sqdkjqlsjdklqsjdlqskjd azjdjksqhvdjqskhdkqhsj zkhjdhqksldjqlskdjlqskjd zjhdjqlskdhqsljkhdsqd checks/xfs000075500000000222152430032700006522 0ustar00#!/bin/sh echo "WARNING: The check script $0 is deprecated. Please use check script blkid instead." >&2 /lib/cryptsetup/checks/blkid "$1" "xfs" checks/swap000075500000000223152430032700006675 0ustar00#!/bin/sh echo "WARNING: The check script $0 is deprecated. Please use check script blkid instead." >&2 /lib/cryptsetup/checks/blkid "$1" "swap" checks/ext2000075500000000602152430032700006606 0ustar00#!/bin/sh echo "WARNING: The check script $0 is deprecated. Please use check script blkid instead." >&2 not_fs="" for fs in ext2 ext3 ext4 ext4dev; do /lib/cryptsetup/checks/blkid "$1" "$fs" >/dev/null || not_fs="$not_fs $fs" done if [ "$not_fs" = " ext2 ext3 ext4 ext4dev" ]; then echo " - The device $1 does not contain a valid ext2, ext3, ext4 or ext4dev filesystem." exit 1 fi checks/un_blkid000075500000001660152430032700007520 0ustar00#!/bin/sh # this script depends on /sbin/blkid from the util-linux package # usage: un_blkid [] # may be any device that should be checked. # if no is given, the check fails for any valid filesystem # if is given, the check fails when a filesystem type # is found on the device. if test ! -x "/sbin/blkid"; then echo " - WARNING: blkid from util-linux is not available, impossible to run checks." exit 1 fi dev="$1" fs="$2" offset="${3-}" blkid="$(/sbin/blkid -o value -s TYPE -p ${offset:+-O "$offset"} -- "$dev")" # blkid output is empty if $dev has an unknown filesystem if [ -n "$blkid" ] && [ -z "$fs" ]; then echo " - The device $dev contains a filesystem type $blkid${offset:+" at offset $offset"}." exit 1 elif [ -n "$fs" ] && [ "$blkid" = "$fs" ]; then echo " - The device $dev contains a filesystem type $fs${offset:+" at offset $offset"}." exit 1 fi checks/blkid000075500000002244152430032700007015 0ustar00#!/bin/sh # this script depends on /sbin/blkid from the util-linux package # usage: blkid [] # may be any device that should be checked. # if no is given, the check fails if no valid filesystem is found. # if is given, the check fails when no filesystem type # is found on the device. if is 'none', the check fails if any # know filesystem is found. if test ! -x "/sbin/blkid"; then echo " - WARNING: blkid from util-linux is not available, impossible to run checks." exit 1 fi dev="$1" fs="$2" offset="${3-}" blkid="$(/sbin/blkid -o value -s TYPE -p ${offset:+-O "$offset"} -- "$dev")" # blkid output is empty if $dev has an unknown filesystem if [ -z "$blkid" ] && [ -z "$fs" ]; then echo " - The device $dev does not contain a known filesystem${offset:+" at offset $offset"}." exit 1 elif [ -n "$blkid" ] && [ "$fs" = "none" ]; then echo " - The device $dev contains a filesystem type $blkid${offset:+" at offset $offset"}." exit 1 elif [ -n "$fs" ] && [ "$blkid" != "$fs" ]; then echo " - The device $dev does not contain a filesystem type $fs${offset:+" at offset $offset"}." exit 1 fi scripts/decrypt_ssl000075500000000533152430032700010511 0ustar00#!