]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/home/homework-luks.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
alloc-util: add strdupa_safe() + strndupa_safe() and use it everywhere
[thirdparty/systemd.git] / src / home / homework-luks.c
1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3 #include <libfdisk.h>
4 #include <linux/loop.h>
5 #include <poll.h>
6 #include <sys/file.h>
7 #include <sys/ioctl.h>
8 #include <sys/mount.h>
9 #include <sys/xattr.h>
10
11 #include "sd-daemon.h"
12
13 #include "blkid-util.h"
14 #include "blockdev-util.h"
15 #include "btrfs-util.h"
16 #include "chattr-util.h"
17 #include "dm-util.h"
18 #include "env-util.h"
19 #include "errno-util.h"
20 #include "fd-util.h"
21 #include "fileio.h"
22 #include "fs-util.h"
23 #include "fsck-util.h"
24 #include "home-util.h"
25 #include "homework-luks.h"
26 #include "homework-mount.h"
27 #include "id128-util.h"
28 #include "io-util.h"
29 #include "memory-util.h"
30 #include "missing_magic.h"
31 #include "mkdir.h"
32 #include "mkfs-util.h"
33 #include "mount-util.h"
34 #include "openssl-util.h"
35 #include "parse-util.h"
36 #include "path-util.h"
37 #include "process-util.h"
38 #include "random-util.h"
39 #include "resize-fs.h"
40 #include "stat-util.h"
41 #include "strv.h"
42 #include "sync-util.h"
43 #include "tmpfile-util.h"
44
45 /* Round down to the nearest 4K size. Given that newer hardware generally prefers 4K sectors, let's align our
46 * partitions to that too. In the worst case we'll waste 3.5K per partition that way, but I think I can live
47 * with that. */
48 #define DISK_SIZE_ROUND_DOWN(x) ((x) & ~UINT64_C(4095))
49
50 /* Rounds up to the nearest 4K boundary. Returns UINT64_MAX on overflow */
51 #define DISK_SIZE_ROUND_UP(x) \
52 ({ \
53 uint64_t _x = (x); \
54 _x > UINT64_MAX - 4095U ? UINT64_MAX : (_x + 4095U) & ~UINT64_C(4095); \
55 })
56
57
58 int run_mark_dirty(int fd, bool b) {
59 char x = '1';
60 int r, ret;
61
62 /* Sets or removes the 'user.home-dirty' xattr on the specified file. We use this to detect when a
63 * home directory was not properly unmounted. */
64
65 assert(fd >= 0);
66
67 r = fd_verify_regular(fd);
68 if (r < 0)
69 return r;
70
71 if (b) {
72 ret = fsetxattr(fd, "user.home-dirty", &x, 1, XATTR_CREATE);
73 if (ret < 0 && errno != EEXIST)
74 return log_debug_errno(errno, "Could not mark home directory as dirty: %m");
75
76 } else {
77 r = fsync_full(fd);
78 if (r < 0)
79 return log_debug_errno(r, "Failed to synchronize image before marking it clean: %m");
80
81 ret = fremovexattr(fd, "user.home-dirty");
82 if (ret < 0 && errno != ENODATA)
83 return log_debug_errno(errno, "Could not mark home directory as clean: %m");
84 }
85
86 r = fsync_full(fd);
87 if (r < 0)
88 return log_debug_errno(r, "Failed to synchronize dirty flag to disk: %m");
89
90 return ret >= 0;
91 }
92
93 int run_mark_dirty_by_path(const char *path, bool b) {
94 _cleanup_close_ int fd = -1;
95
96 assert(path);
97
98 fd = open(path, O_RDWR|O_CLOEXEC|O_NOCTTY);
99 if (fd < 0)
100 return log_debug_errno(errno, "Failed to open %s to mark dirty or clean: %m", path);
101
102 return run_mark_dirty(fd, b);
103 }
104
105 static int probe_file_system_by_fd(
106 int fd,
107 char **ret_fstype,
108 sd_id128_t *ret_uuid) {
109
110 _cleanup_(blkid_free_probep) blkid_probe b = NULL;
111 _cleanup_free_ char *s = NULL;
112 const char *fstype = NULL, *uuid = NULL;
113 sd_id128_t id;
114 int r;
115
116 assert(fd >= 0);
117 assert(ret_fstype);
118 assert(ret_uuid);
119
120 b = blkid_new_probe();
121 if (!b)
122 return -ENOMEM;
123
124 errno = 0;
125 r = blkid_probe_set_device(b, fd, 0, 0);
126 if (r != 0)
127 return errno > 0 ? -errno : -ENOMEM;
128
129 (void) blkid_probe_enable_superblocks(b, 1);
130 (void) blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE|BLKID_SUBLKS_UUID);
131
132 errno = 0;
133 r = blkid_do_safeprobe(b);
134 if (IN_SET(r, -2, 1)) /* nothing found or ambiguous result */
135 return -ENOPKG;
136 if (r != 0)
137 return errno > 0 ? -errno : -EIO;
138
139 (void) blkid_probe_lookup_value(b, "TYPE", &fstype, NULL);
140 if (!fstype)
141 return -ENOPKG;
142
143 (void) blkid_probe_lookup_value(b, "UUID", &uuid, NULL);
144 if (!uuid)
145 return -ENOPKG;
146
147 r = sd_id128_from_string(uuid, &id);
148 if (r < 0)
149 return r;
150
151 s = strdup(fstype);
152 if (!s)
153 return -ENOMEM;
154
155 *ret_fstype = TAKE_PTR(s);
156 *ret_uuid = id;
157
158 return 0;
159 }
160
161 static int probe_file_system_by_path(const char *path, char **ret_fstype, sd_id128_t *ret_uuid) {
162 _cleanup_close_ int fd = -1;
163
164 fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
165 if (fd < 0)
166 return -errno;
167
168 return probe_file_system_by_fd(fd, ret_fstype, ret_uuid);
169 }
170
171 static int block_get_size_by_fd(int fd, uint64_t *ret) {
172 struct stat st;
173
174 assert(fd >= 0);
175 assert(ret);
176
177 if (fstat(fd, &st) < 0)
178 return -errno;
179
180 if (!S_ISBLK(st.st_mode))
181 return -ENOTBLK;
182
183 if (ioctl(fd, BLKGETSIZE64, ret) < 0)
184 return -errno;
185
186 return 0;
187 }
188
189 static int block_get_size_by_path(const char *path, uint64_t *ret) {
190 _cleanup_close_ int fd = -1;
191
192 fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
193 if (fd < 0)
194 return -errno;
195
196 return block_get_size_by_fd(fd, ret);
197 }
198
199 static int run_fsck(const char *node, const char *fstype) {
200 int r, exit_status;
201 pid_t fsck_pid;
202
203 assert(node);
204 assert(fstype);
205
206 r = fsck_exists(fstype);
207 if (r < 0)
208 return log_error_errno(r, "Failed to check if fsck for file system %s exists: %m", fstype);
209 if (r == 0) {
210 log_warning("No fsck for file system %s installed, ignoring.", fstype);
211 return 0;
212 }
213
214 r = safe_fork("(fsck)",
215 FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_STDOUT_TO_STDERR|FORK_CLOSE_ALL_FDS,
216 &fsck_pid);
217 if (r < 0)
218 return r;
219 if (r == 0) {
220 /* Child */
221 execl("/sbin/fsck", "/sbin/fsck", "-aTl", node, NULL);
222 log_open();
223 log_error_errno(errno, "Failed to execute fsck: %m");
224 _exit(FSCK_OPERATIONAL_ERROR);
225 }
226
227 exit_status = wait_for_terminate_and_check("fsck", fsck_pid, WAIT_LOG_ABNORMAL);
228 if (exit_status < 0)
229 return exit_status;
230 if ((exit_status & ~FSCK_ERROR_CORRECTED) != 0) {
231 log_warning("fsck failed with exit status %i.", exit_status);
232
233 if ((exit_status & (FSCK_SYSTEM_SHOULD_REBOOT|FSCK_ERRORS_LEFT_UNCORRECTED)) != 0)
234 return log_error_errno(SYNTHETIC_ERRNO(EIO), "File system is corrupted, refusing.");
235
236 log_warning("Ignoring fsck error.");
237 }
238
239 log_info("File system check completed.");
240
241 return 1;
242 }
243
244 static int luks_try_passwords(
245 struct crypt_device *cd,
246 char **passwords,
247 void *volume_key,
248 size_t *volume_key_size) {
249
250 char **pp;
251 int r;
252
253 assert(cd);
254
255 STRV_FOREACH(pp, passwords) {
256 size_t vks = *volume_key_size;
257
258 r = sym_crypt_volume_key_get(
259 cd,
260 CRYPT_ANY_SLOT,
261 volume_key,
262 &vks,
263 *pp,
264 strlen(*pp));
265 if (r >= 0) {
266 *volume_key_size = vks;
267 return 0;
268 }
269
270 log_debug_errno(r, "Password %zu didn't work for unlocking LUKS superblock: %m", (size_t) (pp - passwords));
271 }
272
273 return -ENOKEY;
274 }
275
276 static int luks_setup(
277 const char *node,
278 const char *dm_name,
279 sd_id128_t uuid,
280 const char *cipher,
281 const char *cipher_mode,
282 uint64_t volume_key_size,
283 char **passwords,
284 const PasswordCache *cache,
285 bool discard,
286 struct crypt_device **ret,
287 sd_id128_t *ret_found_uuid,
288 void **ret_volume_key,
289 size_t *ret_volume_key_size) {
290
291 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
292 _cleanup_(erase_and_freep) void *vk = NULL;
293 sd_id128_t p;
294 size_t vks;
295 char **list;
296 int r;
297
298 assert(node);
299 assert(dm_name);
300 assert(ret);
301
302 r = sym_crypt_init(&cd, node);
303 if (r < 0)
304 return log_error_errno(r, "Failed to allocate libcryptsetup context: %m");
305
306 cryptsetup_enable_logging(cd);
307
308 r = sym_crypt_load(cd, CRYPT_LUKS2, NULL);
309 if (r < 0)
310 return log_error_errno(r, "Failed to load LUKS superblock: %m");
311
312 r = sym_crypt_get_volume_key_size(cd);
313 if (r <= 0)
314 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine LUKS volume key size");
315 vks = (size_t) r;
316
317 if (!sd_id128_is_null(uuid) || ret_found_uuid) {
318 const char *s;
319
320 s = sym_crypt_get_uuid(cd);
321 if (!s)
322 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has no UUID.");
323
324 r = sd_id128_from_string(s, &p);
325 if (r < 0)
326 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has invalid UUID.");
327
328 /* Check that the UUID matches, if specified */
329 if (!sd_id128_is_null(uuid) &&
330 !sd_id128_equal(uuid, p))
331 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has wrong UUID.");
332 }
333
334 if (cipher && !streq_ptr(cipher, sym_crypt_get_cipher(cd)))
335 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong cipher.");
336
337 if (cipher_mode && !streq_ptr(cipher_mode, sym_crypt_get_cipher_mode(cd)))
338 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong cipher mode.");
339
340 if (volume_key_size != UINT64_MAX && vks != volume_key_size)
341 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong volume key size.");
342
343 vk = malloc(vks);
344 if (!vk)
345 return log_oom();
346
347 r = -ENOKEY;
348 FOREACH_POINTER(list, cache->pkcs11_passwords, cache->fido2_passwords, passwords) {
349 r = luks_try_passwords(cd, list, vk, &vks);
350 if (r != -ENOKEY)
351 break;
352 }
353 if (r == -ENOKEY)
354 return log_error_errno(r, "No valid password for LUKS superblock.");
355 if (r < 0)
356 return log_error_errno(r, "Failed to unlocks LUKS superblock: %m");
357
358 r = sym_crypt_activate_by_volume_key(
359 cd,
360 dm_name,
361 vk, vks,
362 discard ? CRYPT_ACTIVATE_ALLOW_DISCARDS : 0);
363 if (r < 0)
364 return log_error_errno(r, "Failed to unlock LUKS superblock: %m");
365
366 log_info("Setting up LUKS device /dev/mapper/%s completed.", dm_name);
367
368 *ret = TAKE_PTR(cd);
369
370 if (ret_found_uuid) /* Return the UUID actually found if the caller wants to know */
371 *ret_found_uuid = p;
372 if (ret_volume_key)
373 *ret_volume_key = TAKE_PTR(vk);
374 if (ret_volume_key_size)
375 *ret_volume_key_size = vks;
376
377 return 0;
378 }
379
380 static int luks_open(
381 const char *dm_name,
382 char **passwords,
383 PasswordCache *cache,
384 struct crypt_device **ret,
385 sd_id128_t *ret_found_uuid,
386 void **ret_volume_key,
387 size_t *ret_volume_key_size) {
388
389 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
390 _cleanup_(erase_and_freep) void *vk = NULL;
391 sd_id128_t p;
392 char **list;
393 size_t vks;
394 int r;
395
396 assert(dm_name);
397 assert(ret);
398
399 /* Opens a LUKS device that is already set up. Re-validates the password while doing so (which also
400 * provides us with the volume key, which we want). */
401
402 r = sym_crypt_init_by_name(&cd, dm_name);
403 if (r < 0)
404 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
405
406 cryptsetup_enable_logging(cd);
407
408 r = sym_crypt_load(cd, CRYPT_LUKS2, NULL);
409 if (r < 0)
410 return log_error_errno(r, "Failed to load LUKS superblock: %m");
411
412 r = sym_crypt_get_volume_key_size(cd);
413 if (r <= 0)
414 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine LUKS volume key size");
415 vks = (size_t) r;
416
417 if (ret_found_uuid) {
418 const char *s;
419
420 s = sym_crypt_get_uuid(cd);
421 if (!s)
422 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has no UUID.");
423
424 r = sd_id128_from_string(s, &p);
425 if (r < 0)
426 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has invalid UUID.");
427 }
428
429 vk = malloc(vks);
430 if (!vk)
431 return log_oom();
432
433 r = -ENOKEY;
434 FOREACH_POINTER(list, cache->pkcs11_passwords, cache->fido2_passwords, passwords) {
435 r = luks_try_passwords(cd, list, vk, &vks);
436 if (r != -ENOKEY)
437 break;
438 }
439 if (r == -ENOKEY)
440 return log_error_errno(r, "No valid password for LUKS superblock.");
441 if (r < 0)
442 return log_error_errno(r, "Failed to unlocks LUKS superblock: %m");
443
444 log_info("Discovered used LUKS device /dev/mapper/%s, and validated password.", dm_name);
445
446 /* This is needed so that crypt_resize() can operate correctly for pre-existing LUKS devices. We need
447 * to tell libcryptsetup the volume key explicitly, so that it is in the kernel keyring. */
448 r = sym_crypt_activate_by_volume_key(cd, NULL, vk, vks, CRYPT_ACTIVATE_KEYRING_KEY);
449 if (r < 0)
450 return log_error_errno(r, "Failed to upload volume key again: %m");
451
452 log_info("Successfully re-activated LUKS device.");
453
454 *ret = TAKE_PTR(cd);
455
456 if (ret_found_uuid)
457 *ret_found_uuid = p;
458 if (ret_volume_key)
459 *ret_volume_key = TAKE_PTR(vk);
460 if (ret_volume_key_size)
461 *ret_volume_key_size = vks;
462
463 return 0;
464 }
465
466 static int fs_validate(
467 const char *dm_node,
