Init
This commit is contained in:
MagicGTS
parent
5fb49494ed
commit
7dce0c6a4d
|
|
@ -0,0 +1,8 @@
|
|||
[Unit]
|
||||
Description=LUKS AUTO key cleaner
|
||||
After=cryptsetup.target
|
||||
DefaultDependencies=no
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/usr/bin/rm -rfd --one-file-system /tmp/luks-auto
|
||||
|
|
@ -0,0 +1,54 @@
|
|||
#!/bin/sh
|
||||
# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
|
||||
# ex: ts=8 sw=4 sts=4 et filetype=sh
|
||||
|
||||
. /lib/dracut-lib.sh
|
||||
|
||||
SYSTEMD_RUN='/run/systemd/system'
|
||||
CRYPTSETUP='/usr/lib/systemd/systemd-cryptsetup'
|
||||
TOUT=$(getargs rd.luks.key.tout)
|
||||
if [ ! -z "$TOUT" ]; then
|
||||
mkdir -p "${SYSTEMD_RUN}/luks-auto-key.service.d"
|
||||
cat > "${SYSTEMD_RUN}/luks-auto-key.service.d/drop-in.conf" <<EOF
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStartPre=/usr/bin/sleep $TOUT
|
||||
|
||||
EOF
|
||||
fi
|
||||
mkdir -p "$SYSTEMD_RUN/luks-auto.target.wants"
|
||||
for argv in $(getargs rd.luks.uuid -d rd_LUKS_UUID); do
|
||||
_UUID=${argv#luks-}
|
||||
_UUID_ESC=$(systemd-escape -p $_UUID)
|
||||
mkdir -p "${SYSTEMD_RUN}/systemd-cryptsetup@luks\x2d${_UUID_ESC}.service.d"
|
||||
cat > "${SYSTEMD_RUN}/systemd-cryptsetup@luks\x2d${_UUID_ESC}.service.d/drop-in.conf" <<EOF
|
||||
[Unit]
|
||||
After=luks-auto.target
|
||||
ConditionPathExists=!/dev/mapper/luks-${_UUID}
|
||||
|
||||
EOF
|
||||
cat > "${SYSTEMD_RUN}/luks-auto@${_UUID_ESC}.service" <<EOF
|
||||
[Unit]
|
||||
Description=luks-auto Cryptography Setup for %I
|
||||
DefaultDependencies=no
|
||||
Conflicts=umount.target
|
||||
IgnoreOnIsolate=true
|
||||
Before=luks-auto.target
|
||||
BindsTo=dev-disk-by\x2duuid-${_UUID_ESC}.device
|
||||
After=dev-disk-by\x2duuid-${_UUID_ESC}.device luks-auto-key.service
|
||||
Before=umount.target
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
RemainAfterExit=yes
|
||||
TimeoutSec=0
|
||||
ExecStart=/etc/systemd/system/luks-auto.sh ${_UUID}
|
||||
ExecStop=$CRYPTSETUP detach 'luks-${_UUID}'
|
||||
Environment=DRACUT_SYSTEMD=1
|
||||
StandardInput=null
|
||||
StandardOutput=syslog
|
||||
StandardError=syslog+console
|
||||
|
||||
EOF
|
||||
ln -fs ${SYSTEMD_RUN}/luks-auto@${_UUID_ESC}.service $SYSTEMD_RUN/luks-auto.target.wants/luks-auto@${_UUID_ESC}.service
|
||||
done
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
[Unit]
|
||||
