1067 lines
22 KiB
Bash
1067 lines
22 KiB
Bash
#!/bin/bash
|
|
# Copyright (C) 1996-2007 SUSE Linux Products GmbH, Nuernberg, Germany.
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program; if not, write to the Free Software
|
|
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
#
|
|
# Author: Werner Fink <werner@suse.de>, 2001-2006
|
|
# Chris Rivera <crivera@novell.com> 2006
|
|
# Ludwig Nussel <lnussel@novell.com> 2007
|
|
#
|
|
# /etc/init.d/boot.crypto
|
|
#
|
|
### BEGIN INIT INFO
|
|
# Provides: boot.crypto
|
|
# Required-Start: boot.localfs boot.device-mapper
|
|
# Should-Start:
|
|
# Required-Stop:
|
|
# Default-Start: B
|
|
# Default-Stop:
|
|
# Description: Enable crypto file systems before leaving boot phase
|
|
# Short-Description: Enable crypto file systems before leaving boot phase
|
|
### END INIT INFO
|
|
|
|
# Determine the base and follow a runlevel link name.
|
|
base=${0##*/}
|
|
link=${base#*[SK][0-9][0-9]}
|
|
|
|
. /etc/rc.status
|
|
|
|
trap "echo" SIGINT SIGSEGV
|
|
set +e
|
|
|
|
# Redirect to real device (e.g. in case of boot logging)
|
|
: ${CRYPTOTAB:=/etc/cryptotab}
|
|
: ${CRYPTTAB:=/etc/crypttab}
|
|
: ${TIMEOUT:=120}
|
|
if test -z "$REDIRECT" ; then
|
|
if (echo -n > /dev/tty) 2>/dev/null ; then
|
|
REDIRECT=/dev/tty
|
|
else
|
|
REDIRECT=/dev/console
|
|
fi
|
|
fi
|
|
|
|
splash=""
|
|
did_redirect=""
|
|
otty=$(stty -g)
|
|
redirect ()
|
|
{
|
|
test -z "$did_redirect" || return 0
|
|
did_redirect=1
|
|
if test -e /proc/splash ; then
|
|
read splash < /proc/splash
|
|
echo verbose > /proc/splash
|
|
fi
|
|
test -z "$otty" || stty "$otty" < $REDIRECT;
|
|
stty -nl -ixon ignbrk -brkint < $REDIRECT
|
|
if test -x /etc/init.d/kbd -a -n "$RUNLEVEL" ; then
|
|
/etc/init.d/kbd start
|
|
fi
|
|
}
|
|
|
|
restore ()
|
|
{
|
|
test -n "$did_redirect" || return 0
|
|
test -z "$otty" || stty "$otty" < $REDIRECT;
|
|
[[ "$splash" =~ silent ]] && echo silent > /proc/splash
|
|
}
|
|
|
|
ppid=0
|
|
prmt=""
|
|
setprompt ()
|
|
{
|
|
if test -t 1 -a "$TERM" != "raw" -a "$TERM" != "dumb" && stty size <&1 > /dev/null 2>&1
|
|
then
|
|
(
|
|
trap "exit 0" SIGTERM
|
|
trap "echo" SIGINT SIGSEGV
|
|
usleep 15000
|
|
while test $timeout -gt 0 ; do
|
|
# cursor to start of line, erase line, print prompt
|
|
echo -en "\r\e[2K${prmt}"
|
|
sleep 2
|
|
: $((timeout-=2))
|
|
done
|
|
) & ppid=$!
|
|
else
|
|
usleep 15000
|
|
echo -en "\r${prmt}"
|
|
ppid=0
|
|
fi
|
|
}
|
|
|
|
unsetprompt ()
|
|
{
|
|
local ret=$?
