summaryrefslogtreecommitdiffstats
path: root/src/cryptsetup/cryptsetup-generator.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* cryptsetup-generator: always process cmdline devicesDavid Tardon2024-06-121-7/+2
|
* cryptsetup-generator: parse all cmdline devices tooDavid Tardon2024-06-121-4/+3
|
* cryptsetup-generator: continue parsing after errorDavid Tardon2024-06-121-5/+3
| | | | | Let's make the crypttab parser more robust and continue even if parsing of a line failed.
* cryptsetup-generator: refactor add_crypttab_devices()David Tardon2024-06-121-38/+48
| | | | | | Move the processing of a crypttab entry to a separate function. No functional changes, just refactoring.
* cryptsetup-generator: Fix memory leakDaan De Meyer2024-05-311-0/+2
|
* cryptsetup: use WantsMountsFor= for key/header when nofail is setLuca Boccassi2023-11-291-10/+13
| | | | | | | | | | | The header and keyfile are necessary only for opening the device, not for closing, so it is not necessary to deactivate the generated cryptsetup unit when the header or keyfile backing store are removed. This is especially useful in the case of softreboot, when the new mount root is setup under /run/nextroot/ but we don't want to close the cryptsetup devices for encrypted /var/ or so, and we simply mount it directly on /run/nextroot/var/ before the soft-reboot.
* tree-wide: port various parsers over to read_stripped_line()Lennart Poettering2023-10-171-5/+4
|
* Drop split-usr and unmerged-usr supportLuca Boccassi2023-07-281-2/+2
| | | | | | | | | | As previously announced, execute order 66: https://lists.freedesktop.org/archives/systemd-devel/2022-September/048352.html The meson options split-usr, rootlibdir and rootprefix become no-ops that print a warning if they are set to anything other than the default values. We can remove them in a future release.
* generators: change TimeoutSec=0 to TimeoutSec=infinityLennart Poettering2023-06-061-1/+2
| | | | | | | | | | | | | | | With these settings we intend to turn off timeouts for possibly interactive/slow commands. The officially documented way to turn off the time-outs is to setting them to infinity. So far we set them to zero here though. This lead to some confusiong, for example #18224. Let's fix this by uniformly spelling out TimeoutSec=infinity. This doesn't change behaviour. It just makes our generated files match what we document, without relying on historic compat support. Fixes: #18224
* {crypt|verity}setup: replace dep on systemd-tmpfiles-setup-dev.service by ↵Lennart Poettering2023-06-011-5/+5
| | | | | | | | | | | | modprobe@loop.service Both should have the same effect: the /dev/loop-control devices should become available. systemd-tmpfiles-setup-dev.service creates the device node "dry" based on modalias data, while modprobe@loop.service creates it fully, because the module backing it is loaded properly. This should shorten the deps chain a bit, simplify things and allows us to focus on the stuff we actually need (i.e. the loopback infra) instead of all entrypoints anyone might possibly need (i.e. the device nodes)
* cryptsetup-generator: imply x-initrd.attach for "usr" and "root" volumesLennart Poettering2023-06-011-6/+18
| | | | | | | | | | | | | | | | | | | | | | | | | Let's imply "x-initrd.attach" for "usr" and "root" volumes, so that we do not attempt to umount them anymore during shutdown. The names of these volumes have been mandated by the Discoverable Partition Spec: https://uapi-group.org/specifications/specs/discoverable_partitions_specification/#suggested-mode-of-operation Hence it appears reasonably safe to special case these volume names. Note that a similar logic is implemented in fstab-generator and in fact PID 1 to treat the root mount and /usr/ mount specially too, to avoid trying to umount it at shutdown. (This is what fstab_is_extrinsic() checks). This should ensure that if /usr/ or / is for some reason a LUKS medium we won't try to detach it during runtime, which likely fails, since we run off it. Note this also moves an ordering dep towards umount.target under the x-initrd.attach check, becasue that's where the crucial conflicts dep is placed too.
* basic: rename util.h to logarithm.hZbigniew Jędrzejewski-Szmek2022-11-081-1/+0
| | | | | util.h is now about logarithms only, so we can rename it. Many files included util.h for no apparent reason… Those includes are dropped.