Description=LUKS AUTO key searcher
|
||||
After=cryptsetup-pre.target
|
||||
Before=luks-auto.target
|
||||
DefaultDependencies=no
|
||||
|
||||
[Service]
|
||||
Environment=DRACUT_SYSTEMD=1
|
||||
Type=oneshot
|
||||
ExecStartPre=/usr/bin/sleep 1
|
||||
ExecStart=/etc/systemd/system/luks-auto-key.sh
|
||||
RemainAfterExit=true
|
||||
StandardInput=null
|
||||
StandardOutput=syslog
|
||||
StandardError=syslog+console
|
||||
|
|
@ -0,0 +1,87 @@
|
|||
#!/bin/sh
|
||||
# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
|
||||
# ex: ts=8 sw=4 sts=4 et filetype=sh
|
||||
export DRACUT_SYSTEMD=1
|
||||
|
||||
. /lib/dracut-lib.sh
|
||||
MNT_B="/tmp/luks-auto"
|
||||
ARG=$(getargs rd.luks.key)
|
||||
IFS=$':' _t=(${ARG})
|
||||
KEY=${_t[0]}
|
||||
F_FIELD=''
|
||||
F_VALUE=''
|
||||
if [ ! -z $KEY ] && [ ! -z ${_t[1]} ];then
|
||||
IFS=$'=' _t=(${_t[1]})
|
||||
F_FIELD=${_t[0]}
|
||||
F_VALUE=${_t[1]}
|
||||
F_VALUE="${F_VALUE%\"}"
|
||||
F_VALUE="${F_VALUE#\"}"
|
||||
fi
|
||||
mkdir -p $MNT_B
|
||||
|
||||
finding_luks_keys(){
|
||||
local _DEVNAME=''
|
||||
local _UUID=''
|
||||
local _TYPE=''
|
||||
local _LABEL=''
|
||||
local _MNT=''
|
||||
local _KEY="$1"
|
||||
local _F_FIELD="$2"
|
||||
local _F_VALUE="$3"
|
||||
local _RET=0
|
||||
blkid -s TYPE -s UUID -s LABEL -u filesystem | grep -v -E -e "TYPE=\".*_member\"" -e "TYPE=\"crypto_.*\"" -e "TYPE=\"swap\"" | while IFS=$'' read -r _line; do
|
||||
IFS=$':' _t=($_line);
|
||||
_DEVNAME=${_t[0]}
|
||||
_UUID=''
|
||||
_TYPE=''
|
||||
_LABEL=''
|
||||
_MNT=''
|
||||
IFS=$' ' _t=(${_t[1]});
|
||||
for _a in "${_t[@]}"; do
|
||||
IFS=$'=' _v=(${_a});
|
||||
temp="${_v[1]%\"}"
|
||||
temp="${temp#\"}"
|
||||
case ${_v[0]} in
|
||||
'UUID')
|
||||
_UUID=$temp
|
||||
;;
|
||||
'TYPE')
|
||||
_TYPE=$temp
|
||||
;;
|
||||
'LABEL')
|
||||
_LABEL=$temp
|
||||
;;
|
||||
esac
|
||||
done
|
||||
if [ ! -z "$_F_FIELD" ];then
|
||||
case $_F_FIELD in
|
||||
'UUID')
|
||||
[ ! -z "$_F_VALUE" ] && [ "$_UUID" != "$_F_VALUE" ] && continue
|
||||
;;
|
||||
'LABEL')
|
||||
[ ! -z "$_F_VALUE" ] && [ "$_LABEL" != "$_F_VALUE" ] && continue
|
||||
;;
|
||||
*)
|
||||
[ "$_DEVNAME" != "$_F_FIELD" ] && continue
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
_MNT=$(findmnt -n -o TARGET $_DEVNAME)
|
||||
if [ -z "$_MNT" ]; then
|
||||
_MNT=${MNT_B}/KEY-${_UUID}
|
||||
mkdir -p "$_MNT" && mount -o ro "$_DEVNAME" "$_MNT"
|
||||
_RET=$?