/bin/sh # # Script to decrypt the key which is encrypted with openssl. # See /usr/share/doc/cryptsetup/examples/gen-ssl-key to create such a key. # decrypt_ssl () { echo "" >&2 echo "Decrypting ssl key $1..." >&2 if ! /usr/bin/openssl enc -aes-256-cbc -d -salt -in "$1" 2>/dev/null; then return 1 fi return 0 } decrypt_ssl "$1" exit $? scripts/decrypt_keyctl000075500000003772152430032700011213 0ustar00#!/bin/sh # decrypt_keyctl - to use in /etc/crypttab as keyscript # Allows to cache passwords for cryptdevices for 60s # The same password is used for for cryptdevices with the same identifier. # The keyfile parameter, which is the third field from /etc/crypttab, is # used as identifier in this keyscript. # # sample crypttab entries: # test1 /dev/sda1 test_pw luks,keyscript=decrypt_keyctl # test2 /dev/sda2 test_pw luks,keyscript=decrypt_keyctl # test3 /dev/sda3 test_other_pw luks,keyscript=decrypt_keyctl # # test1 and test2 have the same identifier thus test2 does not need a password # typed in manually die() { echo "$@" >&2 exit 1 } if [ -z "${CRYPTTAB_KEY:-}" ] || [ "$CRYPTTAB_KEY" = "none" ]; then # store the passphrase in the key name used by systemd-ask-password ID_="cryptsetup" else # the keyfile given from crypttab is used as identifier in the keyring # including the prefix "cryptsetup:" ID_="cryptsetup:$CRYPTTAB_KEY" fi TIMEOUT_='60' ASKPASS_='/lib/cryptsetup/askpass' PROMPT_="Caching passphrase for ${CRYPTTAB_NAME}: " if ! KID_="$(keyctl search @u user "$ID_" 2>/dev/null)" || \ [ -z "$KID_" ] || [ "$CRYPTTAB_TRIED" -gt 0 ]; then # key not found or wrong, ask the user KEY_="$($ASKPASS_ "$PROMPT_")" || die "Error executing $ASKPASS_" if [ -n "$KID_" ]; then # I have cached wrong password and now i may use either `keyctl update` # to update $KID_ or just unlink old key, and add new. With `update` i # may hit "Key has expired", though. So i'll go "unlink and add" way. keyctl unlink "$KID_" @u KID_="" fi KID_="$(printf "%s" "$KEY_" | keyctl padd user "$ID_" @u)" [ -n "$KID_" ] || die "Error adding passphrase to kernel keyring" if ! keyctl timeout "$KID_" "$TIMEOUT_"; then keyctl unlink "$KID_" @u die "Error setting timeout on key ($KID_), removing" fi else echo "Using cached passphrase for ${CRYPTTAB_NAME}." >&2 fi keyctl pipe "$KID_" scripts/passdev000075500000034470152430032700007632 0ustar00ELF>@1@8 @@@@  Q Q  dd,<< (-==88800hhhDDStd88800PtdP"P"P"<<QtdRtd,<</lib64/ld-linux-x86-64.so.2 GNUGNU.$Q="Yd"kՍ; ߖGNUemU)+ J8cG q\jPIvV ""__libc_start_main__cxa_finalizestderr__vfprintf_chk__stack_chk_failfwriteexitgetenvstrtolstrchraccessstat__fprintf_chkmkdtempforkwaitpidstrlenmalloc__sprintf_chkopen__read_chkclosefreeumountrmdirsleepexecllibc.so.6GLIBC_2.33GLIBC_2.4GLIBC_2.34GLIBC_2.3.4GLIBC_2.2.5_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTableii ti ui <`< @@????????? ?(?0?8? @? H? P? X? `?h?p?x???????????HH/HtH5.%.@hfhfhfhfhfhfhfhrfhbfh Rfh Bfh 2fh "fh fhfhfhfhfhfhfhfhfhfhrfhbf%&.fD%.