1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
10 #include "sd-device.h"
12 #include "alloc-util.h"
13 #include "ask-password-api.h"
14 #include "cryptsetup-fido2.h"
15 #include "cryptsetup-keyfile.h"
16 #include "cryptsetup-pkcs11.h"
17 #include "cryptsetup-tpm2.h"
18 #include "cryptsetup-util.h"
19 #include "device-util.h"
23 #include "fstab-util.h"
24 #include "hexdecoct.h"
25 #include "libfido2-util.h"
27 #include "main-func.h"
28 #include "memory-util.h"
29 #include "mount-util.h"
30 #include "nulstr-util.h"
31 #include "parse-util.h"
32 #include "path-util.h"
33 #include "pkcs11-util.h"
34 #include "pretty-print.h"
35 #include "random-util.h"
36 #include "string-util.h"
38 #include "tpm2-util.h"
41 #define ANY_LUKS "LUKS"
42 /* as in src/cryptsetup.h */
43 #define CRYPT_SECTOR_SIZE 512
44 #define CRYPT_MAX_SECTOR_SIZE 4096
46 static const char *arg_type
= NULL
; /* ANY_LUKS, CRYPT_LUKS1, CRYPT_LUKS2, CRYPT_TCRYPT, CRYPT_BITLK or CRYPT_PLAIN */
47 static char *arg_cipher
= NULL
;
48 static unsigned arg_key_size
= 0;
49 static unsigned arg_sector_size
= CRYPT_SECTOR_SIZE
;
50 static int arg_key_slot
= CRYPT_ANY_SLOT
;
51 static unsigned arg_keyfile_size
= 0;
52 static uint64_t arg_keyfile_offset
= 0;
53 static bool arg_keyfile_erase
= false;
54 static bool arg_try_empty_password
= false;
55 static char *arg_hash
= NULL
;
56 static char *arg_header
= NULL
;
57 static unsigned arg_tries
= 3;
58 static bool arg_readonly
= false;
59 static bool arg_verify
= false;
60 static bool arg_discards
= false;
61 static bool arg_same_cpu_crypt
= false;
62 static bool arg_submit_from_crypt_cpus
= false;
63 static bool arg_no_read_workqueue
= false;
64 static bool arg_no_write_workqueue
= false;
65 static bool arg_tcrypt_hidden
= false;
66 static bool arg_tcrypt_system
= false;
67 static bool arg_tcrypt_veracrypt
= false;
68 static char **arg_tcrypt_keyfiles
= NULL
;
69 static uint64_t arg_offset
= 0;
70 static uint64_t arg_skip
= 0;
71 static usec_t arg_timeout
= USEC_INFINITY
;
72 static char *arg_pkcs11_uri
= NULL
;
73 static bool arg_pkcs11_uri_auto
= false;
74 static char *arg_fido2_device
= NULL
;
75 static bool arg_fido2_device_auto
= false;
76 static void *arg_fido2_cid
= NULL
;
77 static size_t arg_fido2_cid_size
= 0;
78 static char *arg_fido2_rp_id
= NULL
;
79 static char *arg_tpm2_device
= NULL
;
80 static bool arg_tpm2_device_auto
= false;
81 static uint32_t arg_tpm2_pcr_mask
= UINT32_MAX
;
83 STATIC_DESTRUCTOR_REGISTER(arg_cipher
, freep
);
84 STATIC_DESTRUCTOR_REGISTER(arg_hash
, freep
);
85 STATIC_DESTRUCTOR_REGISTER(arg_header
, freep
);
86 STATIC_DESTRUCTOR_REGISTER(arg_tcrypt_keyfiles
, strv_freep
);
87 STATIC_DESTRUCTOR_REGISTER(arg_pkcs11_uri
, freep
);
88 STATIC_DESTRUCTOR_REGISTER(arg_fido2_device
, freep
);
89 STATIC_DESTRUCTOR_REGISTER(arg_fido2_cid
, freep
);
90 STATIC_DESTRUCTOR_REGISTER(arg_fido2_rp_id
, freep
);
91 STATIC_DESTRUCTOR_REGISTER(arg_tpm2_device
, freep
);
93 /* Options Debian's crypttab knows we don't:
104 static int parse_one_option(const char *option
) {
110 /* Handled outside of this tool */
111 if (STR_IN_SET(option
, "noauto", "auto", "nofail", "fail", "_netdev", "keyfile-timeout"))
114 if (startswith(option
, "keyfile-timeout="))
117 if ((val
= startswith(option
, "cipher="))) {
118 r
= free_and_strdup(&arg_cipher
, val
);
122 } else if ((val
= startswith(option
, "size="))) {
124 r
= safe_atou(val
, &arg_key_size
);
126 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
130 if (arg_key_size
% 8) {
131 log_error("size= not a multiple of 8, ignoring.");
137 } else if ((val
= startswith(option
, "sector-size="))) {
139 r
= safe_atou(val
, &arg_sector_size
);
141 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
145 if (arg_sector_size
% 2) {
146 log_error("sector-size= not a multiple of 2, ignoring.");
150 if (arg_sector_size
< CRYPT_SECTOR_SIZE
|| arg_sector_size
> CRYPT_MAX_SECTOR_SIZE
) {
151 log_error("sector-size= is outside of %u and %u, ignoring.", CRYPT_SECTOR_SIZE
, CRYPT_MAX_SECTOR_SIZE
);
155 } else if ((val
= startswith(option
, "key-slot=")) ||
156 (val
= startswith(option
, "keyslot="))) {
159 r
= safe_atoi(val
, &arg_key_slot
);
161 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
165 } else if ((val
= startswith(option
, "tcrypt-keyfile="))) {
167 arg_type
= CRYPT_TCRYPT
;
168 if (path_is_absolute(val
)) {
169 if (strv_extend(&arg_tcrypt_keyfiles
, val
) < 0)
172 log_error("Key file path \"%s\" is not absolute. Ignoring.", val
);
174 } else if ((val
= startswith(option
, "keyfile-size="))) {
176 r
= safe_atou(val
, &arg_keyfile_size
);
178 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
182 } else if ((val
= startswith(option
, "keyfile-offset="))) {
184 r
= safe_atou64(val
, &arg_keyfile_offset
);
186 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
190 } else if ((val
= startswith(option
, "keyfile-erase="))) {
192 r
= parse_boolean(val
);
194 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
198 arg_keyfile_erase
= r
;
200 } else if (streq(option
, "keyfile-erase"))
201 arg_keyfile_erase
= true;
203 else if ((val
= startswith(option
