]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/home/homework-luks.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
homework: mae sure PasswordCache is really optional
[thirdparty/systemd.git] / src / home / homework-luks.c
1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3 #include <libfdisk.h>
4 #include <linux/loop.h>
5 #include <poll.h>
6 #include <sys/file.h>
7 #include <sys/ioctl.h>
8 #include <sys/mount.h>
9 #include <sys/xattr.h>
10
11 #if HAVE_VALGRIND_MEMCHECK_H
12 #include <valgrind/memcheck.h>
13 #endif
14
15 #include "sd-daemon.h"
16
17 #include "blkid-util.h"
18 #include "blockdev-util.h"
19 #include "btrfs-util.h"
20 #include "chattr-util.h"
21 #include "dm-util.h"
22 #include "env-util.h"
23 #include "errno-util.h"
24 #include "fd-util.h"
25 #include "fileio.h"
26 #include "fs-util.h"
27 #include "fsck-util.h"
28 #include "home-util.h"
29 #include "homework-luks.h"
30 #include "homework-mount.h"
31 #include "id128-util.h"
32 #include "io-util.h"
33 #include "memory-util.h"
34 #include "missing_magic.h"
35 #include "mkdir.h"
36 #include "mkfs-util.h"
37 #include "mount-util.h"
38 #include "openssl-util.h"
39 #include "parse-util.h"
40 #include "path-util.h"
41 #include "process-util.h"
42 #include "random-util.h"
43 #include "resize-fs.h"
44 #include "stat-util.h"
45 #include "strv.h"
46 #include "sync-util.h"
47 #include "tmpfile-util.h"
48
49 /* Round down to the nearest 4K size. Given that newer hardware generally prefers 4K sectors, let's align our
50 * partitions to that too. In the worst case we'll waste 3.5K per partition that way, but I think I can live
51 * with that. */
52 #define DISK_SIZE_ROUND_DOWN(x) ((x) & ~UINT64_C(4095))
53
54 /* Rounds up to the nearest 4K boundary. Returns UINT64_MAX on overflow */
55 #define DISK_SIZE_ROUND_UP(x) \
56 ({ \
57 uint64_t _x = (x); \
58 _x > UINT64_MAX - 4095U ? UINT64_MAX : (_x + 4095U) & ~UINT64_C(4095); \
59 })
60
61
62 int run_mark_dirty(int fd, bool b) {
63 char x = '1';
64 int r, ret;
65
66 /* Sets or removes the 'user.home-dirty' xattr on the specified file. We use this to detect when a
67 * home directory was not properly unmounted. */
68
69 assert(fd >= 0);
70
71 r = fd_verify_regular(fd);
72 if (r < 0)
73 return r;
74
75 if (b) {
76 ret = fsetxattr(fd, "user.home-dirty", &x, 1, XATTR_CREATE);
77 if (ret < 0 && errno != EEXIST)
78 return log_debug_errno(errno, "Could not mark home directory as dirty: %m");
79
80 } else {
81 r = fsync_full(fd);
82 if (r < 0)
83 return log_debug_errno(r, "Failed to synchronize image before marking it clean: %m");
84
85 ret = fremovexattr(fd, "user.home-dirty");
86 if (ret < 0 && errno != ENODATA)
87 return log_debug_errno(errno, "Could not mark home directory as clean: %m");
88 }
89
90 r = fsync_full(fd);
91 if (r < 0)
92 return log_debug_errno(r, "Failed to synchronize dirty flag to disk: %m");
93
94 return ret >= 0;
95 }
96
97 int run_mark_dirty_by_path(const char *path, bool b) {
98 _cleanup_close_ int fd = -1;
99
100 assert(path);
101
102 fd = open(path, O_RDWR|O_CLOEXEC|O_NOCTTY);
103 if (fd < 0)
104 return log_debug_errno(errno, "Failed to open %s to mark dirty or clean: %m", path);
105
106 return run_mark_dirty(fd, b);
107 }
108
109 static int probe_file_system_by_fd(
110 int fd,
111 char **ret_fstype,
112 sd_id128_t *ret_uuid) {
113
114 _cleanup_(blkid_free_probep) blkid_probe b = NULL;
115 _cleanup_free_ char *s = NULL;
116 const char *fstype = NULL, *uuid = NULL;
117 sd_id128_t id;
118 int r;
119
120 assert(fd >= 0);
121 assert(ret_fstype);
122 assert(ret_uuid);
123
124 b = blkid_new_probe();
125 if (!b)
126 return -ENOMEM;
127
128 errno = 0;
129 r = blkid_probe_set_device(b, fd, 0, 0);
130 if (r != 0)
131 return errno > 0 ? -errno : -ENOMEM;
132
133 (void) blkid_probe_enable_superblocks(b, 1);
134 (void) blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE|BLKID_SUBLKS_UUID);
135
136 errno = 0;
137 r = blkid_do_safeprobe(b);
138 if (IN_SET(r, -2, 1)) /* nothing found or ambiguous result */
139 return -ENOPKG;
140 if (r != 0)
141 return errno > 0 ? -errno : -EIO;
142
143 (void) blkid_probe_lookup_value(b, "TYPE", &fstype, NULL);
144 if (!fstype)
145 return -ENOPKG;
146
147 (void) blkid_probe_lookup_value(b, "UUID", &uuid, NULL);
148 if (!uuid)
149 return -ENOPKG;
150
151 r = sd_id128_from_string(uuid, &id);
152 if (r < 0)
153 return r;
154
155 s = strdup(fstype);
156 if (!s)
157 return -ENOMEM;
158
159 *ret_fstype = TAKE_PTR(s);
160 *ret_uuid = id;
161
162 return 0;
163 }
164
165 static int probe_file_system_by_path(const char *path, char **ret_fstype, sd_id128_t *ret_uuid) {
166 _cleanup_close_ int fd = -1;
167
168 fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
169 if (fd < 0)
170 return -errno;
171
172 return probe_file_system_by_fd(fd, ret_fstype, ret_uuid);
173 }
174
175 static int block_get_size_by_fd(int fd, uint64_t *ret) {
176 struct stat st;
177
178 assert(fd >= 0);
179 assert(ret);
180
181 if (fstat(fd, &st) < 0)
182 return -errno;
183
184 if (!S_ISBLK(st.st_mode))
185 return -ENOTBLK;
186
187 if (ioctl(fd, BLKGETSIZE64, ret) < 0)
188 return -errno;
189
190 return 0;
191 }
192
193 static int block_get_size_by_path(const char *path, uint64_t *ret) {
194 _cleanup_close_ int fd = -1;
195
196 fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
197 if (fd < 0)
198 return -errno;
199
200 return block_get_size_by_fd(fd, ret);
201 }
202
203 static int run_fsck(const char *node, const char *fstype) {
204 int r, exit_status;
205 pid_t fsck_pid;
206
207 assert(node);
208 assert(fstype);
209
210 r = fsck_exists(fstype);
211 if (r < 0)
212 return log_error_errno(r, "Failed to check if fsck for file system %s exists: %m", fstype);
213 if (r == 0) {
214 log_warning("No fsck for file system %s installed, ignoring.", fstype);
215 return 0;
216 }
217
218 r = safe_fork("(fsck)",
219 FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_STDOUT_TO_STDERR|FORK_CLOSE_ALL_FDS,
220 &fsck_pid);
221 if (r < 0)
222 return r;
223 if (r == 0) {
224 /* Child */
225 execl("/sbin/fsck", "/sbin/fsck", "-aTl", node, NULL);
226 log_open();
227 log_error_errno(errno, "Failed to execute fsck: %m");
228 _exit(FSCK_OPERATIONAL_ERROR);
229 }
230
231 exit_status = wait_for_terminate_and_check("fsck", fsck_pid, WAIT_LOG_ABNORMAL);
232 if (exit_status < 0)
233 return exit_status;
234 if ((exit_status & ~FSCK_ERROR_CORRECTED) != 0) {
235 log_warning("fsck failed with exit status %i.", exit_status);
236
237 if ((exit_status & (FSCK_SYSTEM_SHOULD_REBOOT|FSCK_ERRORS_LEFT_UNCORRECTED)) != 0)
238 return log_error_errno(SYNTHETIC_ERRNO(EIO), "File system is corrupted, refusing.");
239
240 log_warning("Ignoring fsck error.");
241 }
242
243 log_info("File system check completed.");
244
245 return 1;
246 }
247
248 static int luks_try_passwords(
249 struct crypt_device *cd,
