]>
Commit | Line | Data |
---|---|---|
db9ecf05 | 1 | /* SPDX-License-Identifier: LGPL-2.1-or-later */ |
e23a0ce8 | 2 | |
e23a0ce8 | 3 | #include <errno.h> |
ca78ad1d | 4 | #include <fcntl.h> |
ca78ad1d ZJS |
5 | #include <sys/stat.h> |
6 | #include <sys/types.h> | |
e23a0ce8 | 7 | |
b5efdb8a | 8 | #include "alloc-util.h" |
0fa9e53d | 9 | #include "dropin.h" |
7949dfa7 | 10 | #include "escape.h" |
3ffd4af2 | 11 | #include "fd-util.h" |
0d39fa9c | 12 | #include "fileio.h" |
07630cea | 13 | #include "fstab-util.h" |
0fa9e53d JJ |
14 | #include "generator.h" |
15 | #include "hashmap.h" | |
7949dfa7 | 16 | #include "id128-util.h" |
e23a0ce8 | 17 | #include "log.h" |
49e942b2 | 18 | #include "mkdir.h" |
6bedfcbb | 19 | #include "parse-util.h" |
bde29068 | 20 | #include "path-util.h" |
4e731273 | 21 | #include "proc-cmdline.h" |
98bad05e | 22 | #include "specifier.h" |
07630cea | 23 | #include "string-util.h" |
0fa9e53d JJ |
24 | #include "strv.h" |
25 | #include "unit-name.h" | |
0fa9e53d JJ |
26 | |
27 | typedef struct crypto_device { | |
28 | char *uuid; | |
6cd5b12a | 29 | char *keyfile; |
70f5f48e | 30 | char *keydev; |
a8574d00 OK |
31 | char *headerdev; |
32 | char *datadev; | |
baade8cc | 33 | char *name; |
0fa9e53d JJ |
34 | char *options; |
35 | bool create; | |
36 | } crypto_device; | |
e23a0ce8 | 37 | |
7a44c7e3 | 38 | static const char *arg_dest = NULL; |
66a78c2b LP |
39 | static bool arg_enabled = true; |
40 | static bool arg_read_crypttab = true; | |
a6c57e74 | 41 | static const char *arg_crypttab = NULL; |
3f5ac303 | 42 | static const char *arg_runtime_directory = NULL; |
6b000af4 | 43 | static bool arg_allow_list = false; |
0fa9e53d JJ |
44 | static Hashmap *arg_disks = NULL; |
45 | static char *arg_default_options = NULL; | |
46 | static char *arg_default_keyfile = NULL; | |
141a79f4 | 47 | |
a4a90e65 YW |
48 | STATIC_DESTRUCTOR_REGISTER(arg_disks, hashmap_freep); |
49 | STATIC_DESTRUCTOR_REGISTER(arg_default_options, freep); | |
50 | STATIC_DESTRUCTOR_REGISTER(arg_default_keyfile, freep); | |
51 | ||
fc6f1ad1 OK |
52 | static int split_locationspec(const char *locationspec, char **ret_file, char **ret_device) { |
53 | _cleanup_free_ char *file = NULL, *device = NULL; | |
f4ea8432 | 54 | const char *c; |
50d2eba2 | 55 | |
fc6f1ad1 OK |
56 | assert(ret_file); |
57 | assert(ret_device); | |
50d2eba2 | 58 | |
fc6f1ad1 OK |
59 | if (!locationspec) { |
60 | *ret_file = *ret_device = NULL; | |
fef716b2 ZJS |
61 | return 0; |
62 | } | |
63 | ||
fc6f1ad1 | 64 | c = strrchr(locationspec, ':'); |
50d2eba2 | 65 | if (c) { |
fc6f1ad1 | 66 | /* The device part has to be either an absolute path to device node (/dev/something, |
32c6237a | 67 | * /dev/foo/something, or even possibly /dev/foo/something:part), or a fstab device |
fc6f1ad1 | 68 | * specification starting with LABEL= or similar. The file part has the same syntax. |
32c6237a | 69 | * |
fc6f1ad1 | 70 | * Let's try to guess if the second part looks like a device specification, or just part of a |
32c6237a ZJS |
71 | * filename with a colon. fstab_node_to_udev_node() will convert the fstab device syntax to |
72 | * an absolute path. If we didn't get an absolute path, assume that it is just part of the | |
fc6f1ad1 | 73 | * first file argument. */ |
32c6237a | 74 | |
fc6f1ad1 OK |
75 | device = fstab_node_to_udev_node(c + 1); |
76 | if (!device) | |
50d2eba2 | 77 | return log_oom(); |
32c6237a | 78 | |
fc6f1ad1 OK |
79 | if (path_is_absolute(device)) |
80 | file = strndup(locationspec, c-locationspec); | |
32c6237a | 81 | else { |
fc6f1ad1 | 82 | log_debug("Location specification argument contains a colon, but \"%s\" doesn't look like a device specification.\n" |
32c6237a | 83 | "Assuming that \"%s\" is a single device specification.", |
fc6f1ad1 OK |
84 | c + 1, locationspec); |
85 | device = mfree(device); | |
32c6237a ZJS |
86 | c = NULL; |
87 | } | |
88 | } | |
89 | ||
90 | if (!c) | |
fc6f1ad1 OK |
91 | /* No device specified */ |
92 | file = strdup(locationspec); | |
32c6237a | 93 | |
fc6f1ad1 | 94 | if (!file) |
32c6237a | 95 | return log_oom(); |
50d2eba2 | 96 | |
fc6f1ad1 OK |
97 | *ret_file = TAKE_PTR(file); |
98 | *ret_device = TAKE_PTR(device); | |
50d2eba2 | 99 | |
100 | return 0; | |
101 | } | |
102 | ||
eb7d9aa3 | 103 | static int generate_device_mount( |
49685fb3 | 104 | const char *name, |
eb7d9aa3 OK |
105 | const char *device, |
106 | const char *type_prefix, /* "keydev" or "headerdev" */ | |
