # ckarg1 is not numeric: ckarg1=filesystem, ckarg2=path
                IFS=, read ckfs1 ckfs2 <<EOF
$ckarg1
EOF
                IFS=, read ckpath1 ckpath2 <<EOF
$ckarg2
EOF
                mkdir /ckey
                msg ":: mount ${resolved} (${ckfs1})..."
                mount --mkdir -r -t "$ckfs1" "$resolved" /ckey
                ckey="/ckey/${ckpath1}"
                is_fs=$(blkid -o value -s TYPE "${ckey}")
                if [ "${is_fs}" != "" ]; then
                    msg ":: mount ${ckey} (${is_fs})..."
                    if cryptsetup isLuks "${ckey}" >/dev/null 2>&1; then
                        msg ":: device ${key} is a LUKS volume..."
                        plymouth ask-for-password --prompt="Password for ckey volume" --dont-pause-progress --number-of-tries=15 --command="/sbin/cryptsetup luksOpen --key-file=- ${ckey} ckey"
                        ckey="/dev/mapper/ckey"
                    fi
                    mount --mkdir -r -t "$ckfs2" "${ckey}" /ckey2
                    ckey="/ckey2/${ckpath2}"
                fi
                dd if="${ckey}" of="${ckeyfile}" >/dev/null 2>&1
                if mountpoint -q /ckey2; then
                    umount /ckey2
                    cryptsetup close --type luks ckey;
                fi
                umount /ckey
                ;;
            *)
                # Read raw data from the block device
                # ckarg1 is numeric: ckarg1=offset, ckarg2=length
                dd if="${resolved}" of="${ckeyfile}" bs=1 skip="${ckarg1}" count="${ckarg2}" >/dev/null 2>&1
                ;;
        esac
    fi

    [ ! -f "${ckeyfile}" ] && echo "Keyfile could not be opened. Reverting to passphrase."
}

_get_sig() {
    msg ":: getting signature for airootfs encrypted container..."
    DEPRECATED_CRYPT=0
    IFS=: read sigdev sigarg1 sigarg2 <<EOF
$sigdevice
EOF
    if resolved=$(resolve_device "${sigdev}" ${rootdelay}); then
        case ${sigarg1} in
            *[!0-9]*)
                # Use a file on the device
                # sigarg1 is not numeric: sigarg1=filesystem, sigarg2=path
                IFS=, read sigfs1 sigfs2 <<EOF
$sigarg1
EOF
                IFS=, read sigpath1 sigpath2 <<EOF
$sigarg2
EOF

                msg ":: mount ${resolved} (${sigfs1}) over /sigdev..."
                mount --mkdir -r -t "$sigfs1" "$resolved" /sigdev
                sigpath="/sigdev/${sigpath1}"
                is_fs=$(blkid -o value -s TYPE "${sigpath}")
                if [ "${is_fs}" != "" ]; then
                    if cryptsetup isLuks "${sigpath}" >/dev/null 2>&1; then
                        plymouth ask-for-password --prompt="Password for ckey volume" --dont-pause-progress --number-of-tries=15 --command="/sbin/cryptsetup luksOpen --key-file=- ${sigpath} sigdev"
                        sigpath="/dev/mapper/sigdev"
                    fi
                    msg ":: mount ${sigpath} (${sigfs2}) over /sigdev2"
                    mount --mkdir -r -t "$sigfs2" "${sigpath}" /sigdev2
                    sigpath="/sigdev2/${sigpath2}"
                fi
                dd if="${sigpath}" of="${sigfile}" >/dev/null 2>&1
                if mountpoint -q /sigdev2; then
                    umount /sigdev2
                    cryptsetup close --type luks sigdev;
                fi
                umount /sigdev
                ;;
            *)
                # Read raw data from the block device
                # sigarg1 is numeric: sigarg1=offset, sigarg2=length
                dd if="${resolved}" of="${sigfile}" bs=1 skip="${sigarg1}" count="${sigarg2}" >/dev/null 2>&1
                ;;
        esac
    else
        err "Can't mount device ${sigdev} over /sigdev"
        launch_interactive_shell
    fi
    if [ ! -f "${sigfile}" ]; then
        err "Signature file could not be opened. "
        launch_interactive_shell
    fi
}