|
|
test $ppid -gt 0 && kill -15 $ppid
|
|
ppid=0
|
|
return $ret
|
|
}
|
|
|
|
reverse ()
|
|
{
|
|
local _line
|
|
while read -r _line ; do
|
|
case "$_line" in \#*|"") continue ;; esac
|
|
reverse
|
|
echo "$_line"
|
|
break
|
|
done
|
|
}
|
|
|
|
detachloopdev ()
|
|
{
|
|
if [ -n "$loopdev" ]; then
|
|
losetup -d $loopdev &> /dev/null || true
|
|
fi
|
|
}
|
|
|
|
#
|
|
# Check for valid super blocks
|
|
#
|
|
check_superblock()
|
|
{
|
|
local fs="$1"
|
|
local device="$2"
|
|
case "$fs" in
|
|
ext[23]) tune2fs -l $device &> /dev/null ;;
|
|
reiserfs) debugreiserfs $device &> /dev/null ;;
|
|
*) true ;;
|
|
esac
|
|
}
|
|
|
|
#
|
|
# parameters: filesys device mountpoint physdev quiet
|
|
# return value:
|
|
# 0 - ok
|
|
# 1 - enter passphrase again
|
|
# 2 - skip entry
|
|
# 3 - fsck
|
|
#
|
|
paranoid_safety_checks()
|
|
{
|
|
local filesys device mp physdev quiet choice
|
|
filesys="$1"
|
|
device="$2"
|
|
mp="$3"
|
|
physdev="$4"
|
|
quiet="$5"
|
|
|
|
check_superblock "$filesys" "$device"
|
|
|
|
if test $? -gt 0 || ! mount -t "$filesys" -n -o ro "$device" "$mp" &> /dev/null ; then
|
|
umount -n "$mp" &> /dev/null || true
|
|
if test -n "$quiet"; then
|
|
return 2
|
|
fi
|
|
echo "${warn}An error occured. Maybe the wrong passphrase was"
|
|
echo "entered or the file system on $physdev is corrupted.${norm}"
|
|
while true ; do
|
|
# TODO: rephrase that
|
|
echo "${extd}Do you want to retry entering the passphrase?${norm}"
|
|
echo -n "${extd}Alternatively you may continue with a file system check.${norm}"
|
|
choice=
|
|
read -p " ([${extd}yes${norm}]/${extd}no${norm}/${extd}check${norm}/) " choice < $REDIRECT || { echo 'no'; choice='no'; }
|
|
case "$choice" in
|
|
[yY][eE][sS]|[yY]|"")
|
|
return 1 ;;
|
|
[nN][oO]|[nN])
|
|
return 2 ;;
|
|
[Cc][hH][eE][Cc][kK]|[Cc])
|
|
return 3 ;;
|
|
esac
|
|
done
|
|
else
|
|
umount -n "$mp" &> /dev/null || true
|
|
fi
|
|
|
|
return 0
|
|
}
|
|
|
|
run_fsck()
|
|
{
|
|
local filesys device mp physdev
|
|
filesys="$1"
|
|
device="$2"
|
|
mp="$3"
|
|
physdev="$4"
|
|
#
|
|
# Checking the structure on the loop device
|
|
#
|
|
if test -x /sbin/fsck.$filesys; then
|
|
fsck -T -a -t $filesys $device
|
|
else
|
|
true
|
|
fi
|
|
if test $? -gt 1; then
|
|
echo "${extd}fsck of $device failed. Please repair manually.${norm}"
|
|
echo "${warn}Warning: do never try to repair if you have entered the wrong passphrase.${norm}"
|
|
# run sulogin only during boot
|
|
if test "$base" != "$link"; then
|
|
PS1="(repair filesystem) # "
|
|
/sbin/sulogin -t "$timeout" $REDIRECT < $REDIRECT > $REDIRECT 2>&1
|
|
sync
|
|
|
|
if ! paranoid_safety_checks "$filesys" "$device" "$mp" "$physdev" 'quiet'; then
|
|
echo "${extd}$physdev still appears to be damaged, skipping${norm}"
|
|
/sbin/cryptsetup remove $name || true
|
|
detachloopdev
|
|
return 1
|
|
fi
|
|
else
|
|
# leave the device set up so user can fun fsck manually
|
|
return 1
|
|
fi
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
report()
|
|
{
|
|
rc_failed "$1"
|
|
shift
|
|
echo -n "$*"
|
|
rc_status -v
|
|
}
|
|
|
|
start_cryptotab ()
|
|
{
|
|
local stat=0
|
|
local haveone=''
|
|
timeout="$TIMEOUT"
|
|
|
|
test -n "$tostart" || echo "Activating crypto devices using $CRYPTOTAB ... "
|
|
while read loopdev physdev access filesys crypto mopt info rest ; do
|
|
case "$loopdev" in
|
|
\#*|"") continue ;;
|
|
esac
|
|
|
|
if test -n "$tostart" -a "$loopdev" != "$tostart" -a "$physdev" != "$tostart" -a "$access" != "$tostart"; then
|
|
continue
|
|
fi
|
|
|
|
haveone=1
|
|
|
|
redirect
|
|
|
|
# key length for cryptsetup
|
|
keylen=
|
|
ivgen='plain'
|
|
hashalgo='sha512'
