summaryrefslogtreecommitdiffstats
path: root/src/cryptsetup/cryptsetup-generator.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
...
* cryptsetup-generator: fix coverity issueLennart Poettering2019-07-311-8/+8
| | | | Fixes coverity issue 1403772
* cryptsetup: add keyfile-timeout to allow a keydev timeout and allow to ↵shinygold2019-07-171-34/+85
| | | | fallback to a password if it fails.
* cryptsetup: no need to zero-initialize zero-initialized structuresLennart Poettering2019-07-161-3/+0
|
* tree-wide: get rid of strappend()Lennart Poettering2019-07-121-2/+2
| | | | | It's a special case of strjoin(), so no need to keep both. In particular as typing strjoin() is even shoert than strappend().
* cryptsetup-generator: fix luks-* entry parsing from crypttabLubomir Rintel2019-06-281-1/+3
| | | | | | | | | This reverts a part of commit 49fe5c099639 ('tree-wide: port various places over to STARTSWITH_SET()') that replaced a pair of startswith() calls with STARTSWITH_SET(). They were in fact for a different strings (device vs. name), botching the crypttap parsing.
* path-util: get rid of prefix_root()Lennart Poettering2019-06-211-1/+1
| | | | | | | | | | | | | | | | | | | prefix_root() is equivalent to path_join() in almost all ways, hence let's remove it. There are subtle differences though: prefix_root() will try shorten multiple "/" before and after the prefix. path_join() doesn't do that. This means prefix_root() might return a string shorter than both its inputs combined, while path_join() never does that. I like the path_join() semantics better, hence I think dropping prefix_root() is totally OK. In the end the strings generated by both functon should always be identical in terms of path_equal() if not streq(). This leaves prefix_roota() in place. Ideally we'd have path_joina(), but I don't think we can reasonably implement that as a macro. or maybe we can? (if so, sounds like something for a later PR) Also add in a few missing OOM checks
* cryptsetup: Add dependency for detached headerRoberto Santalla2019-05-301-24/+56
| | | | | | | | | | | | | Fixes #12650 cryptsetup: Extract dependency check to a separate function cryptsetup: style improvements, error checking Return early on failure/nothing to do Removed braces from single-line ifs Check return value of fstab_filter_options cryptsetup: code style
* Add fopen_unlocked() wrapperZbigniew Jędrzejewski-Szmek2019-04-121-5/+2
|
* cryptsetup-generator: set high OOM score for systemd-cryptsetup instancesMichal Sekletar2019-03-281-0/+1
| | | | | | | | | | | | | | | | With new LUKS2 header format it is possible to use Argon2 key derivation function. This function is "memory-hard" hence keyslot unlocking can potentially use a lot of RAM as this increases resistance to massively parallel GPU based password cracking. However, when multiple systemd-cryptsetup binaries run at the same time it is very likely that system using Argon2 (e.g. Fedora 30) will encounter memory-pressure during early boot, following OOM killing spree. This patch aims to lower the damage done by OOM killer and sets OOMScore for systemd-cryptsetup units to 500. Hopefully OOM killer will then shoot us down and leave rest of the system services alone.
* headers: remove unneeded includes from util.hZbigniew Jędrzejewski-Szmek2019-03-271-0/+3
| | | | | This means we need to include many more headers in various files that simply included util.h before, but it seems cleaner to do it this way.
* mount/generators: do not make unit wanted by its device unitTom Yan2019-02-141-4/+0
| | | | As device units will be reloaded by systemd whenever the corresponding device generates a "changed" event, if the mount unit / cryptsetup service is wanted by its device unit, the former can be restarted by systemd unexpectedly after the user stopped them explicitly. It is not sensible at all and can be considered dangerous. Neither is the behaviour conventional (as `auto` in fstab should only affect behaviour on boot and `mount -a`) or ever documented at all (not even in systemd, see systemd.mount(5) and crypttab(5)).
* generators: define custom main func definer and use it where applicableZbigniew Jędrzejewski-Szmek2018-12-121-11/+4
| | | | | | | | | | There should be no functional difference, except that the error message is changd from "three or no arguments" to "zero or three arguments". Somehow the inverted form always seemed strange. umask() call is also dropped from run-generator. I think it wasn't dropped in 053254e3cb215df3b8c905bc39b920f8817e1c7d because the run generator was merged around the same time.