468 sd_id128_t uuid,
469 char **ret_fstype,
470 sd_id128_t *ret_found_uuid) {
471
472 _cleanup_free_ char *fstype = NULL;
473 sd_id128_t u;
474 int r;
475
476 assert(dm_node);
477 assert(ret_fstype);
478
479 r = probe_file_system_by_path(dm_node, &fstype, &u);
480 if (r < 0)
481 return log_error_errno(r, "Failed to probe file system: %m");
482
483 /* Limit the set of supported file systems a bit, as protection against little tested kernel file
484 * systems. Also, we only support the resize ioctls for these file systems. */
485 if (!supported_fstype(fstype))
486 return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "Image contains unsupported file system: %s", strna(fstype));
487
488 if (!sd_id128_is_null(uuid) &&
489 !sd_id128_equal(uuid, u))
490 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "File system has wrong UUID.");
491
492 log_info("Probing file system completed (found %s).", fstype);
493
494 *ret_fstype = TAKE_PTR(fstype);
495
496 if (ret_found_uuid) /* Return the UUID actually found if the caller wants to know */
497 *ret_found_uuid = u;
498
499 return 0;
500 }
501
502 static int make_dm_names(const char *user_name, char **ret_dm_name, char **ret_dm_node) {
503 _cleanup_free_ char *name = NULL, *node = NULL;
504
505 assert(user_name);
506 assert(ret_dm_name);
507 assert(ret_dm_node);
508
509 name = strjoin("home-", user_name);
510 if (!name)
511 return log_oom();
512
513 node = path_join("/dev/mapper/", name);
514 if (!node)
515 return log_oom();
516
517 *ret_dm_name = TAKE_PTR(name);
518 *ret_dm_node = TAKE_PTR(node);
519 return 0;
520 }
521
522 static int luks_validate(
523 int fd,
524 const char *label,
525 sd_id128_t partition_uuid,
526 sd_id128_t *ret_partition_uuid,
527 uint64_t *ret_offset,
528 uint64_t *ret_size) {
529
530 _cleanup_(blkid_free_probep) blkid_probe b = NULL;
531 sd_id128_t found_partition_uuid = SD_ID128_NULL;
532 const char *fstype = NULL, *pttype = NULL;
533 blkid_loff_t offset = 0, size = 0;
534 blkid_partlist pl;
535 bool found = false;
536 int r, n;
537
538 assert(fd >= 0);
539 assert(label);
540 assert(ret_offset);
541 assert(ret_size);
542
543 b = blkid_new_probe();
544 if (!b)
545 return -ENOMEM;
546
547 errno = 0;
548 r = blkid_probe_set_device(b, fd, 0, 0);
549 if (r != 0)
550 return errno > 0 ? -errno : -ENOMEM;
551
552 (void) blkid_probe_enable_superblocks(b, 1);
553 (void) blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE);
554 (void) blkid_probe_enable_partitions(b, 1);
555 (void) blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
556
557 errno = 0;
558 r = blkid_do_safeprobe(b);
559 if (IN_SET(r, -2, 1)) /* nothing found or ambiguous result */
560 return -ENOPKG;
561 if (r != 0)
562 return errno > 0 ? -errno : -EIO;
563
564 (void) blkid_probe_lookup_value(b, "TYPE", &fstype, NULL);
565 if (streq_ptr(fstype, "crypto_LUKS")) {
566 /* Directly a LUKS image */
567 *ret_offset = 0;
568 *ret_size = UINT64_MAX; /* full disk */
569 *ret_partition_uuid = SD_ID128_NULL;
570 return 0;
571 } else if (fstype)
572 return -ENOPKG;
573
574 (void) blkid_probe_lookup_value(b, "PTTYPE", &pttype, NULL);
575 if (!streq_ptr(pttype, "gpt"))
576 return -ENOPKG;
577
578 errno = 0;
579 pl = blkid_probe_get_partitions(b);
580 if (!pl)
581 return errno > 0 ? -errno : -ENOMEM;
582
583 errno = 0;
584 n = blkid_partlist_numof_partitions(pl);
585 if (n < 0)
586 return errno > 0 ? -errno : -EIO;
587
588 for (int i = 0; i < n; i++) {
589 blkid_partition pp;
590 sd_id128_t id = SD_ID128_NULL;
591 const char *sid;
592
593 errno = 0;
594 pp = blkid_partlist_get_partition(pl, i);
595 if (!pp)
596 return errno > 0 ? -errno : -EIO;
597
598 if (!streq_ptr(blkid_partition_get_type_string(pp), "773f91ef-66d4-49b5-bd83-d683bf40ad16"))
599 continue;
600
601 if (!streq_ptr(blkid_partition_get_name(pp), label))
602 continue;
603
604 sid = blkid_partition_get_uuid(pp);
605 if (sid) {
606 r = sd_id128_from_string(sid, &id);
607 if (r < 0)
608 log_debug_errno(r, "Couldn't parse partition UUID %s, weird: %m", sid);
609
610 if (!sd_id128_is_null(partition_uuid) && !sd_id128_equal(id, partition_uuid))
611 continue;
612 }
613
614 if (found)
615 return -ENOPKG;
616
617 offset = blkid_partition_get_start(pp);
618 size = blkid_partition_get_size(pp);
619 found_partition_uuid = id;
620
621 found = true;
622 }
623
624 if (!found)
625 return -ENOPKG;
626
627 if (offset < 0)
628 return -EINVAL;
629 if ((uint64_t) offset > UINT64_MAX / 512U)
630 return -EINVAL;
631 if (size <= 0)
632 return -EINVAL;
633 if ((uint64_t) size > UINT64_MAX / 512U)
634 return -EINVAL;
635
636 *ret_offset = offset * 512U;
637 *ret_size = size * 512U;
638 *ret_partition_uuid = found_partition_uuid;
639
640 return 0;
641 }
642
643 static int crypt_device_to_evp_cipher(struct crypt_device *cd, const EVP_CIPHER **ret) {
644 _cleanup_free_ char *cipher_name = NULL;
645 const char *cipher, *cipher_mode, *e;
646 size_t key_size, key_bits;
647 const EVP_CIPHER *cc;
648 int r;
649
650 assert(cd);
651
652 /* Let's find the right OpenSSL EVP_CIPHER object that matches the encryption settings of the LUKS
653 * device */
654
655 cipher = sym_crypt_get_cipher(cd);
656 if (!cipher)
657 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot get cipher from LUKS device.");
658
659 cipher_mode = sym_crypt_get_cipher_mode(cd);
660 if (!cipher_mode)
661 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot get cipher mode from LUKS device.");
662
663 e = strchr(cipher_mode, '-');
664 if (e)
665 cipher_mode = strndupa_safe(cipher_mode, e - cipher_mode);
666
667 r = sym_crypt_get_volume_key_size(cd);
668 if (r <= 0)
669 return log_error_errno(r < 0 ? r : SYNTHETIC_ERRNO(EINVAL), "Cannot get volume key size from LUKS device.");
670
671 key_size = r;
672 key_bits = key_size * 8;
673 if (streq(cipher_mode, "xts"))
674 key_bits /= 2;
675
676 if (asprintf(&cipher_name, "%s-%zu-%s", cipher, key_bits, cipher_mode) < 0)
677 return log_oom();
678
679 cc = EVP_get_cipherbyname(cipher_name);
680 if (!cc)
681 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Selected cipher mode '%s' not supported, can't encrypt JSON record.", cipher_name);
682
683 /* Verify that our key length calculations match what OpenSSL thinks */
684 r = EVP_CIPHER_key_length(cc);
685 if (r < 0 || (uint64_t) r != key_size)
686 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Key size of selected cipher doesn't meet our expectations.");
687
688 *ret = cc;
689 return 0;
690 }
691
692 static int luks_validate_home_record(
693 struct crypt_device *cd,
694 UserRecord *h,
695 const void *volume_key,
696 PasswordCache *cache,
697 UserRecord **ret_luks_home_record) {
698
699 int r;
700
701 assert(cd);
702 assert(h);
703
704 for (int token = 0; token < sym_crypt_token_max(CRYPT_LUKS2); token++) {
705 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *rr = NULL;
706 _cleanup_(EVP_CIPHER_CTX_freep) EVP_CIPHER_CTX *context = NULL;
707 _cleanup_(user_record_unrefp) UserRecord *lhr = NULL;
708 _cleanup_free_ void *encrypted = NULL, *iv = NULL;
709 size_t decrypted_size, encrypted_size, iv_size;
710 int decrypted_size_out1, decrypted_size_out2;
711 _cleanup_free_ char *decrypted = NULL;
712 const char *text, *type;
713 crypt_token_info state;
714 JsonVariant *jr, *jiv;
715 unsigned line, column;
716 const EVP_CIPHER *cc;
717
718 state = sym_crypt_token_status(cd, token, &type);
719 if (state == CRYPT_TOKEN_INACTIVE) /* First unconfigured token, give up */
720 break;
721 if (IN_SET(state, CRYPT_TOKEN_INTERNAL, CRYPT_TOKEN_INTERNAL_UNKNOWN, CRYPT_TOKEN_EXTERNAL))
722 continue;
723 if (state != CRYPT_TOKEN_EXTERNAL_UNKNOWN)
724 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unexpected token state of token %i: %i", token, (int) state);
725
726 if (!streq(type, "systemd-homed"))
727 continue;
728
729 r = sym_crypt_token_json_get(cd, token, &text);
730 if (r < 0)
731 return log_error_errno(r, "Failed to read LUKS token %i: %m", token);
732
733 r = json_parse(text, JSON_PARSE_SENSITIVE, &v, &line, &column);
734 if (r < 0)
735 return log_error_errno(r, "Failed to parse LUKS token JSON data %u:%u: %m", line, column);
736
737 jr = json_variant_by_key(v, "record");
738 if (!jr)
739 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "LUKS token lacks 'record' field.");
740 jiv = json_variant_by_key(v, "iv");
741 if (!jiv)
742 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "LUKS token lacks 'iv' field.");
743
744 r = json_variant_unbase64(jr, &encrypted, &encrypted_size);
745 if (r < 0)
746 return log_error_errno(r, "Failed to base64 decode record: %m");
747
748 r = json_variant_unbase64(jiv, &iv, &iv_size);
749 if (r < 0)
750 return log_error_errno(r, "Failed to base64 decode IV: %m");
751
752 r = crypt_device_to_evp_cipher(cd, &cc);
753 if (r < 0)
754 return r;
755 if (iv_size > INT_MAX || EVP_CIPHER_iv_length(cc) != (int) iv_size)
756 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "IV size doesn't match.");
757
758 context = EVP_CIPHER_CTX_new();
759 if (!context)
760 return log_oom();
761
762 if (EVP_DecryptInit_ex(context, cc, NULL, volume_key, iv) != 1)
763 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initialize decryption context.");
764
765 decrypted_size = encrypted_size + EVP_CIPHER_key_length(cc) * 2;
766 decrypted = new(char, decrypted_size);
767 if (!decrypted)
768 return log_oom();
769
770 if (EVP_DecryptUpdate(context, (uint8_t*) decrypted, &decrypted_size_out1, encrypted, encrypted_size) != 1)
771 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to decrypt JSON record.");
772
773 assert((size_t) decrypted_size_out1 <= decrypted_size);
774
775 if (EVP_DecryptFinal_ex(context, (uint8_t*) decrypted + decrypted_size_out1, &decrypted_size_out2) != 1)
776 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to finish decryption of JSON record.");
777
778 assert((size_t) decrypted_size_out1 + (size_t) decrypted_size_out2 < decrypted_size);
779 decrypted_size = (size_t) decrypted_size_out1 + (size_t) decrypted_size_out2;
780
781 if (memchr(decrypted, 0, decrypted_size))
782 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Inner NUL byte in JSON record, refusing.");
783
784 decrypted[decrypted_size] = 0;
785
786 r = json_parse(decrypted, JSON_PARSE_SENSITIVE, &rr, NULL, NULL);
787 if (r < 0)
788 return log_error_errno(r, "Failed to parse decrypted JSON record, refusing.");
789
790 lhr = user_record_new();
791 if (!lhr)
792 return log_oom();
793
794 r = user_record_load(lhr, rr, USER_RECORD_LOAD_EMBEDDED|USER_RECORD_PERMISSIVE);
795 if (r < 0)
796 return log_error_errno(r, "Failed to parse user record: %m");
797
798 if (!user_record_compatible(h, lhr))
799 return log_error_errno(SYNTHETIC_ERRNO(EREMCHG), "LUKS home record not compatible with host record, refusing.");
800
801 r = user_record_authenticate(lhr, h, cache, /* strict_verify= */ true);
802 if (r < 0)
803 return r;
804 assert(r > 0); /* Insist that a password was verified */
805
806 *ret_luks_home_record = TAKE_PTR(lhr);
807 return 0;
808 }
809
810 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Couldn't find home record in LUKS2 header, refusing.");
811 }
812
813 static int format_luks_token_text(
814 struct crypt_device *cd,
815 UserRecord *hr,
816 const void *volume_key,
817 char **ret) {
818
819 int r, encrypted_size_out1 = 0, encrypted_size_out2 = 0, iv_size, key_size;
820 _cleanup_(EVP_CIPHER_CTX_freep) EVP_CIPHER_CTX *context = NULL;
821 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
822 _cleanup_free_ void *iv = NULL, *encrypted = NULL;
823 size_t text_length, encrypted_size;
824 _cleanup_free_ char *text = NULL;
825 const EVP_CIPHER *cc;
826
827 assert(cd);
828 assert(hr);
829 assert(volume_key);
830 assert(ret);
831
832 r = crypt_device_to_evp_cipher(cd, &cc);
833 if (r < 0)
834 return r;
835
836 key_size = EVP_CIPHER_key_length(cc);
837 iv_size = EVP_CIPHER_iv_length(cc);
838
839 if (iv_size > 0) {
840 iv = malloc(iv_size);
841 if (!iv)
842 return log_oom();
843
844 r = genuine_random_bytes(iv, iv_size, RANDOM_BLOCK);
845 if (r < 0)
846 return log_error_errno(r, "Failed to generate IV: %m");
847 }
848
849 context = EVP_CIPHER_CTX_new();
850 if (!context)
851 return log_oom();
852
853 if (EVP_EncryptInit_ex(context, cc, NULL, volume_key, iv) != 1)
854 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initialize encryption context.");
855
856 r = json_variant_format(hr->json, 0, &text);
857 if (r < 0)
858 return log_error_errno(r, "Failed to format user record for LUKS: %m");
859
860 text_length = strlen(text);
861 encrypted_size = text_length + 2*key_size - 1;
862
863 encrypted = malloc(encrypted_size);
864 if (!encrypted)
865 return log_oom();
866
867 if (EVP_EncryptUpdate(context, encrypted, &encrypted_size_out1, (uint8_t*) text, text_length) != 1)
868 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to encrypt JSON record.");
869
870 assert((size_t) encrypted_size_out1 <= encrypted_size);
871
872 if (EVP_EncryptFinal_ex(context, (uint8_t*) encrypted + encrypted_size_out1, &encrypted_size_out2) != 1)
