From 6175747134f95498fc95d01be1bed84923a0eba4 Mon Sep 17 00:00:00 2001 From: Mike Frysinger Date: Wed, 19 Mar 2008 07:20:05 +0000 Subject: Version bump #212997 by Alex Elsayed and make startup script much nicer #202364 by me. (Portage version: 2.2_pre2) --- sys-fs/cryptsetup/ChangeLog | 9 +- sys-fs/cryptsetup/cryptsetup-1.0.6.ebuild | 90 +++++++ sys-fs/cryptsetup/files/1.0.6-dm-crypt-start.sh | 299 ++++++++++++++++++++++++ 3 files changed, 397 insertions(+), 1 deletion(-) create mode 100644 sys-fs/cryptsetup/cryptsetup-1.0.6.ebuild create mode 100644 sys-fs/cryptsetup/files/1.0.6-dm-crypt-start.sh (limited to 'sys-fs/cryptsetup') diff --git a/sys-fs/cryptsetup/ChangeLog b/sys-fs/cryptsetup/ChangeLog index fffadeb2319e..8ce96c826749 100644 --- a/sys-fs/cryptsetup/ChangeLog +++ b/sys-fs/cryptsetup/ChangeLog @@ -1,6 +1,13 @@ # ChangeLog for sys-fs/cryptsetup # Copyright 1999-2008 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sys-fs/cryptsetup/ChangeLog,v 1.54 2008/02/20 02:52:26 wolf31o2 Exp $ +# $Header: /var/cvsroot/gentoo-x86/sys-fs/cryptsetup/ChangeLog,v 1.55 2008/03/19 07:20:04 vapier Exp $ + +*cryptsetup-1.0.6 (19 Mar 2008) + + 19 Mar 2008; Mike Frysinger + +files/1.0.6-dm-crypt-start.sh, +cryptsetup-1.0.6.ebuild: + Version bump #212997 by Alex Elsayed and make startup script much nicer + #202364 by me. 20 Feb 2008; Chris Gianelloni cryptsetup-1.0.5.ebuild, cryptsetup-1.0.5-r1.ebuild: diff --git a/sys-fs/cryptsetup/cryptsetup-1.0.6.ebuild b/sys-fs/cryptsetup/cryptsetup-1.0.6.ebuild new file mode 100644 index 000000000000..2849580df0d0 --- /dev/null +++ b/sys-fs/cryptsetup/cryptsetup-1.0.6.ebuild @@ -0,0 +1,90 @@ +# Copyright 1999-2008 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sys-fs/cryptsetup/cryptsetup-1.0.6.ebuild,v 1.1 2008/03/19 07:20:04 vapier Exp $ + +inherit linux-info eutils flag-o-matic multilib + +DESCRIPTION="Tool to setup encrypted devices with dm-crypt" +HOMEPAGE="http://luks.endorphin.org/" +SRC_URI="http://luks.endorphin.org/source/${P}.tar.bz2" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86" +IUSE="build dynamic nls selinux" + +DEPEND=">=sys-fs/device-mapper-1.00.07-r1 + >=dev-libs/libgcrypt-1.1.42 + >=dev-libs/libgpg-error-1.0-r1 + >=dev-libs/popt-1.7 + selinux? ( sys-libs/libselinux ) + !sys-fs/cryptsetup-luks" + +dm-crypt_check() { + local CONFIG_CHECK="~DM_CRYPT" + local WARNING_DM_CRYPT="CONFIG_DM_CRYPT:\tis not set (required for cryptsetup)\n" + check_extra_config +} + +crypto_check() { + local CONFIG_CHECK="~CRYPTO" + local WARNING_CRYPTO="CONFIG_CRYPTO:\tis not set (required for cryptsetup)\n" + check_extra_config +} + +cbc_check() { + local CONFIG_CHECK="~CRYPTO_CBC" + local WARNING_CRYPTO_CBC="CONFIG_CRYPTO_CBC:\tis not set (required for kernel 2.6.19)\n" + check_extra_config +} + +pkg_setup() { + dm-crypt_check + crypto_check + cbc_check + + if use dynamic ; then + ewarn "If you need cryptsetup for an initrd or initramfs then you" + ewarn "should NOT use the dynamic USE flag" + epause 5 + fi +} + +src_compile() { + econf \ + --sbindir=/sbin \ + $(use_enable !dynamic static) \ + --libdir=/usr/$(get_libdir) \ + $(use_enable nls) \ + $(use_enable selinux) \ + || die + emake || die +} + +src_install() { + emake DESTDIR="${D}" install || die "install failed" + rmdir "${D}"/usr/$(get_libdir)/cryptsetup + insinto /lib/rcscripts/addons + newins "${FILESDIR}"/1.0.6-dm-crypt-start.sh dm-crypt-start.sh || die + newins "${FILESDIR}"/1.0.5-dm-crypt-stop.sh dm-crypt-stop.sh || die + newconfd "${FILESDIR}"/1.0.5-dmcrypt.confd dmcrypt || die + newinitd "${FILESDIR}"/1.0.5-dmcrypt.rc dmcrypt || die +} + +pkg_postinst() { + ewarn "This ebuild introduces a new set of scripts and configuration" + ewarn "than the last version. If you are currently using /etc/conf.d/cryptfs" + ewarn "then you *MUST* copy your old file to:" + ewarn "/etc/conf.d/dmcrypt" + ewarn "Or your encrypted partitions will *NOT* work." + elog "Please see the example for configuring a LUKS mountpoint" + elog "in /etc/conf.d/dmcrypt" + elog + elog "If you are using baselayout-2 then please do:" + elog "rc-update add dmcrypt boot" + elog "This version introduces a command line arguement 'key_timeout'." + elog "If you want the search for the removable key device to timeout" + elog "after 10 seconds add the following to your bootloader config:" + elog "key_timeout=10" + elog "A timeout of 0 will mean it will wait indefinitely." +} diff --git a/sys-fs/cryptsetup/files/1.0.6-dm-crypt-start.sh b/sys-fs/cryptsetup/files/1.0.6-dm-crypt-start.sh new file mode 100644 index 000000000000..aca0700452c8 --- /dev/null +++ b/sys-fs/cryptsetup/files/1.0.6-dm-crypt-start.sh @@ -0,0 +1,299 @@ +# /lib/rcscripts/addons/dm-crypt-start.sh + +# For backwards compatability with baselayout < 1.13.0 +dm_crypt_execute_checkfs() { + dm_crypt_execute_dmcrypt +} + +dm_crypt_execute_volumes() { + dm_crypt_execute_dmcrypt +} + +# Setup mappings for an individual target/swap +# Note: This relies on variables localized in the main body below. +dm_crypt_execute_dmcrypt() { + local dev ret mode foo + # some colors + local red='\x1b[31;01m' green='\x1b[32;01m' off='\x1b[0;0m' + + if [ -n "$target" ]; then + # let user set options, otherwise leave empty + : ${options:=' '} + elif [ -n "$swap" ]; then + einfo "Checking swap is not LUKS" + cryptsetup isLuks ${source} 2>/dev/null >/dev/console # is $source + # create # is $target + local arg1="create" arg2="$target" arg3="$source" luks=0 + + cryptsetup isLuks ${source} 2>/dev/null && { arg1="luksOpen"; arg2="$source"; arg3="$target"; luks=1; } + + if /sbin/cryptsetup status ${target} | egrep -q '\/dev/null 2>&1 + + # Handle keys + if [ -n "$key" ]; then + read_abort() { + local ans + local prompt=" ${green}*${off} $1? (${red}yes${off}/${green}No${off}) " + shift + echo -n -e "${prompt}" >/dev/console + if ! read -n 1 $* ans /dev/console + else + echo >/dev/console + fi + case $ans in + [yY]|[yY][eE][sS]) return 0;; + *) return 1;; + esac + } + + # Notes: sed not used to avoid case where /usr partition is encrypted. + mode=${key/*:/} && ( [ "$mode" == "$key" ] || [ -z "$mode" ] ) && mode=reg + key=${key/:*/} + case "$mode" in + gpg|reg) + # handle key on removable device + if [ -n "$remdev" ]; then + # temp directory to mount removable device + local mntrem=/mnt/remdev.$$ + if [ ! -d "${mntrem}" ] ; then + if ! mkdir -p "${mntrem}" ; then + ewarn "${source} will not be decrypted ..." + einfo "Reason: Unable to create temporary mount point '${mntrem}'" + return + fi + fi + i=0 + einfo "Please insert removable device for ${target}" + while :; do + foo="" + if mount -n -o ro "${remdev}" "${mntrem}" 2>/dev/null >/dev/null ; then + # keyfile exists? + if [ ! -e "${mntrem}${key}" ]; then + umount -n "${mntrem}" + rmdir "${mntrem}" + einfo "Cannot find ${key} on removable media." + read_abort "Abort" ${read_timeout} && return + else + key="${mntrem}${key}" + break + fi + else + [ -e "${remdev}" ] \ + && foo="mount failed" \ + || foo="mount source not found" + fi + ((++i)) + read_abort "Stop waiting after $i attempts (${foo})" -t 1 && return + done + else # keyfile ! on removable device + if [ ! -e "$key" ]; then + ewarn "${source} will not be decrypted ..." + einfo "Reason: keyfile ${key} does not exist." + return + fi + fi + ;; + *) + ewarn "${source} will not be decrypted ..." + einfo "Reason: mode ${mode} is invalid." + return + ;; + esac + else + mode=none + fi + ebegin "dm-crypt map ${target}" + einfo "cryptsetup will be called with : ${options} ${arg1} ${arg2} ${arg3}" + if [ "$mode" == "gpg" ]; then + : ${gpg_options:='-q -d'} + # gpg available ? + if type -p gpg >/dev/null ; then + for (( i = 0 ; i < 3 ; i++ )) + do + # paranoid, don't store key in a variable, pipe it so it stays very little in ram unprotected. + # save stdin stdout stderr "values" + exec 3>&0 4>&1 6>&2 # ABS says fd 5 is reserved + exec &>/dev/console /dev/null | cryptsetup ${options} ${arg1} ${arg2} ${arg3} + ret="$?" + # restore values and close file descriptors + exec 0>&3 1>&4 2>&6 + exec 3>&- 4>&- 6>&- + [ "$ret" -eq 0 ] && break + done + eend "${ret}" "failure running cryptsetup" + else + ewarn "${source} will not be decrypted ..." + einfo "Reason: cannot find gpg application." + einfo "You have to install app-crypt/gnupg first." + einfo "If you have /usr on its own partition, try copying gpg to /bin ." + fi + else + if [ "$mode" == "reg" ]; then + cryptsetup ${options} -d ${key} ${arg1} ${arg2} ${arg3} >/dev/console /dev/console /dev/null >/dev/null + rmdir ${mntrem} 2>/dev/null >/dev/null + fi + splash svc_input_end ${SVCNAME} >/dev/null 2>&1 + + if [[ ${ret} != 0 ]] ; then + cryptfs_status=1 + else + if [[ -n ${pre_mount} ]] ; then + dev="/dev/mapper/${target}" + ebegin " Running pre_mount commands for ${target}" + eval "${pre_mount}" > /dev/null + ewend $? || cryptfs_status=1 + fi + fi +} + +# Run any post_mount commands for an individual mount +# +# Note: This relies on variables localized in the main body below. +dm_crypt_execute_localmount() { + local mount_point + + [ -z "$target" ] && [ -z "$post_mount" ] && return + + if ! /sbin/cryptsetup status ${target} | egrep -q '\/dev/null + eend $? || cryptfs_status=1 + fi +} + +# Determine string lengths +strlen() { + if [ -z "$1" ] + then + echo "usage: strlen " + die + fi + eval echo "\${#${1}}" +} + +# Lookup optional bootparams +parse_opt() { + case "$1" in + *\=*) + local key_name="`echo "$1" | cut -f1 -d=`" + local key_len=`strlen key_name` + local value_start=$((key_len+2)) + echo "$1" | cut -c ${value_start}- + ;; + esac +} + +local cryptfs_status=0 +local gpg_options key loop_file target targetline options pre_mount post_mount source swap remdev + +CMDLINE="`cat /proc/cmdline`" +for x in ${CMDLINE} +do + case "${x}" in + key_timeout\=*) + KEY_TIMEOUT=`parse_opt "${x}"` + if [ ${KEY_TIMEOUT} -gt 0 ]; then + read_timeout="-t ${KEY_TIMEOUT}" + fi + ;; + esac +done + +if [[ -f /etc/conf.d/dmcrypt ]] && [[ -x /sbin/cryptsetup ]] ; then + ebegin "Setting up dm-crypt mappings" + + # Fix for baselayout-1.12.10 (bug 174256) + [ -z ${SVCNAME} ] && SVCNAME="${myservice}" + + while read targetline ; do + # skip comments and blank lines + [[ ${targetline}\# == \#* ]] && continue + + # check for the start of a new target/swap + case ${targetline} in + target=*|swap=*) + # If we have a target queued up, then execute it + dm_crypt_execute_${SVCNAME} + + # Prepare for the next target/swap by resetting variables + unset gpg_options key loop_file target options pre_mount post_mount source swap remdev + ;; + + gpg_options=*|remdev=*|key=*|loop_file=*|options=*|pre_mount=*|post_mount=*|source=*) + if [[ -z ${target} && -z ${swap} ]] ; then + ewarn "Ignoring setting outside target/swap section: ${targetline}" + continue + fi + ;; + + *) + ewarn "Skipping invalid line in /etc/conf.d/dmcrypt: ${targetline}" + ;; + esac + + # Queue this setting for the next call to dm_crypt_execute_${SVCNAME} + eval "${targetline}" + done < /etc/conf.d/dmcrypt + + # If we have a target queued up, then execute it + dm_crypt_execute_${SVCNAME} + + ewend ${cryptfs_status} "Failed to setup dm-crypt devices" +fi + +# vim:ts=4 -- cgit v1.2.3-65-gdbad