250 char **passwords,
251 void *volume_key,
252 size_t *volume_key_size) {
253
254 char **pp;
255 int r;
256
257 assert(cd);
258
259 STRV_FOREACH(pp, passwords) {
260 size_t vks = *volume_key_size;
261
262 r = sym_crypt_volume_key_get(
263 cd,
264 CRYPT_ANY_SLOT,
265 volume_key,
266 &vks,
267 *pp,
268 strlen(*pp));
269 if (r >= 0) {
270 *volume_key_size = vks;
271 return 0;
272 }
273
274 log_debug_errno(r, "Password %zu didn't work for unlocking LUKS superblock: %m", (size_t) (pp - passwords));
275 }
276
277 return -ENOKEY;
278 }
279
280 static int luks_setup(
281 const char *node,
282 const char *dm_name,
283 sd_id128_t uuid,
284 const char *cipher,
285 const char *cipher_mode,
286 uint64_t volume_key_size,
287 char **passwords,
288 const PasswordCache *cache,
289 bool discard,
290 struct crypt_device **ret,
291 sd_id128_t *ret_found_uuid,
292 void **ret_volume_key,
293 size_t *ret_volume_key_size) {
294
295 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
296 _cleanup_(erase_and_freep) void *vk = NULL;
297 sd_id128_t p;
298 size_t vks;
299 char **list;
300 int r;
301
302 assert(node);
303 assert(dm_name);
304 assert(ret);
305
306 r = sym_crypt_init(&cd, node);
307 if (r < 0)
308 return log_error_errno(r, "Failed to allocate libcryptsetup context: %m");
309
310 cryptsetup_enable_logging(cd);
311
312 r = sym_crypt_load(cd, CRYPT_LUKS2, NULL);
313 if (r < 0)
314 return log_error_errno(r, "Failed to load LUKS superblock: %m");
315
316 r = sym_crypt_get_volume_key_size(cd);
317 if (r <= 0)
318 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine LUKS volume key size");
319 vks = (size_t) r;
320
321 if (!sd_id128_is_null(uuid) || ret_found_uuid) {
322 const char *s;
323
324 s = sym_crypt_get_uuid(cd);
325 if (!s)
326 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has no UUID.");
327
328 r = sd_id128_from_string(s, &p);
329 if (r < 0)
330 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has invalid UUID.");
331
332 /* Check that the UUID matches, if specified */
333 if (!sd_id128_is_null(uuid) &&
334 !sd_id128_equal(uuid, p))
335 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has wrong UUID.");
336 }
337
338 if (cipher && !streq_ptr(cipher, sym_crypt_get_cipher(cd)))
339 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong cipher.");
340
341 if (cipher_mode && !streq_ptr(cipher_mode, sym_crypt_get_cipher_mode(cd)))
342 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong cipher mode.");
343
344 if (volume_key_size != UINT64_MAX && vks != volume_key_size)
345 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong volume key size.");
346
347 vk = malloc(vks);
348 if (!vk)
349 return log_oom();
350
351 r = -ENOKEY;
352 FOREACH_POINTER(list,
353 cache ? cache->pkcs11_passwords : NULL,
354 cache ? cache->fido2_passwords : NULL,
355 passwords) {
356 r = luks_try_passwords(cd, list, vk, &vks);
357 if (r != -ENOKEY)
358 break;
359 }
360 if (r == -ENOKEY)
361 return log_error_errno(r, "No valid password for LUKS superblock.");
362 if (r < 0)
363 return log_error_errno(r, "Failed to unlocks LUKS superblock: %m");
364
365 r = sym_crypt_activate_by_volume_key(
366 cd,
367 dm_name,
368 vk, vks,
369 discard ? CRYPT_ACTIVATE_ALLOW_DISCARDS : 0);
370 if (r < 0)
371 return log_error_errno(r, "Failed to unlock LUKS superblock: %m");
372
373 log_info("Setting up LUKS device /dev/mapper/%s completed.", dm_name);
374
375 *ret = TAKE_PTR(cd);
376
377 if (ret_found_uuid) /* Return the UUID actually found if the caller wants to know */
378 *ret_found_uuid = p;
379 if (ret_volume_key)
380 *ret_volume_key = TAKE_PTR(vk);
381 if (ret_volume_key_size)
382 *ret_volume_key_size = vks;
383
384 return 0;
385 }
386
387 static int luks_open(
388 const char *dm_name,
389 char **passwords,
390 const PasswordCache *cache,
391 struct crypt_device **ret,
392 sd_id128_t *ret_found_uuid,
393 void **ret_volume_key,
394 size_t *ret_volume_key_size) {
395
396 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
397 _cleanup_(erase_and_freep) void *vk = NULL;
398 sd_id128_t p;
399 char **list;
400 size_t vks;
401 int r;
402
403 assert(dm_name);
404 assert(ret);
405
406 /* Opens a LUKS device that is already set up. Re-validates the password while doing so (which also
407 * provides us with the volume key, which we want). */
408
409 r = sym_crypt_init_by_name(&cd, dm_name);
410 if (r < 0)
411 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
412
413 cryptsetup_enable_logging(cd);
414
415 r = sym_crypt_load(cd, CRYPT_LUKS2, NULL);
416 if (r < 0)
417 return log_error_errno(r, "Failed to load LUKS superblock: %m");
418
419 r = sym_crypt_get_volume_key_size(cd);
420 if (r <= 0)
421 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine LUKS volume key size");
422 vks = (size_t) r;
423
424 if (ret_found_uuid) {
425 const char *s;
426
427 s = sym_crypt_get_uuid(cd);
428 if (!s)
429 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has no UUID.");
430
431 r = sd_id128_from_string(s, &p);
432 if (r < 0)
433 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has invalid UUID.");
434 }
435
436 vk = malloc(vks);
437 if (!vk)
438 return log_oom();
439
440 r = -ENOKEY;
441 FOREACH_POINTER(list,
442 cache ? cache->pkcs11_passwords : NULL,
443 cache ? cache->fido2_passwords : NULL,
444 passwords) {
445 r = luks_try_passwords(cd, list, vk, &vks);
446 if (r != -ENOKEY)
447 break;
448 }
449 if (r == -ENOKEY)
450 return log_error_errno(r, "No valid password for LUKS superblock.");
451 if (r < 0)
452 return log_error_errno(r, "Failed to unlocks LUKS superblock: %m");
453
454 log_info("Discovered used LUKS device /dev/mapper/%s, and validated password.", dm_name);
455
456 /* This is needed so that crypt_resize() can operate correctly for pre-existing LUKS devices. We need
457 * to tell libcryptsetup the volume key explicitly, so that it is in the kernel keyring. */
458 r = sym_crypt_activate_by_volume_key(cd, NULL, vk, vks, CRYPT_ACTIVATE_KEYRING_KEY);
459 if (r < 0)
460 return log_error_errno(r, "Failed to upload volume key again: %m");
461
462 log_info("Successfully re-activated LUKS device.");
463
464 *ret = TAKE_PTR(cd);
465
466 if (ret_found_uuid)
467 *ret_found_uuid = p;
468 if (ret_volume_key)
469 *ret_volume_key = TAKE_PTR(vk);
470 if (ret_volume_key_size)
471 *ret_volume_key_size = vks;
472
473 return 0;
474 }
475
476 static int fs_validate(
477 const char *dm_node,
478 sd_id128_t uuid,
479 char **ret_fstype,
480 sd_id128_t *ret_found_uuid) {
481
482 _cleanup_free_ char *fstype = NULL;
483 sd_id128_t u;
484 int r;
485
486 assert(dm_node);
487 assert(ret_fstype);
488
489 r = probe_file_system_by_path(dm_node, &fstype, &u);
490 if (r < 0)
491 return log_error_errno(r, "Failed to probe file system: %m");
492
493 /* Limit the set of supported file systems a bit, as protection against little tested kernel file