|
|
name=
|
|
#
|
|
|
|
# Does the user want to skip current entry?
|
|
#
|
|
doskip=0
|
|
#
|
|
# Does the mount point exit?
|
|
#
|
|
if ! test -d $access ; then
|
|
report 5 "$physdev: $access doesn't exist"
|
|
continue
|
|
fi
|
|
if ! test -e $physdev ; then
|
|
report 5 "$physdev doesn't exist"
|
|
continue
|
|
fi
|
|
#
|
|
# Seeking for crypto modules
|
|
#
|
|
case "$crypto" in
|
|
twofish) keylen=192; ivgen='null'; hashalgo='ripemd160:20' ;;
|
|
twofishSL92) keylen=256; ivgen='null' ;;
|
|
twofish[0-9]*) keylen=${crypto#twofish}; ;;
|
|
#TODO add more algorithm or better detection
|
|
*)
|
|
report 2 "$physdev: unsupported algorithm \"$crypto\""
|
|
continue
|
|
;;
|
|
esac
|
|
cipher=twofish-cbc-$ivgen
|
|
|
|
name="${loopdev#/dev/}"
|
|
name="cryptotab_${name//[^A-Za-z0-9]/_}"
|
|
|
|
if [ -e "/dev/mapper/$name" ]; then
|
|
report 5 "$physdev: $name already mapped"
|
|
continue
|
|
fi
|
|
|
|
while true; do # setup/check loop
|
|
#
|
|
# Restore virgin state
|
|
#
|
|
if [ -b "/dev/mapper/$name" ]; then
|
|
/sbin/cryptsetup remove $name || true
|
|
fi
|
|
detachloopdev
|
|
device="$loopdev"
|
|
|
|
#
|
|
# Setting up loop device
|
|
#
|
|
if test -n "$info" ; then
|
|
prmt="${extd}Please enter passphrase for \"$info\" ($physdev): ${norm}"
|
|
else
|
|
prmt="${extd}Please enter passphrase for $physdev: ${norm}"
|
|
fi
|
|
|
|
# we always use a loop device to avoid block size issues
|
|
# with e.g. cdroms for backward compatability
|
|
if ! losetup $loopdev $physdev; then
|
|
report 1 "$physdev..."
|
|
continue 2
|
|
fi
|
|
|
|
params="-t $timeout -c $cipher -s $keylen -h $hashalgo"
|
|
|
|
setprompt
|
|
/sbin/cryptsetup $params create "$name" "$device" < $REDIRECT > $REDIRECT 2>&1
|
|
stat=$?
|
|
unsetprompt
|
|
|
|
if test "$stat" -ne 0; then
|
|
detachloopdev
|
|
report 1 "$physdev..."
|
|
continue 2
|
|
fi
|
|
|
|
device="/dev/mapper/$name"
|
|
|
|
paranoid_safety_checks "$filesys" "$device" "$access" "$physdev"
|
|
stat="$?"
|
|
if test "$stat" = 1; then # retype passphrase
|
|
continue
|
|
elif test "$stat" = 2; then # skip entry
|
|
doskip=1
|
|
fi
|
|
break
|
|
done
|
|
#
|
|
# Does the user want to skip this entry?
|
|
#
|
|
if test $doskip -gt 0 ; then
|
|
/sbin/cryptsetup remove $name || true
|
|
report 5 "$physdev..."
|
|
detachloopdev
|
|
continue
|
|
fi
|
|
|
|
if ! run_fsck "$filesys" "$device" "$access" "$physdev"; then
|
|
report 1 "$physdev..."
|
|
continue
|
|
fi
|
|
|
|
case "$mopt" in
|
|
default|"") mopt="" ;;
|
|
esac
|
|
|
|
mount -t $filesys ${mopt:+-o $mopt} $device $access
|
|
stat=$?
|
|
if test $stat -gt 0 ; then
|
|
stat=1
|
|
/sbin/cryptsetup remove $name || true
|
|
detachloopdev
|
|
fi
|
|
report $stat "$physdev..."