* cryptsetup: support keyfile-timeout for using a device as the key fileChih-Hsuan Yen2022-08-081-6/+19
| | | | Closes https://github.com/systemd/systemd/issues/21993
* generator: Rename password argJan Janssen2022-02-191-10/+10
| | | | | | | | | | This function does not expect a password, but a key file path. The cryptsetup helper binary even calls it that. No Code changes. Follow up on: 6e41f4dd916293f35d7d35cea7eed1807d7ea771 Fixes: https://github.com/systemd/systemd/security/code-scanning/81
* shared/fstab-util: teach fstab_filter_options() a mode where all values are ↵Zbigniew Jędrzejewski-Szmek2021-03-111-3/+6
| | | | | | | | | | returned Apart from tests, the new argument isn't used anywhere, so there should be no functional change. Note that the two arms of the big conditional are switched, so the diff is artificially inflated. The actual code change is rather small. I dropped the path which extracts ret_value manually, because it wasn't supporting unescaping of the escape character properly.
* tree-wide: use free_and_strdup_warn()Yu Watanabe2021-02-111-6/+3
|
* cryptsetup: drop unnecessary bracketYu Watanabe2020-11-271-2/+1
|
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-091-1/+1
|
* Revert "units: add initrd-cryptsetup.target"Zbigniew Jędrzejewski-Szmek2020-10-271-10/+5
| | | | | | | | | | This reverts commit 6c5496c492a8d74e54d22bf8824160cab1e63c10. sysinit.target is shared between the initrd and the host system. Pulling in initrd-cryptsetup.target into sysinit.target causes the following warning at boot: Oct 27 10:42:30 workstation-uefi systemd[1]: initrd-cryptsetup.target: Starting requested but asserts failed. Oct 27 10:42:30 workstation-uefi systemd[1]: Assertion failed for initrd-cryptsetup.target.
* units: add initrd-cryptsetup.targetJonathan Lebon2020-10-211-5/+10
| | | | | | | | | | | | | | | | | | For encrypted block devices that we need to unlock from the initramfs, we currently rely on dracut shipping `cryptsetup.target`. This works, but doesn't cover the case where the encrypted block device requires networking (i.e. the `remote-cryptsetup.target` version). That target however is traditionally dynamically enabled. Instead, let's rework things here by adding a `initrd-cryptsetup.target` specifically for initramfs encrypted block device setup. This plays the role of both `cryptsetup.target` and `remote-cryptsetup.target` in the initramfs. Then, adapt `systemd-cryptsetup-generator` to hook all generated services to this new unit when running from the initrd. This is analogous to `systemd-fstab-generator` hooking all mounts to `initrd-fs.target`, regardless of whether they're network-backed or not.
* Merge pull request #16444 from oniko/luks-detached-headerLennart Poettering2020-10-211-59/+222
|\ | | | | Add support for detached LUKS header on kernel cmd line
| * cryptsetup-generator: Add support for header device in crypttabOndrej Kozina2020-09-251-2/+16
| |
| * cryptsetup-generator: add detached LUKS header supportOndrej Kozina2020-09-251-11/+140
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Adds support for LUKS detached header device on kernel command line. It's introduced via extension to existing luks.options 'header=' argument beyond colon (see examples below). If LUKS header device is specified it's expected to contain filesystem with LUKS header image on a path specified in the first part of header specification. The second parameter 'luks.data' specifies LUKS data device supposed to be paired with detached LUKS header (note that encrypted LUKS data device with detached header is unrecognisable by standard blkid probe). This adds support for LUKS encrypted rootfs partition with detached header. It can also be used for initializing online LUKS2 encryption of data device. Examples: luks.data=<luks_uuid>=/dev/sdz luks.data=<luks_uuid>=/dev/vg/lv luks.data=<luks_uuid>=/dev/mapper/lv luks.data=<luks_uuid>=PARTUUID=<part_uuid> luks.data=<luks_uuid>=PARTLABEL=<part_uuid> luks.options=<luks_uuid>=header=/header/path:UUID=<fs_uuid> luks.options=<luks_uuid>=header=/header/path:PARTUUID=<part_uuid> luks.options=<luks_uuid>=header=/header/path:PARTLABEL=<part_label> luks.options=<luks_uuid>=header=/header/path:LABEL=<fs_label> luks.options=<luks_uuid>=header=/header/path:/dev/sdx luks.options=<luks_uuid>=header=/header/path:/dev/vg/lv The '/header/path' is considered to be relative location within filesystem residing on the header device specified beyond colon character
| * cryptsetup-generator: rename split_keyspec to split_locationspecOndrej Kozina2020-09-251-25/+25
| | | | | | | | To be used later not only for splitting key specifications
| * cryptsetup-generator: Add warn_uuid_invalid helperOndrej Kozina2020-09-251-3/+12
| |
| * cryptsetup-generator: rename and extend device mount helpers.Ondrej Kozina2020-09-251-18/+29
| | | | | | | | | | Those functions will be used later also for (u)mounting LUKS header devices.