107 | const char *device_timeout, | |
49685fb3 | 108 | bool canfail, |
eb7d9aa3 | 109 | bool readonly, |
49685fb3 LP |
110 | char **unit, |
111 | char **mount) { | |
112 | ||
32c6237a | 113 | _cleanup_free_ char *u = NULL, *where = NULL, *name_escaped = NULL, *device_unit = NULL; |
70f5f48e MS |
114 | _cleanup_fclose_ FILE *f = NULL; |
115 | int r; | |
50d2eba2 | 116 | usec_t timeout_us; |
70f5f48e MS |
117 | |
118 | assert(name); | |
eb7d9aa3 | 119 | assert(device); |
70f5f48e MS |
120 | assert(unit); |
121 | assert(mount); | |
122 | ||
3f5ac303 | 123 | r = mkdir_parents(arg_runtime_directory, 0755); |
70f5f48e MS |
124 | if (r < 0) |
125 | return r; | |
126 | ||
3f5ac303 | 127 | r = mkdir(arg_runtime_directory, 0700); |
579875bc MS |
128 | if (r < 0 && errno != EEXIST) |
129 | return -errno; | |
70f5f48e | 130 | |
7949dfa7 MS |
131 | name_escaped = cescape(name); |
132 | if (!name_escaped) | |
133 | return -ENOMEM; | |
134 | ||
eb7d9aa3 | 135 | where = strjoin(arg_runtime_directory, "/", type_prefix, "-", name_escaped); |
70f5f48e MS |
136 | if (!where) |
137 | return -ENOMEM; | |
138 | ||
139 | r = mkdir(where, 0700); | |
579875bc MS |
140 | if (r < 0 && errno != EEXIST) |
141 | return -errno; | |
70f5f48e MS |
142 | |
143 | r = unit_name_from_path(where, ".mount", &u); | |
144 | if (r < 0) | |
145 | return r; | |
146 | ||
147 | r = generator_open_unit_file(arg_dest, NULL, u, &f); | |
148 | if (r < 0) | |
149 | return r; | |
150 | ||
70f5f48e MS |
151 | fprintf(f, |
152 | "[Unit]\n" | |
153 | "DefaultDependencies=no\n\n" | |
154 | "[Mount]\n" | |
155 | "What=%s\n" | |
156 | "Where=%s\n" | |
eb7d9aa3 | 157 | "Options=%s%s\n", device, where, readonly ? "ro" : "rw", canfail ? ",nofail" : ""); |
50d2eba2 | 158 | |
eb7d9aa3 OK |
159 | if (device_timeout) { |
160 | r = parse_sec_fix_0(device_timeout, &timeout_us); | |
50d2eba2 | 161 | if (r >= 0) { |
eb7d9aa3 | 162 | r = unit_name_from_path(device, ".device", &device_unit); |
50d2eba2 | 163 | if (r < 0) |
164 | return log_error_errno(r, "Failed to generate unit name: %m"); | |
165 | ||
166 | r = write_drop_in_format(arg_dest, device_unit, 90, "device-timeout", | |
167 | "# Automatically generated by systemd-cryptsetup-generator \n\n" | |
eb7d9aa3 | 168 | "[Unit]\nJobRunningTimeoutSec=%s", device_timeout); |
50d2eba2 | 169 | if (r < 0) |
170 | return log_error_errno(r, "Failed to write device drop-in: %m"); | |
171 | ||
172 | } else | |
eb7d9aa3 | 173 | log_warning_errno(r, "Failed to parse %s, ignoring: %m", device_timeout); |
50d2eba2 | 174 | |
175 | } | |
70f5f48e MS |
176 | |
177 | r = fflush_and_check(f); | |
178 | if (r < 0) | |
179 | return r; | |
180 | ||
181 | *unit = TAKE_PTR(u); | |
182 | *mount = TAKE_PTR(where); | |
183 | ||
184 | return 0; | |
185 | } | |
186 | ||
eb7d9aa3 OK |
187 | static int generate_device_umount(const char *name, |
188 | const char *device_mount, | |
189 | const char *type_prefix, /* "keydev" or "headerdev" */ | |
882f5f42 MS |
190 | char **ret_umount_unit) { |
191 | _cleanup_fclose_ FILE *f = NULL; | |
192 | _cleanup_free_ char *u = NULL, *name_escaped = NULL, *mount = NULL; | |
193 | int r; | |
194 | ||
195 | assert(name); | |
196 | assert(ret_umount_unit); | |
197 | ||
198 | name_escaped = cescape(name); | |
199 | if (!name_escaped) | |
200 | return -ENOMEM; | |
201 | ||
eb7d9aa3 | 202 | u = strjoin(type_prefix, "-", name_escaped, "-umount.service"); |
882f5f42 MS |
203 | if (!u) |
204 | return -ENOMEM; | |
205 | ||
eb7d9aa3 | 206 | r = unit_name_from_path(device_mount, ".mount", &mount); |
882f5f42 MS |
207 | if (r < 0) |
208 | return r; | |
209 | ||
210 | r = generator_open_unit_file(arg_dest, NULL, u, &f); | |
211 | if (r < 0) | |
212 | return r; | |
213 | ||
214 | fprintf(f, | |
215 | "[Unit]\n" | |
216 | "DefaultDependencies=no\n" | |
217 | "After=%s\n\n" | |
218 | "[Service]\n" | |
eb7d9aa3 | 219 | "ExecStart=-" UMOUNT_PATH " %s\n\n", mount, device_mount); |
882f5f42 MS |
220 | |
221 | r = fflush_and_check(f); | |
222 | if (r < 0) | |
223 | return r; | |
224 | ||
225 | *ret_umount_unit = TAKE_PTR(u); | |
226 | return 0; | |
227 | } | |
228 | ||
7aa0b012 | 229 | static int print_dependencies(FILE *f, const char* device_path, const char* timeout_value, bool canfail) { |
38ab1ec9 RS |
230 | int r; |
231 | ||
c9be8e42 LB |
232 | assert(f); |
233 | assert(device_path); | |
7aa0b012 | 234 | |
38ab1ec9 RS |
235 | if (STR_IN_SET(device_path, "-", "none")) |
236 | /* None, nothing to do */ | |