-fD%&-fD%-fD%-fD%-fD%-fD%,fD%,fD%,fD%,fD%,fD%,fD%,fD%,fD%,fD%,fD%,fD%,fD%,fD%,fD%,fD%,fD%~,fD%v,fD%n,fDUHAWAVAUATSHHfodH%(HE1DžXXX)t*HL,H=K H;!H= HHt1 H~,Lc:LRH8xHX:H"Ht8t xHLH= 1 E1E11Lj?H0LHHAƅH%=`LH" H/+H818H+H= H1Hx {HLH= IA1AE~DH=t 1+EAHSHHH H fHnfHnH y flHs LfHn)fHnH_ flH N fHn)fHnHI H > flfHnH; )fHnfHnH  flH )fHnH fl) AŅu /,1LDdЃu߁HHIMlLIHLHI1H L1LtHLL`M1L1Aƅ L1~IHu.'LLItDHCH)H)HTHL9rD LsHHH1!LItH)HHL9rL*13LH=1f1LDEtEAAA #H'LHD H81HLHtH'H=7 HLjHHm'%H=H\HH'H=9 H7LDH'H=HnH&H=HIH&H=H$H&H=HLnNLL1McH=HL111H1 1ҾH11ҾH1HjH=fAWNHL IATH CH?P1H H%H=3H H%H=HVD1I^HHPTE11H=+%f.H=Y%HR%H9tH%Ht H=)%H5"%H)HH?HHHtH$HtfD=$u+UH=$Ht H=$yd$]wUHHHXH`HhLpLxt )E)M)U)])e)m)u)}dH%(HH1=6$tKHEHDž0H8HPH0H@H#Dž40H8HHdH+%(uHHIncorrect number of arguments Path is %p and filepath is %p Failed to create temporary directory noatime,nodiratime,nodev,noexec,nosuid,roDEBUGInvalid key path Timeout is %i Waiting for %s Unable to stat %s %s is no block device ext4ext3ext2vfatbtrfsreiserfsxfsjfsntfsiso9660udfMounting %s at %s /dev/null-o-t-n/bin/mountFailed to mount %s Failed to allocate memory %s/%sKeyfile doesn't exist Unable to stat keyfile Invalid keyfile size Failed to open keyfile Failed to read entire key Failed to write entire key /tmp/passdev.XXX;<pp0X zRx &D$4XFJ w?9*3$"\t PAC  A EC P`   D<<o p >X  ooooHo=0@P`p 0@P`p@/usr/lib/debug/.dwz/x86_64-linux-gnu/cryptsetup.debug##U\jAB* lm24513dc4225964c5226bd58d3bcd7fe509df96.debugR.shstrtab.interp.note.gnu.property.note.gnu.build-id.note.ABI-tag.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.plt.sec.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.dynamic.data.bss.gnu_debugaltlink.gnu_debuglink 880&hh$9 Go$Q YpaoHH@no`}B X  ``DD  PP"P"<""<,<,=->.@0@00J\040"scripts/decrypt_gnupg000075500000001072152430032700011027 0ustar00#!/bin/sh decrypt_gpg () { echo "Performing GPG symmetric decryption ..." >&2 if ! /lib/cryptsetup/askpass "Enter passphrase for key $1: " | \ /usr/bin/gpg -q --batch --no-options \ --no-random-seed-file --no-default-keyring \ --keyring /dev/null --secret-keyring /dev/null \ --trustdb-name /dev/null --passphrase-fd 0 --decrypt -- "$1"; then return 1 fi return 0 } if [ ! -x /usr/bin/gpg ]; then echo "$0: /usr/bin/gpg is not available" >&2 exit 1 fi if [ -z "$1" ]; then echo "$0: missing key as argument" >&2 exit 1 fi decrypt_gpg "$1" exit $? scripts/decrypt_opensc000075500000002564152430032700011205 0ustar00#!/bin/sh # Why not use "openct-tool rwait" instead of polling opensc-tool exit status? # Well openct daemon has to be running which interferes with pcscd since both # implement reader drivers, my particular CCID reader (SCM SCR331-LC1) doesn't # work with the CCID driver in openct, however it does work with pcscd. # Why not use "opensc-tool --wait" instead of polling opensc-tool exit status? # Although opensc-tool --help reports that there is a --wait option, it doesn't # seem to be implemented. check_card() { cardfound=0 if /usr/bin/opensc-tool -n >/dev/null 2>&1; then cardfound=1 fi } wait_card() { check_card if [ $cardfound = 0 ] ; then echo "Waiting for Smart Card..." >&2 tries=0 while [ $cardfound = 0 ] && [ $tries -lt 60 ] ; do sleep 1 check_card tries=$(($tries + 1)) done if [ $cardfound = 0 ] ; then echo 'Failed to find Smart Card card!' >&2 exit 1 fi fi } wait_card if [ -x /bin/plymouth ] && plymouth --ping; then # Get pin number from plymouth /usr/bin/pkcs15-crypt --decipher --input "$1" --pkcs1 --raw \ --pin "$(plymouth ask-for-password --prompt "Enter pin for $CRYPTTAB_NAME: ")" else # Get pin number from console /usr/bin/pkcs15-crypt --decipher --input "$1" --pkcs1 --raw /dev/console fi exit $? scripts/decrypt_derived000075500000002122152430032700011326 0ustar00#!/bin/sh # WARNING: If you use the decrypt_derived keyscript for devices with # persistent data (i.e. not swap or temp devices), then you will lose # access to that data permanently if something damages the LUKS header # of the LUKS device you derive from. The same applies if you luksFormat # the device, even if you use the same passphrase(s). A LUKS header # backup, or better a backup of the data on the derived device may be # a good idea. See the Cryptsetup FAQ on how to do this right. if [ -z "$1" ]; then echo "$0: must be executed with a crypto device as argument" >&2 exit 1 fi unset -v keys count keys="$(dmsetup table --target crypt --showkeys -- "$1" 2>/dev/null | cut -s -d' ' -f5)" count="$(printf '%s' "$keys" | wc -l)" if [ -n "$keys" ] && [ $count -le 1 ]; then if [ "${keys#:}" = "$keys" ]; then printf '%s' "$keys" exit 0 else echo "$0: device $1 uses the kernel keyring" >&2 fi elif [ $count -eq 0 ]; then echo "$0: device $1 doesn't exist or isn't a crypto device" >&2 else echo "$0: more than one device match" >&2 fi exit 1 scripts/decrypt_gnupg-sc000075500000001671152430032700011437 0ustar00#!/bin/sh if [ -d "/cryptroot/gnupghome" ]; then export GNUPGHOME="/cryptroot/gnupghome" fi run_gpg() { gpg --no-options --trust-model=always "$@" } decrypt_gpg () { local console _ if ! GPG_TTY="$(tty)"; then read console _ /dev/null; then echo "Please insert OpenPGP SmartCard..." >&2 until run_gpg --batch --quiet --no-tty --card-status; do sleep 1 done >/dev/null 2>&1 fi if [ ! -x /usr/bin/gpg ]; then echo "$0: /usr/bin/gpg is not available" >&2 exit 1 fi if [ -z "$1" ] || [ ! -f "$1" ]; then echo "$0: missing key as argument" >&2 exit 1 fi decrypt_gpg "$1" exit $? askpass000075500000054750152430032700006146 0ustar00ELF>'@hR@8 @@@@ @@@L\\@L\\88800hhhDDStd88800Ptd@@@QtdRtdL\\/lib64/ld-linux-x86-64.so.2 GNUGNU \l]TeBBI GNU--em1/9 yi=("_4R &IJXt nd "__libc_start_main__cxa_finalizeclosememsetfreeread__errno_locationrealloclstataccesspipeforkdup2execlexit__stack_chk_failkillsystemstrdupstrlenmkfifotcsetattrstderrfputcklogctlstdin__getdelimclearerrisattyfreopenstdouttcgetattrfwritestrstrfputs__fprintf_chksigfillsetsigprocmask__fdelt_chkselectlibc.so.6GLIBC_2.3.4GLIBC_2.33GLIBC_2.15GLIBC_2.4GLIBC_2.34GLIBC_2.2.5_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTablePti Zfqii |ui \'\'`` `"@(`*0``)8`+H`@P`-X`0*``P(p`U@x`P,`)`,`@`/`.`@.