494 * systems. Also, we only support the resize ioctls for these file systems. */
495 if (!supported_fstype(fstype))
496 return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "Image contains unsupported file system: %s", strna(fstype));
497
498 if (!sd_id128_is_null(uuid) &&
499 !sd_id128_equal(uuid, u))
500 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "File system has wrong UUID.");
501
502 log_info("Probing file system completed (found %s).", fstype);
503
504 *ret_fstype = TAKE_PTR(fstype);
505
506 if (ret_found_uuid) /* Return the UUID actually found if the caller wants to know */
507 *ret_found_uuid = u;
508
509 return 0;
510 }
511
512 static int make_dm_names(const char *user_name, char **ret_dm_name, char **ret_dm_node) {
513 _cleanup_free_ char *name = NULL, *node = NULL;
514
515 assert(user_name);
516 assert(ret_dm_name);
517 assert(ret_dm_node);
518
519 name = strjoin("home-", user_name);
520 if (!name)
521 return log_oom();
522
523 node = path_join("/dev/mapper/", name);
524 if (!node)
525 return log_oom();
526
527 *ret_dm_name = TAKE_PTR(name);
528 *ret_dm_node = TAKE_PTR(node);
529 return 0;
530 }
531
532 static int luks_validate(
533 int fd,
534 const char *label,
535 sd_id128_t partition_uuid,
536 sd_id128_t *ret_partition_uuid,
537 uint64_t *ret_offset,
538 uint64_t *ret_size) {
539
540 _cleanup_(blkid_free_probep) blkid_probe b = NULL;
541 sd_id128_t found_partition_uuid = SD_ID128_NULL;
542 const char *fstype = NULL, *pttype = NULL;
543 blkid_loff_t offset = 0, size = 0;
544 blkid_partlist pl;
545 bool found = false;
546 int r, n;
547
548 assert(fd >= 0);
549 assert(label);
550 assert(ret_offset);
551 assert(ret_size);
552
553 b = blkid_new_probe();
554 if (!b)
555 return -ENOMEM;
556
557 errno = 0;
558 r = blkid_probe_set_device(b, fd, 0, 0);
559 if (r != 0)
560 return errno > 0 ? -errno : -ENOMEM;
561
562 (void) blkid_probe_enable_superblocks(b, 1);
563 (void) blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE);
564 (void) blkid_probe_enable_partitions(b, 1);
565 (void) blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
566
567 errno = 0;
568 r = blkid_do_safeprobe(b);
569 if (IN_SET(r, -2, 1)) /* nothing found or ambiguous result */
570 return -ENOPKG;
571 if (r != 0)
572 return errno > 0 ? -errno : -EIO;
573
574 (void) blkid_probe_lookup_value(b, "TYPE", &fstype, NULL);
575 if (streq_ptr(fstype, "crypto_LUKS")) {
576 /* Directly a LUKS image */
577 *ret_offset = 0;
578 *ret_size = UINT64_MAX; /* full disk */
579 *ret_partition_uuid = SD_ID128_NULL;
580 return 0;
581 } else if (fstype)
582 return -ENOPKG;
583
584 (void) blkid_probe_lookup_value(b, "PTTYPE", &pttype, NULL);
585 if (!streq_ptr(pttype, "gpt"))
586 return -ENOPKG;
587
588 errno = 0;
589 pl = blkid_probe_get_partitions(b);
590 if (!pl)
591 return errno > 0 ? -errno : -ENOMEM;
592
593 errno = 0;
594 n = blkid_partlist_numof_partitions(pl);
595 if (n < 0)
596 return errno > 0 ? -errno : -EIO;
597
598 for (int i = 0; i < n; i++) {
599 blkid_partition pp;
600 sd_id128_t id = SD_ID128_NULL;
601 const char *sid;
602
603 errno = 0;
604 pp = blkid_partlist_get_partition(pl, i);
605 if (!pp)
606 return errno > 0 ? -errno : -EIO;
607
608 if (!streq_ptr(blkid_partition_get_type_string(pp), "773f91ef-66d4-49b5-bd83-d683bf40ad16"))
609 continue;
610
611 if (!streq_ptr(blkid_partition_get_name(pp), label))
612 continue;
613
614 sid = blkid_partition_get_uuid(pp);
615 if (sid) {
616 r = sd_id128_from_string(sid, &id);
617 if (r < 0)
618 log_debug_errno(r, "Couldn't parse partition UUID %s, weird: %m", sid);
619
620 if (!sd_id128_is_null(partition_uuid) && !sd_id128_equal(id, partition_uuid))
621 continue;
622 }
623
624 if (found)
625 return -ENOPKG;
626
627 offset = blkid_partition_get_start(pp);
628 size = blkid_partition_get_size(pp);
629 found_partition_uuid = id;
630
631 found = true;
632 }
633
634 if (!found)
635 return -ENOPKG;
636
637 if (offset < 0)
638 return -EINVAL;
639 if ((uint64_t) offset > UINT64_MAX / 512U)
640 return -EINVAL;
641 if (size <= 0)
642 return -EINVAL;
643 if ((uint64_t) size > UINT64_MAX / 512U)
644 return -EINVAL;
645
646 *ret_offset = offset * 512U;
647 *ret_size = size * 512U;
648 *ret_partition_uuid = found_partition_uuid;
649
650 return 0;
651 }
652
653 static int crypt_device_to_evp_cipher(struct crypt_device *cd, const EVP_CIPHER **ret) {
654 _cleanup_free_ char *cipher_name = NULL;
655 const char *cipher, *cipher_mode, *e;
656 size_t key_size, key_bits;
657 const EVP_CIPHER *cc;
658 int r;
659
660 assert(cd);
661
662 /* Let's find the right OpenSSL EVP_CIPHER object that matches the encryption settings of the LUKS
663 * device */
664
665 cipher = sym_crypt_get_cipher(cd);
666 if (!cipher)
667 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot get cipher from LUKS device.");
668
669 cipher_mode = sym_crypt_get_cipher_mode(cd);
670 if (!cipher_mode)
671 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot get cipher mode from LUKS device.");
672
673 e = strchr(cipher_mode, '-');
674 if (e)
675 cipher_mode = strndupa_safe(cipher_mode, e - cipher_mode);
676
677 r = sym_crypt_get_volume_key_size(cd);
678 if (r <= 0)
679 return log_error_errno(r < 0 ? r : SYNTHETIC_ERRNO(EINVAL), "Cannot get volume key size from LUKS device.");
680
681 key_size = r;
682 key_bits = key_size * 8;
683 if (streq(cipher_mode, "xts"))
684 key_bits /= 2;
685
686 if (asprintf(&cipher_name, "%s-%zu-%s", cipher, key_bits, cipher_mode) < 0)
687 return log_oom();
688
689 cc = EVP_get_cipherbyname(cipher_name);
690 if (!cc)
691 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Selected cipher mode '%s' not supported, can't encrypt JSON record.", cipher_name);
692
693 /* Verify that our key length calculations match what OpenSSL thinks */
694 r = EVP_CIPHER_key_length(cc);
695 if (r < 0 || (uint64_t) r != key_size)
696 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Key size of selected cipher doesn't meet our expectations.");
697
698 *ret = cc;
699 return 0;
700 }
701
702 static int luks_validate_home_record(
703 struct crypt_device *cd,
704 UserRecord *h,
705 const void *volume_key,
706 PasswordCache *cache,
707 UserRecord **ret_luks_home_record) {
708
709 int r;
710
711 assert(cd);
712 assert(h);
713
714 for (int token = 0; token < sym_crypt_token_max(CRYPT_LUKS2); token++) {
715 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *rr = NULL;
716 _cleanup_(EVP_CIPHER_CTX_freep) EVP_CIPHER_CTX *context = NULL;
717 _cleanup_(user_record_unrefp) UserRecord *lhr = NULL;
718 _cleanup_free_ void *encrypted = NULL, *iv = NULL;
719 size_t decrypted_size, encrypted_size, iv_size;
720 int decrypted_size_out1, decrypted_size_out2;
721 _cleanup_free_ char *decrypted = NULL;
722 const char *text, *type;
723 crypt_token_info state;