, "hash="))) {
204 r
= free_and_strdup(&arg_hash
, val
);
208 } else if ((val
= startswith(option
, "header="))) {
211 if (!path_is_absolute(val
))
212 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
213 "Header path \"%s\" is not absolute, refusing.", val
);
216 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
217 "Duplicate header= option, refusing.");
219 arg_header
= strdup(val
);
223 } else if ((val
= startswith(option
, "tries="))) {
225 r
= safe_atou(val
, &arg_tries
);
227 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
231 } else if (STR_IN_SET(option
, "readonly", "read-only"))
233 else if (streq(option
, "verify"))
235 else if (STR_IN_SET(option
, "allow-discards", "discard"))
237 else if (streq(option
, "same-cpu-crypt"))
238 arg_same_cpu_crypt
= true;
239 else if (streq(option
, "submit-from-crypt-cpus"))
240 arg_submit_from_crypt_cpus
= true;
241 else if (streq(option
, "no-read-workqueue"))
242 arg_no_read_workqueue
= true;
243 else if (streq(option
, "no-write-workqueue"))
244 arg_no_write_workqueue
= true;
245 else if (streq(option
, "luks"))
247 /* since cryptsetup 2.3.0 (Feb 2020) */
249 else if (streq(option
, "bitlk"))
250 arg_type
= CRYPT_BITLK
;
252 else if (streq(option
, "tcrypt"))
253 arg_type
= CRYPT_TCRYPT
;
254 else if (STR_IN_SET(option
, "tcrypt-hidden", "tcrypthidden")) {
255 arg_type
= CRYPT_TCRYPT
;
256 arg_tcrypt_hidden
= true;
257 } else if (streq(option
, "tcrypt-system")) {
258 arg_type
= CRYPT_TCRYPT
;
259 arg_tcrypt_system
= true;
260 } else if (STR_IN_SET(option
, "tcrypt-veracrypt", "veracrypt")) {
261 arg_type
= CRYPT_TCRYPT
;
262 arg_tcrypt_veracrypt
= true;
263 } else if (STR_IN_SET(option
, "plain", "swap", "tmp") ||
264 startswith(option
, "tmp="))
265 arg_type
= CRYPT_PLAIN
;
266 else if ((val
= startswith(option
, "timeout="))) {
268 r
= parse_sec_fix_0(val
, &arg_timeout
);
270 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
274 } else if ((val
= startswith(option
, "offset="))) {
276 r
= safe_atou64(val
, &arg_offset
);
278 return log_error_errno(r
, "Failed to parse %s: %m", option
);
280 } else if ((val
= startswith(option
, "skip="))) {
282 r
= safe_atou64(val
, &arg_skip
);
284 return log_error_errno(r
, "Failed to parse %s: %m", option
);
286 } else if ((val
= startswith(option
, "pkcs11-uri="))) {
288 if (streq(val
, "auto")) {
289 arg_pkcs11_uri
= mfree(arg_pkcs11_uri
);
290 arg_pkcs11_uri_auto
= true;
292 if (!pkcs11_uri_valid(val
))
293 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "pkcs11-uri= parameter expects a PKCS#11 URI, refusing");
295 r
= free_and_strdup(&arg_pkcs11_uri
, val
);
299 arg_pkcs11_uri_auto
= false;
302 } else if ((val
= startswith(option
, "fido2-device="))) {
304 if (streq(val
, "auto")) {
305 arg_fido2_device
= mfree(arg_fido2_device
);
306 arg_fido2_device_auto
= true;
308 r
= free_and_strdup(&arg_fido2_device
, val
);
312 arg_fido2_device_auto
= false;
315 } else if ((val
= startswith(option
, "fido2-cid="))) {
317 if (streq(val
, "auto"))
318 arg_fido2_cid
= mfree(arg_fido2_cid
);
320 _cleanup_free_
void *cid
= NULL
;
323 r
= unbase64mem(val
, SIZE_MAX
, &cid
, &cid_size
);
325 return log_error_errno(r
, "Failed to decode FIDO2 CID data: %m");
328 arg_fido2_cid
= TAKE_PTR(cid
);
329 arg_fido2_cid_size
= cid_size
;
332 /* Turn on FIDO2 as side-effect, if not turned on yet. */
333 if (!arg_fido2_device
&& !arg_fido2_device_auto
)
334 arg_fido2_device_auto
= true;
336 } else if ((val
= startswith(option
, "fido2-rp="))) {
338 r
= free_and_strdup(&arg_fido2_rp_id
, val
);
342 } else if ((val
= startswith(option
, "tpm2-device="))) {
344 if (streq(val
, "auto")) {
345 arg_tpm2_device
= mfree(arg_tpm2_device
);
346 arg_tpm2_device_auto
= true;
348 r
= free_and_strdup(&arg_tpm2_device
, val
);
352 arg_tpm2_device_auto
= false;
355 } else if ((val
= startswith(option
, "tpm2-pcrs="))) {
358 arg_tpm2_pcr_mask
= 0;
362 r
= tpm2_parse_pcrs(val
, &mask
);
366 if (arg_tpm2_pcr_mask
== UINT32_MAX
)
367 arg_tpm2_pcr_mask
= mask
;
369 arg_tpm2_pcr_mask
|= mask
;
372 } else if ((val
= startswith(option
, "try-empty-password="))) {
374 r
= parse_boolean(val
);
376 log_error_errno(r
, "Failed to parse %s, ignoring: %m", option
);
380 arg_try_empty_password
= r
;
382 } else if (streq(option
, "try-empty-password"))
383 arg_try_empty_password
= true;
385 else if (!streq(option
, "x-initrd.attach"))
386 log_warning("Encountered unknown /etc/crypttab option '%s', ignoring.", option
);
391 static int parse_options(const char *options
) {
395 _cleanup_free_
char *word
= NULL
;
398 r
= extract_first_word(&options
, &word
, ",", EXTRACT_DONT_COALESCE_SEPARATORS
| EXTRACT_UNESCAPE_SEPARATORS
);
400 return log_error_errno(r
, "Failed to parse options: %m");
404 r
= parse_one_option(word
);
409 /* sanity-check options */
410 if (arg_type
&& !streq(arg_type
, CRYPT_PLAIN
)) {
412 log_warning("offset= ignored with type %s", arg_type
);
414 log_warning("skip= ignored with type %s", arg_type
);
420 static char* disk_description(const char *path
) {
421 static const char name_fields
[] =
423 "ID_MODEL_FROM_DATABASE\0"