|
|
done < $CRYPTOTAB
|
|
|
|
if test -z "$haveone" -a -z "$tostart"; then
|
|
rc_failed 6
|
|
rc_status -v1
|
|
fi
|
|
}
|
|
|
|
hashalotcryptsetup()
|
|
{
|
|
/sbin/hashalot ${halgo:+$halgo} -t $timeout ${pseed:+-s $pseed} ${itercountk:+-C $itercountk} | /sbin/cryptsetup "$@"
|
|
}
|
|
|
|
start_crypttab ()
|
|
{
|
|
local stat=0
|
|
local haveone=''
|
|
|
|
test -n "$tostart" || echo "Activating crypto devices using $CRYPTTAB ... "
|
|
while read name physdev keyfile options dummy; do
|
|
case "$name" in
|
|
\#*|"") continue ;;
|
|
esac
|
|
|
|
if test -n "$tostart" -a "$name" != "$tostart" -a "$physdev" != "$tostart"; then
|
|
continue
|
|
fi
|
|
|
|
haveone=1
|
|
redirect
|
|
|
|
# skip mapped entries
|
|
if test -e /dev/mapper/$name; then
|
|
report 5 "$physdev: $name already mapped"
|
|
continue
|
|
fi
|
|
|
|
test "$keyfile" = "none" && keyfile=""
|
|
test "$options" = "none" && options=""
|
|
|
|
# make sure the keyfile exists
|
|
if test -n "$keyfile" -a ! -e "$keyfile"; then
|
|
report 5 "$physdev: $keyfile does not exist"
|
|
continue
|
|
fi
|
|
if ! test -e $physdev ; then
|
|
report 5 "$physdev doesn't exist"
|
|
continue
|
|
fi
|
|
|
|
# parse the options field
|
|
skip=""
|
|
params=""
|
|
makeswap=""
|
|
maketmp=""
|
|
noauto=""
|
|
luks=""
|
|
check=""
|
|
checkargs=""
|
|
loopdev=""
|
|
param_ro=""
|
|
cipher=""
|
|
keysize=""
|
|
halgo=""
|
|
timeout=""
|
|
tries=""
|
|
pseed=""
|
|
itercountk=""
|
|
while test -n "$options"; do
|
|
arg=${options%%,*}
|
|
options=${options##$arg}
|
|
options=${options##,}
|
|
param=${arg%%=*}
|
|
value=${arg##$param=}
|
|
|
|
case "$param" in
|
|
cipher)
|
|
if test -z "$value" ; then
|
|
echo $"$dst: no value for cipher option, skipping"
|
|
skip="yes"
|
|
fi
|
|
cipher="$value"
|
|
;;
|
|
size)
|
|
if test -z "$value" ; then
|
|
echo $"$dst: no value for size option, skipping"
|
|
skip="yes"
|
|
fi
|
|
keysize="$value"
|
|
;;
|
|
hash)
|
|
if test -z "$value" ; then
|
|
echo $"$dst: no value for hash option, skipping"
|
|
skip="yes"
|
|
fi
|
|
halgo="$value"
|
|
;;
|
|
verify) params="$params -y" ;;
|
|
swap) makeswap="yes" ;;
|
|
tmp) maketmp="yes" ;;
|
|
noauto) noauto="yes" ;;
|
|
luks) luks="yes" ;;
|
|
loop) loopdev="yes" ;;
|
|
readonly) param_ro="-r" ;;
|
|
timeout)
|
|
case "$value" in
|
|
[0-9]*) timeout="$value";;
|
|
*) echo "invalid timeout '$value' ignored" ;;
|
|
esac
|
|
;;
|
|
tries)
|
|
if test -n "$value" ; then
|
|
params="$params --tries=$tries"
|
|
fi
|
|
;;
|
|
check)
|
|
if test -n "$value" -a -x /lib/cryptsetup/checks/"$value" ; then
|
|
check="/lib/cryptsetup/checks/$value"
|
|
else
|
|
check="/lib/cryptsetup/checks/vol_id"
|
|
fi
|
|
;;
|
|
checkargs)
|
|
if test -n "$value" ; then
|
|
checkargs="$value"
|
|
fi
|
|
;;
|
|
pseed) pseed="$value" ;;
|
|
itercountk) itercountk="$value" ;;
|
|
precheck|loud|ssl|gpg|keyscript|*)
|
|
echo "unsupported crypttab option: '$param'"
|
|
skip='yes'
|
|
;;
|
|
esac
|
|
done
|
|
|
|
if test -n "$luks"; then
|
|
if test -n "$cipher" -o -n "$halgo" -o -n "$keysize" -o -n "$pseed" -o -n "$itercountk"; then
|
|
echo "cipher, hash, size, pseed and itercountk options are ignored for LUKS"