724 JsonVariant *jr, *jiv;
725 unsigned line, column;
726 const EVP_CIPHER *cc;
727
728 state = sym_crypt_token_status(cd, token, &type);
729 if (state == CRYPT_TOKEN_INACTIVE) /* First unconfigured token, give up */
730 break;
731 if (IN_SET(state, CRYPT_TOKEN_INTERNAL, CRYPT_TOKEN_INTERNAL_UNKNOWN, CRYPT_TOKEN_EXTERNAL))
732 continue;
733 if (state != CRYPT_TOKEN_EXTERNAL_UNKNOWN)
734 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unexpected token state of token %i: %i", token, (int) state);
735
736 if (!streq(type, "systemd-homed"))
737 continue;
738
739 r = sym_crypt_token_json_get(cd, token, &text);
740 if (r < 0)
741 return log_error_errno(r, "Failed to read LUKS token %i: %m", token);
742
743 r = json_parse(text, JSON_PARSE_SENSITIVE, &v, &line, &column);
744 if (r < 0)
745 return log_error_errno(r, "Failed to parse LUKS token JSON data %u:%u: %m", line, column);
746
747 jr = json_variant_by_key(v, "record");
748 if (!jr)
749 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "LUKS token lacks 'record' field.");
750 jiv = json_variant_by_key(v, "iv");
751 if (!jiv)
752 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "LUKS token lacks 'iv' field.");
753
754 r = json_variant_unbase64(jr, &encrypted, &encrypted_size);
755 if (r < 0)
756 return log_error_errno(r, "Failed to base64 decode record: %m");
757
758 r = json_variant_unbase64(jiv, &iv, &iv_size);
759 if (r < 0)
760 return log_error_errno(r, "Failed to base64 decode IV: %m");
761
762 r = crypt_device_to_evp_cipher(cd, &cc);
763 if (r < 0)
764 return r;
765 if (iv_size > INT_MAX || EVP_CIPHER_iv_length(cc) != (int) iv_size)
766 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "IV size doesn't match.");
767
768 context = EVP_CIPHER_CTX_new();
769 if (!context)
770 return log_oom();
771
772 if (EVP_DecryptInit_ex(context, cc, NULL, volume_key, iv) != 1)
773 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initialize decryption context.");
774
775 decrypted_size = encrypted_size + EVP_CIPHER_key_length(cc) * 2;
776 decrypted = new(char, decrypted_size);
777 if (!decrypted)
778 return log_oom();
779
780 if (EVP_DecryptUpdate(context, (uint8_t*) decrypted, &decrypted_size_out1, encrypted, encrypted_size) != 1)
781 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to decrypt JSON record.");
782
783 assert((size_t) decrypted_size_out1 <= decrypted_size);
784
785 if (EVP_DecryptFinal_ex(context, (uint8_t*) decrypted + decrypted_size_out1, &decrypted_size_out2) != 1)
786 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to finish decryption of JSON record.");
787
788 assert((size_t) decrypted_size_out1 + (size_t) decrypted_size_out2 < decrypted_size);
789 decrypted_size = (size_t) decrypted_size_out1 + (size_t) decrypted_size_out2;
790
791 if (memchr(decrypted, 0, decrypted_size))
792 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Inner NUL byte in JSON record, refusing.");
793
794 decrypted[decrypted_size] = 0;
795
796 r = json_parse(decrypted, JSON_PARSE_SENSITIVE, &rr, NULL, NULL);
797 if (r < 0)
798 return log_error_errno(r, "Failed to parse decrypted JSON record, refusing.");
799
800 lhr = user_record_new();
801 if (!lhr)
802 return log_oom();
803
804 r = user_record_load(lhr, rr, USER_RECORD_LOAD_EMBEDDED|USER_RECORD_PERMISSIVE);
805 if (r < 0)
806 return log_error_errno(r, "Failed to parse user record: %m");
807
808 if (!user_record_compatible(h, lhr))
809 return log_error_errno(SYNTHETIC_ERRNO(EREMCHG), "LUKS home record not compatible with host record, refusing.");
810
811 r = user_record_authenticate(lhr, h, cache, /* strict_verify= */ true);
812 if (r < 0)
813 return r;
814 assert(r > 0); /* Insist that a password was verified */
815
816 *ret_luks_home_record = TAKE_PTR(lhr);
817 return 0;
818 }
819
820 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Couldn't find home record in LUKS2 header, refusing.");
821 }
822
823 static int format_luks_token_text(
824 struct crypt_device *cd,
825 UserRecord *hr,
826 const void *volume_key,
827 char **ret) {
828
829 int r, encrypted_size_out1 = 0, encrypted_size_out2 = 0, iv_size, key_size;
830 _cleanup_(EVP_CIPHER_CTX_freep) EVP_CIPHER_CTX *context = NULL;
831 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
832 _cleanup_free_ void *iv = NULL, *encrypted = NULL;
833 size_t text_length, encrypted_size;
834 _cleanup_free_ char *text = NULL;
835 const EVP_CIPHER *cc;
836
837 assert(cd);
838 assert(hr);
839 assert(volume_key);
840 assert(ret);
841
842 r = crypt_device_to_evp_cipher(cd, &cc);
843 if (r < 0)
844 return r;
845
846 key_size = EVP_CIPHER_key_length(cc);
847 iv_size = EVP_CIPHER_iv_length(cc);
848
849 if (iv_size > 0) {
850 iv = malloc(iv_size);
851 if (!iv)
852 return log_oom();
853
854 r = genuine_random_bytes(iv, iv_size, RANDOM_BLOCK);
855 if (r < 0)
856 return log_error_errno(r, "Failed to generate IV: %m");
857 }
858
859 context = EVP_CIPHER_CTX_new();
860 if (!context)
861 return log_oom();
862
863 if (EVP_EncryptInit_ex(context, cc, NULL, volume_key, iv) != 1)
864 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initialize encryption context.");
865
866 r = json_variant_format(hr->json, 0, &text);
867 if (r < 0)
868 return log_error_errno(r, "Failed to format user record for LUKS: %m");
869
870 text_length = strlen(text);
871 encrypted_size = text_length + 2*key_size - 1;
872
873 encrypted = malloc(encrypted_size);
874 if (!encrypted)
875 return log_oom();
876
877 if (EVP_EncryptUpdate(context, encrypted, &encrypted_size_out1, (uint8_t*) text, text_length) != 1)
878 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to encrypt JSON record.");
879
880 assert((size_t) encrypted_size_out1 <= encrypted_size);
881
882 if (EVP_EncryptFinal_ex(context, (uint8_t*) encrypted + encrypted_size_out1, &encrypted_size_out2) != 1)
883 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to finish encryption of JSON record. ");
884
885 assert((size_t) encrypted_size_out1 + (size_t) encrypted_size_out2 <= encrypted_size);
886
887 r = json_build(&v,
888 JSON_BUILD_OBJECT(
889 JSON_BUILD_PAIR("type", JSON_BUILD_STRING("systemd-homed")),
890 JSON_BUILD_PAIR("keyslots", JSON_BUILD_EMPTY_ARRAY),
891 JSON_BUILD_PAIR("record", JSON_BUILD_BASE64(encrypted, encrypted_size_out1 + encrypted_size_out2)),
892 JSON_BUILD_PAIR("iv", JSON_BUILD_BASE64(iv, iv_size))));
893 if (r < 0)
894 return log_error_errno(r, "Failed to prepare LUKS JSON token object: %m");
895
896 r = json_variant_format(v, 0, ret);
897 if (r < 0)
898 return log_error_errno(r, "Failed to format encrypted user record for LUKS: %m");
899
900 return 0;
901 }
902
903 int home_store_header_identity_luks(
904 UserRecord *h,
905 HomeSetup *setup,
906 UserRecord *old_home) {
907
908 _cleanup_(user_record_unrefp) UserRecord *header_home = NULL;