| * cryptsetup-generator: use proper constant for uuid alphabetOndrej Kozina2020-09-251-1/+1
| |
* | tree-wide: assorted coccinelle fixesFrantisek Sumsal2020-10-091-2/+1
| |
* | Merge pull request #17154 from keszybz/crypttab-commasLennart Poettering2020-10-011-6/+0
|\ \ | |/ |/| Allow escaping commas in crypttab
| * cryptsetup-generator: drop unused fstat()Zbigniew Jędrzejewski-Szmek2020-09-241-6/+0
| | | | | | | | The result stopped being used in 71e4e1258436e7e81d772aed52a02bb5d9c87cb8.
* | cryptsetup-generator: avoid magic value in ternaryJonathan Lebon2020-09-241-1/+1
| | | | | | | | | | | | | | | | | | `startswith` already returns the string with the prefix skipped, so we can simplify this further and avoid using a magic value. Noticed in passing. Co-authored-by: Lennart Poettering <lennart@poettering.net>
* | cryptsetup-generator: use "/proc/cmdline" as source when appropriateJonathan Lebon2020-09-231-4/+6
|/ | | | | | | | Right now, we always say `/etc/crypttab` even if the source was fully derived from the kargs. Let's match what `systemd-fstab-generator` does and use `/proc/cmdline` when that's the case.
* cryptsetup: generate the unit to umount keydev filesystemMichal Sekletár2020-09-111-6/+55
| | | | | | | | | | | | | | | | | | | | | | | | Previously we would call umount from ExecStartPost= of systemd-cryptsetup instance in order to get rid of the keydev mount (i.e. filesystem containing keyfile). Let's generate unit to handle umount. Making this symmetrical (both mount and umount of keydev are handled by units) fixes the problem with lingering keydev mounts. Motivation for the change is the issue where keydev mount would stay around even if device was successfully unlocked and mount is no longer needed. That could happen previously because when generator options are not prefixed with "rd." we run generators twice (e.g. rd.luks.key=...). In such case disk is unlocked in initramfs phase of boot (assuming the initrd image contains the generator and is able to handle unlocking of LUKS devices). After switchroot we however enqueue start job for systemd-cryptsetup instance (because units are regenerated second time) and that pulls in its dependencies into transaction. Later the main systemd-cryptsetup unit not actually started since it is already active and has RemainaAfterExit=yes. Nevertheless, dependencies get activated and keydev mount is attached again. Because previously we called umount from ExecStartPost= of systemd-cryptsetup instance the umount is not called second time and keydev filesystem stays lingering.
* tree-wide: define iterator inside of the macroZbigniew Jędrzejewski-Szmek2020-09-081-2/+1
|
* tree-wide: avoid some loaded termsLennart Poettering2020-06-251-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | https://tools.ietf.org/html/draft-knodel-terminology-02 https://lwn.net/Articles/823224/ This gets rid of most but not occasions of these loaded terms: 1. scsi_id and friends are something that is supposed to be removed from our tree (see #7594) 2. The test suite defines an API used by the ubuntu CI. We can remove this too later, but this needs to be done in sync with the ubuntu CI. 3. In some cases the terms are part of APIs we call or where we expose concepts the kernel names the way it names them. (In particular all remaining uses of the word "slave" in our codebase are like this, it's used by the POSIX PTY layer, by the network subsystem, the mount API and the block device subsystem). Getting rid of the term in these contexts would mean doing some major fixes of the kernel ABI first. Regarding the replacements: when whitelist/blacklist is used as noun we replace with with allow list/deny list, and when used as verb with allow-list/deny-list.