873 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to finish encryption of JSON record. ");
874
875 assert((size_t) encrypted_size_out1 + (size_t) encrypted_size_out2 <= encrypted_size);
876
877 r = json_build(&v,
878 JSON_BUILD_OBJECT(
879 JSON_BUILD_PAIR("type", JSON_BUILD_STRING("systemd-homed")),
880 JSON_BUILD_PAIR("keyslots", JSON_BUILD_EMPTY_ARRAY),
881 JSON_BUILD_PAIR("record", JSON_BUILD_BASE64(encrypted, encrypted_size_out1 + encrypted_size_out2)),
882 JSON_BUILD_PAIR("iv", JSON_BUILD_BASE64(iv, iv_size))));
883 if (r < 0)
884 return log_error_errno(r, "Failed to prepare LUKS JSON token object: %m");
885
886 r = json_variant_format(v, 0, ret);
887 if (r < 0)
888 return log_error_errno(r, "Failed to format encrypted user record for LUKS: %m");
889
890 return 0;
891 }
892
893 int home_store_header_identity_luks(
894 UserRecord *h,
895 HomeSetup *setup,
896 UserRecord *old_home) {
897
898 _cleanup_(user_record_unrefp) UserRecord *header_home = NULL;
899 _cleanup_free_ char *text = NULL;
900 int r;
901
902 assert(h);
903
904 if (!setup->crypt_device)
905 return 0;
906
907 assert(setup->volume_key);
908
909 /* Let's store the user's identity record in the LUKS2 "token" header data fields, in an encrypted
910 * fashion. Why that? If we'd rely on the record being embedded in the payload file system itself we
911 * would have to mount the file system before we can validate the JSON record, its signatures and
912 * whether it matches what we are looking for. However, kernel file system implementations are
913 * generally not ready to be used on untrusted media. Hence let's store the record independently of
914 * the file system, so that we can validate it first, and only then mount the file system. To keep
915 * things simple we use the same encryption settings for this record as for the file system itself. */
916
917 r = user_record_clone(h, USER_RECORD_EXTRACT_EMBEDDED|USER_RECORD_PERMISSIVE, &header_home);
918 if (r < 0)
919 return log_error_errno(r, "Failed to determine new header record: %m");
920
921 if (old_home && user_record_equal(old_home, header_home)) {
922 log_debug("Not updating header home record.");
923 return 0;
924 }
925
926 r = format_luks_token_text(setup->crypt_device, header_home, setup->volume_key, &text);
927 if (r < 0)
928 return r;
929
930 for (int token = 0; token < sym_crypt_token_max(CRYPT_LUKS2); token++) {
931 crypt_token_info state;
932 const char *type;
933
934 state = sym_crypt_token_status(setup->crypt_device, token, &type);
935 if (state == CRYPT_TOKEN_INACTIVE) /* First unconfigured token, we are done */
936 break;
937 if (IN_SET(state, CRYPT_TOKEN_INTERNAL, CRYPT_TOKEN_INTERNAL_UNKNOWN, CRYPT_TOKEN_EXTERNAL))
938 continue; /* Not ours */
939 if (state != CRYPT_TOKEN_EXTERNAL_UNKNOWN)
940 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unexpected token state of token %i: %i", token, (int) state);
941
942 if (!streq(type, "systemd-homed"))
943 continue;
944
945 r = sym_crypt_token_json_set(setup->crypt_device, token, text);
946 if (r < 0)
947 return log_error_errno(r, "Failed to set JSON token for slot %i: %m", token);
948
949 /* Now, let's free the text so that for all further matching tokens we all crypt_json_token_set()
950 * with a NULL text in order to invalidate the tokens. */
951 text = mfree(text);
952 }
953
954 if (text)
955 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Didn't find any record token to update.");
956
957 log_info("Wrote LUKS header user record.");
958
959 return 1;
960 }
961
962 int run_fitrim(int root_fd) {
963 struct fstrim_range range = {
964 .len = UINT64_MAX,
965 };
966
967 /* If discarding is on, discard everything right after mounting, so that the discard setting takes
968 * effect on activation. (Also, optionally, trim on logout) */
969
970 assert(root_fd >= 0);
971
972 if (ioctl(root_fd, FITRIM, &range) < 0) {
973 if (ERRNO_IS_NOT_SUPPORTED(errno) || errno == EBADF) {
974 log_debug_errno(errno, "File system does not support FITRIM, not trimming.");
975 return 0;
976 }
977
978 return log_warning_errno(errno, "Failed to invoke FITRIM, ignoring: %m");
979 }
980
981 log_info("Discarded unused %s.", FORMAT_BYTES(range.len));
982 return 1;
983 }
984
985 int run_fitrim_by_path(const char *root_path) {
986 _cleanup_close_ int root_fd = -1;
987
988 root_fd = open(root_path, O_RDONLY|O_DIRECTORY|O_CLOEXEC);
989 if (root_fd < 0)
990 return log_error_errno(errno, "Failed to open file system '%s' for trimming: %m", root_path);
991
992 return run_fitrim(root_fd);
993 }
994
995 int run_fallocate(int backing_fd, const struct stat *st) {
996 struct stat stbuf;
997
998 assert(backing_fd >= 0);
999
1000 /* If discarding is off, let's allocate the whole image before mounting, so that the setting takes
1001 * effect on activation */
1002
1003 if (!st) {
1004 if (fstat(backing_fd, &stbuf) < 0)
1005 return log_error_errno(errno, "Failed to fstat(): %m");
1006
1007 st = &stbuf;
1008 }
1009
1010 if (!S_ISREG(st->st_mode))
1011 return 0;
1012
1013 if (st->st_blocks >= DIV_ROUND_UP(st->st_size, 512)) {
1014 log_info("Backing file is fully allocated already.");
1015 return 0;
1016 }
1017
1018 if (fallocate(backing_fd, FALLOC_FL_KEEP_SIZE, 0, st->st_size) < 0) {
1019
1020 if (ERRNO_IS_NOT_SUPPORTED(errno)) {
1021 log_debug_errno(errno, "fallocate() not supported on file system, ignoring.");
1022 return 0;
1023 }
1024
1025 if (ERRNO_IS_DISK_SPACE(errno)) {
1026 log_debug_errno(errno, "Not enough disk space to fully allocate home.");
1027 return -ENOSPC; /* make recognizable */
1028 }
1029
1030 return log_error_errno(errno, "Failed to allocate backing file blocks: %m");
1031 }
1032
1033 log_info("Allocated additional %s.",
1034 FORMAT_BYTES((DIV_ROUND_UP(st->st_size, 512) - st->st_blocks) * 512));
1035 return 1;
1036 }
1037
1038 int run_fallocate_by_path(const char *backing_path) {
1039 _cleanup_close_ int backing_fd = -1;
1040
1041 backing_fd = open(backing_path, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
1042 if (backing_fd < 0)
1043 return log_error_errno(errno, "Failed to open '%s' for fallocate(): %m", backing_path);
1044
1045 return run_fallocate(backing_fd, NULL);
1046 }
1047
1048 static int lock_image_fd(int image_fd, const char *ip) {
1049 int r;
1050
1051 /* If the $SYSTEMD_LUKS_LOCK environment variable is set we'll take an exclusive BSD lock on the
1052 * image file, and send it to our parent. homed will keep it open to ensure no other instance of
1053 * homed (across the network or such) will also mount the file. */
1054
1055 r = getenv_bool("SYSTEMD_LUKS_LOCK");
1056 if (r == -ENXIO)
1057 return 0;
1058 if (r < 0)
1059 return log_error_errno(r, "Failed to parse $SYSTEMD_LUKS_LOCK environment variable: %m");
1060 if (r > 0) {
1061 if (flock(image_fd, LOCK_EX|LOCK_NB) < 0) {
1062
1063 if (errno == EWOULDBLOCK)
1064 log_error_errno(errno, "Image file '%s' already locked, can't use.", ip);
1065 else
1066 log_error_errno(errno, "Failed to lock image file '%s': %m", ip);
1067
1068 return errno != EWOULDBLOCK ? -errno : -EADDRINUSE; /* Make error recognizable */
1069 }
1070
1071 log_info("Successfully locked image file '%s'.", ip);
1072
1073 /* Now send it to our parent to keep safe while the home dir is active */
1074 r = sd_pid_notify_with_fds(0, false, "SYSTEMD_LUKS_LOCK_FD=1", &image_fd, 1);
1075 if (r < 0)
1076 log_warning_errno(r, "Failed to send LUKS lock fd to parent, ignoring: %m");
1077 }
1078
1079 return 0;
1080 }
1081
1082 int home_prepare_luks(
1083 UserRecord *h,
1084 bool already_activated,
1085 const char *force_image_path,
1086 PasswordCache *cache,
1087 HomeSetup *setup,
1088 UserRecord **ret_luks_home) {
1089
1090 sd_id128_t found_partition_uuid, found_luks_uuid, found_fs_uuid;
1091 _cleanup_(user_record_unrefp) UserRecord *luks_home = NULL;
1092 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
1093 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
1094 _cleanup_(erase_and_freep) void *volume_key = NULL;
1095 _cleanup_close_ int root_fd = -1, image_fd = -1;
1096 bool dm_activated = false, mounted = false;
1097 size_t volume_key_size = 0;
1098 bool marked_dirty = false;
1099 uint64_t offset, size;
1100 int r;
1101
1102 assert(h);
1103 assert(setup);
1104 assert(setup->dm_name);
1105 assert(setup->dm_node);
1106
1107 assert(user_record_storage(h) == USER_LUKS);
1108
1109 r = dlopen_cryptsetup();
1110 if (r < 0)
1111 return r;
1112
1113 if (already_activated) {
1114 struct loop_info64 info;
1115 const char *n;
1116
1117 r = luks_open(setup->dm_name,
1118 h->password,
1119 cache,
1120 &cd,
1121 &found_luks_uuid,
1122 &volume_key,
1123 &volume_key_size);
1124 if (r < 0)
1125 return r;
1126
1127 r = luks_validate_home_record(cd, h, volume_key, cache, &luks_home);
1128 if (r < 0)
1129 return r;
1130
1131 n = sym_crypt_get_device_name(cd);
1132 if (!n)
1133 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine backing device for DM %s.", setup->dm_name);
1134
1135 r = loop_device_open(n, O_RDWR, &loop);
1136 if (r < 0)
1137 return log_error_errno(r, "Failed to open loopback device %s: %m", n);
1138
1139 if (ioctl(loop->fd, LOOP_GET_STATUS64, &info) < 0) {
1140 _cleanup_free_ char *sysfs = NULL;
1141 struct stat st;
1142
1143 if (!IN_SET(errno, ENOTTY, EINVAL))
1144 return log_error_errno(errno, "Failed to get block device metrics of %s: %m", n);
1145
1146 if (ioctl(loop->fd, BLKGETSIZE64, &size) < 0)
1147 return log_error_errno(r, "Failed to read block device size of %s: %m", n);
1148
1149 if (fstat(loop->fd, &st) < 0)
1150 return log_error_errno(r, "Failed to stat block device %s: %m", n);
1151 assert(S_ISBLK(st.st_mode));
1152
1153 if (asprintf(&sysfs, "/sys/dev/block/%u:%u/partition", major(st.st_rdev), minor(st.st_rdev)) < 0)
1154 return log_oom();
1155
1156 if (access(sysfs, F_OK) < 0) {
1157 if (errno != ENOENT)
1158 return log_error_errno(errno, "Failed to determine whether %s exists: %m", sysfs);
1159
1160 offset = 0;
1161 } else {
1162 _cleanup_free_ char *buffer = NULL;
1163
1164 if (asprintf(&sysfs, "/sys/dev/block/%u:%u/start", major(st.st_rdev), minor(st.st_rdev)) < 0)
1165 return log_oom();
1166
1167 r = read_one_line_file(sysfs, &buffer);
1168 if (r < 0)
1169 return log_error_errno(r, "Failed to read partition start offset: %m");
1170
1171 r = safe_atou64(buffer, &offset);
1172 if (r < 0)
1173 return log_error_errno(r, "Failed to parse partition start offset: %m");
1174
1175 if (offset > UINT64_MAX / 512U)
1176 return log_error_errno(SYNTHETIC_ERRNO(E2BIG), "Offset too large for 64 byte range, refusing.");
1177
1178 offset *= 512U;
1179 }
1180 } else {
1181 offset = info.lo_offset;
1182 size = info.lo_sizelimit;
1183 }
1184
1185 found_partition_uuid = found_fs_uuid = SD_ID128_NULL;
1186
1187 log_info("Discovered used loopback device %s.", loop->node);
1188
1189 root_fd = open(user_record_home_directory(h), O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
1190 if (root_fd < 0) {
1191 r = log_error_errno(r, "Failed to open home directory: %m");
1192 goto fail;
1193 }
1194 } else {
1195 _cleanup_free_ char *fstype = NULL, *subdir = NULL;
1196 const char *ip;
1197 struct stat st;
1198
1199 ip = force_image_path ?: user_record_image_path(h);
1200
1201 subdir = path_join("/run/systemd/user-home-mount/", user_record_user_name_and_realm(h));
1202 if (!subdir)
1203 return log_oom();
1204
1205 image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
1206 if (image_fd < 0)
1207 return log_error_errno(errno, "Failed to open image file %s: %m", ip);
1208
1209 if (fstat(image_fd, &st) < 0)
1210 return log_error_errno(errno, "Failed to fstat() image file: %m");
1211 if (!S_ISREG(st.st_mode) && !S_ISBLK(st.st_mode))
1212 return log_error_errno(
1213 S_ISDIR(st.st_mode) ? SYNTHETIC_ERRNO(EISDIR) : SYNTHETIC_ERRNO(EBADFD),
1214 "Image file %s is not a regular file or block device: %m", ip);
1215
1216 r = lock_image_fd(image_fd, ip);
1217 if (r < 0)
1218 return r;
1219
1220 r = luks_validate(image_fd, user_record_user_name_and_realm(h), h->partition_uuid, &found_partition_uuid, &offset, &size);
1221 if (r < 0)
1222 return log_error_errno(r, "Failed to validate disk label: %m");
1223
1224 /* Everything before this point left the image untouched. We are now starting to make
1225 * changes, hence mark the image dirty */
1226 marked_dirty = run_mark_dirty(image_fd, true) > 0;
1227
1228 if (!user_record_luks_discard(h)) {
1229 r = run_fallocate(image_fd, &st);
1230 if (r < 0)
1231 return r;
1232 }
1233
1234 r = loop_device_make(image_fd, O_RDWR, offset, size, 0, &loop);
1235 if (r == -ENOENT) {
1236 log_error_errno(r, "Loopback block device support is not available on this system.");
1237 return -ENOLINK; /* make recognizable */
1238 }
1239 if (r < 0)
1240 return log_error_errno(r, "Failed to allocate loopback context: %m");
1241
1242 log_info("Setting up loopback device %s completed.", loop->node ?: ip);
1243
1244 r = luks_setup(loop->node ?: ip,
1245 setup->dm_name,
1246 h->luks_uuid,
1247 h->luks_cipher,
1248 h->luks_cipher_mode,
1249 h->luks_volume_key_size,
1250 h->password,
1251 cache,