|
|
fi
|
|
fi
|
|
if test -n "$keyfile"; then
|
|
if test -n "$halgo" -o -n "$pseed" -o -n "$itercountk"; then
|
|
report 2 "${ext}hash, pseed and itercountk options are invalid when using a key file${norm}"
|
|
continue
|
|
fi
|
|
fi
|
|
|
|
if test "$skip" = "yes" -o \( "$noauto" = "yes" -a -z "$tostart" \); then
|
|
report 5 "$physdev"
|
|
continue
|
|
fi
|
|
|
|
if test -n "$param_ro"; then
|
|
params="$params $param_ro"
|
|
fi
|
|
|
|
# we always want a timeout to prevent accidential hanging boot
|
|
if test -z "$timeout"; then
|
|
timeout="$TIMEOUT"
|
|
fi
|
|
params="$params --timeout=$timeout"
|
|
|
|
device="$physdev"
|
|
# if device is a regular file then it's an image
|
|
if test -n "$loopdev" -o -f $device; then
|
|
loopdev=''
|
|
for i in 0 1 2 3 4 5 6 7; do
|
|
if ! test -b "/dev/loop$i"; then
|
|
continue
|
|
fi
|
|
|
|
unset loopsize
|
|
read loopsize < /sys/block/loop$i/size
|
|
if test $? -eq 0 -a "$loopsize" = '0' && /sbin/losetup $param_ro "/dev/loop$i" $device; then
|
|
device="/dev/loop$i"
|
|
loopdev="$device"
|
|
break
|
|
fi
|
|
done
|
|
|
|
if test -z "$loopdev"; then
|
|
report 1 "$physdev: failed to find a usable loop device"
|
|
continue
|
|
fi
|
|
fi
|
|
|
|
doskip=0
|
|
|
|
while true; do # setup/check loop
|
|
|
|
if [ -b "/dev/mapper/$name" ]; then
|
|
/sbin/cryptsetup remove $name
|
|
fi
|
|
|
|
if test -z "$keyfile"; then
|
|
prmt="${extd}Please enter passphrase for $physdev ($name): ${norm}"
|
|
setprompt
|
|
fi
|
|
|
|
# map the devices
|
|
if test -n "$luks" || cryptsetup isLuks "$device" &> /dev/null; then
|
|
luks='yes'
|
|
/sbin/cryptsetup $params ${keyfile:+-d $keyfile} luksOpen "$device" "$name" < $REDIRECT &> $REDIRECT
|
|
stat=$?
|
|
else
|
|
# XXX hack
|
|
if test -n "$pseed" -o -n "$itercountk"; then
|
|
params="$params -d /dev/stdin" # cannot use "-" as cryptsetup would hash that
|
|
cryptsetup=hashalotcryptsetup
|
|
else
|
|
cryptsetup=/sbin/cryptsetup
|
|
fi
|
|
params="$params ${cipher:+-c $cipher} ${halgo:+-h $halgo} ${keysize:+-s $keysize}"
|
|
$cryptsetup $params ${keyfile:+-d $keyfile} create "$name" "$device" < $REDIRECT &> $REDIRECT
|
|
stat=$?
|
|
unset cryptsetup
|
|
fi
|
|
if test -z "$keyfile"; then
|
|
unsetprompt
|
|
fi
|
|
|
|
if test $stat -ne 0; then
|
|
report 1 "$physdev... "
|
|
doskip=1
|
|
detachloopdev
|
|
break
|
|
fi
|
|
|
|
# run check if it's set
|
|
if test -n "$check"; then
|
|
$check "/dev/mapper/$name" $checkargs
|
|
if test $? -ne 0; then
|
|
report 1 "$physdev... "
|
|
doskip=1
|
|
/sbin/cryptsetup remove $name
|
|
detachloopdev
|
|
break
|
|
fi
|
|
fi
|
|
|
|
mountpoint=''
|
|
fs_type='auto'
|
|
infstab=''
|
|
read dummy mountpoint fs_type dummy < <(/bin/awk -vd=/dev/mapper/$name '$1==d{print;exit}' < /etc/fstab)
|
|
if test "$?" -eq 0; then
|
|
infstab='yes'
|
|
fi
|
|
|
|
# run mkfs if the tmp option was given
|
|
if test "$maketmp" = "yes"; then
|
|
echo "Creating filesystem on /dev/mapper/$name..."
|
|
if test "$fs_type" = 'auto'; then
|
|
fs_type='ext2'
|
|
fi
|
|
/sbin/mkfs -t "$fs_type" /dev/mapper/$name
|
|
|
|
if test $? -ne 0; then
|
|
report 1 "$phsdev: failed to create temporary file system."