|
||||
else
|
||||
_RET=0
|
||||
fi
|
||||
if [ "${_RET}" -eq 0 ] && [ -f "${_MNT}/${_KEY}" ]; then
|
||||
cp "${_MNT}/${_KEY}" "$MNT_B/${_UUID}.key"
|
||||
info "Found ${_MNT}/${_KEY} on ${_UUID}"
|
||||
fi
|
||||
if [[ "${_MNT}" =~ "${MNT_B}" ]]; then
|
||||
umount "$_MNT" && rm -rfd --one-file-system "$_MNT"
|
||||
fi
|
||||
done
|
||||
return 0
|
||||
}
|
||||
finding_luks_keys $KEY $F_FIELD $F_VALUE
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
#!/bin/sh
|
||||
# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
|
||||
# ex: ts=8 sw=4 sts=4 et filetype=sh
|
||||
export DRACUT_SYSTEMD=1
|
||||
. /lib/dracut-lib.sh
|
||||
|
||||
MNT_B="/tmp/luks-auto"
|
||||
CRYPTSETUP='/usr/lib/systemd/systemd-cryptsetup'
|
||||
|
||||
for i in $(ls -p $MNT_B | grep -v /);do
|
||||
info "Trying $i on $1..."
|
||||
$CRYPTSETUP attach "luks-$1" "/dev/disk/by-uuid/$1" $MNT_B/$i 'tries=1'
|
||||
if [ "$?" -eq "0" ]; then
|
||||
info "Found $i for $1"
|
||||
exit 0
|
||||
fi
|
||||
done
|
||||
warn "No key found for $1. Fallback to passphrase mode."
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
[Unit]
|
||||
Description=LUKS AUTO target
|
||||
After=systemd-readahead-collect.service systemd-readahead-replay.service
|
||||
After=cryptsetup-pre.target luks-auto-key.service
|
||||
Before=cryptsetup.target
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
#!/bin/bash
|
||||
|
||||
check () {
|
||||
if ! dracut_module_included "systemd"; then
|
||||
"luks-auto needs systemd in the initramfs"
|
||||
return 1
|
||||
fi
|
||||
return 255
|
||||
}
|
||||
|
||||
depends () {
|
||||
echo "systemd"
|
||||
return 0
|
||||
}
|
||||
|
||||
install () {
|
||||
inst "$systemdutildir/systemd-cryptsetup"
|
||||
inst_simple "$moddir/luks.key" "/etc/luks.key"
|
||||
inst_script "$moddir/luks-auto-generator.sh" "$systemdutildir/system-generators/luks-auto-generator.sh"
|
||||
inst_script "$moddir/luks-auto-key.sh" "/etc/systemd/system/luks-auto-key.sh"
|
||||
inst_script "$moddir/luks-auto.sh" "/etc/systemd/system/luks-auto.sh"
|
||||
inst "$moddir/luks-auto.target" "${systemdsystemunitdir}/luks-auto.target"
|
||||
inst "$moddir/luks-auto-key.service" "${systemdsystemunitdir}/luks-auto-key.service"
|
||||
inst "$moddir/luks-auto-clean.service" "${systemdsystemunitdir}/luks-auto-clean.service"
|
||||
ln_r "${systemdsystemunitdir}/luks-auto.target" "${systemdsystemunitdir}/initrd.target.wants/luks-auto.target"
|
||||
ln_r "${systemdsystemunitdir}/luks-auto-key.service" "${systemdsystemunitdir}/initrd.target.wants/luks-auto-key.service"
|
||||
ln_r "${systemdsystemunitdir}/luks-auto-clean.service" "${systemdsystemunitdir}/initrd.target.wants/luks-auto-clean.service"
|
||||
}
|
||||
|
|
@ -1,2 +1,10 @@
|
|||
# dracut-luks-autounlock
|
||||
dracut + systemd + LUKS + usbflash
|
||||
|
||||
That project solve issue when you want auto unlock LUKS volumes with USB key but you're initramfs using systemd.
|
||||
|
||||
## Instalation
|
||||
1. Place 99luks-auto inside /usr/lib/dracut/modules.d
|
||||
2. chmod +x /usr/lib/dracut/modules.d/99luks-auto/*.sh
|
||||
3. echo 'add_dracutmodules+=" luks-auto "' > /etc/dracut.conf.d/luks-auto.conf
|
||||
4. dracut -f
|
||||
|
|
|
|||
Loading…
Reference in New Issue