_verify_signature() {
    local _status
    local _file="${1}"
    local _sigfile="${2}"
    local _dir _filename

    _dir="$(dirname "${_file}")"
    _filename="$(basename "${_file}")"
    cd "${_dir}" || exit 1
    gpg --homedir /gpg --status-fd 1 --verify "${_sigfile}" "${_filename}" 2>/dev/null | grep -E '^\[GNUPG:\] GOODSIG'
    _status=$?
    cd -- "${OLDPWD}" || exit 1
    return ${_status}
}

_cryptdev() {
    if [ -n "${cryptdevice}" ]; then
        DEPRECATED_CRYPT=0
        IFS=: read cryptdev cryptname cryptoptions <<EOF
$cryptdevice
EOF
    else
        DEPRECATED_CRYPT=1
        cryptdev="${root}"
        cryptname="root"
    fi

    IFS=, read cryptdev cryptdevpath <<EOF
$cryptdev
EOF

    if [ -n "${cryptdevpath}" ]; then
        if mount --mkdir -o "defaults" "${cryptdev}" /run/cryptdev; then
            msg ":: device ${cryptdev} mounted over /run/cryptdev"
            cryptdev="/run/cryptdev/${cryptdevpath}"
        else
            err "Can't mount device ${cryptdev} over /run/cryptdev"
            launch_interactive_shell
        fi
    fi
}

_set_cryptargs() {
    set -f
    OLDIFS="$IFS"; IFS=,
    for cryptopt in ${cryptoptions}; do
        case ${cryptopt} in
            allow-discards|discard)
                cryptargs="${cryptargs} --allow-discards"
                ;;
            no-read-workqueue|perf-no_read_workqueue)
                cryptargs="${cryptargs} --perf-no_read_workqueue"
                ;;
            no-write-workqueue|perf-no_write_workqueue)
                cryptargs="${cryptargs} --perf-no_write_workqueue"
                ;;
            readonly|read-only)
                cryptargs="${cryptargs} --readonly"
                ;;
            *)
                msg "::Encryption option '${cryptopt}' not known, ignoring." >&2
                ;;
        esac
    done
    set +f
    IFS="$OLDIFS"
    unset OLDIFS
}

warn_deprecated() {
    msg "The syntax 'root=${root}' where '${root}' is an encrypted volume is deprecated"
    msg "Use 'cryptdevice=${root}:root root=/dev/mapper/root' instead."
}