426 _cleanup_(sd_device_unrefp
) sd_device
*device
= NULL
;
427 const char *i
, *name
;
433 if (stat(path
, &st
) < 0)
436 if (!S_ISBLK(st
.st_mode
))
439 if (sd_device_new_from_stat_rdev(&device
, &st
) < 0)
442 if (sd_device_get_property_value(device
, "ID_PART_ENTRY_NAME", &name
) >= 0) {
443 _cleanup_free_
char *unescaped
= NULL
;
445 /* ID_PART_ENTRY_NAME uses \x style escaping, using libblkid's blkid_encode_string(). Let's
446 * reverse this here to make the string more human friendly in case people embed spaces or
447 * other weird stuff. */
449 r
= cunescape(name
, UNESCAPE_RELAX
, &unescaped
);
451 log_debug_errno(r
, "Failed to unescape ID_PART_ENTRY_NAME, skipping device: %m");
455 if (!isempty(unescaped
) && !string_has_cc(unescaped
, NULL
))
456 return TAKE_PTR(unescaped
);
459 /* These need no unescaping. */
460 NULSTR_FOREACH(i
, name_fields
)
461 if (sd_device_get_property_value(device
, i
, &name
) >= 0 &&
468 static char *disk_mount_point(const char *label
) {
469 _cleanup_free_
char *device
= NULL
;
470 _cleanup_endmntent_
FILE *f
= NULL
;
473 /* Yeah, we don't support native systemd unit files here for now */
475 device
= strjoin("/dev/mapper/", label
);
479 f
= setmntent(fstab_path(), "re");
483 while ((m
= getmntent(f
)))
484 if (path_equal(m
->mnt_fsname
, device
))
485 return strdup(m
->mnt_dir
);
490 static char *friendly_disk_name(const char *src
, const char *vol
) {
491 _cleanup_free_
char *description
= NULL
, *mount_point
= NULL
;
492 char *name_buffer
= NULL
;
498 description
= disk_description(src
);
499 mount_point
= disk_mount_point(vol
);
501 /* If the description string is simply the volume name, then let's not show this twice */
502 if (description
&& streq(vol
, description
))
503 description
= mfree(description
);
505 if (mount_point
&& description
)
506 r
= asprintf(&name_buffer
, "%s (%s) on %s", description
, vol
, mount_point
);
507 else if (mount_point
)
508 r
= asprintf(&name_buffer
, "%s on %s", vol
, mount_point
);
509 else if (description
)
510 r
= asprintf(&name_buffer
, "%s (%s)", description
, vol
);
519 static int get_password(
526 _cleanup_free_
char *friendly
= NULL
, *text
= NULL
, *disk_path
= NULL
;
527 _cleanup_strv_free_erase_
char **passwords
= NULL
;
535 friendly
= friendly_disk_name(src
, vol
);
539 if (asprintf(&text
, "Please enter passphrase for disk %s:", friendly
) < 0)
542 disk_path
= cescape(src
);
546 id
= strjoina("cryptsetup:", disk_path
);
548 r
= ask_password_auto(text
, "drive-harddisk", id
, "cryptsetup", until
,
549 ASK_PASSWORD_PUSH_CACHE
| (accept_cached
*ASK_PASSWORD_ACCEPT_CACHED
),
552 return log_error_errno(r
, "Failed to query password: %m");
555 _cleanup_strv_free_erase_
char **passwords2
= NULL
;
557 assert(strv_length(passwords
) == 1);
559 if (asprintf(&text
, "Please enter passphrase for disk %s (verification):", friendly
) < 0)
562 id
= strjoina("cryptsetup-verification:", disk_path
);
564 r
= ask_password_auto(text
, "drive-harddisk", id
, "cryptsetup", until
, ASK_PASSWORD_PUSH_CACHE
, &passwords2
);
566 return log_error_errno(r
, "Failed to query verification password: %m");
568 assert(strv_length(passwords2
) == 1);
570 if (!streq(passwords
[0], passwords2
[0]))
571 return log_warning_errno(SYNTHETIC_ERRNO(EAGAIN
),
572 "Passwords did not match, retrying.");
575 strv_uniq(passwords
);
577 STRV_FOREACH(p
, passwords
) {
580 if (strlen(*p
)+1 >= arg_key_size
)
583 /* Pad password if necessary */
584 c
= new(char, arg_key_size
);
588 strncpy(c
, *p
, arg_key_size
);
593 *ret
= TAKE_PTR(passwords
);
598 static int attach_tcrypt(
599 struct crypt_device
*cd
,
601 const char *key_file
,
602 const void *key_data
,
603 size_t key_data_size
,
608 _cleanup_(erase_and_freep
) char *passphrase
= NULL
;
609 struct crypt_params_tcrypt params
= {
610 .flags
= CRYPT_TCRYPT_LEGACY_MODES
,
611 .keyfiles
= (const char **)arg_tcrypt_keyfiles
,
612 .keyfiles_count
= strv_length(arg_tcrypt_keyfiles
)
617 assert(key_file
|| key_data
|| !strv_isempty(passwords
));
619 if (arg_pkcs11_uri
|| arg_pkcs11_uri_auto
|| arg_fido2_device
|| arg_fido2_device_auto
|| arg_tpm2_device
|| arg_tpm2_device_auto
)
620 /* Ask for a regular password */
621 return log_error_errno(SYNTHETIC_ERRNO(EAGAIN
),
622 "Sorry, but tcrypt devices are currently not supported in conjunction with pkcs11/fido2/tpm2 support.");
624 if (arg_tcrypt_hidden
)
625 params
.flags
|= CRYPT_TCRYPT_HIDDEN_HEADER
;
627 if (arg_tcrypt_system
)
628 params
.flags
|= CRYPT_TCRYPT_SYSTEM_HEADER
;
630 if (arg_tcrypt_veracrypt
)
631 params
.flags
|= CRYPT_TCRYPT_VERA_MODES
;
634 params
.passphrase
= key_data
;
635 params
.passphrase_size
= key_data_size
;
638 r
= read_one_line_file(key_file
, &passphrase
);
640 log_error_errno(r
, "Failed to read password file '%s': %m", key_file
);
641 return -EAGAIN
; /* log with the actual error, but return EAGAIN */
644 params
.passphrase
= passphrase
;
646 params
.passphrase
= passwords
[0];
648 params
.passphrase_size
= strlen(params
.passphrase
);
651 r
= crypt_load(cd
, CRYPT_TCRYPT
, ¶ms
);
655 log_error_errno(r
, "Failed to activate using discovered key. (Key not correct?)");