* generators: configure logging before the first useZbigniew Jędrzejewski-Szmek2018-12-121-2/+2
|
* cryptsetup-generator: define main through macroYu Watanabe2018-12-021-30/+28
|
* tree-wide: port various places over to STARTSWITH_SET()Lennart Poettering2018-11-261-3/+1
|
* coccinelle: make use of SYNTHETIC_ERRNOZbigniew Jędrzejewski-Szmek2018-11-221-8/+7
| | | | | | | | | | | Ideally, coccinelle would strip unnecessary braces too. But I do not see any option in coccinelle for this, so instead, I edited the patch text using search&replace to remove the braces. Unfortunately this is not fully automatic, in particular it didn't deal well with if-else-if-else blocks and ifdefs, so there is an increased likelikehood be some bugs in such spots. I also removed part of the patch that coccinelle generated for udev, where we returns -1 for failure. This should be fixed independently.
* generators: drop umask callsZbigniew Jędrzejewski-Szmek2018-11-211-2/+0
| | | | | | | | | systemd already sets the umask (see e3b8d0637dd755b3426f3363b2cdad63f738116c). When running under systemd, we don't need to set it. And when *not* running under systemd, for example during development, there is no reason to override the user config. Let's just drop those calls. $ git grep -e 'umask\(' -l 'src/*generator*' |xargs perl -i -0pe 's|^[^\n]*umask\([^\n]+\n\n||gms'
* generators: introduce a common implementation for the log setup boilerplateLennart Poettering2018-11-201-4/+1
|
* Move LONG_LINE_MAX definition to fileio.hZbigniew Jędrzejewski-Szmek2018-11-141-1/+0
| | | | | | | | | | | All users of the macro (except for one, in serialize.c), use the macro in connection with read_line(), so they must include fileio.h. Let's not play libc games and require multiple header file to be included for the most common use of a function. The removal of def.h includes is not exact. I mostly went over the commits that switch over to use read_line() and add def.h at the same time and reverted the addition of def.h in those files.
* cryptsetup-generator: allow whitespace characters in keydev specificationMichal Sekletar2018-10-301-21/+43
| | | | | | For example, <luks.uuid>=/keyfile:LABEL="KEYFILE FS" previously wouldn't work, because we truncated label at the first whitespace character, i.e. LABEL="KEYFILE".
* cryptsetup-generator: don't return error if target directory already existsMichal Sekletar2018-10-301-4/+4
|
* cryptsetup-generator: fgets() excorcismLennart Poettering2018-10-181-7/+12
|
* cryptsetup: use PATH_IN_SET() instead of STR_IN_SET() when comparing pathsLennart Poettering2018-10-051-1/+1
| | | | It's formally more correct.
* cryptsetup: don't use %m if there's no error to showLennart Poettering2018-10-051-2/+4
| | | | | | We are not the ones receiving an error here, but the ones generating it, hence we shouldn't show it with %m, that's just confusing, as it suggests we received an error from some other call.
* cryptsetup-generator: introduce basic keydev supportMichal Sekletar2018-09-041-4/+101
| | | | | | | | | | | | | | | | | | | | | Dracut has a support for unlocking encrypted drives with keyfile stored on the external drive. This support is included in the generated initrd only if systemd module is not included. When systemd is used in initrd then attachment of encrypted drives is handled by systemd-cryptsetup tools. Our generator has support for keyfile, however, it didn't support keyfile on the external block device (keydev). This commit introduces basic keydev support. Keydev can be specified per luks.uuid on the kernel command line. Keydev is automatically mounted during boot and we look for keyfile in the keydev mountpoint (i.e. keyfile path is prefixed with the keydev mount point path). After crypt device is attached we automatically unmount where keyfile resides. Example: rd.luks.key=70bc876b-f627-4038-9049-3080d79d2165=/key:LABEL=KEYDEV
* cryptsetup: Add dependency on loopback setup to generated unitsLorenz Hübschle-Schneider2018-06-271-1/+6
| | | | | | | | For loopback volumes, the generated unit needs to depend on systemd-tmpfiles-setup-dev.service to ensure that loopback support is loaded. Fixes #9308
* tree-wide: remove Lennart's copyright linesLennart Poettering2018-06-141-3/+0
| | | | | | | | | | | These lines are generally out-of-date, incomplete and unnecessary. With SPDX and git repository much more accurate and fine grained information about licensing and authorship is available, hence let's drop the per-file copyright notice. Of course, removing copyright lines of others is problematic, hence this commit only removes my own lines and leaves all others untouched. It might be nicer if sooner or later those could go away too, making git the only and accurate source of authorship information.