1252 user_record_luks_discard(h) || user_record_luks_offline_discard(h),
1253 &cd,
1254 &found_luks_uuid,
1255 &volume_key,
1256 &volume_key_size);
1257 if (r < 0)
1258 return r;
1259
1260 dm_activated = true;
1261
1262 r = luks_validate_home_record(cd, h, volume_key, cache, &luks_home);
1263 if (r < 0)
1264 goto fail;
1265
1266 r = fs_validate(setup->dm_node, h->file_system_uuid, &fstype, &found_fs_uuid);
1267 if (r < 0)
1268 goto fail;
1269
1270 r = run_fsck(setup->dm_node, fstype);
1271 if (r < 0)
1272 goto fail;
1273
1274 r = home_unshare_and_mount(setup->dm_node, fstype, user_record_luks_discard(h), user_record_mount_flags(h));
1275 if (r < 0)
1276 goto fail;
1277
1278 mounted = true;
1279
1280 root_fd = open(subdir, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
1281 if (root_fd < 0) {
1282 r = log_error_errno(r, "Failed to open home directory: %m");
1283 goto fail;
1284 }
1285
1286 if (user_record_luks_discard(h))
1287 (void) run_fitrim(root_fd);
1288
1289 setup->image_fd = TAKE_FD(image_fd);
1290 setup->do_offline_fallocate = !(setup->do_offline_fitrim = user_record_luks_offline_discard(h));
1291 setup->do_mark_clean = marked_dirty;
1292 }
1293
1294 setup->loop = TAKE_PTR(loop);
1295 setup->crypt_device = TAKE_PTR(cd);
1296 setup->root_fd = TAKE_FD(root_fd);
1297 setup->found_partition_uuid = found_partition_uuid;
1298 setup->found_luks_uuid = found_luks_uuid;
1299 setup->found_fs_uuid = found_fs_uuid;
1300 setup->partition_offset = offset;
1301 setup->partition_size = size;
1302 setup->volume_key = TAKE_PTR(volume_key);
1303 setup->volume_key_size = volume_key_size;
1304
1305 setup->undo_mount = mounted;
1306 setup->undo_dm = dm_activated;
1307
1308 if (ret_luks_home)
1309 *ret_luks_home = TAKE_PTR(luks_home);
1310
1311 return 0;
1312
1313 fail:
1314 if (mounted)
1315 (void) umount_verbose(LOG_ERR, "/run/systemd/user-home-mount", UMOUNT_NOFOLLOW);
1316
1317 if (dm_activated)
1318 (void) sym_crypt_deactivate_by_name(cd, setup->dm_name, 0);
1319
1320 if (image_fd >= 0 && marked_dirty)
1321 (void) run_mark_dirty(image_fd, false);
1322
1323 return r;
1324 }
1325
1326 static void print_size_summary(uint64_t host_size, uint64_t encrypted_size, struct statfs *sfs) {
1327 assert(sfs);
1328
1329 log_info("Image size is %s, file system size is %s, file system payload size is %s, file system free is %s.",
1330 FORMAT_BYTES(host_size),
1331 FORMAT_BYTES(encrypted_size),
1332 FORMAT_BYTES((uint64_t) sfs->f_blocks * (uint64_t) sfs->f_frsize),
1333 FORMAT_BYTES((uint64_t) sfs->f_bfree * (uint64_t) sfs->f_frsize));
1334 }
1335
1336 int home_activate_luks(
1337 UserRecord *h,
1338 PasswordCache *cache,
1339 UserRecord **ret_home) {
1340
1341 _cleanup_(user_record_unrefp) UserRecord *new_home = NULL, *luks_home_record = NULL;
1342 _cleanup_(home_setup_undo) HomeSetup setup = HOME_SETUP_INIT;
1343 uint64_t host_size, encrypted_size;
1344 const char *hdo, *hd;
1345 struct statfs sfs;
1346 int r;
1347
1348 assert(h);
1349 assert(user_record_storage(h) == USER_LUKS);
1350 assert(ret_home);
1351
1352 r = dlopen_cryptsetup();
1353 if (r < 0)
1354 return r;
1355
1356 assert_se(hdo = user_record_home_directory(h));
1357 hd = strdupa_safe(hdo); /* copy the string out, since it might change later in the home record object */
1358
1359 r = make_dm_names(h->user_name, &setup.dm_name, &setup.dm_node);
1360 if (r < 0)
1361 return r;
1362
1363 r = access(setup.dm_node, F_OK);
1364 if (r < 0) {
1365 if (errno != ENOENT)
1366 return log_error_errno(errno, "Failed to determine whether %s exists: %m", setup.dm_node);
1367 } else
1368 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Device mapper device %s already exists, refusing.", setup.dm_node);
1369
1370 r = home_prepare_luks(
1371 h,
1372 false,
1373 NULL,
1374 cache,
1375 &setup,
1376 &luks_home_record);
1377 if (r < 0)
1378 return r;
1379
1380 r = block_get_size_by_fd(setup.loop->fd, &host_size);
1381 if (r < 0)
1382 return log_error_errno(r, "Failed to get loopback block device size: %m");
1383
1384 r = block_get_size_by_path(setup.dm_node, &encrypted_size);
1385 if (r < 0)
1386 return log_error_errno(r, "Failed to get LUKS block device size: %m");
1387
1388 r = home_refresh(
1389 h,
1390 &setup,
1391 luks_home_record,
1392 cache,
1393 &sfs,
1394 &new_home);
1395 if (r < 0)
1396 return r;
1397
1398 r = home_extend_embedded_identity(new_home, h, &setup);
1399 if (r < 0)
1400 return r;
1401
1402 setup.root_fd = safe_close(setup.root_fd);
1403
1404 r = home_move_mount(user_record_user_name_and_realm(h), hd);
1405 if (r < 0)
1406 return r;
1407
1408 setup.undo_mount = false;
1409 setup.do_offline_fitrim = false;
1410
1411 loop_device_relinquish(setup.loop);
1412
1413 r = sym_crypt_deactivate_by_name(NULL, setup.dm_name, CRYPT_DEACTIVATE_DEFERRED);
1414 if (r < 0)
1415 log_warning_errno(r, "Failed to relinquish DM device, ignoring: %m");
1416
1417 setup.undo_dm = false;
1418 setup.do_offline_fallocate = false;
1419 setup.do_mark_clean = false;
1420
1421 log_info("Everything completed.");
1422
1423 print_size_summary(host_size, encrypted_size, &sfs);
1424
1425 *ret_home = TAKE_PTR(new_home);
1426 return 1;
1427 }
1428
1429 int home_deactivate_luks(UserRecord *h) {
1430 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
1431 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
1432 bool we_detached;
1433 int r;
1434
1435 /* Note that the DM device and loopback device are set to auto-detach, hence strictly speaking we
1436 * don't have to explicitly have to detach them. However, we do that nonetheless (in case of the DM
1437 * device), to avoid races: by explicitly detaching them we know when the detaching is complete. We
1438 * don't bother about the loopback device because unlike the DM device it doesn't have a fixed
1439 * name. */
1440
1441 r = dlopen_cryptsetup();
1442 if (r < 0)
1443 return r;
1444
1445 r = make_dm_names(h->user_name, &dm_name, &dm_node);
1446 if (r < 0)
1447 return r;
1448
1449 r = sym_crypt_init_by_name(&cd, dm_name);
1450 if (IN_SET(r, -ENODEV, -EINVAL, -ENOENT)) {
1451 log_debug_errno(r, "LUKS device %s has already been detached.", dm_name);
1452 we_detached = false;
1453 } else if (r < 0)
1454 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
1455 else {
1456 log_info("Discovered used LUKS device %s.", dm_node);
1457
1458 cryptsetup_enable_logging(cd);
1459
1460 r = sym_crypt_deactivate_by_name(cd, dm_name, 0);
1461 if (IN_SET(r, -ENODEV, -EINVAL, -ENOENT)) {
1462 log_debug_errno(r, "LUKS device %s is already detached.", dm_node);
1463 we_detached = false;
1464 } else if (r < 0)
1465 return log_info_errno(r, "LUKS device %s couldn't be deactivated: %m", dm_node);
1466 else {
1467 log_info("LUKS device detaching completed.");
1468 we_detached = true;
1469 }
1470 }
1471
1472 if (user_record_luks_offline_discard(h))
1473 log_debug("Not allocating on logout.");
1474 else
1475 (void) run_fallocate_by_path(user_record_image_path(h));
1476
1477 run_mark_dirty_by_path(user_record_image_path(h), false);
1478 return we_detached;
1479 }
1480
1481 int home_trim_luks(UserRecord *h) {
1482 assert(h);
1483
1484 if (!user_record_luks_offline_discard(h)) {
1485 log_debug("Not trimming on logout.");
1486 return 0;
1487 }
1488
1489 (void) run_fitrim_by_path(user_record_home_directory(h));
1490 return 0;
1491 }
1492
1493 static struct crypt_pbkdf_type* build_good_pbkdf(struct crypt_pbkdf_type *buffer, UserRecord *hr) {
1494 assert(buffer);
1495 assert(hr);
1496
1497 *buffer = (struct crypt_pbkdf_type) {
1498 .hash = user_record_luks_pbkdf_hash_algorithm(hr),
1499 .type = user_record_luks_pbkdf_type(hr),
1500 .time_ms = user_record_luks_pbkdf_time_cost_usec(hr) / USEC_PER_MSEC,
1501 .max_memory_kb = user_record_luks_pbkdf_memory_cost(hr) / 1024,
1502 .parallel_threads = user_record_luks_pbkdf_parallel_threads(hr),
1503 };
1504
1505 return buffer;
1506 }
1507
1508 static struct crypt_pbkdf_type* build_minimal_pbkdf(struct crypt_pbkdf_type *buffer, UserRecord *hr) {
1509 assert(buffer);
1510 assert(hr);
1511
1512 /* For PKCS#11 derived keys (which are generated randomly and are of high quality already) we use a
1513 * minimal PBKDF */
1514 *buffer = (struct crypt_pbkdf_type) {
1515 .hash = user_record_luks_pbkdf_hash_algorithm(hr),
1516 .type = CRYPT_KDF_PBKDF2,
1517 .iterations = 1,
1518 .time_ms = 1,
1519 };
1520
1521 return buffer;
1522 }
1523
1524 static int luks_format(
1525 const char *node,
1526 const char *dm_name,
1527 sd_id128_t uuid,
1528 const char *label,
1529 const PasswordCache *cache,
1530 char **effective_passwords,
1531 bool discard,
1532 UserRecord *hr,
1533 struct crypt_device **ret) {
1534
1535 _cleanup_(user_record_unrefp) UserRecord *reduced = NULL;
1536 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
1537 _cleanup_(erase_and_freep) void *volume_key = NULL;
1538 struct crypt_pbkdf_type good_pbkdf, minimal_pbkdf;
1539 _cleanup_free_ char *text = NULL;
1540 size_t volume_key_size;
1541 int slot = 0, r;
1542 char **pp;
1543
1544 assert(node);
1545 assert(dm_name);
1546 assert(hr);
1547 assert(ret);
1548
1549 r = sym_crypt_init(&cd, node);
1550 if (r < 0)
1551 return log_error_errno(r, "Failed to allocate libcryptsetup context: %m");
1552
1553 cryptsetup_enable_logging(cd);
1554
1555 /* Normally we'd, just leave volume key generation to libcryptsetup. However, we can't, since we
1556 * can't extract the volume key from the library again, but we need it in order to encrypt the JSON
1557 * record. Hence, let's generate it on our own, so that we can keep track of it. */
1558
1559 volume_key_size = user_record_luks_volume_key_size(hr);
1560 volume_key = malloc(volume_key_size);
1561 if (!volume_key)
1562 return log_oom();
1563
1564 r = genuine_random_bytes(volume_key, volume_key_size, RANDOM_BLOCK);
1565 if (r < 0)
1566 return log_error_errno(r, "Failed to generate volume key: %m");
1567
1568 #if HAVE_CRYPT_SET_METADATA_SIZE
1569 /* Increase the metadata space to 4M, the largest LUKS2 supports */
1570 r = sym_crypt_set_metadata_size(cd, 4096U*1024U, 0);
1571 if (r < 0)
1572 return log_error_errno(r, "Failed to change LUKS2 metadata size: %m");
1573 #endif
1574
1575 build_good_pbkdf(&good_pbkdf, hr);
1576 build_minimal_pbkdf(&minimal_pbkdf, hr);
1577
1578 r = sym_crypt_format(
1579 cd,
1580 CRYPT_LUKS2,
1581 user_record_luks_cipher(hr),
1582 user_record_luks_cipher_mode(hr),
1583 ID128_TO_UUID_STRING(uuid),
1584 volume_key,
1585 volume_key_size,
1586 &(struct crypt_params_luks2) {
1587 .label = label,
1588 .subsystem = "systemd-home",
1589 .sector_size = 512U,
1590 .pbkdf = &good_pbkdf,
1591 });
1592 if (r < 0)
1593 return log_error_errno(r, "Failed to format LUKS image: %m");
1594
1595 log_info("LUKS formatting completed.");
1596
1597 STRV_FOREACH(pp, effective_passwords) {
1598
1599 if (strv_contains(cache->pkcs11_passwords, *pp) ||
1600 strv_contains(cache->fido2_passwords, *pp)) {
1601 log_debug("Using minimal PBKDF for slot %i", slot);
1602 r = sym_crypt_set_pbkdf_type(cd, &minimal_pbkdf);
1603 } else {
1604 log_debug("Using good PBKDF for slot %i", slot);
1605 r = sym_crypt_set_pbkdf_type(cd, &good_pbkdf);
1606 }
1607 if (r < 0)
1608 return log_error_errno(r, "Failed to tweak PBKDF for slot %i: %m", slot);
1609
1610 r = sym_crypt_keyslot_add_by_volume_key(
1611 cd,
1612 slot,
1613 volume_key,
1614 volume_key_size,
1615 *pp,
1616 strlen(*pp));
1617 if (r < 0)
1618 return log_error_errno(r, "Failed to set up LUKS password for slot %i: %m", slot);
1619
1620 log_info("Writing password to LUKS keyslot %i completed.", slot);
1621 slot++;
1622 }
1623
1624 r = sym_crypt_activate_by_volume_key(
1625 cd,
1626 dm_name,
1627 volume_key,
1628 volume_key_size,
1629 discard ? CRYPT_ACTIVATE_ALLOW_DISCARDS : 0);
1630 if (r < 0)
1631 return log_error_errno(r, "Failed to activate LUKS superblock: %m");
1632
1633 log_info("LUKS activation by volume key succeeded.");
1634
1635 r = user_record_clone(hr, USER_RECORD_EXTRACT_EMBEDDED|USER_RECORD_PERMISSIVE, &reduced);
1636 if (r < 0)
1637 return log_error_errno(r, "Failed to prepare home record for LUKS: %m");
1638
1639 r = format_luks_token_text(cd, reduced, volume_key, &text);
1640 if (r < 0)
1641 return r;
1642
1643 r = sym_crypt_token_json_set(cd, CRYPT_ANY_TOKEN, text);
1644 if (r < 0)
1645 return log_error_errno(r, "Failed to set LUKS JSON token: %m");
1646
1647 log_info("Writing user record as LUKS token completed.");
1648
1649 if (ret)
1650 *ret = TAKE_PTR(cd);
1651
1652 return 0;
1653 }
1654
1655 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct fdisk_context*, fdisk_unref_context, NULL);
1656 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct fdisk_partition*, fdisk_unref_partition, NULL);
1657 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct fdisk_parttype*, fdisk_unref_parttype, NULL);
1658 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct fdisk_table*, fdisk_unref_table, NULL);
1659
1660 static int make_partition_table(
1661 int fd,
1662 const char *label,
1663 sd_id128_t uuid,
1664 uint64_t *ret_offset,
1665 uint64_t *ret_size,