658 log_error_errno(r
, "Failed to activate using password file '%s'. (Key data not correct?)", key_file
);
660 return -EAGAIN
; /* log the actual error, but return EAGAIN */
663 return log_error_errno(r
, "Failed to load tcrypt superblock on device %s: %m", crypt_get_device_name(cd
));
666 r
= crypt_activate_by_volume_key(cd
, name
, NULL
, 0, flags
);
668 return log_error_errno(r
, "Failed to activate tcrypt device %s: %m", crypt_get_device_name(cd
));
673 static char *make_bindname(const char *volume
) {
676 if (asprintf(&s
, "@%" PRIx64
"/cryptsetup/%s", random_u64(), volume
) < 0)
682 static int make_security_device_monitor(sd_event
*event
, sd_device_monitor
**ret
) {
683 _cleanup_(sd_device_monitor_unrefp
) sd_device_monitor
*monitor
= NULL
;
688 r
= sd_device_monitor_new(&monitor
);
690 return log_error_errno(r
, "Failed to allocate device monitor: %m");
692 r
= sd_device_monitor_filter_add_match_tag(monitor
, "security-device");
694 return log_error_errno(r
, "Failed to configure device monitor: %m");
696 r
= sd_device_monitor_attach_event(monitor
, event
);
698 return log_error_errno(r
, "Failed to attach device monitor: %m");
700 r
= sd_device_monitor_start(monitor
, NULL
, NULL
);
702 return log_error_errno(r
, "Failed to start device monitor: %m");
704 *ret
= TAKE_PTR(monitor
);
708 static int attach_luks_or_plain_or_bitlk_by_fido2(
709 struct crypt_device
*cd
,
711 const char *key_file
,
712 const void *key_data
,
713 size_t key_data_size
,
716 bool pass_volume_key
) {
718 _cleanup_(sd_device_monitor_unrefp
) sd_device_monitor
*monitor
= NULL
;
719 _cleanup_(erase_and_freep
) void *decrypted_key
= NULL
;
720 _cleanup_(sd_event_unrefp
) sd_event
*event
= NULL
;
721 _cleanup_free_
void *discovered_salt
= NULL
, *discovered_cid
= NULL
;
722 size_t discovered_salt_size
, discovered_cid_size
, cid_size
, decrypted_key_size
;
723 _cleanup_free_
char *friendly
= NULL
, *discovered_rp_id
= NULL
;
724 int keyslot
= arg_key_slot
, r
;
730 assert(arg_fido2_device
|| arg_fido2_device_auto
);
733 if (!key_file
&& !key_data
)
734 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "FIDO2 mode selected but no key file specified, refusing.");
736 rp_id
= arg_fido2_rp_id
;
738 cid_size
= arg_fido2_cid_size
;
740 r
= find_fido2_auto_data(
744 &discovered_salt_size
,
746 &discovered_cid_size
,
749 if (IN_SET(r
, -ENOTUNIQ
, -ENXIO
))
750 return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN
),
751 "Automatic FIDO2 metadata discovery was not possible because missing or not unique, falling back to traditional unlocking.");
755 rp_id
= discovered_rp_id
;
756 key_data
= discovered_salt
;
757 key_data_size
= discovered_salt_size
;
758 cid
= discovered_cid
;
759 cid_size
= discovered_cid_size
;
762 friendly
= friendly_disk_name(crypt_get_device_name(cd
), name
);
767 bool processed
= false;
769 r
= acquire_fido2_key(
775 key_file
, arg_keyfile_size
, arg_keyfile_offset
,
776 key_data
, key_data_size
,
778 &decrypted_key
, &decrypted_key_size
);
781 if (r
!= -EAGAIN
) /* EAGAIN means: token not found */
785 /* We didn't find the token. In this case, watch for it via udev. Let's
786 * create an event loop and monitor first. */
790 r
= sd_event_default(&event
);
792 return log_error_errno(r
, "Failed to allocate event loop: %m");
794 r
= make_security_device_monitor(event
, &monitor
);
798 log_notice("Security token not present for unlocking volume %s, please plug it in.", friendly
);
800 /* Let's immediately rescan in case the token appeared in the time we needed
801 * to create and configure the monitor */
806 /* Wait for one event, and then eat all subsequent events until there are no
808 r
= sd_event_run(event
, processed
? 0 : UINT64_MAX
);
810 return log_error_errno(r
, "Failed to run event loop: %m");
817 log_debug("Got one or more potentially relevant udev events, rescanning FIDO2...");
821 r
= crypt_activate_by_volume_key(cd
, name
, decrypted_key
, decrypted_key_size
, flags
);
823 _cleanup_(erase_and_freep
) char *base64_encoded
= NULL
;
825 /* Before using this key as passphrase we base64 encode it, for compat with homed */
827 r
= base64mem(decrypted_key
, decrypted_key_size
, &base64_encoded
);
831 r
= crypt_activate_by_passphrase(cd
, name
, keyslot
, base64_encoded
, strlen(base64_encoded
), flags
);
834 log_error_errno(r
, "Failed to activate with FIDO2 decrypted key. (Key incorrect?)");
835 return -EAGAIN
; /* log actual error, but return EAGAIN */
838 return log_error_errno(r
, "Failed to activate with FIDO2 acquired key: %m");
843 static int attach_luks_or_plain_or_bitlk_by_pkcs11(
844 struct crypt_device
*cd
,
846 const char *key_file
,
847 const void *key_data
,
848 size_t key_data_size
,
851 bool pass_volume_key
) {
853 _cleanup_(sd_device_monitor_unrefp
) sd_device_monitor
*monitor
= NULL
;
854 _cleanup_free_
char *friendly
= NULL
, *discovered_uri
= NULL
;
855 size_t decrypted_key_size
= 0, discovered_key_size
= 0;
856 _cleanup_(erase_and_freep
) void *decrypted_key
= NULL
;
857 _cleanup_(sd_event_unrefp
) sd_event
*event
= NULL
;
858 _cleanup_free_
void *discovered_key
= NULL
