diff options
author | Patrick J Volkerding <volkerdi@slackware.com> | 2022-08-01 23:30:59 +0000 |
---|---|---|
committer | Eric Hameleers <alien@slackware.com> | 2022-08-02 09:00:16 +0200 |
commit | 886a355a893951afa67e6f95616777980b700e7c (patch) | |
tree | 05a4a9255094722bad3d194328c167deb307535d /source/a/cryptsetup | |
parent | 18570c2f3bedf7370815285dc11da0ebc401a5cd (diff) | |
download | current-886a355a893951afa67e6f95616777980b700e7c.tar.gz current-886a355a893951afa67e6f95616777980b700e7c.tar.xz |
Mon Aug 1 23:30:59 UTC 202220220801233059
a/cryptsetup-2.5.0-x86_64-2.txz: Rebuilt.
Use file descriptor 3 in rc.luks's main loop so that sdtin works properly for
cryptsetup and/or a keyscript. PiterPunk gave it to me like this and then I
proceeded to break it. Sorry about that.
Diffstat (limited to 'source/a/cryptsetup')
-rwxr-xr-x | source/a/cryptsetup/cryptsetup.SlackBuild | 11 | ||||
-rw-r--r-- | source/a/cryptsetup/doinst.sh | 12 | ||||
-rw-r--r-- | source/a/cryptsetup/rc.luks | 90 |
3 files changed, 111 insertions, 2 deletions
diff --git a/source/a/cryptsetup/cryptsetup.SlackBuild b/source/a/cryptsetup/cryptsetup.SlackBuild index e31194315..fea2faf99 100755 --- a/source/a/cryptsetup/cryptsetup.SlackBuild +++ b/source/a/cryptsetup/cryptsetup.SlackBuild @@ -25,7 +25,7 @@ cd $(dirname $0) ; CWD=$(pwd) PKGNAM=cryptsetup VERSION=${VERSION:-$(echo $PKGNAM-*.tar.xz | rev | cut -f 3- -d . | cut -f 1 -d - | rev)} -BUILD=${BUILD:-1} +BUILD=${BUILD:-2} # Automatically determine the architecture we're building on: if [ -z "$ARCH" ]; then @@ -87,6 +87,7 @@ CFLAGS="$SLKCFLAGS" \ --sysconfdir=/etc \ --enable-cryptsetup-reencrypt \ --enable-libargon2 \ + --disable-asciidoc \ --mandir=/usr/man \ --docdir=/usr/doc/cryptsetup-$VERSION \ --build=$ARCH-slackware-linux || exit 1 @@ -118,9 +119,14 @@ mkdir -p $PKG/sbin ln -sf ../../sbin/cryptsetup . ) +# Add the rc script: +mkdir -p $PKG/etc/rc.d +cat $CWD/rc.luks > $PKG/etc/rc.d/rc.luks.new +chmod 755 $PKG/etc/rc.d/rc.luks.new + mkdir -p $PKG/usr/doc/$PKGNAM-$VERSION cp -a \ - AUTHORS COPYING* INSTALL NEWS README* TODO FAQ \ + AUTHORS* COPYING* INSTALL* NEWS* README* TODO* FAQ* \ $PKG/usr/doc/$PKGNAM-$VERSION # Convert pdf files to text. We do not package bloated PDFs. @@ -159,6 +165,7 @@ find $PKG | xargs file | grep -e "executable" -e "shared object" \ | grep ELF | cut -f 1 -d : | xargs strip --strip-unneeded 2> /dev/null mkdir -p $PKG/install +zcat $CWD/doinst.sh > $PKG/install/doinst.sh cat $CWD/slack-desc > $PKG/install/slack-desc cd $PKG diff --git a/source/a/cryptsetup/doinst.sh b/source/a/cryptsetup/doinst.sh new file mode 100644 index 000000000..3d03e45fa --- /dev/null +++ b/source/a/cryptsetup/doinst.sh @@ -0,0 +1,12 @@ +config() { + NEW="$1" + OLD="`dirname $NEW`/`basename $NEW .new`" + # If there's no config file by that name, mv it over: + if [ ! -r $OLD ]; then + mv $NEW $OLD + elif [ "`cat $OLD | md5sum`" = "`cat $NEW | md5sum`" ]; then # toss the redundant copy + rm $NEW + fi + # Otherwise, we leave the .new copy for the admin to consider... +} +config etc/rc.d/rc.luks.new diff --git a/source/a/cryptsetup/rc.luks b/source/a/cryptsetup/rc.luks new file mode 100644 index 000000000..243244969 --- /dev/null +++ b/source/a/cryptsetup/rc.luks @@ -0,0 +1,90 @@ +#!/bin/bash +# Open any volumes created by cryptsetup. +# +# Some notes on /etc/crypttab in Slackware: +# Only LUKS formatted volumes are supported (except for swap) +# crypttab follows the following format: +# <luks_name> <device> <password> <options> +# +# <luks_name>: This is the name of your LUKS volume. +# For example: crypt-home +# +# <device>: This is the device containing your LUKS volume. +# For example: /dev/sda2 +# +# <password>: This is either the volume password in plain text, or the name of +# a key file. Use 'none' to interactively enter password on boot. +# +# <options>: Comma-separated list of options. Note that there must be a +# password field for any options to be picked up (use a password of 'none' to +# get a password prompt at boot). The following options are supported: +# +# discard -- this will cause --allow-discards to be passed to the cryptsetup +# program while opening the LUKS volume. +# +# ro -- this will cause --readonly to be passed to the cryptsetup program while +# opening the LUKS volume. +# +# swap -- this option cannot be used with other options. The device given will +# be formatted as a new encrypted volume with a random key on boot, and used as +# swap. +# +# keyscript=<path/to/script> -- get the password from the named script's stdout. +# The only parameter sent to script is the <password> field, but the script can +# ignore it. +# + +if [ -f /etc/crypttab -a -x /sbin/cryptsetup ]; then + # First, check for device-mapper support. + if ! grep -wq device-mapper /proc/devices ; then + # If device-mapper exists as a module, try to load it. + # Try to load a device-mapper kernel module: + /sbin/modprobe -q dm-mod + fi + # NOTE: we only support LUKS formatted volumes (except for swap)! + # The input for this loop comes from after the "done" below, so that we can + # use fd3 and keep stdin functional for password entry or in case a keyscript + # requires it: + while read line <&3; do + eval LUKSARRAY=( $line ) + LUKS="${LUKSARRAY[0]}" + DEV="${LUKSARRAY[1]}" + PASS="${LUKSARRAY[2]}" + OPTS="${LUKSARRAY[3]}" + KEYSCRIPT="$(echo $OPTS | sed -n 's/.*keyscript=\([^,]*\).*/\1/p')" + LUKSOPTS="" + if echo $OPTS | grep -wq ro ; then LUKSOPTS="${LUKSOPTS} --readonly" ; fi + if echo $OPTS | grep -wq discard ; then LUKSOPTS="${LUKSOPTS} --allow-discards" ; fi + # Skip LUKS volumes that were already unlocked (in the initrd): + /sbin/cryptsetup status $LUKS 2>/dev/null | head -n 1 | grep -q "is active" && continue + if /sbin/cryptsetup isLuks $DEV 2>/dev/null ; then + if [ -z "${LUKSOPTS}" ]; then + echo "Unlocking LUKS encrypted volume '${LUKS}' on device '$DEV':" + else + echo "Unlocking LUKS encrypted volume '${LUKS}' on device '$DEV' with options '${LUKSOPTS}':" + fi + if [ -x "${KEYSCRIPT}" ]; then + # A password was outputted by a script + ${KEYSCRIPT} "${PASS}" | /sbin/cryptsetup ${LUKSOPTS} luksOpen $DEV $LUKS + echo + elif [ -n "${PASS}" -a "${PASS}" != "none" ]; then + if [ -f "${PASS}" ]; then + # A password was given a key-file filename + /sbin/cryptsetup ${LUKSOPTS} --key-file=${PASS} luksOpen $DEV $LUKS + else + # A password was provided in plain text + echo "${PASS}" | /sbin/cryptsetup ${LUKSOPTS} luksOpen $DEV $LUKS + fi + else + # No password was given, or a password of 'none' was given + /sbin/cryptsetup ${LUKSOPTS} luksOpen $DEV $LUKS + fi + elif echo $OPTS | grep -wq swap ; then + # If any of the volumes is to be used as encrypted swap, + # then encrypt it using a random key and run mkswap: + echo "Creating encrypted swap volume '${LUKS}' on device '$DEV':" + /sbin/cryptsetup --cipher=aes --key-file=/dev/urandom --key-size=256 create $LUKS $DEV + mkswap /dev/mapper/$LUKS + fi + done 3< <(grep -vE '^(#|$)' /etc/crypttab) +fi |