237 | return 0; | |
238 | ||
c6b1d7d1 LP |
239 | if (PATH_IN_SET(device_path, |
240 | "/dev/urandom", | |
241 | "/dev/random", | |
242 | "/dev/hw_random", | |
243 | "/dev/hwrng")) { | |
38ab1ec9 RS |
244 | /* RNG device, add random dep */ |
245 | fputs("After=systemd-random-seed.service\n", f); | |
246 | return 0; | |
247 | } | |
248 | ||
249 | _cleanup_free_ char *udev_node = fstab_node_to_udev_node(device_path); | |
250 | if (!udev_node) | |
251 | return log_oom(); | |
252 | ||
253 | if (path_equal(udev_node, "/dev/null")) | |
254 | return 0; | |
255 | ||
256 | if (path_startswith(udev_node, "/dev/")) { | |
162392b7 | 257 | /* We are dealing with a block device, add dependency for corresponding unit */ |
38ab1ec9 RS |
258 | _cleanup_free_ char *unit = NULL; |
259 | ||
260 | r = unit_name_from_path(udev_node, ".device", &unit); | |
261 | if (r < 0) | |
262 | return log_error_errno(r, "Failed to generate unit name: %m"); | |
263 | ||
7aa0b012 CHY |
264 | fprintf(f, "After=%1$s\n", unit); |
265 | if (canfail) { | |
266 | fprintf(f, "Wants=%1$s\n", unit); | |
c9be8e42 LB |
267 | if (timeout_value) { |
268 | r = write_drop_in_format(arg_dest, unit, 90, "device-timeout", | |
269 | "# Automatically generated by systemd-cryptsetup-generator \n\n" | |
270 | "[Unit]\nJobRunningTimeoutSec=%s", timeout_value); | |
271 | if (r < 0) | |
272 | return log_error_errno(r, "Failed to write device drop-in: %m"); | |
273 | } | |
7aa0b012 CHY |
274 | } else |
275 | fprintf(f, "Requires=%1$s\n", unit); | |
38ab1ec9 RS |
276 | } else { |
277 | /* Regular file, add mount dependency */ | |
278 | _cleanup_free_ char *escaped_path = specifier_escape(device_path); | |
279 | if (!escaped_path) | |
280 | return log_oom(); | |
281 | ||
c9be8e42 | 282 | fprintf(f, "%s=%s\n", canfail ? "WantsMountsFor" : "RequiresMountsFor", escaped_path); |
38ab1ec9 RS |
283 | } |
284 | ||
285 | return 0; | |
286 | } | |
287 | ||
8ce02b87 LP |
288 | static bool attach_in_initrd(const char *name, const char *options) { |
289 | assert(name); | |
290 | ||
291 | /* Imply x-initrd.attach in case the volume name is among those defined in the Discoverable Partition | |
292 | * Specification for partitions that we require to be mounted during the initrd → host transition, | |
293 | * i.e. for the root fs itself, and /usr/. This mirrors similar behaviour in | |
294 | * systemd-fstab-generator. */ | |
295 | ||
296 | return fstab_test_option(options, "x-initrd.attach\0") || | |
297 | STR_IN_SET(name, "root", "usr"); | |
298 | } | |
299 | ||
e23a0ce8 LP |
300 | static int create_disk( |
301 | const char *name, | |
302 | const char *device, | |
b7de9651 | 303 | const char *key_file, |
50d2eba2 | 304 | const char *keydev, |
a8574d00 | 305 | const char *headerdev, |
62ca7d3b JL |
306 | const char *options, |
307 | const char *source) { | |
e23a0ce8 | 308 | |
fb883e75 | 309 | _cleanup_free_ char *n = NULL, *d = NULL, *u = NULL, *e = NULL, |
a7e88558 | 310 | *keydev_mount = NULL, *keyfile_timeout_value = NULL, |
b7de9651 | 311 | *filtered = NULL, *u_escaped = NULL, *name_escaped = NULL, *header_path = NULL, *key_file_buffer = NULL, |
a8574d00 | 312 | *tmp_fstype = NULL, *filtered_header = NULL, *headerdev_mount = NULL; |
7fd1b19b | 313 | _cleanup_fclose_ FILE *f = NULL; |
b559616f | 314 | const char *dmname; |
8ce02b87 | 315 | bool noauto, nofail, swap, netdev; |
53ac130b | 316 | int r, detached_header, keyfile_can_timeout, tmp; |
e23a0ce8 LP |
317 | |
318 | assert(name); | |
319 | assert(device); | |
320 | ||
b9f111b9 ZJS |
321 | noauto = fstab_test_yes_no_option(options, "noauto\0" "auto\0"); |
322 | nofail = fstab_test_yes_no_option(options, "nofail\0" "fail\0"); | |
a6dba978 | 323 | swap = fstab_test_option(options, "swap\0"); |
b001ad61 | 324 | netdev = fstab_test_option(options, "_netdev\0"); |
8c11d3c1 | 325 | |
ff0c31bc ZJS |
326 | keyfile_can_timeout = fstab_filter_options(options, |
327 | "keyfile-timeout\0", | |
328 | NULL, &keyfile_timeout_value, NULL, NULL); | |
50d2eba2 | 329 | if (keyfile_can_timeout < 0) |
330 | return log_error_errno(keyfile_can_timeout, "Failed to parse keyfile-timeout= option value: %m"); | |
331 | ||
a8574d00 OK |
332 | detached_header = fstab_filter_options( |
333 | options, | |
334 | "header\0", | |
335 | NULL, | |
336 | &header_path, | |
ff0c31bc | 337 | NULL, |
a8574d00 | 338 | headerdev ? &filtered_header : NULL); |
38ab1ec9 RS |
339 | if (detached_header < 0) |