1666 sd_id128_t *ret_disk_uuid) {
1667
1668 _cleanup_(fdisk_unref_partitionp) struct fdisk_partition *p = NULL, *q = NULL;
1669 _cleanup_(fdisk_unref_parttypep) struct fdisk_parttype *t = NULL;
1670 _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
1671 _cleanup_free_ char *path = NULL, *disk_uuid_as_string = NULL;
1672 uint64_t offset, size, first_lba, start, last_lba, end;
1673 sd_id128_t disk_uuid;
1674 int r;
1675
1676 assert(fd >= 0);
1677 assert(label);
1678 assert(ret_offset);
1679 assert(ret_size);
1680
1681 t = fdisk_new_parttype();
1682 if (!t)
1683 return log_oom();
1684
1685 r = fdisk_parttype_set_typestr(t, "773f91ef-66d4-49b5-bd83-d683bf40ad16");
1686 if (r < 0)
1687 return log_error_errno(r, "Failed to initialize partition type: %m");
1688
1689 c = fdisk_new_context();
1690 if (!c)
1691 return log_oom();
1692
1693 if (asprintf(&path, "/proc/self/fd/%i", fd) < 0)
1694 return log_oom();
1695
1696 r = fdisk_assign_device(c, path, 0);
1697 if (r < 0)
1698 return log_error_errno(r, "Failed to open device: %m");
1699
1700 r = fdisk_create_disklabel(c, "gpt");
1701 if (r < 0)
1702 return log_error_errno(r, "Failed to create GPT disk label: %m");
1703
1704 p = fdisk_new_partition();
1705 if (!p)
1706 return log_oom();
1707
1708 r = fdisk_partition_set_type(p, t);
1709 if (r < 0)
1710 return log_error_errno(r, "Failed to set partition type: %m");
1711
1712 r = fdisk_partition_partno_follow_default(p, 1);
1713 if (r < 0)
1714 return log_error_errno(r, "Failed to place partition at first free partition index: %m");
1715
1716 first_lba = fdisk_get_first_lba(c); /* Boundary where usable space starts */
1717 assert(first_lba <= UINT64_MAX/512);
1718 start = DISK_SIZE_ROUND_UP(first_lba * 512); /* Round up to multiple of 4K */
1719
1720 if (start == UINT64_MAX)
1721 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Overflow while rounding up start LBA.");
1722
1723 last_lba = fdisk_get_last_lba(c); /* One sector before boundary where usable space ends */
1724 assert(last_lba < UINT64_MAX/512);
1725 end = DISK_SIZE_ROUND_DOWN((last_lba + 1) * 512); /* Round down to multiple of 4K */
1726
1727 if (end <= start)
1728 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Resulting partition size zero or negative.");
1729
1730 r = fdisk_partition_set_start(p, start / 512);
1731 if (r < 0)
1732 return log_error_errno(r, "Failed to place partition at offset %" PRIu64 ": %m", start);
1733
1734 r = fdisk_partition_set_size(p, (end - start) / 512);
1735 if (r < 0)
1736 return log_error_errno(r, "Failed to end partition at offset %" PRIu64 ": %m", end);
1737
1738 r = fdisk_partition_set_name(p, label);
1739 if (r < 0)
1740 return log_error_errno(r, "Failed to set partition name: %m");
1741
1742 r = fdisk_partition_set_uuid(p, ID128_TO_UUID_STRING(uuid));
1743 if (r < 0)
1744 return log_error_errno(r, "Failed to set partition UUID: %m");
1745
1746 r = fdisk_add_partition(c, p, NULL);
1747 if (r < 0)
1748 return log_error_errno(r, "Failed to add partition: %m");
1749
1750 r = fdisk_write_disklabel(c);
1751 if (r < 0)
1752 return log_error_errno(r, "Failed to write disk label: %m");
1753
1754 r = fdisk_get_disklabel_id(c, &disk_uuid_as_string);
1755 if (r < 0)
1756 return log_error_errno(r, "Failed to determine disk label UUID: %m");
1757
1758 r = sd_id128_from_string(disk_uuid_as_string, &disk_uuid);
1759 if (r < 0)
1760 return log_error_errno(r, "Failed to parse disk label UUID: %m");
1761
1762 r = fdisk_get_partition(c, 0, &q);
1763 if (r < 0)
1764 return log_error_errno(r, "Failed to read created partition metadata: %m");
1765
1766 assert(fdisk_partition_has_start(q));
1767 offset = fdisk_partition_get_start(q);
1768 if (offset > UINT64_MAX / 512U)
1769 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Partition offset too large.");
1770
1771 assert(fdisk_partition_has_size(q));
1772 size = fdisk_partition_get_size(q);
1773 if (size > UINT64_MAX / 512U)
1774 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Partition size too large.");
1775
1776 *ret_offset = offset * 512U;
1777 *ret_size = size * 512U;
1778 *ret_disk_uuid = disk_uuid;
1779
1780 return 0;
1781 }
1782
1783 static bool supported_fs_size(const char *fstype, uint64_t host_size) {
1784 uint64_t m;
1785
1786 m = minimal_size_by_fs_name(fstype);
1787 if (m == UINT64_MAX)
1788 return false;
1789
1790 return host_size >= m;
1791 }
1792
1793 static int wait_for_devlink(const char *path) {
1794 _cleanup_close_ int inotify_fd = -1;
1795 usec_t until;
1796 int r;
1797
1798 /* let's wait for a device link to show up in /dev, with a timeout. This is good to do since we
1799 * return a /dev/disk/by-uuid/… link to our callers and they likely want to access it right-away,
1800 * hence let's wait until udev has caught up with our changes, and wait for the symlink to be
1801 * created. */
1802
1803 until = usec_add(now(CLOCK_MONOTONIC), 45 * USEC_PER_SEC);
1804
1805 for (;;) {
1806 _cleanup_free_ char *dn = NULL;
1807 usec_t w;
1808
1809 if (laccess(path, F_OK) < 0) {
1810 if (errno != ENOENT)
1811 return log_error_errno(errno, "Failed to determine whether %s exists: %m", path);
1812 } else
1813 return 0; /* Found it */
1814
1815 if (inotify_fd < 0) {
1816 /* We need to wait for the device symlink to show up, let's create an inotify watch for it */
1817 inotify_fd = inotify_init1(IN_NONBLOCK|IN_CLOEXEC);
1818 if (inotify_fd < 0)
1819 return log_error_errno(errno, "Failed to allocate inotify fd: %m");
1820 }
1821
1822 dn = dirname_malloc(path);
1823 for (;;) {
1824 if (!dn)
1825 return log_oom();
1826
1827 log_info("Watching %s", dn);
1828
1829 if (inotify_add_watch(inotify_fd, dn, IN_CREATE|IN_MOVED_TO|IN_ONLYDIR|IN_DELETE_SELF|IN_MOVE_SELF) < 0) {
1830 if (errno != ENOENT)
1831 return log_error_errno(errno, "Failed to add watch on %s: %m", dn);
1832 } else
1833 break;
1834
1835 if (empty_or_root(dn))
1836 break;
1837
1838 dn = dirname_malloc(dn);
1839 }
1840
1841 w = now(CLOCK_MONOTONIC);
1842 if (w >= until)
1843 return log_error_errno(SYNTHETIC_ERRNO(ETIMEDOUT), "Device link %s still hasn't shown up, giving up.", path);
1844
1845 r = fd_wait_for_event(inotify_fd, POLLIN, usec_sub_unsigned(until, w));
1846 if (r < 0)
1847 return log_error_errno(r, "Failed to watch inotify: %m");
1848
1849 (void) flush_fd(inotify_fd);
1850 }
1851 }
1852
1853 static int calculate_disk_size(UserRecord *h, const char *parent_dir, uint64_t *ret) {
1854 struct statfs sfs;
1855 uint64_t m;
1856
1857 assert(h);
1858 assert(parent_dir);
1859 assert(ret);
1860
1861 if (h->disk_size != UINT64_MAX) {
1862 *ret = DISK_SIZE_ROUND_DOWN(h->disk_size);
1863 return 0;
1864 }
1865
1866 if (statfs(parent_dir, &sfs) < 0)
1867 return log_error_errno(errno, "statfs() on %s failed: %m", parent_dir);
1868
1869 m = sfs.f_bsize * sfs.f_bavail;
1870
1871 if (h->disk_size_relative == UINT64_MAX) {
1872
1873 if (m > UINT64_MAX / USER_DISK_SIZE_DEFAULT_PERCENT)
1874 return log_error_errno(SYNTHETIC_ERRNO(EOVERFLOW), "Disk size too large.");
1875
1876 *ret = DISK_SIZE_ROUND_DOWN(m * USER_DISK_SIZE_DEFAULT_PERCENT / 100);
1877
1878 log_info("Sizing home to %u%% of available disk space, which is %s.",
1879 USER_DISK_SIZE_DEFAULT_PERCENT,
1880 FORMAT_BYTES(*ret));
1881 } else {
1882 *ret = DISK_SIZE_ROUND_DOWN((uint64_t) ((double) m * (double) h->disk_size_relative / (double) UINT32_MAX));
1883
1884 log_info("Sizing home to %" PRIu64 ".%01" PRIu64 "%% of available disk space, which is %s.",
1885 (h->disk_size_relative * 100) / UINT32_MAX,
1886 ((h->disk_size_relative * 1000) / UINT32_MAX) % 10,
1887 FORMAT_BYTES(*ret));
1888 }
1889
1890 if (*ret < USER_DISK_SIZE_MIN)
1891 *ret = USER_DISK_SIZE_MIN;
1892
1893 return 0;
1894 }
1895
1896 static int home_truncate(
1897 UserRecord *h,
1898 int fd,
1899 const char *path,
1900 uint64_t size) {
1901
1902 bool trunc;
1903 int r;
1904
1905 assert(h);
1906 assert(fd >= 0);
1907 assert(path);
1908
1909 trunc = user_record_luks_discard(h);
1910 if (!trunc) {
1911 r = fallocate(fd, 0, 0, size);
1912 if (r < 0 && ERRNO_IS_NOT_SUPPORTED(errno)) {
1913 /* Some file systems do not support fallocate(), let's gracefully degrade
1914 * (ZFS, reiserfs, …) and fall back to truncation */
1915 log_notice_errno(errno, "Backing file system does not support fallocate(), falling back to ftruncate(), i.e. implicitly using non-discard mode.");
1916 trunc = true;
1917 }
1918 }
1919
1920 if (trunc)
1921 r = ftruncate(fd, size);
1922
1923 if (r < 0) {
1924 if (ERRNO_IS_DISK_SPACE(errno)) {
1925 log_error_errno(errno, "Not enough disk space to allocate home.");
1926 return -ENOSPC; /* make recognizable */
1927 }
1928
1929 return log_error_errno(errno, "Failed to truncate home image %s: %m", path);
1930 }
1931
1932 return 0;
1933 }
1934
1935 int home_create_luks(
1936 UserRecord *h,
1937 PasswordCache *cache,
1938 char **effective_passwords,
1939 UserRecord **ret_home) {
1940
1941 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL, *subdir = NULL, *disk_uuid_path = NULL, *temporary_image_path = NULL;
1942 uint64_t encrypted_size,
1943 host_size = 0, partition_offset = 0, partition_size = 0; /* Unnecessary initialization to appease gcc */
1944 bool image_created = false, dm_activated = false, mounted = false;
1945 _cleanup_(user_record_unrefp) UserRecord *new_home = NULL;
1946 sd_id128_t partition_uuid, fs_uuid, luks_uuid, disk_uuid;
1947 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
1948 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
1949 _cleanup_close_ int image_fd = -1, root_fd = -1;
1950 const char *fstype, *ip;
1951 struct statfs sfs;
1952 int r;
1953
1954 assert(h);
1955 assert(h->storage < 0 || h->storage == USER_LUKS);
1956 assert(ret_home);
1957
1958 r = dlopen_cryptsetup();
1959 if (r < 0)
1960 return r;
1961
1962 assert_se(ip = user_record_image_path(h));
1963
1964 fstype = user_record_file_system_type(h);
1965 if (!supported_fstype(fstype))
1966 return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "Unsupported file system type: %s", fstype);
1967
1968 r = mkfs_exists(fstype);
1969 if (r < 0)
1970 return log_error_errno(r, "Failed to check if mkfs binary for %s exists: %m", fstype);
1971 if (r == 0) {
1972 if (h->file_system_type || streq(fstype, "ext4") || !supported_fstype("ext4"))
1973 return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "mkfs binary for file system type %s does not exist.", fstype);
1974
1975 /* If the record does not explicitly declare a file system to use, and the compiled-in
1976 * default does not actually exist, than do an automatic fallback onto ext4, as the baseline
1977 * fs of Linux. We won't search for a working fs type here beyond ext4, i.e. nothing fancier
1978 * than a single, conservative fallback to baseline. This should be useful in minimal
1979 * environments where mkfs.btrfs or so are not made available, but mkfs.ext4 as Linux' most
1980 * boring, most basic fs is. */
1981 log_info("Formatting tool for compiled-in default file system %s not available, falling back to ext4 instead.", fstype);
1982 fstype = "ext4";
1983 }
1984
1985 if (sd_id128_is_null(h->partition_uuid)) {
1986 r = sd_id128_randomize(&partition_uuid);
1987 if (r < 0)
1988 return log_error_errno(r, "Failed to acquire partition UUID: %m");
1989 } else
1990 partition_uuid = h->partition_uuid;
1991
1992 if (sd_id128_is_null(h->luks_uuid)) {
1993 r = sd_id128_randomize(&luks_uuid);
1994 if (r < 0)
1995 return log_error_errno(r, "Failed to acquire LUKS UUID: %m");
1996 } else
1997 luks_uuid = h->luks_uuid;
1998
1999 if (sd_id128_is_null(h->file_system_uuid)) {
2000 r = sd_id128_randomize(&fs_uuid);
2001 if (r < 0)
2002 return log_error_errno(r, "Failed to acquire file system UUID: %m");
2003 } else
2004 fs_uuid = h->file_system_uuid;
2005
2006 r = make_dm_names(h->user_name, &dm_name, &dm_node);
2007 if (r < 0)
2008 return r;
2009
2010 r = access(dm_node, F_OK);
2011 if (r < 0) {
2012 if (errno != ENOENT)
2013 return log_error_errno(errno, "Failed to determine whether %s exists: %m", dm_node);
2014 } else
2015 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Device mapper device %s already exists, refusing.", dm_node);
2016
2017 if (path_startswith(ip, "/dev/")) {
2018 _cleanup_free_ char *sysfs = NULL;
2019 uint64_t block_device_size;
2020 struct stat st;
2021
2022 /* Let's place the home directory on a real device, i.e. an USB stick or such */
2023
2024 image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2025 if (image_fd < 0)
2026 return log_error_errno(errno, "Failed to open device %s: %m", ip);
2027
2028 if (fstat(image_fd, &st) < 0)
2029 return log_error_errno(errno, "Failed to stat device %s: %m", ip);
2030 if (!S_ISBLK(st.st_mode))
2031 return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Device is not a block device, refusing.");
2032
2033 if (asprintf(&sysfs, "/sys/dev/block/%u:%u/partition", major(st.st_rdev), minor(st.st_rdev)) < 0)
2034 return log_oom();
2035 if (access(sysfs, F_OK) < 0) {
2036 if (errno != ENOENT)
2037 return log_error_errno(errno, "Failed to check whether %s exists: %m", sysfs);