* tree-wide: drop 'This file is part of systemd' blurbLennart Poettering2018-06-141-2/+0
| | | | | | | | | | | | | | | | This part of the copyright blurb stems from the GPL use recommendations: https://www.gnu.org/licenses/gpl-howto.en.html The concept appears to originate in times where version control was per file, instead of per tree, and was a way to glue the files together. Ultimately, we nowadays don't live in that world anymore, and this information is entirely useless anyway, as people are very welcome to copy these files into any projects they like, and they shouldn't have to change bits that are part of our copyright header for that. hence, let's just get rid of this old cruft, and shorten our codebase a bit.
* tree-wide: drop spurious newlines (#8764)Lennart Poettering2018-04-191-1/+0
| | | | | | | | Double newlines (i.e. one empty lines) are great to structure code. But let's avoid triple newlines (i.e. two empty lines), quadruple newlines, quintuple newlines, …, that's just spurious whitespace. It's an easy way to drop 121 lines of code, and keeps the coding style of our sources a bit tigther.
* tree-wide: drop license boilerplateZbigniew Jędrzejewski-Szmek2018-04-061-13/+0
| | | | | | | | | | Files which are installed as-is (any .service and other unit files, .conf files, .policy files, etc), are left as is. My assumption is that SPDX identifiers are not yet that well known, so it's better to retain the extended header to avoid any doubt. I also kept any copyright lines. We can probably remove them, but it'd nice to obtain explicit acks from all involved authors before doing that.
* log: remove LOG_TARGET_SAFE pseudo log targetLennart Poettering2018-01-241-1/+2
| | | | | | | | | | | | | This removes LOG_TARGET_SAFE. It's made redundant by the new "prohibit-ipc" logging flag, as it used to have a similar effect: avoid logging to the journal/syslog, i.e. any local services in order to avoid deadlocks when we lock from PID 1 or its utility processes (such as generators). All previous users of LOG_TARGET_SAFE are switched over to the new setting. This makes things a bit safer for all, as not even the SYSTEMD_LOG_TARGET env var can be used to accidentally log to the journal anymore in these programs.
* cryptsetup: small if check improvement (#7747)Lennart Poettering2017-12-271-6/+10
| | | | | | | It's a bit weird to test these strings after the fact instead of before. Let's make sure that we don't even attempt the string escaping if the strings are NULL. Follow-up for #7688
* cryptsetup-generator: Don't mistake NULL input as OOM (#7688)Jan Alexander Steffens2017-12-181-2/+2
| | | | | | | | | | | | | | | | | Since systemd v236, several Arch users complained that systemd-cryptsetup-generator exits with an OOM error and that it prevents the boot from continuing. Investigating the diff of cryptsetup-generator between v235 and v236 I noticed that create_disk allowed for the `password` and `filtered` variables to be NULL (they're handled with `strempty()`) but not their `*_escaped` versions, and returned OOM errors in those cases. Fix this by checking that the input string is non-NULL before deciding that `specifier_escape` had an OOM error. I could not test this fix myself, but some users have reported success. Downstream bug: https://bugs.archlinux.org/task/56733
* generator: add helper function for writing unit filesZbigniew Jędrzejewski-Szmek2017-12-151-16/+9
| | | | | It doesn't save too much, but it's a common pattern so I think it's worth to factor this out.