______'_-_,^^^^^ ^ ^ ^ ^ ^^^^____ _(_0_8_@_H_P_X_`_h_ p_!x_"_#_$_%_&_(_)_*_+HH?HtH5b>%d>@hfhfhfhfhfhfhfhrfhbfh Rfh Bfh 2fh "fh fhfhfhfhfhfhfhfhfhfhrfhbfhRfhBfh2fh"fhfhfhfh fh!fh"fh#fh$f%f=fD%;fD%;fD%;fD%;fD%;fD%;fD%;fD%;fD%;fD%;fD%;fD%;fD%;fD%;fD%;fD%;fD%~;fD%v;fD%n;fD%f;fD%^;fD%V;fD%N;fD%F;fD%>;fD%6;fD%.;fD%&;fD%;fD%;fD%;fD%;fD%:fD%:fD%:fD%:fD%:fDUHAWAVAUIATSH8dH%(HE1HDžHDžt1H:LH HH81DHL5:HMqH11D=qIA|$"t$I}AT$AD$$A|$ fE|$!u I(I9uH@AHH1ME1HA|$"t+Ic|$$x" AL$$LHH @AD9DMI(I9uEt+HE111D(td8tj fAD$!IMAA"tKIc$xCA$HLHH#@t%HHAWtHHuI(I9uHH` 1s1I^HHPTE11H=8f.H=9H9H9tH~8Ht H=Y9H5R9H)HH?HHHtH]8HtfD=9u+UH=:8Ht H=F8d8]wUHAUIATISHHxQH;Ht*I$1H;vHIEI$H[A\A]]@UHxH=8Ht;H81H=8H8H8H8]fDUHAVAAUIATISH2HI$I}H9uWI$H3I}H)HDHy8t1[A\A]A^]DH3HH3HuHI4$IEHHt I$H31I$HUH 7HATIH57SHH7%u [A\]@H7H 7Ht&Ht> uH 7HQH 7H7I $H[A\]UH \7HATIH5]7SHHJ7tHB7I$H/7H[A\]UH 6HATIH56SHH6UtH6I$H6H[A\]UHATSHPHH=hH@dH%(HE1HH=FHH9PL%5L^HZW6xwuI&xE1HHLL1HfDHUdH+%(u/H@[A\]ËfD$@UHSH=5H]H l5Hl5H5m5U HSH=65H]H 5H 5H5 5UHATL%SHLHdH%(HE1CH=g/HHH,HHLHD9::H}f4uL}T}x!E1IH ILHHL1r(HH}EHUdH+%(ueH[A\]DXHD 45&}}@UHSHHHt 8uHH]1-DH]ff.fUHSHH=2Ht0H21H=2+H2H2=2uLxHHA2߾o2H?1 H0H]11ɿ7H]f.UH=,2HAUATIԺ SHH5 2HL-0IMHxQH 1uI$H H[A\A]]@HH@H4> uHH 1fI}GH1[A\A]]f.UHAWAVAUATI1SHhdH%(HE1HHvH/H5HHEHoH/L5HLH HJL-/LHIUH+1a1H5p0fo[0HU1fo ]0foe0oi0)EE)U)M]Ew|L-/L5L=/dev/null 2>&1 || true if [ "$INITSTATE" != "init" ]; then log_action_begin_msg "Starting $INITSTATE crypto disks" fi mount_fs crypttab_foreach_entry _do_start_callback umount_fs log_action_end_msg 0 } _do_start_callback() { setup_mapping || log_action_end_msg $? } # mount_fs() # Premounts file systems mount_fs() { local point MOUNTED="" for point in $MOUNT; do if mount "$point" >/dev/null; then MOUNTED="$MOUNTED $point" fi done } # Postunmounts file systems umount_fs() { local point for point in $MOUNTED; do umount "$point" >/dev/null done } # setup_mapping() # Set up a crypttab(5) mapping defined by $CRYPTTAB_NAME, # $CRYPTTAB_SOURCE, $CRYPTTAB_KEY, $CRYPTTAB_OPTIONS. setup_mapping() { if dm_blkdevname "$CRYPTTAB_NAME" >/dev/null; then device_msg "running" return 0 fi local loud="${DEFAULT_LOUD:-}" crypttab_parse_options --export --missing-path=fail || return 1 if [ -n "${CRYPTTAB_OPTION_quiet+x}" ]; then loud="no" elif [ -n "${CRYPTTAB_OPTION_loud+x}" ]; then loud="yes" fi if [ -z "${FORCE_START-}" ]; then if [ "$INITSTATE" = "early" -a -n "${CRYPTTAB_OPTION_noearly+x}" ] || [ "$INITSTATE" != "manual" -a -n "${CRYPTTAB_OPTION_noauto+x}" ]; then device_msg "ignored" return 0 fi fi if [ -z "${CRYPTTAB_OPTION_keyscript+x}" ] && [ "$CRYPTTAB_KEY" != "none" ]; then if ! crypttab_key_check; then device_msg "invalid key" return 1 fi CRYPTTAB_OPTION_tries=1 fi if ! crypttab_resolve_source; then if [ "$loud" = "yes" ]; then device_msg "skipped, device $CRYPTTAB_SOURCE does not exist" fi return 1 fi device_msg "starting" local offset_bytes="" if [ -n "${CRYPTTAB_OPTION_offset+x}" ] && [ ${#CRYPTTAB_OPTION_offset} -le 7 ] && [ $CRYPTTAB_OPTION_offset -lt 4194304 ]; then # silently ignore large offset values which might cause the multiplication to overflow... offset_bytes=$((CRYPTTAB_OPTION_offset * 512)) fi local out tmpdev