2038 } else
2039 return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Operating on partitions is currently not supported, sorry. Please specify a top-level block device.");
2040
2041 if (flock(image_fd, LOCK_EX) < 0) /* make sure udev doesn't read from it while we operate on the device */
2042 return log_error_errno(errno, "Failed to lock block device %s: %m", ip);
2043
2044 if (ioctl(image_fd, BLKGETSIZE64, &block_device_size) < 0)
2045 return log_error_errno(errno, "Failed to read block device size: %m");
2046
2047 if (h->disk_size == UINT64_MAX) {
2048
2049 /* If a relative disk size is requested, apply it relative to the block device size */
2050 if (h->disk_size_relative < UINT32_MAX)
2051 host_size = CLAMP(DISK_SIZE_ROUND_DOWN(block_device_size * h->disk_size_relative / UINT32_MAX),
2052 USER_DISK_SIZE_MIN, USER_DISK_SIZE_MAX);
2053 else
2054 host_size = block_device_size; /* Otherwise, take the full device */
2055
2056 } else if (h->disk_size > block_device_size)
2057 return log_error_errno(SYNTHETIC_ERRNO(EMSGSIZE), "Selected disk size larger than backing block device, refusing.");
2058 else
2059 host_size = DISK_SIZE_ROUND_DOWN(h->disk_size);
2060
2061 if (!supported_fs_size(fstype, host_size))
2062 return log_error_errno(SYNTHETIC_ERRNO(ERANGE),
2063 "Selected file system size too small for %s.", fstype);
2064
2065 /* After creation we should reference this partition by its UUID instead of the block
2066 * device. That's preferable since the user might have specified a device node such as
2067 * /dev/sdb to us, which might look very different when replugged. */
2068 if (asprintf(&disk_uuid_path, "/dev/disk/by-uuid/" SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(luks_uuid)) < 0)
2069 return log_oom();
2070
2071 if (user_record_luks_discard(h) || user_record_luks_offline_discard(h)) {
2072 /* If we want online or offline discard, discard once before we start using things. */
2073
2074 if (ioctl(image_fd, BLKDISCARD, (uint64_t[]) { 0, block_device_size }) < 0)
2075 log_full_errno(errno == EOPNOTSUPP ? LOG_DEBUG : LOG_WARNING, errno,
2076 "Failed to issue full-device BLKDISCARD on device, ignoring: %m");
2077 else
2078 log_info("Full device discard completed.");
2079 }
2080 } else {
2081 _cleanup_free_ char *parent = NULL;
2082
2083 parent = dirname_malloc(ip);
2084 if (!parent)
2085 return log_oom();
2086
2087 r = mkdir_p(parent, 0755);
2088 if (r < 0)
2089 return log_error_errno(r, "Failed to create parent directory %s: %m", parent);
2090
2091 r = calculate_disk_size(h, parent, &host_size);
2092 if (r < 0)
2093 return r;
2094
2095 if (!supported_fs_size(fstype, host_size))
2096 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Selected file system size too small for %s.", fstype);
2097
2098 r = tempfn_random(ip, "homework", &temporary_image_path);
2099 if (r < 0)
2100 return log_error_errno(r, "Failed to derive temporary file name for %s: %m", ip);
2101
2102 image_fd = open(temporary_image_path, O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW, 0600);
2103 if (image_fd < 0)
2104 return log_error_errno(errno, "Failed to create home image %s: %m", temporary_image_path);
2105
2106 image_created = true;
2107
2108 r = chattr_fd(image_fd, FS_NOCOW_FL, FS_NOCOW_FL, NULL);
2109 if (r < 0)
2110 log_full_errno(ERRNO_IS_NOT_SUPPORTED(r) ? LOG_DEBUG : LOG_WARNING, r,
2111 "Failed to set file attributes on %s, ignoring: %m", temporary_image_path);
2112
2113 r = home_truncate(h, image_fd, temporary_image_path, host_size);
2114 if (r < 0)
2115 goto fail;
2116
2117 log_info("Allocating image file completed.");
2118 }
2119
2120 r = make_partition_table(
2121 image_fd,
2122 user_record_user_name_and_realm(h),
2123 partition_uuid,
2124 &partition_offset,
2125 &partition_size,
2126 &disk_uuid);
2127 if (r < 0)
2128 goto fail;
2129
2130 log_info("Writing of partition table completed.");
2131
2132 r = loop_device_make(image_fd, O_RDWR, partition_offset, partition_size, 0, &loop);
2133 if (r < 0) {
2134 if (r == -ENOENT) { /* this means /dev/loop-control doesn't exist, i.e. we are in a container
2135 * or similar and loopback bock devices are not available, return a
2136 * recognizable error in this case. */
2137 log_error_errno(r, "Loopback block device support is not available on this system.");
2138 r = -ENOLINK;
2139 goto fail;
2140 }
2141
2142 log_error_errno(r, "Failed to set up loopback device for %s: %m", temporary_image_path);
2143 goto fail;
2144 }
2145
2146 r = loop_device_flock(loop, LOCK_EX); /* make sure udev won't read before we are done */
2147 if (r < 0) {
2148 log_error_errno(r, "Failed to take lock on loop device: %m");
2149 goto fail;
2150 }
2151
2152 log_info("Setting up loopback device %s completed.", loop->node ?: ip);
2153
2154 r = luks_format(loop->node,
2155 dm_name,
2156 luks_uuid,
2157 user_record_user_name_and_realm(h),
2158 cache,
2159 effective_passwords,
2160 user_record_luks_discard(h) || user_record_luks_offline_discard(h),
2161 h,
2162 &cd);
2163 if (r < 0)
2164 goto fail;
2165
2166 dm_activated = true;
2167
2168 r = block_get_size_by_path(dm_node, &encrypted_size);
2169 if (r < 0) {
2170 log_error_errno(r, "Failed to get encrypted block device size: %m");
2171 goto fail;
2172 }
2173
2174 log_info("Setting up LUKS device %s completed.", dm_node);
2175
2176 r = make_filesystem(dm_node, fstype, user_record_user_name_and_realm(h), fs_uuid, user_record_luks_discard(h));
2177 if (r < 0)
2178 goto fail;
2179
2180 log_info("Formatting file system completed.");
2181
2182 r = home_unshare_and_mount(dm_node, fstype, user_record_luks_discard(h), user_record_mount_flags(h));
2183 if (r < 0)
2184 goto fail;
2185
2186 mounted = true;
2187
2188 subdir = path_join("/run/systemd/user-home-mount/", user_record_user_name_and_realm(h));
2189 if (!subdir) {
2190 r = log_oom();
2191 goto fail;
2192 }
2193
2194 /* Prefer using a btrfs subvolume if we can, fall back to directory otherwise */
2195 r = btrfs_subvol_make_fallback(subdir, 0700);
2196 if (r < 0) {
2197 log_error_errno(r, "Failed to create user directory in mounted image file: %m");
2198 goto fail;
2199 }
2200
2201 root_fd = open(subdir, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
2202 if (root_fd < 0) {
2203 r = log_error_errno(errno, "Failed to open user directory in mounted image file: %m");
2204 goto fail;
2205 }
2206
2207 r = home_populate(h, root_fd);
2208 if (r < 0)
2209 goto fail;
2210
2211 r = home_sync_and_statfs(root_fd, &sfs);
2212 if (r < 0)
2213 goto fail;
2214
2215 r = user_record_clone(h, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_LOG|USER_RECORD_PERMISSIVE, &new_home);
2216 if (r < 0) {
2217 log_error_errno(r, "Failed to clone record: %m");
2218 goto fail;
2219 }
2220
2221 r = user_record_add_binding(
2222 new_home,
2223 USER_LUKS,
2224 disk_uuid_path ?: ip,
2225 partition_uuid,
2226 luks_uuid,
2227 fs_uuid,
2228 sym_crypt_get_cipher(cd),
2229 sym_crypt_get_cipher_mode(cd),
2230 luks_volume_key_size_convert(cd),
2231 fstype,
2232 NULL,
2233 h->uid,
2234 (gid_t) h->uid);
2235 if (r < 0) {
2236 log_error_errno(r, "Failed to add binding to record: %m");
2237 goto fail;
2238 }
2239
2240 if (user_record_luks_offline_discard(h)) {
2241 r = run_fitrim(root_fd);
2242 if (r < 0)
2243 goto fail;
2244 }
2245
2246 root_fd = safe_close(root_fd);
2247
2248 r = umount_verbose(LOG_ERR, "/run/systemd/user-home-mount", UMOUNT_NOFOLLOW);
2249 if (r < 0)
2250 goto fail;
2251
2252 mounted = false;
2253
2254 r = sym_crypt_deactivate_by_name(cd, dm_name, 0);
2255 if (r < 0) {
2256 log_error_errno(r, "Failed to deactivate LUKS device: %m");
2257 goto fail;
2258 }
2259
2260 sym_crypt_free(cd);
2261 cd = NULL;
2262
2263 dm_activated = false;
2264
2265 loop = loop_device_unref(loop);
2266
2267 if (!user_record_luks_offline_discard(h)) {
2268 r = run_fallocate(image_fd, NULL /* refresh stat() data */);
2269 if (r < 0)
2270 goto fail;
2271 }
2272
2273 /* Sync everything to disk before we move things into place under the final name. */
2274 if (fsync(image_fd) < 0) {
2275 r = log_error_errno(r, "Failed to synchronize image to disk: %m");
2276 goto fail;
2277 }
2278
2279 if (disk_uuid_path)
2280 (void) ioctl(image_fd, BLKRRPART, 0);
2281 else {
2282 /* If we operate on a file, sync the containing directory too. */
2283 r = fsync_directory_of_file(image_fd);
2284 if (r < 0) {
2285 log_error_errno(r, "Failed to synchronize directory of image file to disk: %m");
2286 goto fail;
2287 }
2288 }
2289
2290 /* Let's close the image fd now. If we are operating on a real block device this will release the BSD
2291 * lock that ensures udev doesn't interfere with what we are doing */
2292 image_fd = safe_close(image_fd);
2293
2294 if (temporary_image_path) {
2295 if (rename(temporary_image_path, ip) < 0) {
2296 log_error_errno(errno, "Failed to rename image file: %m");
2297 goto fail;
2298 }
2299
2300 log_info("Moved image file into place.");
2301 }
2302
2303 if (disk_uuid_path)
2304 (void) wait_for_devlink(disk_uuid_path);
2305
2306 log_info("Everything completed.");
2307
2308 print_size_summary(host_size, encrypted_size, &sfs);
2309
2310 *ret_home = TAKE_PTR(new_home);
2311 return 0;
2312
2313 fail:
2314 /* Let's close all files before we unmount the file system, to avoid EBUSY */
2315 root_fd = safe_close(root_fd);
2316
2317 if (mounted)
2318 (void) umount_verbose(LOG_WARNING, "/run/systemd/user-home-mount", UMOUNT_NOFOLLOW);
2319
2320 if (dm_activated)
2321 (void) sym_crypt_deactivate_by_name(cd, dm_name, 0);
2322
2323 loop = loop_device_unref(loop);
2324
2325 if (image_created)
2326 (void) unlink(temporary_image_path);
2327
2328 return r;
2329 }
2330
2331 int home_validate_update_luks(UserRecord *h, HomeSetup *setup) {
2332 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
2333 int r;
2334
2335 assert(h);
2336 assert(setup);
2337
2338 r = make_dm_names(h->user_name, &dm_name, &dm_node);
2339 if (r < 0)
2340 return r;
2341
2342 r = access(dm_node, F_OK);
2343 if (r < 0 && errno != ENOENT)
2344 return log_error_errno(errno, "Failed to determine whether %s exists: %m", dm_node);
2345
2346 free_and_replace(setup->dm_name, dm_name);
2347 free_and_replace(setup->dm_node, dm_node);
2348
2349 return r >= 0;
2350 }
2351
2352 enum {
2353 CAN_RESIZE_ONLINE,
2354 CAN_RESIZE_OFFLINE,
2355 };
2356
2357 static int can_resize_fs(int fd, uint64_t old_size, uint64_t new_size) {
2358 struct statfs sfs;
2359
2360 assert(fd >= 0);
2361
2362 /* Filter out bogus requests early */
2363 if (old_size == 0 || old_size == UINT64_MAX ||
2364 new_size == 0 || new_size == UINT64_MAX)
2365 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid resize parameters.");
2366
2367 if ((old_size & 511) != 0 || (new_size & 511) != 0)
2368 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Resize parameters not multiple of 512.");
2369
2370 if (fstatfs(fd, &sfs) < 0)
2371 return log_error_errno(errno, "Failed to fstatfs() file system: %m");
2372
2373 if (is_fs_type(&sfs, BTRFS_SUPER_MAGIC)) {
2374
2375 if (new_size < BTRFS_MINIMAL_SIZE)
2376 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for btrfs (needs to be 256M at least.");
2377
2378 /* btrfs can grow and shrink online */
2379
2380 } else if (is_fs_type(&sfs, XFS_SB_MAGIC)) {
2381
2382 if (new_size < XFS_MINIMAL_SIZE)
2383 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for xfs (needs to be 14M at least).");
2384
2385 /* XFS can grow, but not shrink */
2386 if (new_size < old_size)
2387 return log_error_errno(SYNTHETIC_ERRNO(EMSGSIZE), "Shrinking this type of file system is not supported.");
2388
2389 } else if (is_fs_type(&sfs, EXT4_SUPER_MAGIC)) {
2390
2391 if (new_size < EXT4_MINIMAL_SIZE)
2392 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for ext4 (needs to be 1M at least).");
2393
2394 /* ext4 can grow online, and shrink offline */
2395 if (new_size < old_size)
2396 return CAN_RESIZE_OFFLINE;
2397
2398 } else
2399 return log_error_errno(SYNTHETIC_ERRNO(ESOCKTNOSUPPORT), "Resizing this type of file system is not supported.");
2400
2401 return CAN_RESIZE_ONLINE;
2402 }
2403
2404 static int ext4_offline_resize_fs(HomeSetup *setup, uint64_t new_size, bool discard, unsigned long flags) {
2405 _cleanup_free_ char *size_str = NULL;
2406 bool re_open = false, re_mount = false;
2407 pid_t resize_pid, fsck_pid;
2408 int r, exit_status;
2409
2410 assert(setup);
2411 assert(setup->dm_node);
2412
2413 /* First, unmount the file system */
2414 if (setup->root_fd >= 0) {
2415 setup->root_fd = safe_close(setup->root_fd);
2416 re_open = true;
2417 }
2418
2419 if (setup->undo_mount) {
2420 r = umount_verbose(LOG_ERR, "/run/systemd/user-home-mount", UMOUNT_NOFOLLOW);
2421 if (r < 0)
2422 return r;
2423
2424 setup->undo_mount = false;
2425 re_mount = true;
2426 }
2427
2428 log_info("Temporary unmounting of file system completed.");
2429
2430 /* resize2fs requires that the file system is force checked first, do so. */
2431 r = safe_fork("(e2fsck)",
2432 FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_STDOUT_TO_STDERR|FORK_CLOSE_ALL_FDS,
2433 &fsck_pid);