* tree-wide: use __fsetlocking() instead of fxyz_unlocked()Lennart Poettering2017-12-141-3/+8
| | | | | | | | | | | | | | | | | | | | | | | | Let's replace usage of fputc_unlocked() and friends by __fsetlocking(f, FSETLOCKING_BYCALLER). This turns off locking for the entire FILE*, instead of doing individual per-call decision whether to use normal calls or _unlocked() calls. This has various benefits: 1. It's easier to read and easier not to forget 2. It's more comprehensive, as fprintf() and friends are covered too (as these functions have no _unlocked() counterpart) 3. Philosophically, it's a bit more correct, because it's more a property of the file handle really whether we ever pass it on to another thread, not of the operations we then apply to it. This patch reworks all pieces of codes that so far used fxyz_unlocked() calls to use __fsetlocking() instead. It also reworks all places that use open_memstream(), i.e. use stdio FILE* for string manipulations. Note that this in some way a revert of 4b61c8751135c58be043d86b9fef4c8ec7aadf18.
* generators: be more careful when writing unit settings that support ↵Lennart Poettering2017-11-291-7/+25
| | | | | | | | specifier expansion Let's always escape strings we receive from the user before writing them out to unit file settings that suppor specifier expansion, so that user strings are transported as-is.
* cryptsetup-generator: add helper function and use hashmap_free_with_destructorZbigniew Jędrzejewski-Szmek2017-11-281-13/+7
|
* Replace free and reassignment with free_and_replaceDaniel Lockyer2017-11-241-3/+1
|
* Add SPDX license identifiers to source files under the LGPLZbigniew Jędrzejewski-Szmek2017-11-191-0/+1
| | | | | This follows what the kernel is doing, c.f. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5fd54ace4721fc5ce2bb5aef6318fcf17f421460.
* units: replace remote-cryptsetup-pre.target with remote-fs-pre.targetZbigniew Jędrzejewski-Szmek2017-10-171-1/+1
| | | | | | | | | | | | | | | | | remote-cryptsetup-pre.target was designed as an active unit (that pulls in network-online.target), the opposite of remote-fs-pre.target (a passive unit, with individual provider services ordering itself before it and pulling it in, for example iscsi.service and nfs-client.target). To make remote-cryptsetup-pre.target really work, those services should be ordered before it too. But this would require updates to all those services, not just changes from systemd side. But the requirements for remote-fs-pre.target and remote-cryptset-pre.target are fairly similar (e.g. iscsi devices can certainly be used for both), so let's reuse remote-fs-pre.target also for remote cryptsetup units. This loses a bit of flexibility, but does away with the requirement for various provider services to know about remote-cryptsetup-pre.target.
* tree-wide: use IN_SET macro (#6977)Yu Watanabe2017-10-041-1/+1
|
* cryptsetup: make sure we invoke the cryptsetup tools with a shared keyringLennart Poettering2017-09-151-0/+1
| | | | | | | | We want that cryptsetup can cache keys between multiple invocations, and it does so via the root user's user keyring, hence let's share it among services. Replaces: #6286
* cryptsetup-generator: use remote-cryptsetup.target when _netdev is presentZbigniew Jędrzejewski-Szmek2017-09-051-13/+17
| | | | | | | This allows such devices to depend on the network. Their startup will be delayed similarly to network mount units. Fixes #4642.
* 6647 - use path_startswith("/dev") in cryptsetup (#6732)ettavolt2017-09-041-2/+2
| | | For both key and partition paths.
* cryptsetup-generator: do not bind to the decrypted device unit (#6538)Ivan Shapovalov2017-08-301-1/+0
| | | | | | | This breaks things when the decrypted device is not immediately `SYSTEMD_READY=1` (e. g. when a multi-device btrfs system is placed on multiple cryptsetup devices). Fixes #6537.
* tree-wide: fput[cs]() → fput[cs]_unlocked() wherever that makes sense (#6396)Lennart Poettering2017-07-211-14/+14
| | | | | | | | As a follow-up for db3f45e2d2586d78f942a43e661415bc50716d11 let's do the same for all other cases where we create a FILE* with local scope and know that no other threads hence can have access to it. For most cases this shouldn't change much really, but this should speed dbus introspection and calender time formatting up a bit.
