2 # -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
3 # ex: ts=8 sw=4 sts=4 et filetype=sh
5 PATH=/usr/sbin:/usr/bin:/sbin:/bin
7 # do not ask, if we already have root
8 [ -f /sysroot/proc ] && exit 0
10 # check if destination already exists
11 [ -b /dev/mapper/$2 ] && exit 0
13 # we already asked for this device
14 [ -f /tmp/cryptroot-asked-$2 ] && exit 0
16 # load dm_crypt if it is not already loaded
17 [ -d /sys/module/dm_crypt ] || modprobe dm_crypt
19 . /lib/dracut-crypt-lib.sh
21 # default luksname - luks-UUID
24 # if device name is /dev/dm-X, convert to /dev/mapper/name
25 if [ "${1##/dev/dm-}" != "$1" ]; then
26 device="/dev/mapper/$(dmsetup info -c --noheadings -o name "$1")"
31 # TODO: improve to support what cmdline does
32 if [ -f /etc/crypttab ] && getargbool 1 rd.luks.crypttab -n rd_NO_CRYPTTAB; then
33 while read name dev rest; do
34 # ignore blank lines and comments
35 if [ -z "$name" -o "${name#\#}" != "$name" ]; then
39 # UUID used in crypttab
40 if [ "${dev%%=*}" = "UUID" ]; then
41 if [ "luks-${dev##UUID=}" = "$2" ]; then
46 # path used in crypttab
48 cdev=$(readlink -f $dev)
49 mdev=$(readlink -f $device)
50 if [ "$cdev" = "$mdev" ]; then
63 info "luksOpen $device $luksname"
65 if [ -n "$(getarg rd.luks.key)" ]; then
66 if tmp=$(getkey /tmp/luks.keys $device); then
70 info "No key found for $device. Will try later."
71 initqueue --unique --onetime --settled \
72 --name cryptroot-ask-$luksname \
73 $(command -v cryptroot-ask) "$@"
78 mntp=$(mkuniqdir /mnt keydev)
79 mount -r "$keydev" "$mntp" || die 'Mounting rem. dev. failed!'
80 cryptsetup -d "$mntp/$keypath" luksOpen "$device" "$luksname"
83 unset mntp keypath keydev
85 # Prompt for password with plymouth, if installed and running.
86 if [ -x /bin/plymouth ] && /bin/plymouth --has-active-vt; then
87 prompt="Password [$device ($luksname)]:"
88 if [ ${#luksname} -gt 8 ]; then
89 sluksname=${sluksname##luks-}
90 sluksname=${luksname%%${luksname##????????}}
91 prompt="Password for $device ($sluksname...)"
94 # flock against other interactive activities
96 /bin/plymouth ask-for-password \
97 --prompt "$prompt" --number-of-tries=5 \
98 --command="$(command -v cryptsetup) luksOpen -T1 $device $luksname"
101 unset sluksname prompt
104 # flock against other interactive activities
106 echo "$device ($luksname) is password protected"
107 cryptsetup luksOpen -T5 $device $luksname
112 unset device luksname
114 # mark device as asked
115 >> /tmp/cryptroot-asked-$2