* cryptsetup: support tmp= file system argumentLennart Poettering2020-05-261-7/+20
| | | | | | | | Let's catch up with Debian a bit more. This also changes the default from ext2 to ext4. Fixes: #952
* cryptsetup: also check for /dev/hwrng as random device nodeLennart Poettering2020-05-191-2/+8
|
* cryptsetup-generator: use systemd-makefs for implementation of "swap" and ↵Lennart Poettering2020-05-181-2/+2
| | | | | | | | | | | | | | | "tmp" options This way we can take benefit of the correct block device locking we just added. I was thinking whether to instead pull in a regular systemd-makefs@.service instance, but I couldn't come up with a reason to, and thus opted for just doing the minimal patch and just replacing the simply mkfs calls. Fixes: #10179 Replaces: #13162
* tree-wide: spellcheck using codespellZbigniew Jędrzejewski-Szmek2020-04-161-1/+1
| | | | Fixes #15436.
* units: introduce blockdev@.target for properly ordering mounts/swaps against ↵Lennart Poettering2020-01-211-44/+14
| | | | | | | | | cryptsetup Let's hook it into both cryptsetup-generator and gpt-auto-generator with a shared implementation in generator.c Fixes: #8472
* cryptsetup-generator: order after cryptsetup-pre.target unconditionallyLennart Poettering2020-01-211-3/+5
|
* cryptsetup-generator: break overly long lineLennart Poettering2020-01-211-1/+8
|
* Merge pull request #14241 from keszybz/resume-timeoutLennart Poettering2019-12-171-13/+9
|\ | | | | Bump resume timeout to infinity
| * cryptsetup-generator: unconfuse writing of the device timeoutZbigniew Jędrzejewski-Szmek2019-12-031-13/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | The code was using timeout=0 as the default option string. This option string was ultimately passed to generator_write_timeouts(), which only looks for comment=systemd.device-timeout= or x-systemd.device-timeout=, i.e. the whole call path was bogus. Let's rework this: generator_write_timeouts() now writes any timeouts if configured by the user. create_disk() writes out it's own timeout, but with lower priority. Since the code path that was calling timeout=0 was not effective, the only change is that we stop overwriting the timeout if explicitly configured by the user. In both code paths, ignore failure to write.
* | crypsetup: introduce x-initrd.attach optionFranck Bui2019-12-051-2/+6
|/ | | | | | | | | | | | | | | | | This option is an indication for PID1 that the entry in crypttab is handled by initrd only and therefore it shouldn't interfer during the usual start-up and shutdown process. It should be primarily used with the encrypted device containing the root FS as we want to keep it (and thus its encrypted device) until the very end of the shutdown process, i.e. when initrd takes over. This option is the counterpart of "x-initrd.mount" used in fstab. Note that the slice containing the cryptsetup services also needs to drop the usual shutdown dependencies as it's required by the cryptsetup services. Fixes: #14224
* cryptsetup-generator: guess whether the keyfile argument is two items or oneZbigniew Jędrzejewski-Szmek2019-11-131-15/+30
| | | | | | Fixes #13615. See the inline comment for documentation.
* cryptsetup-generator: allow overriding /run/systemd/cryptsetup with ↵Zbigniew Jędrzejewski-Szmek2019-11-131-3/+5
| | | | | | | | $RUNTIME_DIRECTORY I added a fairly vague entry to docs/ENVIRONMENT because I think it is worth mentioning there (in case someone is looking for any environment variable that might be relevant).
* cryptsetup-generator: allow overriding crypttab path with $SYSTEMD_CRYPTABZbigniew Jędrzejewski-Szmek2019-11-131-6/+10
|
* cryptsetup: don't assert on variable which is optionalZbigniew Jędrzejewski-Szmek2019-08-011-2/+6
| | | | | | | https://github.com/systemd/systemd/commit/50d2eba27b9bfc77ef6b40e5721713846815418b#commitcomment-34519739 In add_crypttab_devices() split_keyspec is called on the keyfile argument, which may be NULL.
* cryptsetup: use unabbrieviated variable namesZbigniew Jędrzejewski-Szmek2019-08-011-9/+9
| | | | | Now that "ret_" has been added to the output variables, we can name the internal variables without artificial abbrevs.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-04 02:06:42 +0100