|
|
doskip=1
|
|
/sbin/cryptsetup remove $name
|
|
detachloopdev
|
|
break
|
|
fi
|
|
fi
|
|
|
|
# no need for paranoid checks with luks as cryptsetup is able to
|
|
# verify the passphrase itself then
|
|
#
|
|
# if the device is not in fstab we can't do paranoid checks as we
|
|
# don't know what the intention of the device is
|
|
if test "$makeswap" != 'yes' -a -z "$luks" -a -n "$infstab"; then
|
|
if test -z "$luks"; then
|
|
paranoid_safety_checks "$fs_type" "/dev/mapper/$name" "$mountpoint" "$physdev"
|
|
stat="$?"
|
|
if test "$stat" = 1; then # retype passphrase
|
|
continue
|
|
elif test "$stat" = 2; then # skip entry
|
|
report 5 "$physdev..."
|
|
doskip=1
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
break;
|
|
done # setup/check loop
|
|
|
|
if test "$doskip" -gt 0; then
|
|
if test -b "/dev/mapper/$name"; then
|
|
/sbin/cryptsetup remove "$name"
|
|
fi
|
|
detachloopdev
|
|
continue
|
|
fi
|
|
|
|
# run mkswap if necessary. boot.swap with enable this later
|
|
if test "$makeswap" = "yes"; then
|
|
mkswap "/dev/mapper/$name"
|
|
stat="$?"
|
|
test $stat -eq 0 || stat=1
|
|
report $stat "$physdev..."
|
|
continue
|
|
fi
|
|
|
|
if test -z "$infstab"; then
|
|
report 0 "$physdev..."
|
|
continue
|
|
fi
|
|
|
|
if ! run_fsck "$fs_type" "/dev/mapper/$name" "$mp" "$physdev"; then
|
|
report 1 "$physdev..."
|
|
continue
|
|
fi
|
|
|
|
mount /dev/mapper/$name
|
|
stat="$?"
|
|
|
|
if test $stat -gt 0 ; then
|
|
stat=1
|
|
/sbin/cryptsetup remove $name || true
|
|
detachloopdev
|
|
fi
|
|
|
|
# set permissions for tmp dirs
|
|
if test "$maketmp" = "yes"; then
|
|
chmod 1777 $mountpoint
|
|
fi
|
|
|
|
report $stat "$physdev..."
|
|
|
|
done < $CRYPTTAB
|
|
if test -z "$haveone" -a -z "$tostart"; then
|
|
rc_failed 6
|
|
rc_status -v1
|
|
fi
|
|
}
|
|
|
|
umount_or_swapoff()
|
|
{
|
|
# unmount device
|
|
if /bin/grep -q "^/dev/mapper/$name[ \t]" /proc/mounts; then
|
|
umount "/dev/mapper/$name"
|
|
if test $? -gt 0 ; then
|
|
return 1
|
|
fi
|
|
elif /bin/grep -q "^/dev/mapper/$name[ \t]" /proc/swaps; then
|
|
swapoff "/dev/mapper/$name"
|
|
if test $? -gt 0 ; then
|
|
return 1
|
|
fi
|
|
fi
|
|
|
|
return 0
|
|
}
|
|
|
|
|
|
stop_cryptotab ()
|
|
{
|
|
local haveone=''
|
|
|
|
test -n "$tostop" || echo "Turning off crypto devices using $CRYPTOTAB ... "
|
|
|
|
while read loopdev physdev access filesys crypto mopt rest ; do
|
|
case "$loopdev" in
|
|
\#*|"") continue ;;
|
|
esac
|
|
|
|
if test -n "$tostop" -a "$loopdev" != "$tostop" -a "$physdev" != "$tostop" -a "$access" != "$tostop"; then
|
|
continue
|
|
fi
|
|
|
|
haveone=1
|
|
|
|
name="${loopdev#/dev/}"
|
|
name="cryptotab_${name//[^A-Za-z0-9]/_}"
|
|
|
|
if test -b "/dev/mapper/$name"; then
|
|
|
|
if ! umount_or_swapoff; then
|
|
report 1 "$physdev..."
|
|
continue
|
|
fi
|
|
|
|
cryptsetup remove "$name" || rc_failed 1
|
|
fi
|
|
|
|
if losetup $loopdev >/dev/null 2>&1; then
|
|
losetup -d $loopdev || rc_failed 1
|
|
fi
|
|
|
|
echo -n "$physdev..."
