3e026f665c
- Add safety measure to pcr snapshot by checking platform and tpm status * safe_tpm_pcr_snapshot.patch - Fix installation failure due to unavailable nvram device on ppc64le (bsc#1201361) * 0001-grub-install-set-point-of-no-return-for-powerpc-ieee1275.patch - Add patches to dynamically allocate additional memory regions for EFI systems (bsc#1202438) * 0001-mm-Allow-dynamically-requesting-additional-memory-re.patch * 0002-kern-efi-mm-Always-request-a-fixed-number-of-pages-o.patch * 0003-kern-efi-mm-Extract-function-to-add-memory-regions.patch * 0004-kern-efi-mm-Pass-up-errors-from-add_memory_regions.patch * 0005-kern-efi-mm-Implement-runtime-addition-of-pages.patch - Enlarge the default heap size and defer the disk cache invalidation (bsc#1202438) * 0001-kern-efi-mm-Enlarge-the-default-heap-size.patch * 0002-mm-Defer-the-disk-cache-invalidation.patch - Add patches for ALP FDE support * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch * 0004-normal-menu-Don-t-show-Booting-s-msg-when-auto-booti.patch * 0005-EFI-suppress-the-Welcome-to-GRUB-message-in-EFI-buil.patch * 0006-EFI-console-Do-not-set-colorstate-until-the-first-te.patch * 0007-EFI-console-Do-not-set-cursor-until-the-first-text-o.patch * 0008-linuxefi-Use-common-grub_initrd_load.patch * 0009-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch * 0010-templates-import-etc-crypttab-to-grub.cfg.patch OBS-URL: https://build.opensuse.org/request/show/1004537 OBS-URL: https://build.opensuse.org/package/show/Base:System/grub2?expand=0&rev=419
128 lines
5.0 KiB
Diff
128 lines
5.0 KiB
Diff
From a25627c13b7e1e6998a14b5dd23b04b28465d737 Mon Sep 17 00:00:00 2001
|
|
From: Josselin Poiret via Grub-devel <grub-devel@gnu.org>
|
|
Date: Tue, 14 Jun 2022 15:47:30 +0200
|
|
Subject: [PATCH 02/10] devmapper/getroot: Set up cheated LUKS2 cryptodisk
|
|
mount from DM parameters
|
|
|
|
This lets a LUKS2 cryptodisk have its cipher and hash filled out,
|
|
otherwise they wouldn't be initialized if cheat mounted.
|
|
---
|
|
grub-core/osdep/devmapper/getroot.c | 91 +++++++++++++++++++++++++++++++++++-
|
|
1 file changed, 90 insertions(+), 1 deletion(-)
|
|
|
|
--- a/grub-core/osdep/devmapper/getroot.c
|
|
+++ b/grub-core/osdep/devmapper/getroot.c
|
|
@@ -51,6 +51,8 @@
|
|
#include <grub/emu/misc.h>
|
|
#include <grub/emu/hostdisk.h>
|
|
|
|
+#include <grub/cryptodisk.h>
|
|
+
|
|
static int
|
|
grub_util_open_dm (const char *os_dev, struct dm_tree **tree,
|
|
struct dm_tree_node **node)
|
|
@@ -186,7 +188,6 @@
|
|
&& lastsubdev)
|
|
{
|
|
char *grdev = grub_util_get_grub_dev (lastsubdev);
|
|
- dm_tree_free (tree);
|
|
if (grdev)
|
|
{
|
|
grub_err_t err;
|
|
@@ -194,7 +195,95 @@
|
|
if (err)
|
|
grub_util_error (_("can't mount encrypted volume `%s': %s"),
|
|
lastsubdev, grub_errmsg);
|
|
+ if (strncmp (uuid, "CRYPT-LUKS2-", sizeof ("CRYPT-LUKS2-") - 1) == 0)
|
|
+ {
|
|
+ /* set LUKS2 cipher from dm parameters, since it is not
|
|
+ * possible to determine the correct one without
|
|
+ * unlocking, as there might be multiple segments.