;
859 int keyslot
= arg_key_slot
, r
;
864 assert(arg_pkcs11_uri
|| arg_pkcs11_uri_auto
);
866 if (arg_pkcs11_uri_auto
) {
867 r
= find_pkcs11_auto_data(cd
, &discovered_uri
, &discovered_key
, &discovered_key_size
, &keyslot
);
868 if (IN_SET(r
, -ENOTUNIQ
, -ENXIO
))
869 return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN
),
870 "Automatic PKCS#11 metadata discovery was not possible because missing or not unique, falling back to traditional unlocking.");
874 uri
= discovered_uri
;
875 key_data
= discovered_key
;
876 key_data_size
= discovered_key_size
;
878 uri
= arg_pkcs11_uri
;
880 if (!key_file
&& !key_data
)
881 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "PKCS#11 mode selected but no key file specified, refusing.");
884 friendly
= friendly_disk_name(crypt_get_device_name(cd
), name
);
889 bool processed
= false;
891 r
= decrypt_pkcs11_key(
895 key_file
, arg_keyfile_size
, arg_keyfile_offset
,
896 key_data
, key_data_size
,
898 &decrypted_key
, &decrypted_key_size
);
901 if (r
!= -EAGAIN
) /* EAGAIN means: token not found */
905 /* We didn't find the token. In this case, watch for it via udev. Let's
906 * create an event loop and monitor first. */
910 r
= sd_event_default(&event
);
912 return log_error_errno(r
, "Failed to allocate event loop: %m");
914 r
= make_security_device_monitor(event
, &monitor
);
918 log_notice("Security token %s not present for unlocking volume %s, please plug it in.",
921 /* Let's immediately rescan in case the token appeared in the time we needed
922 * to create and configure the monitor */
927 /* Wait for one event, and then eat all subsequent events until there are no
929 r
= sd_event_run(event
, processed
? 0 : UINT64_MAX
);
931 return log_error_errno(r
, "Failed to run event loop: %m");
938 log_debug("Got one or more potentially relevant udev events, rescanning PKCS#11...");
942 r
= crypt_activate_by_volume_key(cd
, name
, decrypted_key
, decrypted_key_size
, flags
);
944 _cleanup_(erase_and_freep
) char *base64_encoded
= NULL
;
946 /* Before using this key as passphrase we base64 encode it. Why? For compatibility
947 * with homed's PKCS#11 hookup: there we want to use the key we acquired through
948 * PKCS#11 for other authentication/decryption mechanisms too, and some of them do
949 * not not take arbitrary binary blobs, but require NUL-terminated strings — most
950 * importantly UNIX password hashes. Hence, for compatibility we want to use a string
951 * without embedded NUL here too, and that's easiest to generate from a binary blob
952 * via base64 encoding. */
954 r
= base64mem(decrypted_key
, decrypted_key_size
, &base64_encoded
);
958 r
= crypt_activate_by_passphrase(cd
, name
, keyslot
, base64_encoded
, strlen(base64_encoded
), flags
);
961 log_error_errno(r
, "Failed to activate with PKCS#11 decrypted key. (Key incorrect?)");
962 return -EAGAIN
; /* log actual error, but return EAGAIN */
965 return log_error_errno(r
, "Failed to activate with PKCS#11 acquired key: %m");
970 static int make_tpm2_device_monitor(sd_event
*event
, sd_device_monitor
**ret
) {
971 _cleanup_(sd_device_monitor_unrefp
) sd_device_monitor
*monitor
= NULL
;
976 r
= sd_device_monitor_new(&monitor
);
978 return log_error_errno(r
, "Failed to allocate device monitor: %m");
980 r
= sd_device_monitor_filter_add_match_subsystem_devtype(monitor
, "tpmrm", NULL
);
982 return log_error_errno(r
, "Failed to configure device monitor: %m");
984 r
= sd_device_monitor_attach_event(monitor
, event
);
986 return log_error_errno(r
, "Failed to attach device monitor: %m");
988 r
= sd_device_monitor_start(monitor
, NULL
, NULL
);
990 return log_error_errno(r
, "Failed to start device monitor: %m");
992 *ret
= TAKE_PTR(monitor
);
996 static int attach_luks_or_plain_or_bitlk_by_tpm2(
997 struct crypt_device
*cd
,
999 const char *key_file
,
1000 const void *key_data
,
1001 size_t key_data_size
,
1004 bool pass_volume_key
) {
1006 _cleanup_(sd_device_monitor_unrefp
) sd_device_monitor
*monitor
= NULL
;
1007 _cleanup_(erase_and_freep
) void *decrypted_key
= NULL
;
1008 _cleanup_(sd_event_unrefp
) sd_event
*event
= NULL
;
1009 _cleanup_free_
char *friendly
= NULL
;
1010 int keyslot
= arg_key_slot
, r
;
1011 size_t decrypted_key_size
;
1015 assert(arg_tpm2_device
|| arg_tpm2_device_auto
);
1017 friendly
= friendly_disk_name(crypt_get_device_name(cd
), name
);
1022 bool processed
= false;
1024 if (key_file
|| key_data
) {
1025 /* If key data is specified, use that */
1027 r
= acquire_tpm2_key(
1030 arg_tpm2_pcr_mask
== UINT32_MAX
? TPM2_PCR_MASK_DEFAULT
: arg_tpm2_pcr_mask
,
1031 key_file
, arg_keyfile_size
, arg_keyfile_offset
,
1032 key_data
, key_data_size
,
1033 NULL
, 0, /* we don't know the policy hash */
1034 &decrypted_key
, &decrypted_key_size
);
1037 if (r
!= -EAGAIN
) /* EAGAIN means: no tpm2 chip found */
1040 _cleanup_free_
void *blob
= NULL
, *policy_hash
= NULL
;
1041 size_t blob_size
, policy_hash_size
;
1042 bool found_some
= false;
1043 int token
= 0; /* first token to look at */
1045 /* If no key data is specified, look for it in the header. In order to support