340 | return log_error_errno(detached_header, "Failed to parse header= option value: %m"); | |
341 | ||
ff0c31bc | 342 | tmp = fstab_filter_options(options, "tmp\0", NULL, &tmp_fstype, NULL, NULL); |
53ac130b LP |
343 | if (tmp < 0) |
344 | return log_error_errno(tmp, "Failed to parse tmp= option value: %m"); | |
345 | ||
baaa35ad ZJS |
346 | if (tmp && swap) |
347 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), | |
348 | "Device '%s' cannot be both 'tmp' and 'swap'. Ignoring.", | |
349 | name); | |
155da457 | 350 | |
98bad05e LP |
351 | name_escaped = specifier_escape(name); |
352 | if (!name_escaped) | |
353 | return log_oom(); | |
354 | ||
744198e9 LP |
355 | e = unit_name_escape(name); |
356 | if (!e) | |
357 | return log_oom(); | |
358 | ||
f7f21d33 | 359 | u = fstab_node_to_udev_node(device); |
24a988e9 HH |
360 | if (!u) |
361 | return log_oom(); | |
e23a0ce8 | 362 | |
fb883e75 ZJS |
363 | r = unit_name_build("systemd-cryptsetup", e, ".service", &n); |
364 | if (r < 0) | |
365 | return log_error_errno(r, "Failed to generate unit name: %m"); | |
366 | ||
98bad05e LP |
367 | u_escaped = specifier_escape(u); |
368 | if (!u_escaped) | |
369 | return log_oom(); | |
370 | ||
7410616c LP |
371 | r = unit_name_from_path(u, ".device", &d); |
372 | if (r < 0) | |
373 | return log_error_errno(r, "Failed to generate unit name: %m"); | |
e23a0ce8 | 374 | |
b7de9651 | 375 | if (keydev && !key_file) |
baaa35ad | 376 | return log_error_errno(SYNTHETIC_ERRNO(EINVAL), |
b7de9651 | 377 | "Key device is specified, but path to the key file is missing."); |
70f5f48e | 378 | |
fb883e75 ZJS |
379 | r = generator_open_unit_file(arg_dest, NULL, n, &f); |
380 | if (r < 0) | |
381 | return r; | |
0d536673 | 382 | |
62ca7d3b | 383 | r = generator_write_cryptsetup_unit_section(f, source); |
a7e88558 LP |
384 | if (r < 0) |
385 | return r; | |
6bbd539e LP |
386 | |
387 | if (netdev) | |
388 | fprintf(f, "After=remote-fs-pre.target\n"); | |
e23a0ce8 | 389 | |
1dc85eff | 390 | /* If initrd takes care of attaching the disk then it should also detach it during shutdown. */ |
8ce02b87 LP |
391 | if (!attach_in_initrd(name, options)) |
392 | fprintf(f, | |
393 | "Conflicts=umount.target\n" | |
394 | "Before=umount.target\n"); | |
1dc85eff | 395 | |
70f5f48e | 396 | if (keydev) { |
882f5f42 | 397 | _cleanup_free_ char *unit = NULL, *umount_unit = NULL; |
70f5f48e | 398 | |
eb7d9aa3 OK |
399 | r = generate_device_mount( |
400 | name, | |
401 | keydev, | |
402 | "keydev", | |
403 | keyfile_timeout_value, | |
404 | /* canfail = */ keyfile_can_timeout > 0, | |
405 | /* readonly= */ true, | |
406 | &unit, | |
407 | &keydev_mount); | |
70f5f48e MS |
408 | if (r < 0) |
409 | return log_error_errno(r, "Failed to generate keydev mount unit: %m"); | |
410 | ||
eb7d9aa3 | 411 | r = generate_device_umount(name, keydev_mount, "keydev", &umount_unit); |
882f5f42 MS |
412 | if (r < 0) |
413 | return log_error_errno(r, "Failed to generate keydev umount unit: %m"); | |
414 | ||
b7de9651 JJ |
415 | key_file_buffer = path_join(keydev_mount, key_file); |
416 | if (!key_file_buffer) | |
70f5f48e MS |
417 | return log_oom(); |
418 | ||
b7de9651 | 419 | key_file = key_file_buffer; |
50d2eba2 | 420 | |
421 | fprintf(f, "After=%s\n", unit); | |
422 | if (keyfile_can_timeout > 0) | |
423 | fprintf(f, "Wants=%s\n", unit); | |
424 | else | |
425 | fprintf(f, "Requires=%s\n", unit); | |
882f5f42 | 426 | |
d7a0f1f4 | 427 | if (umount_unit) |
882f5f42 MS |
428 | fprintf(f, |
429 | "Wants=%s\n" | |
430 | "Before=%s\n", | |
431 | umount_unit, | |
432 | umount_unit | |
433 | ); | |
70f5f48e MS |
434 | } |
435 | ||
a8574d00 OK |
436 | if (headerdev) { |
437 | _cleanup_free_ char *unit = NULL, *umount_unit = NULL, *p = NULL; | |
438 | ||
439 | r = generate_device_mount( | |
440 | name, | |
441 | headerdev, | |
442 | "headerdev", | |
443 | NULL, | |
444 | /* canfail= */ false, /* header is always necessary */ | |
445 | /* readonly= */ false, /* LUKS2 recovery requires rw header access */ | |
446 | &unit, | |
447 | &headerdev_mount); | |
448 | if (r < 0) | |
449 | return log_error_errno(r, "Failed to generate header device mount unit: %m"); | |
450 | ||
451 | r = generate_device_umount(name, headerdev_mount, "headerdev", &umount_unit); | |
452 | if (r < 0) | |
453 | return log_error_errno(r, "Failed to generate header device umount unit: %m"); | |
454 | ||
455 | p = path_join(headerdev_mount, header_path); | |
456 | if (!p) | |
457 | return log_oom(); | |