* cryptsetup-generator: add a helper utility to create symlinksZbigniew Jędrzejewski-Szmek2017-07-101-37/+14
| | | | | | | | It seems that there's a common pattern among the various generators. Let's add a helper function for it and make use of it in cryptsetup-generator. This fixes a bunch of theoretical memleaks in error paths, since *to wasn't generally freed properly. Not thath it matters.
* cryptsetup-generator: run cryptsetup service before swap unit (#5480)Mauricio Faria de Oliveira2017-02-281-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the cryptsetup service unit and swap unit for a swap device are not strictly ordered, it might happen that the swap unit activates/mounts the swap device before its cryptsetup service unit has a chance to run the 'mkswap' command (that it is programmed to). This leads to the following error: Starting Cryptography Setup for sda3_crypt... [ OK ] Found device /dev/mapper/sda3_crypt. Activating swap /dev/mapper/sda3_crypt... [ OK ] Activated swap /dev/mapper/sda3_crypt. [ OK ] Reached target Swap. [FAILED] Failed to start Cryptography Setup for sda3_crypt. See 'systemctl status systemd-cryptsetup@sda3_crypt.service' for details. [DEPEND] Dependency failed for Encrypted Volumes. Which happens because the swap device is already mounted: # systemctl status systemd-cryptsetup@sda3_crypt.service <...> Active: failed (Result: exit-code) since Mon 2017-02-27 14:21:43 CST; 54s ago <...> <...> systemd[1]: Starting Cryptography Setup for sda3_crypt... <...> mkswap[2420]: mkswap: error: /dev/mapper/sda3_crypt is mounted; will not make swapspace <...> So, modify cryptsetup-generator to include a 'Before=' option for the respective 'dev-mapper-%i.swap' device in the cryptsetup service unit. Now, correct ordering is ensured, and the error no longer occurs: Starting Cryptography Setup for sda3_crypt... [ OK ] Found device /dev/mapper/sda3_crypt. [ OK ] Started Cryptography Setup for sda3_crypt. Activating swap /dev/mapper/sda3_crypt... [ OK ] Reached target Encrypted Volumes. [ OK ] Activated swap /dev/mapper/sda3_crypt. [ OK ] Reached target Swap.
* cryptsetup: various coding style improvementsLennart Poettering2016-12-211-27/+29
| | | | No functional changes.
* util-lib: various improvements to kernel command line parsingLennart Poettering2016-12-211-19/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This improves kernel command line parsing in a number of ways: a) An kernel option "foo_bar=xyz" is now considered equivalent to "foo-bar-xyz", i.e. when comparing kernel command line option names "-" and "_" are now considered equivalent (this only applies to the option names though, not the option values!). Most of our kernel options used "-" as word separator in kernel command line options so far, but some used "_". With this change, which was a source of confusion for users (well, at least of one user: myself, I just couldn't remember that it's systemd.debug-shell, not systemd.debug_shell). Considering both as equivalent is inspired how modern kernel module loading normalizes all kernel module names to use underscores now too. b) All options previously using a dash for separating words in kernel command line options now use an underscore instead, in all documentation and in code. Since a) has been implemented this should not create any compatibility problems, but normalizes our documentation and our code. c) All kernel command line options which take booleans (or are boolean-like) have been reworked so that "foobar" (without argument) is now equivalent to "foobar=1" (but not "foobar=0"), thus normalizing the handling of our boolean arguments. Specifically this means systemd.debug-shell and systemd_debug_shell=1 are now entirely equivalent. d) All kernel command line options which take an argument, and where no argument is specified will now result in a log message. e.g. passing just "systemd.unit" will no result in a complain that it needs an argument. This is implemented in the proc_cmdline_missing_value() function. e) There's now a call proc_cmdline_get_bool() similar to proc_cmdline_get_key() that parses booleans (following the logic explained in c). f) The proc_cmdline_parse() call's boolean argument has been replaced by a new flags argument that takes a common set of bits with proc_cmdline_get_key(). g) All kernel command line APIs now begin with the same "proc_cmdline_" prefix. h) There are now tests for much of this. Yay!
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-07 17:32:44 +0100