1046 * software upgrades we'll iterate through all suitable tokens, maybe one of them
1052 r
= find_tpm2_auto_data(
1054 arg_tpm2_pcr_mask
, /* if != UINT32_MAX we'll only look for tokens with this PCR mask */
1055 token
, /* search for the token with this index, or any later index than this */
1058 &policy_hash
, &policy_hash_size
,
1062 /* No further TPM2 tokens found in the LUKS2 header.*/
1064 return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN
),
1065 "No TPM2 metadata matching the current system state found in LUKS2 header, falling back to traditional unlocking.");
1067 return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN
),
1068 "No TPM2 metadata enrolled in LUKS2 header, falling back to traditional unlocking.");
1075 r
= acquire_tpm2_key(
1079 NULL
, 0, 0, /* no key file */
1081 policy_hash
, policy_hash_size
,
1082 &decrypted_key
, &decrypted_key_size
);
1086 token
++; /* try a different token next time */
1091 if (r
!= -EAGAIN
) /* EAGAIN means: no tpm2 chip found */
1096 /* We didn't find the TPM2 device. In this case, watch for it via udev. Let's create
1097 * an event loop and monitor first. */
1101 r
= sd_event_default(&event
);
1103 return log_error_errno(r
, "Failed to allocate event loop: %m");
1105 r
= make_tpm2_device_monitor(event
, &monitor
);
1109 log_info("TPM2 device not present for unlocking %s, waiting for it to become available.", friendly
);
1111 /* Let's immediately rescan in case the device appeared in the time we needed
1112 * to create and configure the monitor */
1117 /* Wait for one event, and then eat all subsequent events until there are no
1119 r
= sd_event_run(event
, processed
? 0 : UINT64_MAX
);
1121 return log_error_errno(r
, "Failed to run event loop: %m");
1128 log_debug("Got one or more potentially relevant udev events, rescanning for TPM2...");
1131 if (pass_volume_key
)
1132 r
= crypt_activate_by_volume_key(cd
, name
, decrypted_key
, decrypted_key_size
, flags
);
1134 _cleanup_(erase_and_freep
) char *base64_encoded
= NULL
;
1136 /* Before using this key as passphrase we base64 encode it, for compat with homed */
1138 r
= base64mem(decrypted_key
, decrypted_key_size
, &base64_encoded
);
1142 r
= crypt_activate_by_passphrase(cd
, name
, keyslot
, base64_encoded
, strlen(base64_encoded
), flags
);
1145 log_error_errno(r
, "Failed to activate with TPM2 decrypted key. (Key incorrect?)");
1146 return -EAGAIN
; /* log actual error, but return EAGAIN */
1149 return log_error_errno(r
, "Failed to activate with TPM2 acquired key: %m");
1154 static int attach_luks_or_plain_or_bitlk_by_key_data(
1155 struct crypt_device
*cd
,
1157 const void *key_data
,
1158 size_t key_data_size
,
1160 bool pass_volume_key
) {
1168 if (pass_volume_key
)
1169 r
= crypt_activate_by_volume_key(cd
, name
, key_data
, key_data_size
, flags
);
1171 r
= crypt_activate_by_passphrase(cd
, name
, arg_key_slot
, key_data
, key_data_size
, flags
);
1173 log_error_errno(r
, "Failed to activate. (Key incorrect?)");
1174 return -EAGAIN
; /* Log actual error, but return EAGAIN */
1177 return log_error_errno(r
, "Failed to activate: %m");
1182 static int attach_luks_or_plain_or_bitlk_by_key_file(
1183 struct crypt_device
*cd
,
1185 const char *key_file
,
1187 bool pass_volume_key
) {
1189 _cleanup_(erase_and_freep
) char *kfdata
= NULL
;
1190 _cleanup_free_
char *bindname
= NULL
;
1198 /* If we read the key via AF_UNIX, make this client recognizable */
1199 bindname
= make_bindname(name
);
1203 r
= read_full_file_full(
1205 arg_keyfile_offset
== 0 ? UINT64_MAX
: arg_keyfile_offset
,
1206 arg_keyfile_size
== 0 ? SIZE_MAX
: arg_keyfile_size
,
1207 READ_FULL_FILE_SECURE
|READ_FULL_FILE_WARN_WORLD_READABLE
|READ_FULL_FILE_CONNECT_SOCKET
,
1211 log_error_errno(r
, "Failed to activate, key file '%s' missing.", key_file
);
1212 return -EAGAIN
; /* Log actual error, but return EAGAIN */
1215 if (pass_volume_key
)
1216 r
= crypt_activate_by_volume_key(cd
, name
, kfdata
, kfsize
, flags
);
1218 r
= crypt_activate_by_passphrase(cd
, name
, arg_key_slot
, kfdata
, kfsize
, flags
);
1220 log_error_errno(r
, "Failed to activate with key file '%s'. (Key data incorrect?)", key_file
);
1221 return -EAGAIN
; /* Log actual error, but return EAGAIN */
1224 return log_error_errno(r
, "Failed to activate with key file '%s': %m", key_file
);
1229 static int attach_luks_or_plain_or_bitlk_by_passphrase(
1230 struct crypt_device
*cd
,
1234 bool pass_volume_key
) {
1243 STRV_FOREACH(p
, passwords
) {
1244 if (pass_volume_key
)
1245 r
= crypt_activate_by_volume_key(cd
, name
, *p
, arg_key_size
, flags
);
1247 r
= crypt_activate_by_passphrase(cd
, name
, arg_key_slot
, *p
, strlen(*p
), flags
);
1252 log_error_errno(r
, "Failed to activate with specified passphrase. (Passphrase incorrect?)");
1253 return -EAGAIN
; /* log actual error, but return EAGAIN */
1256 return log_error_errno(r
, "Failed to activate with specified passphrase: %m");
1261 static int attach_luks_or_plain_or_bitlk(
1262 struct crypt_device
*cd
,
1264 const char *key_file
,
1265 const void *key_data
,
1266 size_t key_data_size
,
1271 bool pass_volume_key
= false;