458 | ||
459 | free_and_replace(header_path, p); | |
460 | ||
461 | if (isempty(filtered_header)) | |
462 | p = strjoin("header=", header_path); | |
463 | else | |
464 | p = strjoin(filtered_header, ",header=", header_path); | |
465 | ||
466 | if (!p) | |
467 | return log_oom(); | |
468 | ||
469 | free_and_replace(filtered_header, p); | |
470 | options = filtered_header; | |
471 | ||
472 | fprintf(f, "After=%s\n" | |
473 | "Requires=%s\n", unit, unit); | |
474 | ||
ba715423 | 475 | if (umount_unit) |
a8574d00 OK |
476 | fprintf(f, |
477 | "Wants=%s\n" | |
478 | "Before=%s\n", | |
479 | umount_unit, | |
480 | umount_unit | |
481 | ); | |
a8574d00 OK |
482 | } |
483 | ||
155da457 | 484 | if (!nofail) |
6bdcb720 ZJS |
485 | fprintf(f, |
486 | "Before=%s\n", | |
487 | netdev ? "remote-cryptsetup.target" : "cryptsetup.target"); | |
155da457 | 488 | |
b7de9651 | 489 | if (key_file && !keydev) { |
7aa0b012 CHY |
490 | r = print_dependencies(f, key_file, |
491 | keyfile_timeout_value, | |
c9be8e42 | 492 | /* canfail= */ keyfile_can_timeout > 0 || nofail); |
38ab1ec9 RS |
493 | if (r < 0) |
494 | return r; | |
495 | } | |
bde29068 | 496 | |
38ab1ec9 | 497 | /* Check if a header option was specified */ |
a8574d00 | 498 | if (detached_header > 0 && !headerdev) { |
7aa0b012 | 499 | r = print_dependencies(f, header_path, |
c9be8e42 LB |
500 | /* timeout_value= */ NULL, |
501 | /* canfail= */ nofail); | |
38ab1ec9 RS |
502 | if (r < 0) |
503 | return r; | |
ceca9501 | 504 | } |
e23a0ce8 | 505 | |
a7e88558 | 506 | if (path_startswith(u, "/dev/")) |
9ece938a TW |
507 | fprintf(f, |
508 | "BindsTo=%s\n" | |
8ce02b87 | 509 | "After=%s\n", |
9ece938a | 510 | d, d); |
a7e88558 | 511 | else |
ce49a479 LP |
512 | /* For loopback devices make sure to explicitly load loop.ko, as this code might run very |
513 | * early where device nodes created via systemd-tmpfiles-setup-dev.service might not be | |
514 | * around yet. Hence let's sync on the module itself. */ | |
9ece938a | 515 | fprintf(f, |
b90cbe66 | 516 | "RequiresMountsFor=%s\n" |
ce49a479 LP |
517 | "Wants=modprobe@loop.service\n" |
518 | "After=modprobe@loop.service\n", | |
98bad05e LP |
519 | u_escaped); |
520 | ||
8eea8687 ZJS |
521 | r = generator_write_timeouts(arg_dest, device, name, options, &filtered); |
522 | if (r < 0) | |
7cecc563 | 523 | log_warning_errno(r, "Failed to write device timeout drop-in: %m"); |
8eea8687 | 524 | |
b7de9651 | 525 | r = generator_write_cryptsetup_service_section(f, name, u, key_file, filtered); |
a7e88558 LP |
526 | if (r < 0) |
527 | return r; | |
e23a0ce8 | 528 | |
53ac130b LP |
529 | if (tmp) { |
530 | _cleanup_free_ char *tmp_fstype_escaped = NULL; | |
531 | ||
532 | if (tmp_fstype) { | |
533 | tmp_fstype_escaped = specifier_escape(tmp_fstype); | |
534 | if (!tmp_fstype_escaped) | |
535 | return log_oom(); | |
536 | } | |
537 | ||
e23a0ce8 | 538 | fprintf(f, |
b0d3095f | 539 | "ExecStartPost=" LIBEXECDIR "/systemd-makefs '%s' '/dev/mapper/%s'\n", |
53ac130b LP |
540 | tmp_fstype_escaped ?: "ext4", name_escaped); |
541 | } | |
e23a0ce8 | 542 | |
8c11d3c1 | 543 | if (swap) |
e23a0ce8 | 544 | fprintf(f, |
b0d3095f | 545 | "ExecStartPost=" LIBEXECDIR "/systemd-makefs swap '/dev/mapper/%s'\n", |
98bad05e | 546 | name_escaped); |
e23a0ce8 | 547 | |
4652c56c ZJS |
548 | r = fflush_and_check(f); |
549 | if (r < 0) | |
fb883e75 | 550 | return log_error_errno(r, "Failed to write unit file %s: %m", n); |
e23a0ce8 | 551 | |
155da457 | 552 | if (!noauto) { |
6bdcb720 ZJS |
553 | r = generator_add_symlink(arg_dest, |
554 | netdev ? "remote-cryptsetup.target" : "cryptsetup.target", | |
b559616f ZJS |
555 | nofail ? "wants" : "requires", n); |
556 | if (r < 0) | |
557 | return r; | |
f7f21d33 | 558 | } |
74715b82 | 559 | |
b559616f ZJS |
560 | dmname = strjoina("dev-mapper-", e, ".device"); |
561 | r = generator_add_symlink(arg_dest, dmname, "requires", n); | |
562 | if (r < 0) | |
563 | return r; | |
74715b82 | 564 | |
68395007 | 565 | if (!noauto && !nofail) { |
7cecc563 ZJS |
566 | r = write_drop_in(arg_dest, dmname, 40, "device-timeout", |
567 | "# Automatically generated by systemd-cryptsetup-generator\n\n" | |
a9b837aa LP |
568 | "[Unit]\n" |
569 | "JobTimeoutSec=infinity\n"); | |
23bbb0de | 570 | if (r < 0) |
7cecc563 | 571 | log_warning_errno(r, "Failed to write device timeout drop-in: %m"); |
68395007 HH |
572 | } |
573 | ||
24a988e9 | 574 | return 0; |
e23a0ce8 LP |
575 | } |
576 | ||
a4a90e65 YW |