|
|
rc_status -v
|
|
|
|
done < <(reverse < $CRYPTOTAB)
|
|
|
|
if test -z "$haveone" -a -z "$tostop"; then
|
|
rc_status -v1
|
|
fi
|
|
}
|
|
|
|
stop_crypttab ()
|
|
{
|
|
local haveone=''
|
|
|
|
test -n "$tostop" || echo "Turning off crypto devices using $CRYPTTAB ... "
|
|
|
|
while read name physdev keyfile options dummy; do
|
|
case "$name" in
|
|
\#*|"") continue ;;
|
|
esac
|
|
|
|
if test -n "$tostop" -a "$name" != "$tostop" -a "$physdev" != "$tostop"; then
|
|
continue
|
|
fi
|
|
|
|
haveone=1
|
|
|
|
loopdev=""
|
|
device="$physdev"
|
|
|
|
if test -b "/dev/mapper/$name"; then
|
|
if ! umount_or_swapoff; then
|
|
report 1 "$physdev..."
|
|
continue
|
|
fi
|
|
|
|
/sbin/cryptsetup remove "$name" || rc_failed 1
|
|
fi
|
|
|
|
# delete the loop device
|
|
while read line; do
|
|
case "$line" in
|
|
*\(${physdev}\)*) device=${line%%:*}; loopdev='yes' ;;
|
|
esac
|
|
done < <(/sbin/losetup -a)
|
|
|
|
if test -n "$loopdev" && losetup $device >/dev/null 2>&1; then
|
|
/sbin/losetup -d $device || rc_failed 1
|
|
fi
|
|
|
|
echo -n "$physdev..."
|
|
rc_status -v
|
|
|
|
done < <(reverse < $CRYPTTAB)
|
|
|
|
if test -z "$haveone" -a -z "$tostop"; then
|
|
rc_status -v1
|
|
fi
|
|
}
|
|
|
|
status_cryptotab()
|
|
{
|
|
local state str
|
|
local haveone=''
|
|
while read loopdev physdev access filesys crypto mopt info rest ; do
|
|
case "$loopdev" in
|
|
\#*|"") continue ;;
|
|
esac
|
|
|
|
haveone=1
|
|
|
|
name="${loopdev#/dev/}"
|
|
name="cryptotab_${name//[^A-Za-z0-9]/_}"
|
|
|
|
echo -n "$physdev"
|
|
state=0
|
|
str=''
|
|
|
|
if losetup "$loopdev" > /dev/null 2>&1; then
|
|
str="$str ${loopdev#/dev/}"
|
|
state=$((state+1))
|
|
fi
|
|
if test -b "/dev/mapper/$name"; then
|
|
str="$str mapped"
|
|
state=$((state+1))
|
|
fi
|
|
if /bin/grep -q "^/dev/mapper/$name[ \t]" /proc/mounts; then
|
|
str="$str mounted"
|
|
state=$((state+1))
|
|
fi
|
|
|
|
if test "$state" = 3; then
|
|
rc_failed 0
|
|
elif test "$state" != 0; then
|
|
rc_failed 4
|
|
else
|
|
rc_failed 3
|
|
fi
|
|
|
|
if test -n "$str"; then
|
|
echo -n " [$str ]"
|
|
fi
|
|
rc_status -v
|
|
|
|
done < $CRYPTOTAB
|
|
|
|
if test -z "$haveone"; then
|
|
report 3 "$CRYPTOTAB"
|
|
fi
|
|
}
|
|
|
|
status_crypttab()
|
|
{
|
|
local state str
|
|
local haveone=''
|
|
|
|
while read name physdev keyfile options dummy; do
|
|
case "$name" in
|
|
\#*|"") continue ;;
|
|
esac
|
|
|
|
haveone=1
|
|
|
|
echo -n "$physdev"
|
|
state=0
|
|
str=''
|
|
|
|
loopdev=''
|
|
# find the loop device
|
|
while read line; do
|
|
case "$line" in
|
|
*\(${physdev}\)*) loopdev=${line%%:*};;
|
|
esac
|
|
done < <(/sbin/losetup -a)
|
|
|
|
if test -n "$loopdev" && losetup "$loopdev" > /dev/null 2>&1; then
|
|
str="$str ${loopdev#/dev/}"
|
|
state=$((state|1))
|
|
fi
|
|
if test -b "/dev/mapper/$name"; then
|
|
str="$str mapped"
|
|
state=$((state|2))
|
|
fi
|
|