|
|
+ */
|
|
+ grub_disk_t source;
|
|
+ grub_cryptodisk_t cryptodisk;
|
|
+ grub_uint64_t start, length;
|
|
+ char *target_type;
|
|
+ char *params;
|
|
+ const char *name;
|
|
+ char *cipher, *cipher_mode;
|
|
+ struct dm_task *dmt;
|
|
+ char *seek_head, *c;
|
|
+ unsigned int remaining;
|
|
+
|
|
+ source = grub_disk_open (grdev);
|
|
+ cryptodisk = grub_cryptodisk_get_by_source_disk (source);
|
|
+ grub_disk_close (source);
|
|
+
|
|
+ name = dm_tree_node_get_name (node);
|
|
+
|
|
+ grub_util_info ("populating parameters of cryptomount `%s' from DM device `%s'",
|
|
+ uuid, name);
|
|
+
|
|
+ dmt = dm_task_create (DM_DEVICE_TABLE);
|
|
+ if (dmt == 0)
|
|
+ grub_util_error (_("can't create dm task DM_DEVICE_TABLE"));
|
|
+ if (dm_task_set_name (dmt, name) == 0)
|
|
+ grub_util_error (_("can't set dm task name to `%s'"), name);
|
|
+ if (dm_task_run (dmt) == 0)
|
|
+ grub_util_error (_("can't run dm task for `%s'"), name);
|
|
+ /* dm_get_next_target doesn't have any error modes, everything has
|
|
+ * been handled by dm_task_run.
|
|
+ */
|
|
+ dm_get_next_target (dmt, NULL, &start, &length,
|
|
+ &target_type, ¶ms);
|
|
+ if (strncmp (target_type, "crypt", sizeof ("crypt")) != 0)
|
|
+ grub_util_error (_("dm target of type `%s' is not `crypt'"),
|
|
+ target_type);
|
|
+
|
|
+ /* dm target parameters for dm-crypt is
|
|
+ * <cipher> <key> <iv_offset> <device path> <offset> [<#opt_params> <opt_param1> ...]
|
|
+ */
|
|
+ c = params;
|
|
+ remaining = grub_strlen (c);
|
|
+
|
|
+ /* first, get the cipher name from the cipher */
|
|
+ if (!(seek_head = grub_memchr (c, '-', remaining)))
|
|
+ grub_util_error (_("can't get cipher from dm-crypt parameters `%s'"),
|
|
+ params);
|
|
+ cipher = grub_strndup (c, seek_head - c);
|
|
+ remaining -= seek_head - c + 1;
|
|
+ c = seek_head + 1;
|
|
+
|
|
+ /* now, the cipher mode */
|
|
+ if (!(seek_head = grub_memchr (c, ' ', remaining)))
|
|
+ grub_util_error (_("can't get cipher mode from dm-crypt parameters `%s'"),
|
|
+ params);
|
|
+ cipher_mode = grub_strndup (c, seek_head - c);
|
|
+ remaining -= seek_head - c + 1;
|
|
+ c = seek_head + 1;
|
|
+
|
|
+ err = grub_cryptodisk_setcipher (cryptodisk, cipher, cipher_mode);
|
|
+ if (err)
|
|
+ {
|
|
+ grub_util_error (_("can't set cipher of cryptodisk `%s' to `%s' with mode `%s'"),
|
|
+ uuid, cipher, cipher_mode);
|
|
+ }
|
|
+
|
|
+ grub_free (cipher);
|
|
+ grub_free (cipher_mode);
|
|
+
|
|
+ /* This is the only hash usable by PBKDF2, and we don't
|
|
+ * have Argon2 support yet, so set it by default,
|
|
+ * otherwise grub-probe would miss the required
|
|
+ * abstraction
|
|
+ */
|
|
+ cryptodisk->hash = grub_crypto_lookup_md_by_name ("sha256");
|
|
+ if (cryptodisk->hash == 0)
|
|
+ {
|
|
+ grub_util_error (_("can't lookup hash sha256 by name"));
|
|
+ }
|
|
+
|
|
+ dm_task_destroy (dmt);
|
|
+ }
|
|
}
|
|
+ dm_tree_free (tree);
|
|
grub_free (grdev);
|
|
}
|
|
else
|