2434 if (r < 0)
2435 return r;
2436 if (r == 0) {
2437 /* Child */
2438 execlp("e2fsck" ,"e2fsck", "-fp", setup->dm_node, NULL);
2439 log_open();
2440 log_error_errno(errno, "Failed to execute e2fsck: %m");
2441 _exit(EXIT_FAILURE);
2442 }
2443
2444 exit_status = wait_for_terminate_and_check("e2fsck", fsck_pid, WAIT_LOG_ABNORMAL);
2445 if (exit_status < 0)
2446 return exit_status;
2447 if ((exit_status & ~FSCK_ERROR_CORRECTED) != 0) {
2448 log_warning("e2fsck failed with exit status %i.", exit_status);
2449
2450 if ((exit_status & (FSCK_SYSTEM_SHOULD_REBOOT|FSCK_ERRORS_LEFT_UNCORRECTED)) != 0)
2451 return log_error_errno(SYNTHETIC_ERRNO(EIO), "File system is corrupted, refusing.");
2452
2453 log_warning("Ignoring fsck error.");
2454 }
2455
2456 log_info("Forced file system check completed.");
2457
2458 /* We use 512 sectors here, because resize2fs doesn't do byte sizes */
2459 if (asprintf(&size_str, "%" PRIu64 "s", new_size / 512) < 0)
2460 return log_oom();
2461
2462 /* Resize the thing */
2463 r = safe_fork("(e2resize)",
2464 FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_WAIT|FORK_STDOUT_TO_STDERR|FORK_CLOSE_ALL_FDS,
2465 &resize_pid);
2466 if (r < 0)
2467 return r;
2468 if (r == 0) {
2469 /* Child */
2470 execlp("resize2fs" ,"resize2fs", setup->dm_node, size_str, NULL);
2471 log_open();
2472 log_error_errno(errno, "Failed to execute resize2fs: %m");
2473 _exit(EXIT_FAILURE);
2474 }
2475
2476 log_info("Offline file system resize completed.");
2477
2478 /* Re-establish mounts and reopen the directory */
2479 if (re_mount) {
2480 r = home_mount_node(setup->dm_node, "ext4", discard, flags);
2481 if (r < 0)
2482 return r;
2483
2484 setup->undo_mount = true;
2485 }
2486
2487 if (re_open) {
2488 setup->root_fd = open("/run/systemd/user-home-mount", O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
2489 if (setup->root_fd < 0)
2490 return log_error_errno(errno, "Failed to reopen file system: %m");
2491 }
2492
2493 log_info("File system mounted again.");
2494
2495 return 0;
2496 }
2497
2498 static int prepare_resize_partition(
2499 int fd,
2500 uint64_t partition_offset,
2501 uint64_t old_partition_size,
2502 uint64_t new_partition_size,
2503 sd_id128_t *ret_disk_uuid,
2504 struct fdisk_table **ret_table) {
2505
2506 _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
2507 _cleanup_(fdisk_unref_tablep) struct fdisk_table *t = NULL;
2508 _cleanup_free_ char *path = NULL, *disk_uuid_as_string = NULL;
2509 size_t n_partitions;
2510 sd_id128_t disk_uuid;
2511 bool found = false;
2512 int r;
2513
2514 assert(fd >= 0);
2515 assert(ret_disk_uuid);
2516 assert(ret_table);
2517
2518 assert((partition_offset & 511) == 0);
2519 assert((old_partition_size & 511) == 0);
2520 assert((new_partition_size & 511) == 0);
2521 assert(UINT64_MAX - old_partition_size >= partition_offset);
2522 assert(UINT64_MAX - new_partition_size >= partition_offset);
2523
2524 if (partition_offset == 0) {
2525 /* If the offset is at the beginning we assume no partition table, let's exit early. */
2526 log_debug("Not rewriting partition table, operating on naked device.");
2527 *ret_disk_uuid = SD_ID128_NULL;
2528 *ret_table = NULL;
2529 return 0;
2530 }
2531
2532 c = fdisk_new_context();
2533 if (!c)
2534 return log_oom();
2535
2536 if (asprintf(&path, "/proc/self/fd/%i", fd) < 0)
2537 return log_oom();
2538
2539 r = fdisk_assign_device(c, path, 0);
2540 if (r < 0)
2541 return log_error_errno(r, "Failed to open device: %m");
2542
2543 if (!fdisk_is_labeltype(c, FDISK_DISKLABEL_GPT))
2544 return log_error_errno(SYNTHETIC_ERRNO(ENOMEDIUM), "Disk has no GPT partition table.");
2545
2546 r = fdisk_get_disklabel_id(c, &disk_uuid_as_string);
2547 if (r < 0)
2548 return log_error_errno(r, "Failed to acquire disk UUID: %m");
2549
2550 r = sd_id128_from_string(disk_uuid_as_string, &disk_uuid);
2551 if (r < 0)
2552 return log_error_errno(r, "Failed parse disk UUID: %m");
2553
2554 r = fdisk_get_partitions(c, &t);
2555 if (r < 0)
2556 return log_error_errno(r, "Failed to acquire partition table: %m");
2557
2558 n_partitions = fdisk_table_get_nents(t);
2559 for (size_t i = 0; i < n_partitions; i++) {
2560 struct fdisk_partition *p;
2561
2562 p = fdisk_table_get_partition(t, i);
2563 if (!p)
2564 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to read partition metadata: %m");
2565
2566 if (fdisk_partition_is_used(p) <= 0)
2567 continue;
2568 if (fdisk_partition_has_start(p) <= 0 || fdisk_partition_has_size(p) <= 0 || fdisk_partition_has_end(p) <= 0)
2569 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Found partition without a size.");
2570
2571 if (fdisk_partition_get_start(p) == partition_offset / 512U &&
2572 fdisk_partition_get_size(p) == old_partition_size / 512U) {
2573
2574 if (found)
2575 return log_error_errno(SYNTHETIC_ERRNO(ENOTUNIQ), "Partition found twice, refusing.");
2576
2577 /* Found our partition, now patch it */
2578 r = fdisk_partition_size_explicit(p, 1);
2579 if (r < 0)
2580 return log_error_errno(r, "Failed to enable explicit partition size: %m");
2581
2582 r = fdisk_partition_set_size(p, new_partition_size / 512U);
2583 if (r < 0)
2584 return log_error_errno(r, "Failed to change partition size: %m");
2585
2586 found = true;
2587 continue;
2588
2589 } else {
2590 if (fdisk_partition_get_start(p) < partition_offset + new_partition_size / 512U &&
2591 fdisk_partition_get_end(p) >= partition_offset / 512)
2592 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Can't extend, conflicting partition found.");
2593 }
2594 }
2595
2596 if (!found)
2597 return log_error_errno(SYNTHETIC_ERRNO(ENOPKG), "Failed to find matching partition to resize.");
2598
2599 *ret_table = TAKE_PTR(t);
2600 *ret_disk_uuid = disk_uuid;
2601
2602 return 1;
2603 }
2604
2605 static int ask_cb(struct fdisk_context *c, struct fdisk_ask *ask, void *userdata) {
2606 char *result;
2607
2608 assert(c);
2609
2610 switch (fdisk_ask_get_type(ask)) {
2611
2612 case FDISK_ASKTYPE_STRING:
2613 result = new(char, 37);
2614 if (!result)
2615 return log_oom();
2616
2617 fdisk_ask_string_set_result(ask, id128_to_uuid_string(*(sd_id128_t*) userdata, result));
2618 break;
2619
2620 default:
2621 log_debug("Unexpected question from libfdisk, ignoring.");
2622 }
2623
2624 return 0;
2625 }
2626
2627 static int apply_resize_partition(int fd, sd_id128_t disk_uuids, struct fdisk_table *t) {
2628 _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
2629 _cleanup_free_ void *two_zero_lbas = NULL;
2630 _cleanup_free_ char *path = NULL;
2631 ssize_t n;
2632 int r;
2633
2634 assert(fd >= 0);
2635
2636 if (!t) /* no partition table to apply, exit early */
2637 return 0;
2638
2639 two_zero_lbas = malloc0(1024U);
2640 if (!two_zero_lbas)
2641 return log_oom();
2642
2643 /* libfdisk appears to get confused by the existing PMBR. Let's explicitly flush it out. */
2644 n = pwrite(fd, two_zero_lbas, 1024U, 0);
2645 if (n < 0)
2646 return log_error_errno(errno, "Failed to wipe partition table: %m");
2647 if (n != 1024)
2648 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while wiping partition table.");
2649
2650 c = fdisk_new_context();
2651 if (!c)
2652 return log_oom();
2653
2654 if (asprintf(&path, "/proc/self/fd/%i", fd) < 0)
2655 return log_oom();
2656
2657 r = fdisk_assign_device(c, path, 0);
2658 if (r < 0)
2659 return log_error_errno(r, "Failed to open device: %m");
2660
2661 r = fdisk_create_disklabel(c, "gpt");
2662 if (r < 0)
2663 return log_error_errno(r, "Failed to create GPT disk label: %m");
2664
2665 r = fdisk_apply_table(c, t);
2666 if (r < 0)
2667 return log_error_errno(r, "Failed to apply partition table: %m");
2668
2669 r = fdisk_set_ask(c, ask_cb, &disk_uuids);
2670 if (r < 0)
2671 return log_error_errno(r, "Failed to set libfdisk query function: %m");
2672
2673 r = fdisk_set_disklabel_id(c);
2674 if (r < 0)
2675 return log_error_errno(r, "Failed to change disklabel ID: %m");
2676
2677 r = fdisk_write_disklabel(c);
2678 if (r < 0)
2679 return log_error_errno(r, "Failed to write disk label: %m");
2680
2681 return 1;
2682 }
2683
2684 int home_resize_luks(
2685 UserRecord *h,
2686 bool already_activated,
2687 PasswordCache *cache,
2688 HomeSetup *setup,
2689 UserRecord **ret_home) {
2690
2691 uint64_t old_image_size, new_image_size, old_fs_size, new_fs_size, crypto_offset, new_partition_size;
2692 _cleanup_(user_record_unrefp) UserRecord *header_home = NULL, *embedded_home = NULL, *new_home = NULL;
2693 _cleanup_(fdisk_unref_tablep) struct fdisk_table *table = NULL;
2694 _cleanup_free_ char *whole_disk = NULL;
2695 _cleanup_close_ int image_fd = -1;
2696 sd_id128_t disk_uuid;
2697 const char *ip, *ipo;
2698 struct statfs sfs;
2699 struct stat st;
2700 int r, resize_type;
2701
2702 assert(h);
2703 assert(user_record_storage(h) == USER_LUKS);
2704 assert(setup);
2705 assert(ret_home);
2706
2707 r = dlopen_cryptsetup();
2708 if (r < 0)
2709 return r;
2710
2711 assert_se(ipo = user_record_image_path(h));
2712 ip = strdupa_safe(ipo); /* copy out since original might change later in home record object */
2713
2714 image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2715 if (image_fd < 0)
2716 return log_error_errno(errno, "Failed to open image file %s: %m", ip);
2717
2718 if (fstat(image_fd, &st) < 0)
2719 return log_error_errno(errno, "Failed to stat image file %s: %m", ip);
2720 if (S_ISBLK(st.st_mode)) {
2721 dev_t parent;
2722
2723 r = block_get_whole_disk(st.st_rdev, &parent);
2724 if (r < 0)
2725 return log_error_errno(r, "Failed to acquire whole block device for %s: %m", ip);
2726 if (r > 0) {
2727 /* If we shall resize a file system on a partition device, then let's figure out the
2728 * whole disk device and operate on that instead, since we need to rewrite the
2729 * partition table to resize the partition. */
2730
2731 log_info("Operating on partition device %s, using parent device.", ip);
2732
2733 r = device_path_make_major_minor(st.st_mode, parent, &whole_disk);
2734 if (r < 0)
2735 return log_error_errno(r, "Failed to derive whole disk path for %s: %m", ip);
2736
2737 safe_close(image_fd);
2738
2739 image_fd = open(whole_disk, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2740 if (image_fd < 0)
2741 return log_error_errno(errno, "Failed to open whole block device %s: %m", whole_disk);
2742
2743 if (fstat(image_fd, &st) < 0)
2744 return log_error_errno(errno, "Failed to stat whole block device %s: %m", whole_disk);
2745 if (!S_ISBLK(st.st_mode))
2746 return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Whole block device %s is not actually a block device, refusing.", whole_disk);
2747 } else
2748 log_info("Operating on whole block device %s.", ip);
2749
2750 if (ioctl(image_fd, BLKGETSIZE64, &old_image_size) < 0)
2751 return log_error_errno(errno, "Failed to determine size of original block device: %m");
2752
2753 if (flock(image_fd, LOCK_EX) < 0) /* make sure udev doesn't read from it while we operate on the device */
2754 return log_error_errno(errno, "Failed to lock block device %s: %m", ip);
2755
2756 new_image_size = old_image_size; /* we can't resize physical block devices */
2757 } else {
2758 uint64_t new_image_size_rounded;
2759
2760 r = stat_verify_regular(&st);
2761 if (r < 0)
2762 return log_error_errno(r, "Image %s is not a block device nor regular file: %m", ip);
2763
2764 old_image_size = st.st_size;
2765
2766 /* Note an asymetry here: when we operate on loopback files the specified disk size we get we
2767 * apply onto the loopback file as a whole. When we operate on block devices we instead apply
2768 * to the partition itself only. */
2769
2770 new_image_size_rounded = DISK_SIZE_ROUND_DOWN(h->disk_size);
2771
2772 if (old_image_size == h->disk_size ||
2773 old_image_size == new_image_size_rounded) {
2774 /* If exact match, or a match after we rounded down, don't do a thing */
2775 log_info("Image size already matching, skipping operation.");
2776 return 0;
2777 }
2778
2779 new_image_size = new_image_size_rounded;
2780 }
2781
2782 r = home_prepare_luks(h, already_activated, whole_disk, cache, setup, &header_home);
2783 if (r < 0)
2784 return r;
2785
2786 r = home_load_embedded_identity(h, setup->root_fd, header_home, USER_RECONCILE_REQUIRE_NEWER_OR_EQUAL, cache, &embedded_home, &new_home);
2787 if (r < 0)
2788 return r;
2789
2790 log_info("offset = %" PRIu64 ", size = %" PRIu64 ", image = %" PRIu64, setup->partition_offset, setup->partition_size, old_image_size);
2791
2792 if ((UINT64_MAX - setup->partition_offset) < setup->partition_size ||
2793 setup->partition_offset + setup->partition_size > old_image_size)
2794 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Old partition doesn't fit in backing storage, refusing.");
2795
2796 if (S_ISREG(st.st_mode)) {
2797 uint64_t partition_table_extra;
2798
2799 partition_table_extra = old_image_size - setup->partition_size;
2800 if (new_image_size <= partition_table_extra)
2801 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "New size smaller than partition table metadata.");
2802