577 | static crypto_device* crypt_device_free(crypto_device *d) { |
578 | if (!d) | |
579 | return NULL; | |
580 | ||
6dd1c368 ZJS |
581 | free(d->uuid); |
582 | free(d->keyfile); | |
70f5f48e | 583 | free(d->keydev); |
7ce0104d DDM |
584 | free(d->headerdev); |
585 | free(d->datadev); | |
6dd1c368 ZJS |
586 | free(d->name); |
587 | free(d->options); | |
a4a90e65 | 588 | return mfree(d); |
0fa9e53d JJ |
589 | } |
590 | ||
591 | static crypto_device *get_crypto_device(const char *uuid) { | |
592 | int r; | |
593 | crypto_device *d; | |
594 | ||
595 | assert(uuid); | |
596 | ||
597 | d = hashmap_get(arg_disks, uuid); | |
598 | if (!d) { | |
599 | d = new0(struct crypto_device, 1); | |
600 | if (!d) | |
601 | return NULL; | |
602 | ||
0fa9e53d | 603 | d->uuid = strdup(uuid); |
6b430fdb ZJS |
604 | if (!d->uuid) |
605 | return mfree(d); | |
0fa9e53d JJ |
606 | |
607 | r = hashmap_put(arg_disks, d->uuid, d); | |
608 | if (r < 0) { | |
609 | free(d->uuid); | |
6b430fdb | 610 | return mfree(d); |
0fa9e53d JJ |
611 | } |
612 | } | |
613 | ||
614 | return d; | |
615 | } | |
616 | ||
c3ee5b34 OK |
617 | static bool warn_uuid_invalid(const char *uuid, const char *key) { |
618 | assert(key); | |
619 | ||
620 | if (!id128_is_valid(uuid)) { | |
621 | log_warning("Failed to parse %s= kernel command line switch. UUID is invalid, ignoring.", key); | |
622 | return true; | |
623 | } | |
624 | ||
625 | return false; | |
626 | } | |
627 | ||
a8574d00 OK |
628 | static int filter_header_device(const char *options, |
629 | char **ret_headerdev, | |
630 | char **ret_filtered_headerdev_options) { | |
631 | int r; | |
632 | _cleanup_free_ char *headerfile = NULL, *headerdev = NULL, *headerspec = NULL, | |
633 | *filtered_headerdev = NULL, *filtered_headerspec = NULL; | |
634 | ||
635 | assert(ret_headerdev); | |
636 | assert(ret_filtered_headerdev_options); | |
637 | ||
ff0c31bc | 638 | r = fstab_filter_options(options, "header\0", NULL, &headerspec, NULL, &filtered_headerspec); |
a8574d00 OK |
639 | if (r < 0) |
640 | return log_error_errno(r, "Failed to parse header= option value: %m"); | |
641 | ||
642 | if (r > 0) { | |
643 | r = split_locationspec(headerspec, &headerfile, &headerdev); | |
644 | if (r < 0) | |
645 | return r; | |
646 | ||
647 | if (isempty(filtered_headerspec)) | |
648 | filtered_headerdev = strjoin("header=", headerfile); | |
649 | else | |
650 | filtered_headerdev = strjoin(filtered_headerspec, ",header=", headerfile); | |
651 | ||
652 | if (!filtered_headerdev) | |
653 | return log_oom(); | |
654 | } else | |
655 | filtered_headerdev = TAKE_PTR(filtered_headerspec); | |
656 | ||
657 | *ret_filtered_headerdev_options = TAKE_PTR(filtered_headerdev); | |
658 | *ret_headerdev = TAKE_PTR(headerdev); | |
659 | ||
660 | return 0; | |
661 | } | |
662 | ||
96287a49 | 663 | static int parse_proc_cmdline_item(const char *key, const char *value, void *data) { |
0fa9e53d | 664 | _cleanup_free_ char *uuid = NULL, *uuid_value = NULL; |
1d84ad94 LP |
665 | crypto_device *d; |
666 | int r; | |
66a78c2b | 667 | |
1d84ad94 | 668 | if (streq(key, "luks")) { |
059cb385 | 669 | |
1d84ad94 | 670 | r = value ? parse_boolean(value) : 1; |
141a79f4 | 671 | if (r < 0) |
1d84ad94 | 672 | log_warning("Failed to parse luks= kernel command line switch %s. Ignoring.", value); |
141a79f4 ZJS |
673 | else |
674 | arg_enabled = r; | |
66a78c2b | 675 | |
1d84ad94 | 676 | } else if (streq(key, "luks.crypttab")) { |
66a78c2b | 677 | |
1d84ad94 | 678 | r = value ? parse_boolean(value) : 1; |
141a79f4 | 679 | if (r < 0) |
1d84ad94 | 680 | log_warning("Failed to parse luks.crypttab= kernel command line switch %s. Ignoring.", value); |
141a79f4 ZJS |
681 | else |
682 | arg_read_crypttab = r; | |
66a78c2b | 683 | |
1d84ad94 LP |
684 | } else if (streq(key, "luks.uuid")) { |
685 | ||
686 | if (proc_cmdline_value_missing(key, value)) | |
687 | return 0; | |
66a78c2b | 688 | |
263a7964 | 689 | d = get_crypto_device(startswith(value, "luks-") ?: value); |
0fa9e53d | 690 | if (!d) |
141a79f4 | 691 | return log_oom(); |
66a78c2b | 692 | |
6b000af4 | 693 | d->create = arg_allow_list = true; |
0fa9e53d | 694 | |
1d84ad94 | 695 | } else if (streq(key, "luks.options")) { |
a8574d00 | 696 | _cleanup_free_ char *headerdev = NULL, *filtered_headerdev_options = NULL; |
1d84ad94 LP |
697 | |
698 | if (proc_cmdline_value_missing(key, value)) | |
699 | return 0; | |
66a78c2b | 700 | |
0fa9e53d | 701 | r = sscanf(value, "%m[0-9a-fA-F-]=%ms", &uuid, &uuid_value); |
a8574d00 | 702 | if (r != 2) |
b3f9c17a | 703 | return free_and_strdup_warn(&arg_default_options, value); |
0fa9e53d | 704 | |
a8574d00 OK |
705 | if (warn_uuid_invalid(uuid, key)) |
706 | return 0; | |
0fa9e53d | 707 | |
a8574d00 OK |
708 | d = get_crypto_device(uuid); |
709 | if (!d) | |
141a79f4 | 710 | return log_oom(); |
66a78c2b | 711 | |
a8574d00 OK |
712 | r = filter_header_device(uuid_value, &headerdev, &filtered_headerdev_options); |
713 | if (r < 0) | |
714 | return r; | |
715 | ||
716 | free_and_replace(d->options, filtered_headerdev_options); | |
717 | free_and_replace(d->headerdev, headerdev); | |
1d84ad94 | 718 | } else if (streq(key, "luks.key")) { |
7949dfa7 MS |
719 | size_t n; |
720 | _cleanup_free_ char *keyfile = NULL, *keydev = NULL; | |
7949dfa7 | 721 | const char *keyspec; |
1d84ad94 LP |
722 | |
723 | if (proc_cmdline_value_missing(key, value)) | |
724 | return 0; | |
66a78c2b | 725 | |
008fd4f9 | 726 | n = strspn(value, ALPHANUMERICAL "-"); |
b3f9c17a YW |
727 | if (value[n] != '=') |
728 | return free_and_strdup_warn(&arg_default_keyfile, value); | |
70f5f48e | 729 | |
7949dfa7 MS |
730 | uuid = strndup(value, n); |
731 | if (!uuid) | |
732 | return log_oom(); | |
6cd5b12a | 733 | |
c3ee5b34 | 734 | if (warn_uuid_invalid(uuid, key)) |
7949dfa7 | 735 | return 0; |
7949dfa7 MS |
736 | |
737 | d = get_crypto_device(uuid); | |
738 | if (!d) | |
739 | return log_oom(); | |
70f5f48e | 740 | |
7949dfa7 | 741 | keyspec = value + n + 1; |
fc6f1ad1 | 742 | r = split_locationspec(keyspec, &keyfile, &keydev); |
50d2eba2 | 743 | if (r < 0) |
744 | return r; | |
70f5f48e | 745 | |
7949dfa7 MS |
746 | free_and_replace(d->keyfile, keyfile); |
747 | free_and_replace(d->keydev, keydev); | |
a8574d00 OK |
748 | } else if (streq(key, "luks.data")) { |
749 | size_t n; | |
750 | _cleanup_free_ char *datadev = NULL; | |
751 | ||
752 | if (proc_cmdline_value_missing(key, value)) | |
753 | return 0; | |
50d2eba2 | 754 | |
a8574d00 OK |
755 | n = strspn(value, ALPHANUMERICAL "-"); |
756 | if (value[n] != '=') { | |
757 | log_warning("Failed to parse luks.data= kernel command line switch. UUID is invalid, ignoring."); | |
758 | return 0; | |
759 | } | |
760 | ||
761 | uuid = strndup(value, n); | |
762 | if (!uuid) | |
763 | return log_oom(); | |
764 | ||
765 | if (warn_uuid_invalid(uuid, key)) | |
766 | return 0; | |
767 | ||
768 | d = get_crypto_device(uuid); | |
769 | if (!d) | |
770 | return log_oom(); | |
771 | ||
772 | datadev = fstab_node_to_udev_node(value + n + 1); | |
773 | if (!datadev) | |
774 | return log_oom(); | |
50d2eba2 | 775 | |
a8574d00 | 776 | free_and_replace(d->datadev, datadev); |
1d84ad94 LP |
777 | } else if (streq(key, "luks.name")) { |
778 | ||
779 | if (proc_cmdline_value_missing(key, value)) | |
780 | return 0; | |
baade8cc JJ |
781 | |
782 | r = sscanf(value, "%m[0-9a-fA-F-]=%ms", &uuid, &uuid_value); | |
783 | if (r == 2) { | |
784 | d = get_crypto_device(uuid); | |
785 | if (!d) | |
786 | return log_oom(); | |
787 | ||
6b000af4 | 788 | d->create = arg_allow_list = true; |
baade8cc | 789 | |
f9ecfd3b | 790 | free_and_replace(d->name, uuid_value); |
baade8cc JJ |
791 | } else |
792 | log_warning("Failed to parse luks name switch %s. Ignoring.", value); | |
85013844 | 793 | } |
66a78c2b | 794 | |
24a988e9 | 795 | return 0; |
66a78c2b LP |
796 | } |
797 | ||
0fa9e53d | 798 | static int add_crypttab_devices(void) { |
7fd1b19b | 799 | _cleanup_fclose_ FILE *f = NULL; |
b42674a1 | 800 | unsigned crypttab_line = 0; |
b42674a1 | 801 | int r; |
e23a0ce8 | 802 | |
0fa9e53d JJ |
803 | if (!arg_read_crypttab) |
804 | return 0; | |
805 | ||
a6c57e74 | 806 | r = fopen_unlocked(arg_crypttab, "re", &f); |
fdeea3f4 | 807 | if (r < 0) { |
0fa9e53d | 808 | if (errno != ENOENT) |
a6c57e74 | 809 | log_error_errno(errno, "Failed to open %s: %m", arg_crypttab); |
0fa9e53d | 810 | return 0; |
e23a0ce8 LP |
811 | } |
812 | ||
0fa9e53d | 813 | for (;;) { |
13445d97 OK |
814 | _cleanup_free_ char *line = NULL, *name = NULL, *device = NULL, *keyspec = NULL, *options = NULL, |
815 | *keyfile = NULL, *keydev = NULL, *headerdev = NULL, *filtered_header = NULL; | |
0fa9e53d | 816 | crypto_device *d = NULL; |
0ff6ff2b | 817 | char *uuid; |
b42674a1 | 818 | int k; |
4c12626c | 819 | |
0ff6ff2b | 820 | r = read_stripped_line(f, LONG_LINE_MAX, &line); |
b42674a1 | 821 | if (r < 0) |
a6c57e74 | 822 | return log_error_errno(r, "Failed to read %s: %m", arg_crypttab); |