1277 if ((!arg_type
&& !crypt_get_type(cd
)) || streq_ptr(arg_type
, CRYPT_PLAIN
)) {
1278 struct crypt_params_plain params
= {
1279 .offset
= arg_offset
,
1281 .sector_size
= arg_sector_size
,
1283 const char *cipher
, *cipher_mode
;
1284 _cleanup_free_
char *truncated_cipher
= NULL
;
1286 if (streq_ptr(arg_hash
, "plain"))
1287 /* plain isn't a real hash type. it just means "use no hash" */
1290 params
.hash
= arg_hash
;
1292 /* for CRYPT_PLAIN, the behaviour of cryptsetup package is to not hash when a key
1293 * file is provided */
1294 params
.hash
= "ripemd160";
1299 l
= strcspn(arg_cipher
, "-");
1300 truncated_cipher
= strndup(arg_cipher
, l
);
1301 if (!truncated_cipher
)
1304 cipher
= truncated_cipher
;
1305 cipher_mode
= arg_cipher
[l
] ? arg_cipher
+l
+1 : "plain";
1308 cipher_mode
= "cbc-essiv:sha256";
1311 /* for CRYPT_PLAIN limit reads from keyfile to key length, and ignore keyfile-size */
1312 arg_keyfile_size
= arg_key_size
;
1314 /* In contrast to what the name crypt_format() might suggest this doesn't actually format
1315 * anything, it just configures encryption parameters when used for plain mode. */
1316 r
= crypt_format(cd
, CRYPT_PLAIN
, cipher
, cipher_mode
, NULL
, NULL
, arg_keyfile_size
, ¶ms
);
1318 return log_error_errno(r
, "Loading of cryptographic parameters failed: %m");
1320 /* hash == NULL implies the user passed "plain" */
1321 pass_volume_key
= !params
.hash
;
1324 log_info("Set cipher %s, mode %s, key size %i bits for device %s.",
1325 crypt_get_cipher(cd
),
1326 crypt_get_cipher_mode(cd
),
1327 crypt_get_volume_key_size(cd
)*8,
1328 crypt_get_device_name(cd
));
1330 if (arg_tpm2_device
|| arg_tpm2_device_auto
)
1331 return attach_luks_or_plain_or_bitlk_by_tpm2(cd
, name
, key_file
, key_data
, key_data_size
, until
, flags
, pass_volume_key
);
1332 if (arg_fido2_device
|| arg_fido2_device_auto
)
1333 return attach_luks_or_plain_or_bitlk_by_fido2(cd
, name
, key_file
, key_data
, key_data_size
, until
, flags
, pass_volume_key
);
1334 if (arg_pkcs11_uri
|| arg_pkcs11_uri_auto
)
1335 return attach_luks_or_plain_or_bitlk_by_pkcs11(cd
, name
, key_file
, key_data
, key_data_size
, until
, flags
, pass_volume_key
);
1337 return attach_luks_or_plain_or_bitlk_by_key_data(cd
, name
, key_data
, key_data_size
, flags
, pass_volume_key
);
1339 return attach_luks_or_plain_or_bitlk_by_key_file(cd
, name
, key_file
, flags
, pass_volume_key
);
1341 return attach_luks_or_plain_or_bitlk_by_passphrase(cd
, name
, passwords
, flags
, pass_volume_key
);
1344 static int help(void) {
1345 _cleanup_free_
char *link
= NULL
;
1348 r
= terminal_urlify_man("systemd-cryptsetup@.service", "8", &link
);
1352 printf("%s attach VOLUME SOURCEDEVICE [PASSWORD] [OPTIONS]\n"
1353 "%s detach VOLUME\n\n"
1354 "Attaches or detaches an encrypted block device.\n"
1355 "\nSee the %s for details.\n",
1356 program_invocation_short_name
,
1357 program_invocation_short_name
,
1363 static uint32_t determine_flags(void) {
1367 flags
|= CRYPT_ACTIVATE_READONLY
;
1370 flags
|= CRYPT_ACTIVATE_ALLOW_DISCARDS
;
1372 if (arg_same_cpu_crypt
)
1373 flags
|= CRYPT_ACTIVATE_SAME_CPU_CRYPT
;
1375 if (arg_submit_from_crypt_cpus
)
1376 flags
|= CRYPT_ACTIVATE_SUBMIT_FROM_CRYPT_CPUS
;
1378 if (arg_no_read_workqueue
)
1379 flags
|= CRYPT_ACTIVATE_NO_READ_WORKQUEUE
;
1381 if (arg_no_write_workqueue
)
1382 flags
|= CRYPT_ACTIVATE_NO_WRITE_WORKQUEUE
;
1384 #ifdef CRYPT_ACTIVATE_SERIALIZE_MEMORY_HARD_PBKDF
1385 /* Try to decrease the risk of OOM event if memory hard key derivation function is in use */
1386 /* https://gitlab.com/cryptsetup/cryptsetup/issues/446/ */
1387 flags
|= CRYPT_ACTIVATE_SERIALIZE_MEMORY_HARD_PBKDF
;
1393 static void remove_and_erasep(const char **p
) {
1399 r
= unlinkat_deallocate(AT_FDCWD
, *p
, UNLINK_ERASE
);
1400 if (r
< 0 && r
!= -ENOENT
)
1401 log_warning_errno(r
, "Unable to erase key file '%s', ignoring: %m", *p
);
1404 static int run(int argc
, char *argv
[]) {
1405 _cleanup_(crypt_freep
) struct crypt_device
*cd
= NULL
;
1413 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
),
1414 "This program requires at least two arguments.");
1418 cryptsetup_enable_logging(cd
);
1424 if (streq(verb
, "attach")) {
1425 _cleanup_(remove_and_erasep
) const char *destroy_key_file
= NULL
;
1426 _cleanup_(erase_and_freep
) void *key_data
= NULL
;
1427 const char *volume
, *source
, *key_file
, *options
;
1428 crypt_status_info status
;
1429 size_t key_data_size
= 0;
1434 /* Arguments: systemd-cryptsetup attach VOLUME SOURCE-DEVICE [PASSWORD] [OPTIONS] */
1437 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "attach requires at least two arguments.");
1441 key_file
= argc
>= 5 && !STR_IN_SET(argv
[4], "", "-", "none") ? argv
[4] : NULL
;
1442 options
= argc
>= 6 && !STR_IN_SET(argv
[5], "", "-", "none") ? argv
[5] : NULL
;
1444 if (!filename_is_valid(volume
))
1445 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Volume name '%s' is not valid.", volume
);
1447 if (key_file
&& !path_is_absolute(key_file
)) {
1448 log_warning("Password file path '%s' is not absolute. Ignoring.", key_file
);
1453 r
= parse_options(options