909 _cleanup_free_ char *text = NULL;
910 int r;
911
912 assert(h);
913
914 if (!setup->crypt_device)
915 return 0;
916
917 assert(setup->volume_key);
918
919 /* Let's store the user's identity record in the LUKS2 "token" header data fields, in an encrypted
920 * fashion. Why that? If we'd rely on the record being embedded in the payload file system itself we
921 * would have to mount the file system before we can validate the JSON record, its signatures and
922 * whether it matches what we are looking for. However, kernel file system implementations are
923 * generally not ready to be used on untrusted media. Hence let's store the record independently of
924 * the file system, so that we can validate it first, and only then mount the file system. To keep
925 * things simple we use the same encryption settings for this record as for the file system itself. */
926
927 r = user_record_clone(h, USER_RECORD_EXTRACT_EMBEDDED|USER_RECORD_PERMISSIVE, &header_home);
928 if (r < 0)
929 return log_error_errno(r, "Failed to determine new header record: %m");
930
931 if (old_home && user_record_equal(old_home, header_home)) {
932 log_debug("Not updating header home record.");
933 return 0;
934 }
935
936 r = format_luks_token_text(setup->crypt_device, header_home, setup->volume_key, &text);
937 if (r < 0)
938 return r;
939
940 for (int token = 0; token < sym_crypt_token_max(CRYPT_LUKS2); token++) {
941 crypt_token_info state;
942 const char *type;
943
944 state = sym_crypt_token_status(setup->crypt_device, token, &type);
945 if (state == CRYPT_TOKEN_INACTIVE) /* First unconfigured token, we are done */
946 break;
947 if (IN_SET(state, CRYPT_TOKEN_INTERNAL, CRYPT_TOKEN_INTERNAL_UNKNOWN, CRYPT_TOKEN_EXTERNAL))
948 continue; /* Not ours */
949 if (state != CRYPT_TOKEN_EXTERNAL_UNKNOWN)
950 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unexpected token state of token %i: %i", token, (int) state);
951
952 if (!streq(type, "systemd-homed"))
953 continue;
954
955 r = sym_crypt_token_json_set(setup->crypt_device, token, text);
956 if (r < 0)
957 return log_error_errno(r, "Failed to set JSON token for slot %i: %m", token);
958
959 /* Now, let's free the text so that for all further matching tokens we all crypt_json_token_set()
960 * with a NULL text in order to invalidate the tokens. */
961 text = mfree(text);
962 }
963
964 if (text)
965 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Didn't find any record token to update.");
966
967 log_info("Wrote LUKS header user record.");
968
969 return 1;
970 }
971
972 int run_fitrim(int root_fd) {
973 struct fstrim_range range = {
974 .len = UINT64_MAX,
975 };
976
977 /* If discarding is on, discard everything right after mounting, so that the discard setting takes
978 * effect on activation. (Also, optionally, trim on logout) */
979
980 assert(root_fd >= 0);
981
982 if (ioctl(root_fd, FITRIM, &range) < 0) {
983 if (ERRNO_IS_NOT_SUPPORTED(errno) || errno == EBADF) {
984 log_debug_errno(errno, "File system does not support FITRIM, not trimming.");
985 return 0;
986 }
987
988 return log_warning_errno(errno, "Failed to invoke FITRIM, ignoring: %m");
989 }
990
991 log_info("Discarded unused %s.", FORMAT_BYTES(range.len));
992 return 1;
993 }
994
995 int run_fitrim_by_path(const char *root_path) {
996 _cleanup_close_ int root_fd = -1;
997
998 root_fd = open(root_path, O_RDONLY|O_DIRECTORY|O_CLOEXEC);
999 if (root_fd < 0)
1000 return log_error_errno(errno, "Failed to open file system '%s' for trimming: %m", root_path);
1001
1002 return run_fitrim(root_fd);
1003 }
1004
1005 int run_fallocate(int backing_fd, const struct stat *st) {
1006 struct stat stbuf;
1007
1008 assert(backing_fd >= 0);
1009
1010 /* If discarding is off, let's allocate the whole image before mounting, so that the setting takes
1011 * effect on activation */
1012
1013 if (!st) {
1014 if (fstat(backing_fd, &stbuf) < 0)
1015 return log_error_errno(errno, "Failed to fstat(): %m");
1016
1017 st = &stbuf;
1018 }
1019
1020 if (!S_ISREG(st->st_mode))
1021 return 0;
1022
1023 if (st->st_blocks >= DIV_ROUND_UP(st->st_size, 512)) {
1024 log_info("Backing file is fully allocated already.");
1025 return 0;
1026 }
1027
1028 if (fallocate(backing_fd, FALLOC_FL_KEEP_SIZE, 0, st->st_size) < 0) {
1029
1030 if (ERRNO_IS_NOT_SUPPORTED(errno)) {
1031 log_debug_errno(errno, "fallocate() not supported on file system, ignoring.");
1032 return 0;
1033 }
1034
1035 if (ERRNO_IS_DISK_SPACE(errno)) {
1036 log_debug_errno(errno, "Not enough disk space to fully allocate home.");
1037 return -ENOSPC; /* make recognizable */
1038 }
1039
1040 return log_error_errno(errno, "Failed to allocate backing file blocks: %m");
1041 }
1042
1043 log_info("Allocated additional %s.",
1044 FORMAT_BYTES((DIV_ROUND_UP(st->st_size, 512) - st->st_blocks) * 512));
1045 return 1;
1046 }
1047
1048 int run_fallocate_by_path(const char *backing_path) {
1049 _cleanup_close_ int backing_fd = -1;
1050
1051 backing_fd = open(backing_path, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
1052 if (backing_fd < 0)
1053 return log_error_errno(errno, "Failed to open '%s' for fallocate(): %m", backing_path);
1054
1055 return run_fallocate(backing_fd, NULL);
1056 }
1057
1058 static int lock_image_fd(int image_fd, const char *ip) {
1059 int r;
1060
1061 /* If the $SYSTEMD_LUKS_LOCK environment variable is set we'll take an exclusive BSD lock on the
1062 * image file, and send it to our parent. homed will keep it open to ensure no other instance of
1063 * homed (across the network or such) will also mount the file. */
1064
1065 r = getenv_bool("SYSTEMD_LUKS_LOCK");
1066 if (r == -ENXIO)
1067 return 0;
1068 if (r < 0)
1069 return log_error_errno(r, "Failed to parse $SYSTEMD_LUKS_LOCK environment variable: %m");
1070 if (r > 0) {
1071 struct stat st;
1072
1073 if (fstat(image_fd, &st) < 0)
1074 return log_error_errno(errno, "Failed to stat image file: %m");
1075 if (S_ISBLK(st.st_mode)) {
1076 /* Locking block devices doesn't really make sense, as this might interfear with
1077 * udev's workings, and these locks aren't network propagated anyway, hence not what
1078 * we are after here. */
1079 log_debug("Not locking image file '%s', since it's a block device.", ip);
1080 return 0;
1081 }
1082 r = stat_verify_regular(&st);
1083 if (r < 0)
1084 return log_error_errno(r, "Image file to lock is not a regular file: %m");
1085
1086 if (flock(image_fd, LOCK_EX|LOCK_NB) < 0) {
1087
1088 if (errno == EWOULDBLOCK)
1089 log_error_errno(errno, "Image file '%s' already locked, can't use.", ip);
1090 else
1091 log_error_errno(errno, "Failed to lock image file '%s': %m", ip);
1092
1093 return errno != EWOULDBLOCK ? -errno : -EADDRINUSE; /* Make error recognizable */
1094 }
1095
1096 log_info("Successfully locked image file '%s'.", ip);
1097