if [ "$CRYPTTAB_TYPE" != "luks" ] && [ "$CRYPTTAB_TYPE" != "bitlk" ]; then # fail if the device has a filesystem and the disk encryption format doesn't # verify the key digest (unlike LUKS); unless it's swap, otherwise people can't # easily convert an existing plainttext swap partition to an encrypted one if ! out="$(/lib/cryptsetup/checks/un_blkid "$CRYPTTAB_SOURCE" "" ${CRYPTTAB_OPTION_offset+"$offset_bytes"} 2>/dev/null)" && ! /lib/cryptsetup/checks/blkid "$CRYPTTAB_SOURCE" swap ${CRYPTTAB_OPTION_offset+"$offset_bytes"} >/dev/null; then log_warning_msg "$CRYPTTAB_NAME: the precheck for '$CRYPTTAB_SOURCE' failed: $out" return 1 fi fi local count=0 maxtries="${CRYPTTAB_OPTION_tries:-3}" fstype rv local target="$CRYPTTAB_NAME" CRYPTTAB_NAME="${CRYPTTAB_NAME}_unformatted" # XXX potential conflict while [ $maxtries -le 0 ] || [ $count -lt $maxtries ]; do if [ -z "${CRYPTTAB_OPTION_keyscript+x}" ] && [ "$CRYPTTAB_KEY" != "none" ]; then # unlock via keyfile unlock_mapping "$CRYPTTAB_KEY" else # unlock interactively or via keyscript CRYPTTAB_NAME="$target" run_keyscript "$count" | unlock_mapping fi rv=$? count=$(( $count + 1 )) if [ $rv -ne 0 ] || ! tmpdev="$(dm_blkdevname "$CRYPTTAB_NAME")"; then continue fi if [ -n "${CRYPTTAB_OPTION_check+x}" ] && \ ! "$CRYPTTAB_OPTION_check" "$tmpdev" ${CRYPTTAB_OPTION_checkargs+"$CRYPTTAB_OPTION_checkargs"}; then log_warning_msg "$target: the check for '$CRYPTTAB_NAME' failed" cryptsetup remove -- "$CRYPTTAB_NAME" continue fi if [ "${CRYPTTAB_OPTION_swap+x}" ]; then if out="$(/lib/cryptsetup/checks/un_blkid "$tmpdev" "" ${CRYPTTAB_OPTION_offset+"$offset_bytes"} 2>/dev/null)" || /lib/cryptsetup/checks/blkid "$tmpdev" swap ${CRYPTTAB_OPTION_offset+"$offset_bytes"} >/dev/null 2>&1; then mkswap "$tmpdev" >/dev/null 2>&1 else log_warning_msg "$target: the check for '$CRYPTTAB_NAME' failed. $CRYPTTAB_NAME contains data: $out" cryptsetup remove -- "$CRYPTTAB_NAME" return 1 fi elif [ "${CRYPTTAB_OPTION_tmp+x}" ]; then local tmpdir="$(mktemp --tmpdir="/run/cryptsetup" --directory)" rv=0 if ! mkfs -t "$CRYPTTAB_OPTION_tmp" -q "$tmpdev" >/dev/null 2>&1 || ! mount -t "$CRYPTTAB_OPTION_tmp" "$tmpdev" "$tmpdir" || ! chmod 1777 "$tmpdir"; then rv=1 fi umount "$tmpdir" || true rmdir "$tmpdir" || true [ $rv -eq 0 ] || return $rv fi if command -v udevadm >/dev/null 2>&1; then udevadm settle fi dmsetup rename -- "$CRYPTTAB_NAME" "$target" device_msg "$target" "started" return 0 done device_msg "$target" "failed" return 1 } # Removes all mappings in crypttab, except the ones holding the root # file system or /usr do_stop() { local devno_rootfs devno_usr dmsetup mknodes log_action_begin_msg "Stopping $INITSTATE crypto disks" devno_rootfs="$(get_mnt_devno /)" || devno_rootfs="" devno_usr="$(get_mnt_devno /usr)" || devno_usr="" crypttab_foreach_entry _do_stop_callback log_action_end_msg 0 } _do_stop_callback() { local skip="n" devno rv=0 # traverse the device tree for each crypttab(5) entry and mark / and # /usr holders as skipped. that's suboptimal but we can't use # mapped