b42674a1 | 823 | if (r == 0) |
0fa9e53d | 824 | break; |
66a78c2b | 825 | |
0fa9e53d | 826 | crypttab_line++; |
141a79f4 | 827 | |
0ff6ff2b | 828 | if (IN_SET(line[0], 0, '#')) |
0fa9e53d | 829 | continue; |
66a78c2b | 830 | |
0ff6ff2b | 831 | k = sscanf(line, "%ms %ms %ms %ms", &name, &device, &keyspec, &options); |
0fa9e53d | 832 | if (k < 2 || k > 4) { |
a6c57e74 | 833 | log_error("Failed to parse %s:%u, ignoring.", arg_crypttab, crypttab_line); |
0fa9e53d JJ |
834 | continue; |
835 | } | |
66a78c2b | 836 | |
844d5a87 | 837 | uuid = startswith(device, "UUID="); |
0fa9e53d JJ |
838 | if (!uuid) |
839 | uuid = path_startswith(device, "/dev/disk/by-uuid/"); | |
844d5a87 LR |
840 | if (!uuid) |
841 | uuid = startswith(name, "luks-"); | |
0fa9e53d JJ |
842 | if (uuid) |
843 | d = hashmap_get(arg_disks, uuid); | |
8973790e | 844 | |
6b000af4 | 845 | if (arg_allow_list && !d) { |
0fa9e53d JJ |
846 | log_info("Not creating device '%s' because it was not specified on the kernel command line.", name); |
847 | continue; | |
8973790e LP |
848 | } |
849 | ||
fc6f1ad1 | 850 | r = split_locationspec(keyspec, &keyfile, &keydev); |
50d2eba2 | 851 | if (r < 0) |
852 | return r; | |
853 | ||
13445d97 OK |
854 | if (options && (!d || !d->options)) { |
855 | r = filter_header_device(options, &headerdev, &filtered_header); | |
856 | if (r < 0) | |
857 | return r; | |
858 | free_and_replace(options, filtered_header); | |
859 | } | |
860 | ||
861 | r = create_disk(name, | |
862 | device, | |
863 | keyfile, | |
864 | keydev, | |
865 | (d && d->options) ? d->headerdev : headerdev, | |
866 | (d && d->options) ? d->options : options, | |
867 | arg_crypttab); | |
0fa9e53d JJ |
868 | if (r < 0) |
869 | return r; | |
8973790e | 870 | |
0fa9e53d JJ |
871 | if (d) |
872 | d->create = false; | |
873 | } | |
8973790e | 874 | |
0fa9e53d JJ |
875 | return 0; |
876 | } | |
66a78c2b | 877 | |
0fa9e53d JJ |
878 | static int add_proc_cmdline_devices(void) { |
879 | int r; | |
0fa9e53d | 880 | crypto_device *d; |
66a78c2b | 881 | |
90e74a66 | 882 | HASHMAP_FOREACH(d, arg_disks) { |
baade8cc | 883 | _cleanup_free_ char *device = NULL; |
66a78c2b | 884 | |
0fa9e53d JJ |
885 | if (!d->create) |
886 | continue; | |
e23a0ce8 | 887 | |
baade8cc | 888 | if (!d->name) { |
b910cc72 | 889 | d->name = strjoin("luks-", d->uuid); |
baade8cc JJ |
890 | if (!d->name) |
891 | return log_oom(); | |
892 | } | |
e23a0ce8 | 893 | |
b910cc72 | 894 | device = strjoin("UUID=", d->uuid); |
0fa9e53d JJ |
895 | if (!device) |
896 | return log_oom(); | |
7ab064a6 | 897 | |
7cecc563 | 898 | r = create_disk(d->name, |
a8574d00 | 899 | d->datadev ?: device, |
7cecc563 ZJS |
900 | d->keyfile ?: arg_default_keyfile, |
901 | d->keydev, | |
a8574d00 | 902 | d->headerdev, |
62ca7d3b JL |
903 | d->options ?: arg_default_options, |
904 | "/proc/cmdline"); | |
0fa9e53d JJ |
905 | if (r < 0) |
906 | return r; | |
e23a0ce8 LP |
907 | } |
908 | ||
0fa9e53d JJ |
909 | return 0; |
910 | } | |
e23a0ce8 | 911 | |
a4a90e65 YW |
912 | DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(crypt_device_hash_ops, char, string_hash_func, string_compare_func, |
913 | crypto_device, crypt_device_free); | |
914 | ||
7a44c7e3 | 915 | static int run(const char *dest, const char *dest_early, const char *dest_late) { |
5f4bfe56 | 916 | int r; |
e23a0ce8 | 917 | |
7a44c7e3 | 918 | assert_se(arg_dest = dest); |
e23a0ce8 | 919 | |
a6c57e74 | 920 | arg_crypttab = getenv("SYSTEMD_CRYPTTAB") ?: "/etc/crypttab"; |
3f5ac303 | 921 | arg_runtime_directory = getenv("RUNTIME_DIRECTORY") ?: "/run/systemd/cryptsetup"; |
a6c57e74 | 922 | |
a4a90e65 YW |
923 | arg_disks = hashmap_new(&crypt_device_hash_ops); |
924 | if (!arg_disks) | |
925 | return log_oom(); | |
7ab064a6 | 926 | |
1d84ad94 | 927 | r = proc_cmdline_parse(parse_proc_cmdline_item, NULL, PROC_CMDLINE_STRIP_RD_PREFIX); |
a4a90e65 YW |
928 | if (r < 0) |
929 | return log_warning_errno(r, "Failed to parse kernel command line: %m"); | |
7ab064a6 | 930 | |
a4a90e65 YW |
931 | if (!arg_enabled) |
932 | return 0; | |
e23a0ce8 | 933 | |
5f4bfe56 LP |
934 | r = add_crypttab_devices(); |
935 | if (r < 0) | |
a4a90e65 | 936 | return r; |
0fa9e53d | 937 | |
5f4bfe56 LP |
938 | r = add_proc_cmdline_devices(); |
939 | if (r < 0) | |
a4a90e65 | 940 | return r; |
141a79f4 | 941 | |
a4a90e65 | 942 | return 0; |
e23a0ce8 | 943 | } |
a4a90e65 | 944 | |
7a44c7e3 | 945 | DEFINE_MAIN_GENERATOR_FUNCTION(run); |