1098 /* Now send it to our parent to keep safe while the home dir is active */
1099 r = sd_pid_notify_with_fds(0, false, "SYSTEMD_LUKS_LOCK_FD=1", &image_fd, 1);
1100 if (r < 0)
1101 log_warning_errno(r, "Failed to send LUKS lock fd to parent, ignoring: %m");
1102 }
1103
1104 return 0;
1105 }
1106
1107 int home_setup_luks(
1108 UserRecord *h,
1109 HomeSetupFlags flags,
1110 const char *force_image_path,
1111 PasswordCache *cache,
1112 HomeSetup *setup,
1113 UserRecord **ret_luks_home) {
1114
1115 sd_id128_t found_partition_uuid, found_luks_uuid, found_fs_uuid;
1116 _cleanup_(user_record_unrefp) UserRecord *luks_home = NULL;
1117 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
1118 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
1119 _cleanup_(erase_and_freep) void *volume_key = NULL;
1120 _cleanup_close_ int root_fd = -1, image_fd = -1;
1121 bool dm_activated = false, mounted = false;
1122 size_t volume_key_size = 0;
1123 bool marked_dirty = false;
1124 uint64_t offset, size;
1125 int r;
1126
1127 assert(h);
1128 assert(setup);
1129 assert(setup->dm_name);
1130 assert(setup->dm_node);
1131
1132 assert(user_record_storage(h) == USER_LUKS);
1133
1134 r = dlopen_cryptsetup();
1135 if (r < 0)
1136 return r;
1137
1138 if (FLAGS_SET(flags, HOME_SETUP_ALREADY_ACTIVATED)) {
1139 struct loop_info64 info;
1140 const char *n;
1141
1142 r = luks_open(setup->dm_name,
1143 h->password,
1144 cache,
1145 &cd,
1146 &found_luks_uuid,
1147 &volume_key,
1148 &volume_key_size);
1149 if (r < 0)
1150 return r;
1151
1152 r = luks_validate_home_record(cd, h, volume_key, cache, &luks_home);
1153 if (r < 0)
1154 return r;
1155
1156 n = sym_crypt_get_device_name(cd);
1157 if (!n)
1158 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine backing device for DM %s.", setup->dm_name);
1159
1160 r = loop_device_open(n, O_RDWR, &loop);
1161 if (r < 0)
1162 return log_error_errno(r, "Failed to open loopback device %s: %m", n);
1163
1164 if (ioctl(loop->fd, LOOP_GET_STATUS64, &info) < 0) {
1165 _cleanup_free_ char *sysfs = NULL;
1166 struct stat st;
1167
1168 if (!IN_SET(errno, ENOTTY, EINVAL))
1169 return log_error_errno(errno, "Failed to get block device metrics of %s: %m", n);
1170
1171 if (ioctl(loop->fd, BLKGETSIZE64, &size) < 0)
1172 return log_error_errno(r, "Failed to read block device size of %s: %m", n);
1173
1174 if (fstat(loop->fd, &st) < 0)
1175 return log_error_errno(r, "Failed to stat block device %s: %m", n);
1176 assert(S_ISBLK(st.st_mode));
1177
1178 if (asprintf(&sysfs, "/sys/dev/block/%u:%u/partition", major(st.st_rdev), minor(st.st_rdev)) < 0)
1179 return log_oom();
1180
1181 if (access(sysfs, F_OK) < 0) {
1182 if (errno != ENOENT)
1183 return log_error_errno(errno, "Failed to determine whether %s exists: %m", sysfs);
1184
1185 offset = 0;
1186 } else {
1187 _cleanup_free_ char *buffer = NULL;
1188
1189 if (asprintf(&sysfs, "/sys/dev/block/%u:%u/start", major(st.st_rdev), minor(st.st_rdev)) < 0)
1190 return log_oom();
1191
1192 r = read_one_line_file(sysfs, &buffer);
1193 if (r < 0)
1194 return log_error_errno(r, "Failed to read partition start offset: %m");
1195
1196 r = safe_atou64(buffer, &offset);
1197 if (r < 0)
1198 return log_error_errno(r, "Failed to parse partition start offset: %m");
1199
1200 if (offset > UINT64_MAX / 512U)
1201 return log_error_errno(SYNTHETIC_ERRNO(E2BIG), "Offset too large for 64 byte range, refusing.");
1202
1203 offset *= 512U;
1204 }
1205 } else {
1206 #if HAVE_VALGRIND_MEMCHECK_H
1207 VALGRIND_MAKE_MEM_DEFINED(&info, sizeof(info));
1208 #endif
1209
1210 offset = info.lo_offset;
1211 size = info.lo_sizelimit;
1212 }
1213
1214 found_partition_uuid = found_fs_uuid = SD_ID128_NULL;
1215
1216 log_info("Discovered used loopback device %s.", loop->node);
1217
1218 root_fd = open(user_record_home_directory(h), O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
1219 if (root_fd < 0) {
1220 r = log_error_errno(errno, "Failed to open home directory: %m");
1221 goto fail;
1222 }
1223 } else {
1224 _cleanup_free_ char *fstype = NULL, *subdir = NULL;
1225 const char *ip;
1226 struct stat st;
1227
1228 ip = force_image_path ?: user_record_image_path(h);
1229
1230 subdir = path_join("/run/systemd/user-home-mount/", user_record_user_name_and_realm(h));
1231 if (!subdir)
1232 return log_oom();
1233
1234 image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
1235 if (image_fd < 0)
1236 return log_error_errno(errno, "Failed to open image file %s: %m", ip);
1237
1238 if (fstat(image_fd, &st) < 0)
1239 return log_error_errno(errno, "Failed to fstat() image file: %m");
1240 if (!S_ISREG(st.st_mode) && !S_ISBLK(st.st_mode))
1241 return log_error_errno(
1242 S_ISDIR(st.st_mode) ? SYNTHETIC_ERRNO(EISDIR) : SYNTHETIC_ERRNO(EBADFD),
1243 "Image file %s is not a regular file or block device: %m", ip);
1244
1245 r = lock_image_fd(image_fd, ip);
1246 if (r < 0)
1247 return r;
1248
1249 r = luks_validate(image_fd, user_record_user_name_and_realm(h), h->partition_uuid, &found_partition_uuid, &offset, &size);
1250 if (r < 0)
1251 return log_error_errno(r, "Failed to validate disk label: %m");
1252
1253 /* Everything before this point left the image untouched. We are now starting to make
1254 * changes, hence mark the image dirty */
1255 marked_dirty = run_mark_dirty(image_fd, true) > 0;
1256
1257 if (!user_record_luks_discard(h)) {
1258 r = run_fallocate(image_fd, &st);
1259 if (r < 0)
1260 return r;
1261 }
1262
1263 r = loop_device_make(image_fd, O_RDWR, offset, size, 0, &loop);
1264 if (r == -ENOENT) {
1265 log_error_errno(r, "Loopback block device support is not available on this system.");
1266 return -ENOLINK; /* make recognizable */
1267 }
1268 if (r < 0)
1269 return log_error_errno(r, "Failed to allocate loopback context: %m");
1270
1271 log_info("Setting up loopback device %s completed.", loop->node ?: ip);
1272
1273 r = luks_setup(loop->node ?: ip,
1274 setup->dm_name,
1275 h->luks_uuid,
1276 h->luks_cipher,
1277 h->luks_cipher_mode,
1278 h->luks_volume_key_size,
1279 h->password,
1280 cache,
1281 user_record_luks_discard(h) || user_record_luks_offline_discard(h),
1282 &cd,
1283 &found_luks_uuid,
1284 &volume_key,
1285 &volume_key_size);
1286 if (r < 0)
1287 return r;
1288
1289 dm_activated = true;
1290
1291 r = luks_validate_home_record(cd, h, volume_key, cache, &luks_home);
1292 if (r < 0)
1293 goto fail;
1294
1295 r = fs_validate(setup->dm_node, h->file_system_uuid, &fstype, &found_fs_uuid);
1296 if (r < 0)
1297 goto fail;
1298
1299 r = run_fsck(setup->dm_node, fstype);
1300 if (r < 0)
1301 goto fail;
1302
1303 r = home_unshare_and_mount(setup->dm_node, fstype, user_record_luks_discard(h), user_record_mount_flags(h));
1304 if (r < 0)
1305 goto fail;
1306
1307 mounted = true;
1308
1309 root_fd = open(subdir, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