);
1458 log_debug("%s %s ← %s type=%s cipher=%s", __func__
,
1459 volume
, source
, strempty(arg_type
), strempty(arg_cipher
));
1461 /* A delicious drop of snake oil */
1462 (void) mlockall(MCL_FUTURE
);
1465 _cleanup_free_
char *bindname
= NULL
;
1468 bindname
= make_bindname(volume
);
1472 /* If a key file is not explicitly specified, search for a key in a well defined
1473 * search path, and load it. */
1475 fn
= strjoina(volume
, ".key");
1478 STRV_MAKE("/etc/cryptsetup-keys.d", "/run/cryptsetup-keys.d"),
1480 &key_data
, &key_data_size
);
1484 log_debug("Automatically discovered key for volume '%s'.", volume
);
1485 } else if (arg_keyfile_erase
)
1486 destroy_key_file
= key_file
; /* let's get this baby erased when we leave */
1489 log_debug("LUKS header: %s", arg_header
);
1490 r
= crypt_init(&cd
, arg_header
);
1492 r
= crypt_init(&cd
, source
);
1494 return log_error_errno(r
, "crypt_init() failed: %m");
1496 cryptsetup_enable_logging(cd
);
1498 status
= crypt_status(cd
, volume
);
1499 if (IN_SET(status
, CRYPT_ACTIVE
, CRYPT_BUSY
)) {
1500 log_info("Volume %s already active.", volume
);
1504 flags
= determine_flags();
1506 until
= usec_add(now(CLOCK_MONOTONIC
), arg_timeout
);
1507 if (until
== USEC_INFINITY
)
1510 arg_key_size
= (arg_key_size
> 0 ? arg_key_size
: (256 / 8));
1515 /* Ideally we'd do this on the open fd, but since this is just a
1516 * warning it's OK to do this in two steps. */
1517 if (stat(key_file
, &st
) >= 0 && S_ISREG(st
.st_mode
) && (st
.st_mode
& 0005))
1518 log_warning("Key file %s is world-readable. This is not a good idea!", key_file
);
1521 if (!arg_type
|| STR_IN_SET(arg_type
, ANY_LUKS
, CRYPT_LUKS1
, CRYPT_LUKS2
)) {
1522 r
= crypt_load(cd
, !arg_type
|| streq(arg_type
, ANY_LUKS
) ? CRYPT_LUKS
: arg_type
, NULL
);
1524 return log_error_errno(r
, "Failed to load LUKS superblock on device %s: %m", crypt_get_device_name(cd
));
1527 r
= crypt_set_data_device(cd
, source
);
1529 return log_error_errno(r
, "Failed to set LUKS data device %s: %m", source
);
1532 /* Tokens are available in LUKS2 only, but it is ok to call (and fail) with LUKS1. */
1533 if (!key_file
&& !key_data
) {
1534 r
= crypt_activate_by_token(cd
, volume
, CRYPT_ANY_TOKEN
, NULL
, flags
);
1536 log_debug("Volume %s activated with LUKS token id %i.", volume
, r
);
1540 log_debug_errno(r
, "Token activation unsuccessful for device %s: %m", crypt_get_device_name(cd
));
1544 /* since cryptsetup 2.3.0 (Feb 2020) */
1546 if (streq_ptr(arg_type
, CRYPT_BITLK
)) {
1547 r
= crypt_load(cd
, CRYPT_BITLK
, NULL
);
1549 return log_error_errno(r
, "Failed to load Bitlocker superblock on device %s: %m", crypt_get_device_name(cd
));
1553 for (tries
= 0; arg_tries
== 0 || tries
< arg_tries
; tries
++) {
1554 _cleanup_strv_free_erase_
char **passwords
= NULL
;
1556 /* When we were able to acquire multiple keys, let's always process them in this order:
1558 * 1. A key acquired via PKCS#11 or FIDO2 token, or TPM2 chip
1559 * 2. The discovered key: i.e. key_data + key_data_size
1560 * 3. The configured key: i.e. key_file + arg_keyfile_offset + arg_keyfile_size
1561 * 4. The empty password, in case arg_try_empty_password is set
1562 * 5. We enquire the user for a password
1565 if (!key_file
&& !key_data
&& !arg_pkcs11_uri
&& !arg_pkcs11_uri_auto
&& !arg_fido2_device
&& !arg_fido2_device_auto
&& !arg_tpm2_device
&& !arg_tpm2_device_auto
) {
1567 if (arg_try_empty_password
) {
1568 /* Hmm, let's try an empty password now, but only once */
1569 arg_try_empty_password
= false;
1571 key_data
= strdup("");
1577 /* Ask the user for a passphrase only as last resort, if we have
1578 * nothing else to check for */
1580 r
= get_password(volume
, source
, until
, tries
== 0 && !arg_verify
, &passwords
);
1588 if (streq_ptr(arg_type
, CRYPT_TCRYPT
))
1589 r
= attach_tcrypt(cd
, volume
, key_file
, key_data
, key_data_size
, passwords
, flags
);
1591 r
= attach_luks_or_plain_or_bitlk(cd
, volume
, key_file
, key_data
, key_data_size
, passwords
, flags
, until
);
1597 /* Key not correct? Let's try again! */
1600 key_data
= erase_and_free(key_data
);
1602 arg_pkcs11_uri
= mfree(arg_pkcs11_uri
);
1603 arg_pkcs11_uri_auto
= false;
1604 arg_fido2_device
= mfree(arg_fido2_device
);
1605 arg_fido2_device_auto
= false;
1606 arg_tpm2_device
= mfree(arg_tpm2_device
);
1607 arg_tpm2_device_auto
= false;
1610 if (arg_tries
!= 0 && tries
>= arg_tries
)
1611 return log_error_errno(SYNTHETIC_ERRNO(EPERM
), "Too many attempts to activate; giving up.");
1613 } else if (streq(verb
, "detach")) {
1618 if (!filename_is_valid(volume
))
1619 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Volume name '%s' is not valid.", volume
);
1621 r
= crypt_init_by_name(&cd
, volume
);
1623 log_info("Volume %s already inactive.", volume
);
1627 return log_error_errno(r
, "crypt_init_by_name() failed: %m");
1629 cryptsetup_enable_logging(cd
);
1631 r
= crypt_deactivate(cd
, volume
);
1633 return log_error_errno(r
, "Failed to deactivate: %m");
1636 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Unknown verb %s.", verb
);
1641 DEFINE_MAIN_FUNCTION(run
);