_open_root() {
    resolved=$(cryptsetup isLuks "${cryptdev}" >/dev/null 2>&1 && echo "${cryptdev}")
    [ "${resolved}" = "" ] && resolved=$(resolve_device "${cryptdev}" ${rootdelay})
    if [ "${resolved}" != "" ]; then
        if cryptsetup isLuks ${resolved} >/dev/null 2>&1; then
            [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
            dopassphrase=1
            # If keyfile exists, try to use that
            if [ -f "${ckeyfile}" ]; then
                if eval cryptsetup --key-file ${ckeyfile} open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}; then
                    dopassphrase=0
                else
                    echo "Invalid keyfile. Reverting to passphrase."
                fi
            fi
            # Ask for a passphrase
            if [ ${dopassphrase} -gt 0 ]; then
                echo ""
                echo "A password is required to access the ${cryptname} volume:"
                plymouth ask-for-password --prompt="Password for ${cryptname} volume" --dont-pause-progress --number-of-tries=15 --command="/sbin/cryptsetup luksOpen --key-file=- ${resolved} ${cryptname} ${cryptargs} ${CSQUIET}"
            fi
            if [ -e "/dev/mapper/${cryptname}" ]; then
                if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
                    export root="/dev/mapper/root"
                fi
            else
                err "Password succeeded, but ${cryptname} creation failed, aborting..."
                return 1
            fi
        elif [ -n "${crypto}" ]; then
            [ ${DEPRECATED_CRYPT} -eq 1 ] && warn_deprecated
            msg "Non-LUKS encrypted device found..."
            if echo "$crypto" | awk -F: '{ exit(NF == 5) }'; then
                err "Verify parameter format: crypto=hash:cipher:keysize:offset:skip"
                err "Non-LUKS decryption not attempted..."
                return 1
            fi
            exe="cryptsetup open --type plain $resolved $cryptname $cryptargs"
            IFS=: read c_hash c_cipher c_keysize c_offset c_skip <<EOF
$crypto
EOF
            [ -n "$c_hash" ]    && exe="$exe --hash '$c_hash'"
            [ -n "$c_cipher" ]  && exe="$exe --cipher '$c_cipher'"
            [ -n "$c_keysize" ] && exe="$exe --key-size '$c_keysize'"
            [ -n "$c_offset" ]  && exe="$exe --offset '$c_offset'"
            [ -n "$c_skip" ]    && exe="$exe --skip '$c_skip'"
            if [ -f "$ckeyfile" ]; then
                exe="$exe --key-file $ckeyfile"
            else
                echo ""
                echo "A password is required to access the ${cryptname} volume:"
            fi
            eval "$exe $CSQUIET"

            if [ $? -ne 0 ]; then
                err "Non-LUKS device decryption failed. verify format: "
                err "      crypto=hash:cipher:keysize:offset:skip"
                return 1
            fi
            if [ -e "/dev/mapper/${cryptname}" ]; then
                if [ ${DEPRECATED_CRYPT} -eq 1 ]; then
                    export root="/dev/mapper/root"
                fi
            else
                err "Password succeeded, but ${cryptname} creation failed, aborting..."
                return 1
            fi
        else
            err "Failed to open encryption mapping: The device ${cryptdev} is not a LUKS volume and the crypto= paramater was not specified."
        fi
    fi
}

_compare_signatures() {
    local _cryptdev_sig_sha _keys_sig_sha
    _cryptdev_sig_sha=$(sha512sum "${cryptdev}.sig")
    _keys_sig_sha=$(sha512sum "/crypto_sigfile.bin")
    if [ "${_keys_sig_sha%% *}" != "${_cryptdev_sig_sha%% *}" ]; then
        err "Signatures on devices are different."
        return 1
    else
        msg "Signatures match, continue booting."
    fi
}

_verify() {
    _compare_signatures
    if _verify_signature "${cryptdev}" "/crypto_sigfile.bin"; then
        msg ":: Signature is OK, continue booting."
        export verify="n"
    else
        err "One or more files are corrupted"
        return 1
    fi
}

run_hook() {
    modprobe -a -q dm-crypt >/dev/null 2>&1
    # shellcheck disable=SC2154
    [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"
    _cryptdev

    # Get signature file if specified
    sigfile="/crypto_sigfile.bin"
    if [ -n "$sigdevice" ]; then
        _get_sig
    fi

    # shellcheck disable=SC2154
    [ "${verify}" = "y" ] && _verify

    # Get key file if specified
    ckeyfile="/crypto_keyfile.bin"
    if [ -n "$cryptkey" ]; then
        _get_key
    fi

    # This may happen if third party hooks do the crypt setup
    if [ -b "/dev/mapper/${cryptname}" ]; then
        echo "Device ${cryptname} already exists, not doing any crypt setup."
        return 0
    fi

    _set_cryptargs
    _open_root
    rm -f ${ckeyfile}
    rm -f "${sigfile}"
}

# vim: set ft=sh ts=4 sw=4 et: