2 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
3 # ex: ts=8 sw=4 sts=4 et filetype=sh
5 # do not ask, if we already have root
6 [ -f /sysroot/proc ] && exit 0
8 # check if destination already exists
9 [ -b /dev/mapper/$2 ] && exit 0
11 # we already asked for this device
12 [ -f /tmp/cryptroot-asked-$2 ] && exit 0
14 # load dm_crypt if it is not already loaded
15 [ -d /sys/module/dm_crypt ] || modprobe dm_crypt
19 # default luksname - luks-UUID
22 # if device name is /dev/dm-X, convert to /dev/mapper/name
23 if [ "${1##/dev/dm-}" != "$1" ]; then
24 device="/dev/mapper/$(dmsetup info -c --noheadings -o name "$1")"
29 if [ -f /etc/crypttab ] && ! getarg rd_NO_CRYPTTAB; then
30 while read name dev rest; do
31 # ignore blank lines and comments
32 if [ -z "$name" -o "${name#\#}" != "$name" ]; then
36 # UUID used in crypttab
37 if [ "${dev%%=*}" = "UUID" ]; then
38 if [ "luks-${dev##UUID=}" = "$2" ]; then
43 # path used in crypttab
45 cdev=$(readlink -f $dev)
46 mdev=$(readlink -f $device)
47 if [ "$cdev" = "$mdev" ]; then
57 # Search key on external devices
60 # Try to mount device specified by UUID and probe for existence of any of
61 # the paths. On success return 0 and print "<uuid> <first-existing-path>",
63 # Function leaves mount point created.
65 local uuid="$1"; shift; local keypaths="$*"
66 local ret=1; local mount_point=/mnt/keydev
69 [ -n "${uuid}" -a -n "${keypaths}" ] || return 1
70 [ -d ${mount_point} ] || mkdir -p "${mount_point}" || return 1
72 if mount -r -U "${uuid}" "${mount_point}" 2>/dev/null >/dev/null; then
73 for path in ${keypaths}; do
74 if [ -f "${mount_point}/${path}" ]; then
75 echo "${uuid} ${path}"
82 umount "${mount_point}" 2>/dev/null >/dev/null
87 keypaths="$(getargs rd_LUKS_KEYPATH)"
88 unset keydev_uuid keypath
90 if [ -n "$keypaths" ]; then
91 keydev_uuids="$(getargs rd_LUKS_KEYDEV_UUID)"
92 [ -n "$keydev_uuids" ] || {
93 warn 'No UUID of device storing LUKS key specified.'
94 warn 'It is recommended to set rd_LUKS_KEYDEV_UUID.'
95 warn 'Performing scan of *all* devices accessible by UUID...'
97 tmp=$(foreach_uuid_until "probe_keydev \$full_uuid $keypaths" \
99 keydev_uuid="${tmp%% *}"
102 warn "Key for $device not found."
104 unset tmp keydev_uuids
113 info "luksOpen $device $luksname"
115 if [ -n "$keydev_uuid" ]; then
118 mount -r -U "$keydev_uuid" "$mntp"
119 cryptsetup -d "$mntp/$keypath" luksOpen "$device" "$luksname"
121 rmdir -p "$mntp" 2>/dev/null
122 unset mntp keypath keydev_uuid
124 # Prompt for password with plymouth, if installed.
125 # Should we check if plymouthd is running?
126 if [ -x /bin/plymouth ]; then
127 prompt="Password [$device ($luksname)]:"
128 if [ ${#luksname} -gt 8 ]; then
129 sluksname=${sluksname##luks-}
130 sluksname=${luksname%%${luksname##????????}}
131 prompt="Password for $device ($sluksname...)"
134 # flock against other interactive activities
136 /bin/plymouth ask-for-password \
138 --command="/sbin/cryptsetup luksOpen -T1 $device $luksname"
141 unset sluksname prompt
144 # flock against other interactive activities
146 echo "$device ($luksname) is password protected"
147 cryptsetup luksOpen -T5 $device $luksname
152 unset device luksname
154 # mark device as asked
155 >> /tmp/cryptroot-asked-$2