1310 if (root_fd < 0) {
1311 r = log_error_errno(errno, "Failed to open home directory: %m");
1312 goto fail;
1313 }
1314
1315 if (user_record_luks_discard(h))
1316 (void) run_fitrim(root_fd);
1317
1318 setup->image_fd = TAKE_FD(image_fd);
1319 setup->do_offline_fallocate = !(setup->do_offline_fitrim = user_record_luks_offline_discard(h));
1320 setup->do_mark_clean = marked_dirty;
1321 }
1322
1323 setup->loop = TAKE_PTR(loop);
1324 setup->crypt_device = TAKE_PTR(cd);
1325 setup->root_fd = TAKE_FD(root_fd);
1326 setup->found_partition_uuid = found_partition_uuid;
1327 setup->found_luks_uuid = found_luks_uuid;
1328 setup->found_fs_uuid = found_fs_uuid;
1329 setup->partition_offset = offset;
1330 setup->partition_size = size;
1331 setup->volume_key = TAKE_PTR(volume_key);
1332 setup->volume_key_size = volume_key_size;
1333
1334 setup->undo_mount = mounted;
1335 setup->undo_dm = dm_activated;
1336
1337 if (ret_luks_home)
1338 *ret_luks_home = TAKE_PTR(luks_home);
1339
1340 return 0;
1341
1342 fail:
1343 if (mounted)
1344 (void) umount_verbose(LOG_ERR, "/run/systemd/user-home-mount", UMOUNT_NOFOLLOW);
1345
1346 if (dm_activated)
1347 (void) sym_crypt_deactivate_by_name(cd, setup->dm_name, 0);
1348
1349 if (image_fd >= 0 && marked_dirty)
1350 (void) run_mark_dirty(image_fd, false);
1351
1352 return r;
1353 }
1354
1355 static void print_size_summary(uint64_t host_size, uint64_t encrypted_size, struct statfs *sfs) {
1356 assert(sfs);
1357
1358 log_info("Image size is %s, file system size is %s, file system payload size is %s, file system free is %s.",
1359 FORMAT_BYTES(host_size),
1360 FORMAT_BYTES(encrypted_size),
1361 FORMAT_BYTES((uint64_t) sfs->f_blocks * (uint64_t) sfs->f_frsize),
1362 FORMAT_BYTES((uint64_t) sfs->f_bfree * (uint64_t) sfs->f_frsize));
1363 }
1364
1365 int home_activate_luks(
1366 UserRecord *h,
1367 PasswordCache *cache,
1368 UserRecord **ret_home) {
1369
1370 _cleanup_(user_record_unrefp) UserRecord *new_home = NULL, *luks_home_record = NULL;
1371 _cleanup_(home_setup_done) HomeSetup setup = HOME_SETUP_INIT;
1372 uint64_t host_size, encrypted_size;
1373 const char *hdo, *hd;
1374 struct statfs sfs;
1375 int r;
1376
1377 assert(h);
1378 assert(user_record_storage(h) == USER_LUKS);
1379 assert(ret_home);
1380
1381 r = dlopen_cryptsetup();
1382 if (r < 0)
1383 return r;
1384
1385 assert_se(hdo = user_record_home_directory(h));
1386 hd = strdupa_safe(hdo); /* copy the string out, since it might change later in the home record object */
1387
1388 r = home_get_state_luks(h, &setup);
1389 if (r < 0)
1390 return r;
1391 if (r > 0)
1392 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Device mapper device %s already exists, refusing.", setup.dm_node);
1393
1394 r = home_setup_luks(
1395 h,
1396 0,
1397 NULL,
1398 cache,
1399 &setup,
1400 &luks_home_record);
1401 if (r < 0)
1402 return r;
1403
1404 r = block_get_size_by_fd(setup.loop->fd, &host_size);
1405 if (r < 0)
1406 return log_error_errno(r, "Failed to get loopback block device size: %m");
1407
1408 r = block_get_size_by_path(setup.dm_node, &encrypted_size);
1409 if (r < 0)
1410 return log_error_errno(r, "Failed to get LUKS block device size: %m");
1411
1412 r = home_refresh(
1413 h,
1414 &setup,
1415 luks_home_record,
1416 cache,
1417 &sfs,
1418 &new_home);
1419 if (r < 0)
1420 return r;
1421
1422 r = home_extend_embedded_identity(new_home, h, &setup);
1423 if (r < 0)
1424 return r;
1425
1426 setup.root_fd = safe_close(setup.root_fd);
1427
1428 r = home_move_mount(user_record_user_name_and_realm(h), hd);
1429 if (r < 0)
1430 return r;
1431
1432 setup.undo_mount = false;
1433 setup.do_offline_fitrim = false;
1434
1435 loop_device_relinquish(setup.loop);
1436
1437 r = sym_crypt_deactivate_by_name(NULL, setup.dm_name, CRYPT_DEACTIVATE_DEFERRED);
1438 if (r < 0)
1439 log_warning_errno(r, "Failed to relinquish DM device, ignoring: %m");
1440
1441 setup.undo_dm = false;
1442 setup.do_offline_fallocate = false;
1443 setup.do_mark_clean = false;
1444
1445 log_info("Everything completed.");
1446
1447 print_size_summary(host_size, encrypted_size, &sfs);
1448
1449 *ret_home = TAKE_PTR(new_home);
1450 return 1;
1451 }
1452
1453 int home_deactivate_luks(UserRecord *h) {
1454 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
1455 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
1456 bool we_detached;
1457 int r;
1458
1459 /* Note that the DM device and loopback device are set to auto-detach, hence strictly speaking we
1460 * don't have to explicitly have to detach them. However, we do that nonetheless (in case of the DM
1461 * device), to avoid races: by explicitly detaching them we know when the detaching is complete. We
1462 * don't bother about the loopback device because unlike the DM device it doesn't have a fixed
1463 * name. */
1464
1465 r = dlopen_cryptsetup();
1466 if (r < 0)
1467 return r;
1468
1469 r = make_dm_names(h->user_name, &dm_name, &dm_node);
1470 if (r < 0)
1471 return r;
1472
1473 r = sym_crypt_init_by_name(&cd, dm_name);
1474 if (IN_SET(r, -ENODEV, -EINVAL, -ENOENT)) {
1475 log_debug_errno(r, "LUKS device %s has already been detached.", dm_name);
1476 we_detached = false;
1477 } else if (r < 0)
1478 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
1479 else {
1480 log_info("Discovered used LUKS device %s.", dm_node);
1481
1482 cryptsetup_enable_logging(cd);
1483
1484 r = sym_crypt_deactivate_by_name(cd, dm_name, 0);
1485 if (IN_SET(r, -ENODEV, -EINVAL, -ENOENT)) {
1486 log_debug_errno(r, "LUKS device %s is already detached.", dm_node);
1487 we_detached = false;
1488 } else if (r < 0)
1489 return log_info_errno(r, "LUKS device %s couldn't be deactivated: %m", dm_node);
1490 else {
1491 log_info("LUKS device detaching completed.");
1492 we_detached = true;
1493 }
1494 }
1495
1496 if (user_record_luks_offline_discard(h))
1497 log_debug("Not allocating on logout.");
1498 else
1499 (void) run_fallocate_by_path(user_record_image_path(h));
1500
1501 run_mark_dirty_by_path(user_record_image_path(h), false);
1502 return we_detached;
1503 }
1504
1505 int home_trim_luks(UserRecord *h) {
1506 assert(h);
1507
1508 if (!user_record_luks_offline_discard(h)) {
1509 log_debug("Not trimming on logout.");
1510 return 0;
1511 }
1512
1513 (void) run_fitrim_by_path(user_record_home_directory(h));
1514 return 0;
1515 }
1516
1517 static struct crypt_pbkdf_type* build_good_pbkdf(struct crypt_pbkdf_type *buffer, UserRecord *hr) {
1518 assert(buffer);
1519 assert(hr);
1520
1521 *buffer = (struct crypt_pbkdf_type) {
1522 .hash = user_record_luks_pbkdf_hash_algorithm(hr),
1523 .type = user_record_luks_pbkdf_type(hr),
1524 .time_ms = user_record_luks_pbkdf_time_cost_usec(hr) / USEC_PER_MSEC,
1525 .max_memory_kb = user_record_luks_pbkdf_memory_cost(hr) / 1024,
1526 .parallel_threads = user_record_luks_pbkdf_parallel_threads(hr),