2803 new_partition_size = DISK_SIZE_ROUND_DOWN(new_image_size - partition_table_extra);
2804 } else {
2805 uint64_t new_partition_size_rounded;
2806
2807 assert(S_ISBLK(st.st_mode));
2808
2809 new_partition_size_rounded = DISK_SIZE_ROUND_DOWN(h->disk_size);
2810
2811 if (h->disk_size == setup->partition_size ||
2812 new_partition_size_rounded == setup->partition_size) {
2813 log_info("Partition size already matching, skipping operation.");
2814 return 0;
2815 }
2816
2817 new_partition_size = new_partition_size_rounded;
2818 }
2819
2820 if ((UINT64_MAX - setup->partition_offset) < new_partition_size ||
2821 setup->partition_offset + new_partition_size > new_image_size)
2822 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "New partition doesn't fit into backing storage, refusing.");
2823
2824 crypto_offset = sym_crypt_get_data_offset(setup->crypt_device);
2825 if (setup->partition_size / 512U <= crypto_offset)
2826 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Weird, old crypto payload offset doesn't actually fit in partition size?");
2827 if (new_partition_size / 512U <= crypto_offset)
2828 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "New size smaller than crypto payload offset?");
2829
2830 old_fs_size = (setup->partition_size / 512U - crypto_offset) * 512U;
2831 new_fs_size = DISK_SIZE_ROUND_DOWN((new_partition_size / 512U - crypto_offset) * 512U);
2832
2833 /* Before we start doing anything, let's figure out if we actually can */
2834 resize_type = can_resize_fs(setup->root_fd, old_fs_size, new_fs_size);
2835 if (resize_type < 0)
2836 return resize_type;
2837 if (resize_type == CAN_RESIZE_OFFLINE && already_activated)
2838 return log_error_errno(SYNTHETIC_ERRNO(ETXTBSY), "File systems of this type can only be resized offline, but is currently online.");
2839
2840 log_info("Ready to resize image size %s → %s, partition size %s → %s, file system size %s → %s.",
2841 FORMAT_BYTES(old_image_size),
2842 FORMAT_BYTES(new_image_size),
2843 FORMAT_BYTES(setup->partition_size),
2844 FORMAT_BYTES(new_partition_size),
2845 FORMAT_BYTES(old_fs_size),
2846 FORMAT_BYTES(new_fs_size));
2847
2848 r = prepare_resize_partition(
2849 image_fd,
2850 setup->partition_offset,
2851 setup->partition_size,
2852 new_partition_size,
2853 &disk_uuid,
2854 &table);
2855 if (r < 0)
2856 return r;
2857
2858 if (new_fs_size > old_fs_size) {
2859
2860 if (S_ISREG(st.st_mode)) {
2861 /* Grow file size */
2862 r = home_truncate(h, image_fd, ip, new_image_size);
2863 if (r < 0)
2864 return r;
2865
2866 log_info("Growing of image file completed.");
2867 }
2868
2869 /* Make sure loopback device sees the new bigger size */
2870 r = loop_device_refresh_size(setup->loop, UINT64_MAX, new_partition_size);
2871 if (r == -ENOTTY)
2872 log_debug_errno(r, "Device is not a loopback device, not refreshing size.");
2873 else if (r < 0)
2874 return log_error_errno(r, "Failed to refresh loopback device size: %m");
2875 else
2876 log_info("Refreshing loop device size completed.");
2877
2878 r = apply_resize_partition(image_fd, disk_uuid, table);
2879 if (r < 0)
2880 return r;
2881 if (r > 0)
2882 log_info("Growing of partition completed.");
2883
2884 if (ioctl(image_fd, BLKRRPART, 0) < 0)
2885 log_debug_errno(errno, "BLKRRPART failed on block device, ignoring: %m");
2886
2887 /* Tell LUKS about the new bigger size too */
2888 r = sym_crypt_resize(setup->crypt_device, setup->dm_name, new_fs_size / 512U);
2889 if (r < 0)
2890 return log_error_errno(r, "Failed to grow LUKS device: %m");
2891
2892 log_info("LUKS device growing completed.");
2893 } else {
2894 r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
2895 if (r < 0)
2896 return r;
2897
2898 if (S_ISREG(st.st_mode)) {
2899 if (user_record_luks_discard(h))
2900 /* Before we shrink, let's trim the file system, so that we need less space on disk during the shrinking */
2901 (void) run_fitrim(setup->root_fd);
2902 else {
2903 /* If discard is off, let's ensure all backing blocks are allocated, so that our resize operation doesn't fail half-way */
2904 r = run_fallocate(image_fd, &st);
2905 if (r < 0)
2906 return r;
2907 }
2908 }
2909 }
2910
2911 /* Now resize the file system */
2912 if (resize_type == CAN_RESIZE_ONLINE)
2913 r = resize_fs(setup->root_fd, new_fs_size, NULL);
2914 else
2915 r = ext4_offline_resize_fs(setup, new_fs_size, user_record_luks_discard(h), user_record_mount_flags(h));
2916 if (r < 0)
2917 return log_error_errno(r, "Failed to resize file system: %m");
2918
2919 log_info("File system resizing completed.");
2920
2921 /* Immediately sync afterwards */
2922 r = home_sync_and_statfs(setup->root_fd, NULL);
2923 if (r < 0)
2924 return r;
2925
2926 if (new_fs_size < old_fs_size) {
2927
2928 /* Shrink the LUKS device now, matching the new file system size */
2929 r = sym_crypt_resize(setup->crypt_device, setup->dm_name, new_fs_size / 512);
2930 if (r < 0)
2931 return log_error_errno(r, "Failed to shrink LUKS device: %m");
2932
2933 log_info("LUKS device shrinking completed.");
2934
2935 if (S_ISREG(st.st_mode)) {
2936 /* Shrink the image file */
2937 if (ftruncate(image_fd, new_image_size) < 0)
2938 return log_error_errno(errno, "Failed to shrink image file %s: %m", ip);
2939
2940 log_info("Shrinking of image file completed.");
2941 }
2942
2943 /* Refresh the loop devices size */
2944 r = loop_device_refresh_size(setup->loop, UINT64_MAX, new_partition_size);
2945 if (r == -ENOTTY)
2946 log_debug_errno(r, "Device is not a loopback device, not refreshing size.");
2947 else if (r < 0)
2948 return log_error_errno(r, "Failed to refresh loopback device size: %m");
2949 else
2950 log_info("Refreshing loop device size completed.");
2951
2952 r = apply_resize_partition(image_fd, disk_uuid, table);
2953 if (r < 0)
2954 return r;
2955 if (r > 0)
2956 log_info("Shrinking of partition completed.");
2957
2958 if (ioctl(image_fd, BLKRRPART, 0) < 0)
2959 log_debug_errno(errno, "BLKRRPART failed on block device, ignoring: %m");
2960 } else {
2961 r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
2962 if (r < 0)
2963 return r;
2964 }
2965
2966 r = home_store_header_identity_luks(new_home, setup, header_home);
2967 if (r < 0)
2968 return r;
2969
2970 r = home_extend_embedded_identity(new_home, h, setup);
2971 if (r < 0)
2972 return r;
2973
2974 if (user_record_luks_discard(h))
2975 (void) run_fitrim(setup->root_fd);
2976
2977 r = home_sync_and_statfs(setup->root_fd, &sfs);
2978 if (r < 0)
2979 return r;
2980
2981 r = home_setup_undo(setup);
2982 if (r < 0)
2983 return r;
2984
2985 log_info("Everything completed.");
2986
2987 print_size_summary(new_image_size, new_fs_size, &sfs);
2988
2989 *ret_home = TAKE_PTR(new_home);
2990 return 0;
2991 }
2992
2993 int home_passwd_luks(
2994 UserRecord *h,
2995 HomeSetup *setup,
2996 PasswordCache *cache, /* the passwords acquired via PKCS#11/FIDO2 security tokens */
2997 char **effective_passwords /* new passwords */) {
2998
2999 size_t volume_key_size, max_key_slots, n_effective;
3000 _cleanup_(erase_and_freep) void *volume_key = NULL;
3001 struct crypt_pbkdf_type good_pbkdf, minimal_pbkdf;
3002 const char *type;
3003 char **list;
3004 int r;
3005
3006 assert(h);
3007 assert(user_record_storage(h) == USER_LUKS);
3008 assert(setup);
3009
3010 r = dlopen_cryptsetup();
3011 if (r < 0)
3012 return r;
3013
3014 type = sym_crypt_get_type(setup->crypt_device);
3015 if (!type)
3016 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine crypto device type.");
3017
3018 r = sym_crypt_keyslot_max(type);
3019 if (r <= 0)
3020 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine number of key slots.");
3021 max_key_slots = r;
3022
3023 r = sym_crypt_get_volume_key_size(setup->crypt_device);
3024 if (r <= 0)
3025 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine volume key size.");
3026 volume_key_size = (size_t) r;
3027
3028 volume_key = malloc(volume_key_size);
3029 if (!volume_key)
3030 return log_oom();
3031
3032 r = -ENOKEY;
3033 FOREACH_POINTER(list, cache->pkcs11_passwords, cache->fido2_passwords, h->password) {
3034 r = luks_try_passwords(setup->crypt_device, list, volume_key, &volume_key_size);
3035 if (r != -ENOKEY)
3036 break;
3037 }
3038 if (r == -ENOKEY)
3039 return log_error_errno(SYNTHETIC_ERRNO(ENOKEY), "Failed to unlock LUKS superblock with supplied passwords.");
3040 if (r < 0)
3041 return log_error_errno(r, "Failed to unlocks LUKS superblock: %m");
3042
3043 n_effective = strv_length(effective_passwords);
3044
3045 build_good_pbkdf(&good_pbkdf, h);
3046 build_minimal_pbkdf(&minimal_pbkdf, h);
3047
3048 for (size_t i = 0; i < max_key_slots; i++) {
3049 r = sym_crypt_keyslot_destroy(setup->crypt_device, i);
3050 if (r < 0 && !IN_SET(r, -ENOENT, -EINVAL)) /* Returns EINVAL or ENOENT if there's no key in this slot already */
3051 return log_error_errno(r, "Failed to destroy LUKS password: %m");
3052
3053 if (i >= n_effective) {
3054 if (r >= 0)
3055 log_info("Destroyed LUKS key slot %zu.", i);
3056 continue;
3057 }
3058
3059 if (strv_contains(cache->pkcs11_passwords, effective_passwords[i]) ||
3060 strv_contains(cache->fido2_passwords, effective_passwords[i])) {
3061 log_debug("Using minimal PBKDF for slot %zu", i);
3062 r = sym_crypt_set_pbkdf_type(setup->crypt_device, &minimal_pbkdf);
3063 } else {
3064 log_debug("Using good PBKDF for slot %zu", i);
3065 r = sym_crypt_set_pbkdf_type(setup->crypt_device, &good_pbkdf);
3066 }
3067 if (r < 0)
3068 return log_error_errno(r, "Failed to tweak PBKDF for slot %zu: %m", i);
3069
3070 r = sym_crypt_keyslot_add_by_volume_key(
3071 setup->crypt_device,
3072 i,
3073 volume_key,
3074 volume_key_size,
3075 effective_passwords[i],
3076 strlen(effective_passwords[i]));
3077 if (r < 0)
3078 return log_error_errno(r, "Failed to set up LUKS password: %m");
3079
3080 log_info("Updated LUKS key slot %zu.", i);
3081 }
3082
3083 return 1;
3084 }
3085
3086 int home_lock_luks(UserRecord *h) {
3087 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
3088 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
3089 _cleanup_close_ int root_fd = -1;
3090 const char *p;
3091 int r;
3092
3093 assert(h);
3094
3095 assert_se(p = user_record_home_directory(h));
3096 root_fd = open(p, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
3097 if (root_fd < 0)
3098 return log_error_errno(errno, "Failed to open home directory: %m");
3099
3100 r = make_dm_names(h->user_name, &dm_name, &dm_node);
3101 if (r < 0)
3102 return r;
3103
3104 r = dlopen_cryptsetup();
3105 if (r < 0)
3106 return r;
3107
3108 r = sym_crypt_init_by_name(&cd, dm_name);
3109 if (r < 0)
3110 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
3111
3112 log_info("Discovered used LUKS device %s.", dm_node);
3113 cryptsetup_enable_logging(cd);
3114
3115 if (syncfs(root_fd) < 0) /* Snake oil, but let's better be safe than sorry */
3116 return log_error_errno(errno, "Failed to synchronize file system %s: %m", p);
3117
3118 root_fd = safe_close(root_fd);
3119
3120 log_info("File system synchronized.");
3121
3122 /* Note that we don't invoke FIFREEZE here, it appears libcryptsetup/device-mapper already does that on its own for us */
3123
3124 r = sym_crypt_suspend(cd, dm_name);
3125 if (r < 0)
3126 return log_error_errno(r, "Failed to suspend cryptsetup device: %s: %m", dm_node);
3127
3128 log_info("LUKS device suspended.");
3129 return 0;
3130 }
3131
3132 static int luks_try_resume(
3133 struct crypt_device *cd,
3134 const char *dm_name,
3135 char **password) {
3136
3137 char **pp;
3138 int r;
3139
3140 assert(cd);
3141 assert(dm_name);
3142
3143 STRV_FOREACH(pp, password) {
3144 r = sym_crypt_resume_by_passphrase(
3145 cd,
3146 dm_name,
3147 CRYPT_ANY_SLOT,
3148 *pp,
3149 strlen(*pp));
3150 if (r >= 0) {
3151 log_info("Resumed LUKS device %s.", dm_name);
3152 return 0;
3153 }
3154
3155 log_debug_errno(r, "Password %zu didn't work for resuming device: %m", (size_t) (pp - password));
3156 }
3157
3158 return -ENOKEY;
3159 }
3160
3161 int home_unlock_luks(UserRecord *h, PasswordCache *cache) {
3162 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
3163 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
3164 char **list;
3165 int r;
3166
3167 assert(h);
3168
3169 r = make_dm_names(h->user_name, &dm_name, &dm_node);
3170 if (r < 0)
3171 return r;
3172
3173 r = dlopen_cryptsetup();
3174 if (r < 0)
3175 return r;
3176
3177 r = sym_crypt_init_by_name(&cd, dm_name);
3178 if (r < 0)
3179 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
3180
3181 log_info("Discovered used LUKS device %s.", dm_node);
3182 cryptsetup_enable_logging(cd);
3183
3184 r = -ENOKEY;
3185 FOREACH_POINTER(list, cache->pkcs11_passwords, cache->fido2_passwords, h->password) {
3186 r = luks_try_resume(cd, dm_name, list);
3187 if (r != -ENOKEY)
3188 break;
3189 }
3190 if (r == -ENOKEY)
3191 return log_error_errno(r, "No valid password for LUKS superblock.");
3192 if (r < 0)
3193 return log_error_errno(r, "Failed to resume LUKS superblock: %m");
3194
3195 log_info("LUKS device resumed.");
3196 return 0;
3197 }
Unnamed repository; edit this file 'description' to name the repository.