device names as they might contain any character other than # NUL. shouldn't be much overhead anyway as the device tree is # likely not that long foreach_cryptdev _do_stop_skipped $devno_rootfs $devno_usr [ "$skip" = "n" ] || return $rv if devno="$(dmsetup info -c --noheadings -o devno -- "$CRYPTTAB_NAME" 2>/dev/null)" && [ -n "$devno" ]; then foreach_cryptdev --reverse _do_stop_remove "$devno" || rv=$? # try to remove slave devices first fi return $rv } _do_stop_skipped() { if [ "$1" = "$CRYPTTAB_NAME" ]; then skip="y" fi } _do_stop_remove() { local name="$1" i rv=0 for i in 1 2 4 8 16 32; do remove_mapping "$name" 3<&- && break || rv=$? if [ $rv -eq 1 ] || [ $rv -eq 2 -a $i -gt 16 ]; then log_action_end_msg $rv break fi log_action_cont_msg "$name busy..." sleep $i done } # device_msg([$name], $message) # Convenience function to handle $VERBOSE device_msg() { local name message if [ $# -eq 1 ]; then name="$CRYPTTAB_NAME" message="$1" else name="$1" message="$2" fi if [ "$VERBOSE" != "no" ]; then log_action_cont_msg "$name ($message)" fi } # remove_mapping($target) # Remove mapping $target remove_mapping() { local CRYPTTAB_NAME="$1" if ! dm_blkdevname "$CRYPTTAB_NAME" >/dev/null; then device_msg "stopped" return 0 fi if [ "$(dmsetup info --noheadings -c -o subsystem -- "$CRYPTTAB_NAME")" != "CRYPT" ]; then device_msg "error" return 1 fi local opencount="$(dmsetup info -c --noheadings -o open -- "$CRYPTTAB_NAME" 2>/dev/null || true)" if [ -z "$opencount" ]; then device_msg "error" return 1 elif [ "$opencount" != "0" ]; then device_msg "busy" if [ "$INITSTATE" = "early" ] || [ "$INITSTATE" = "manual" ]; then return 1 elif [ "$INITSTATE" = "remaining" ]; then return 2 fi return 0 fi if cryptsetup remove -- "$CRYPTTAB_NAME"; then device_msg "stopping" return 0 else device_msg "error" return 1 fi } # vim: set filetype=sh : functions000064400000065267152430032700006513 0ustar00if [ "${0#/usr/share/initramfs-tools/hooks/}" != "$0" ] || [ "${0#/etc/initramfs-tools/hooks/}" != "$0" ]; then # called from an initramfs-tools hook script TABFILE="$DESTDIR/cryptroot/crypttab" elif [ "${0#/scripts/}" != "$0" ]; then # called at initramfs stage from a boot script TABFILE="/cryptroot/crypttab" CRYPTROOT_COUNT_FILE="/run/cryptroot.initrd.cnt" else TABFILE="${TABFILE-/etc/crypttab}" fi export DM_DEFAULT_NAME_MANGLING_MODE=hex # for dmsetup(8) # Logging helpers. Send the argument list to plymouth(1), or fold it # and print it to the standard error. cryptsetup_message() { local IFS=' ' if [ "${0#/scripts/}" != "$0" ] && [ -x /bin/plymouth ] && plymouth --ping; then plymouth message --text="cryptsetup: $*" elif [ ${#*} -lt 70 ]; then echo "cryptsetup: $*" >&2 else # use busybox's fold(1) and sed(1) at initramfs stage echo "cryptsetup: $*" | fold -s | sed '1! s/^/ /' >&2 fi return 0 } # crypttab_parse_options([--export], [--quiet], [--missing-path={ignore|warn|fail}]) # Parse $_CRYPTTAB_OPTIONS, a comma-separated option string from the # crypttab(5) 4th column, and sets corresponding variables # CRYPTTAB_OPTION_