if /bin/grep -q "^/dev/mapper/$name[ \t]" /proc/mounts; then
|
|
str="$str mounted"
|
|
state=$((state|4))
|
|
elif /bin/grep -q "^/dev/mapper/$name[ \t]" /proc/swaps; then
|
|
str="$str swap"
|
|
state=$((state|4))
|
|
fi
|
|
|
|
if test -n "$str"; then
|
|
echo -n " [$str ]"
|
|
fi
|
|
if test "$state" != 0; then
|
|
if test $((state&2)) = 0; then
|
|
rc_failed 4
|
|
else
|
|
if ! test -e "$physdev"; then
|
|
rc_failed 1
|
|
else
|
|
rc_failed 0
|
|
fi
|
|
fi
|
|
else
|
|
rc_failed 3
|
|
fi
|
|
rc_status -v
|
|
|
|
done < $CRYPTTAB
|
|
|
|
if test -z "$haveone"; then
|
|
report 3 "$CRYPTTAB"
|
|
fi
|
|
}
|
|
|
|
#
|
|
# Cutomize_{start,stop}_hook are for interactive usage only
|
|
#
|
|
cutomize_start_hook ()
|
|
{
|
|
local srv
|
|
|
|
test "$base" != "$link" && return 0
|
|
test -s /etc/sysconfig/boot.crypto || return 0
|
|
. /etc/sysconfig/boot.crypto
|
|
|
|
for srv in $TRY_RESTART_AT_START ; do
|
|
test -n "$srv" || break
|
|
test -x /etc/init.d/$srv || continue
|
|
/etc/init.d/$srv try-restart
|
|
done
|
|
|
|
for srv in $RESTART_AT_START ; do
|
|
test -n "$srv" || break
|
|
test -x /etc/init.d/$srv || continue
|
|
/etc/init.d/$srv restart
|
|
done
|
|
|
|
for srv in $RELOAD_AT_START ; do
|
|
test -n "$srv" || break
|
|
test -x /etc/init.d/$srv || continue
|
|
/etc/init.d/$srv reload
|
|
done
|
|
}
|
|
|
|
cutomize_stop_hook ()
|
|
{
|
|
local srv
|
|
|
|
test "$base" != "$link" && return 0
|
|
test -s /etc/sysconfig/boot.crypto || return 0
|
|
. /etc/sysconfig/boot.crypto
|
|
|
|
for srv in $TRY_RESTART_AT_STOP ; do
|
|
test -n "$srv" || break
|
|
test -x /etc/init.d/$srv || continue
|
|
/etc/init.d/$srv try-restart
|
|
done
|
|
|
|
for srv in $RESTART_AT_STOP ; do
|
|
test -n "$srv" || break
|
|
test -x /etc/init.d/$srv || continue
|
|
/etc/init.d/$srv restart
|
|
done
|
|
|
|
for srv in $RELOAD_AT_STOP ; do
|
|
test -n "$srv" || break
|
|
test -x /etc/init.d/$srv || continue
|
|
/etc/init.d/$srv reload
|
|
done
|
|
}
|
|
|
|
rc_reset
|
|
case "$1" in
|
|
start|b)
|
|
|
|
if ! /sbin/modprobe -q dm-crypt; then
|
|
echo "kernel lacks dm-crypt support"
|
|
rc_failed 5
|
|
rc_status -v
|
|
rc_exit
|
|
fi
|
|
|
|
tostart="$2"
|
|
|
|
if test -s $CRYPTOTAB; then
|
|
start_cryptotab
|
|
fi
|
|
|
|
if test -s $CRYPTTAB; then
|
|
start_crypttab
|
|
fi
|
|
|
|
rc_failed 0
|
|
|
|
restore
|
|
|
|
cutomize_start_hook
|
|
;;
|
|
stop)
|
|
|
|
tostop="$2"
|
|
|
|
if test -s $CRYPTOTAB; then
|
|
stop_cryptotab
|
|
fi
|
|
|
|
if test -s $CRYPTTAB; then
|
|
stop_crypttab
|
|
fi
|
|
|
|
rc_failed 0
|
|
|
|
cutomize_stop_hook
|
|
;;
|
|
status)
|
|
if test -s $CRYPTOTAB; then
|
|
status_cryptotab
|
|
fi
|
|
|
|
if test -s $CRYPTTAB; then
|
|
status_crypttab
|
|
fi
|
|
rc_failed 0
|
|
;;
|
|
restart)
|
|
$0 stop
|
|
$0 start
|
|
rc_status
|
|
;;
|
|
*)
|
|
echo "Usage: $0 {start|stop|status|restart}"
|
|
exit 1
|
|
;;
|
|
esac
|
|
rc_exit
|