cryptroot-ask.sh: fixed luks handling

see https://bugzilla.redhat.com/show_bug.cgi?id=530898#c16
master
Harald Hoyer 2010-01-12 14:55:09 +01:00
parent 66e45737e1
commit bb2200ffca
2 changed files with 71 additions and 32 deletions

View File

@ -11,26 +11,45 @@


. /lib/dracut-lib.sh . /lib/dracut-lib.sh


# default luksname - luks-UUID
luksname=$2 luksname=$2


# if device name is /dev/dm-X, convert to /dev/mapper/name
if [ "${1##/dev/dm-}" != "$1" ]; then
device="/dev/mapper/$(dmsetup info -c --noheadings -o name "$1")"
else
device="$1"
fi

if [ -f /etc/crypttab ] && ! getargs rd_NO_CRYPTTAB; then if [ -f /etc/crypttab ] && ! getargs rd_NO_CRYPTTAB; then
found=0
while read name dev rest; do while read name dev rest; do
# ignore blank lines and comments
if [ -z "$name" -o "${name#\#}" != "$name" ]; then
continue
fi

# UUID used in crypttab
if [ "${dev%%=*}" = "UUID" ]; then
if [ "luks-${dev##UUID=}" = "$2" ]; then
luksname="$name"
break
fi
# path used in crypttab
else
cdev=$(readlink -f $dev) cdev=$(readlink -f $dev)
mdev=$(readlink -f $1) mdev=$(readlink -f $device)
if [ "$cdev" = "$mdev" ]; then if [ "$cdev" = "$mdev" ]; then
# for now just ignore everything which is in crypttab luksname="$name"
# anaconda does not write an entry for root break
exit 0 fi
#luksname="$name"
#break
fi fi
done < /etc/crypttab done < /etc/crypttab
unset name dev rest
fi fi


LUKS=$(getargs rd_LUKS_UUID=) LUKS=$(getargs rd_LUKS_UUID=)
ask=1 ask=1

if [ -n "$LUKS" ]; then if [ -n "$LUKS" ]; then
ask=0 ask=0
luuid=${2##luks-} luuid=${2##luks-}
@ -42,25 +61,23 @@ if [ -n "$LUKS" ]; then
fi fi
done done
fi fi
unset LUKS luks luuid


if [ $ask -gt 0 ]; then if [ $ask -gt 0 ]; then
info "luksOpen $1 $2" info "luksOpen $device $luksname"
# flock against other interactive activities # flock against other interactive activities
{ flock -s 9; { flock -s 9;
/bin/plymouth ask-for-password \ /bin/plymouth ask-for-password \
--prompt "$1 is password protected" \ --prompt "$device ($luksname) is password protected" \
--command="/sbin/cryptsetup luksOpen -T1 $1 $luksname" --command="/sbin/cryptsetup luksOpen -T1 $device $luksname"
} 9>/.console.lock } 9>/.console.lock
fi fi
unset ask device luksname


# mark device as asked # mark device as asked
>> /tmp/cryptroot-asked-$2 >> /tmp/cryptroot-asked-$2


udevsettle udevsettle


unset LUKS
unset ask
unset luks
exit 0 exit 0
# vim:ts=8:sw=4:sts=4:et # vim:ts=8:sw=4:sts=4:et


View File

@ -11,25 +11,45 @@


. /lib/dracut-lib.sh . /lib/dracut-lib.sh


# default luksname - luks-UUID
luksname=$2 luksname=$2

# if device name is /dev/dm-X, convert to /dev/mapper/name
if [ "${1##/dev/dm-}" != "$1" ]; then
device="/dev/mapper/$(dmsetup info -c --noheadings -o name "$1")"
else
device="$1"
fi

if [ -f /etc/crypttab ] && ! getargs rd_NO_CRYPTTAB; then if [ -f /etc/crypttab ] && ! getargs rd_NO_CRYPTTAB; then
found=0
while read name dev rest; do while read name dev rest; do
# ignore blank lines and comments
if [ -z "$name" -o "${name#\#}" != "$name" ]; then
continue
fi

# UUID used in crypttab
if [ "${dev%%=*}" = "UUID" ]; then
if [ "luks-${dev##UUID=}" = "$2" ]; then
luksname="$name"
break
fi
# path used in crypttab
else
cdev=$(readlink -f $dev) cdev=$(readlink -f $dev)
mdev=$(readlink -f $1) mdev=$(readlink -f $device)
if [ "$cdev" = "$mdev" ]; then if [ "$cdev" = "$mdev" ]; then
# for now just ignore everything which is in crypttab luksname="$name"
# anaconda does not write an entry for root break
exit 0 fi
#luksname="$name"
#break
fi fi
done < /etc/crypttab done < /etc/crypttab
unset name dev rest
fi fi


LUKS=$(getargs rd_LUKS_UUID=) LUKS=$(getargs rd_LUKS_UUID=)
ask=1 ask=1

if [ -n "$LUKS" ]; then if [ -n "$LUKS" ]; then
ask=0 ask=0
luuid=${2##luks-} luuid=${2##luks-}
@ -41,12 +61,13 @@ if [ -n "$LUKS" ]; then
fi fi
done done
fi fi
unset LUKS luks luuid


if [ $ask -gt 0 ]; then if [ $ask -gt 0 ]; then
info "luksOpen $1 $2" info "luksOpen $device $luksname"
# flock against other interactive activities # flock against other interactive activities
{ flock -s 9; { flock -s 9;
echo -n "$1 is password protected " echo -n "$device ($luksname) is password protected"
/sbin/cryptsetup luksOpen -T1 $1 $luksname /sbin/cryptsetup luksOpen -T1 $1 $luksname
} 9>/.console.lock } 9>/.console.lock
fi fi
@ -55,3 +76,4 @@ fi
>> /tmp/cryptroot-asked-$2 >> /tmp/cryptroot-asked-$2


exit 0 exit 0
# vim:ts=8:sw=4:sts=4:et