1527 };
1528
1529 return buffer;
1530 }
1531
1532 static struct crypt_pbkdf_type* build_minimal_pbkdf(struct crypt_pbkdf_type *buffer, UserRecord *hr) {
1533 assert(buffer);
1534 assert(hr);
1535
1536 /* For PKCS#11 derived keys (which are generated randomly and are of high quality already) we use a
1537 * minimal PBKDF */
1538 *buffer = (struct crypt_pbkdf_type) {
1539 .hash = user_record_luks_pbkdf_hash_algorithm(hr),
1540 .type = CRYPT_KDF_PBKDF2,
1541 .iterations = 1,
1542 .time_ms = 1,
1543 };
1544
1545 return buffer;
1546 }
1547
1548 static int luks_format(
1549 const char *node,
1550 const char *dm_name,
1551 sd_id128_t uuid,
1552 const char *label,
1553 const PasswordCache *cache,
1554 char **effective_passwords,
1555 bool discard,
1556 UserRecord *hr,
1557 struct crypt_device **ret) {
1558
1559 _cleanup_(user_record_unrefp) UserRecord *reduced = NULL;
1560 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
1561 _cleanup_(erase_and_freep) void *volume_key = NULL;
1562 struct crypt_pbkdf_type good_pbkdf, minimal_pbkdf;
1563 _cleanup_free_ char *text = NULL;
1564 size_t volume_key_size;
1565 int slot = 0, r;
1566 char **pp;
1567
1568 assert(node);
1569 assert(dm_name);
1570 assert(hr);
1571 assert(ret);
1572
1573 r = sym_crypt_init(&cd, node);
1574 if (r < 0)
1575 return log_error_errno(r, "Failed to allocate libcryptsetup context: %m");
1576
1577 cryptsetup_enable_logging(cd);
1578
1579 /* Normally we'd, just leave volume key generation to libcryptsetup. However, we can't, since we
1580 * can't extract the volume key from the library again, but we need it in order to encrypt the JSON
1581 * record. Hence, let's generate it on our own, so that we can keep track of it. */
1582
1583 volume_key_size = user_record_luks_volume_key_size(hr);
1584 volume_key = malloc(volume_key_size);
1585 if (!volume_key)
1586 return log_oom();
1587
1588 r = genuine_random_bytes(volume_key, volume_key_size, RANDOM_BLOCK);
1589 if (r < 0)
1590 return log_error_errno(r, "Failed to generate volume key: %m");
1591
1592 #if HAVE_CRYPT_SET_METADATA_SIZE
1593 /* Increase the metadata space to 4M, the largest LUKS2 supports */
1594 r = sym_crypt_set_metadata_size(cd, 4096U*1024U, 0);
1595 if (r < 0)
1596 return log_error_errno(r, "Failed to change LUKS2 metadata size: %m");
1597 #endif
1598
1599 build_good_pbkdf(&good_pbkdf, hr);
1600 build_minimal_pbkdf(&minimal_pbkdf, hr);
1601
1602 r = sym_crypt_format(
1603 cd,
1604 CRYPT_LUKS2,
1605 user_record_luks_cipher(hr),
1606 user_record_luks_cipher_mode(hr),
1607 ID128_TO_UUID_STRING(uuid),
1608 volume_key,
1609 volume_key_size,
1610 &(struct crypt_params_luks2) {
1611 .label = label,
1612 .subsystem = "systemd-home",
1613 .sector_size = 512U,
1614 .pbkdf = &good_pbkdf,
1615 });
1616 if (r < 0)
1617 return log_error_errno(r, "Failed to format LUKS image: %m");
1618
1619 log_info("LUKS formatting completed.");
1620
1621 STRV_FOREACH(pp, effective_passwords) {
1622
1623 if (password_cache_contains(cache, *pp)) { /* is this a fido2 or pkcs11 password? */
1624 log_debug("Using minimal PBKDF for slot %i", slot);
1625 r = sym_crypt_set_pbkdf_type(cd, &minimal_pbkdf);
1626 } else {
1627 log_debug("Using good PBKDF for slot %i", slot);
1628 r = sym_crypt_set_pbkdf_type(cd, &good_pbkdf);
1629 }
1630 if (r < 0)
1631 return log_error_errno(r, "Failed to tweak PBKDF for slot %i: %m", slot);
1632
1633 r = sym_crypt_keyslot_add_by_volume_key(
1634 cd,
1635 slot,
1636 volume_key,
1637 volume_key_size,
1638 *pp,
1639 strlen(*pp));
1640 if (r < 0)
1641 return log_error_errno(r, "Failed to set up LUKS password for slot %i: %m", slot);
1642
1643 log_info("Writing password to LUKS keyslot %i completed.", slot);
1644 slot++;
1645 }
1646
1647 r = sym_crypt_activate_by_volume_key(
1648 cd,
1649 dm_name,
1650 volume_key,
1651 volume_key_size,
1652 discard ? CRYPT_ACTIVATE_ALLOW_DISCARDS : 0);
1653 if (r < 0)
1654 return log_error_errno(r, "Failed to activate LUKS superblock: %m");
1655
1656 log_info("LUKS activation by volume key succeeded.");
1657
1658 r = user_record_clone(hr, USER_RECORD_EXTRACT_EMBEDDED|USER_RECORD_PERMISSIVE, &reduced);
1659 if (r < 0)
1660 return log_error_errno(r, "Failed to prepare home record for LUKS: %m");
1661
1662 r = format_luks_token_text(cd, reduced, volume_key, &text);
1663 if (r < 0)
1664 return r;
1665
1666 r = sym_crypt_token_json_set(cd, CRYPT_ANY_TOKEN, text);
1667 if (r < 0)
1668 return log_error_errno(r, "Failed to set LUKS JSON token: %m");
1669
1670 log_info("Writing user record as LUKS token completed.");
1671
1672 if (ret)
1673 *ret = TAKE_PTR(cd);
1674
1675 return 0;
1676 }
1677
1678 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct fdisk_context*, fdisk_unref_context, NULL);
1679 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct fdisk_partition*, fdisk_unref_partition, NULL);
1680 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct fdisk_parttype*, fdisk_unref_parttype, NULL);
1681 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct fdisk_table*, fdisk_unref_table, NULL);
1682
1683 static int make_partition_table(
1684 int fd,
1685 const char *label,
1686 sd_id128_t uuid,
1687 uint64_t *ret_offset,
1688 uint64_t *ret_size,
1689 sd_id128_t *ret_disk_uuid) {
1690
1691 _cleanup_(fdisk_unref_partitionp) struct fdisk_partition *p = NULL, *q = NULL;
1692 _cleanup_(fdisk_unref_parttypep) struct fdisk_parttype *t = NULL;
1693 _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
1694 _cleanup_free_ char *path = NULL, *disk_uuid_as_string = NULL;
1695 uint64_t offset, size, first_lba, start, last_lba, end;
1696 sd_id128_t disk_uuid;
1697 int r;
1698
1699 assert(fd >= 0);
1700 assert(label);
1701 assert(ret_offset);
1702 assert(ret_size);
1703
1704 t = fdisk_new_parttype();
1705 if (!t)
1706 return log_oom();
1707
1708 r = fdisk_parttype_set_typestr(t, "773f91ef-66d4-49b5-bd83-d683bf40ad16");
1709 if (r < 0)
1710 return log_error_errno(r, "Failed to initialize partition type: %m");
1711
1712 c = fdisk_new_context();
1713 if (!c)
1714 return log_oom();
1715
1716 if (asprintf(&path, "/proc/self/fd/%i", fd) < 0)
1717 return log_oom();
1718
1719 r = fdisk_assign_device(c, path, 0);
1720 if (r < 0)
1721 return log_error_errno(r, "Failed to open device: %m");
1722
1723 r = fdisk_create_disklabel(c, "gpt");
1724 if (r < 0)
1725 return log_error_errno(r, "Failed to create GPT disk label: %m");
1726
1727 p = fdisk_new_partition();
1728 if (!p)
1729 return log_oom();
1730
1731 r = fdisk_partition_set_type(p, t);
1732 if (r < 0)
1733 return log_error_errno(r, "Failed to set partition type: %m");
1734
1735 r = fdisk_partition_partno_follow_default(p, 1);
1736 if (r < 0)
1737 return log_error_errno(r, "Failed to place partition at first free partition index: %m");
1738
1739 first_lba = fdisk_get_first_lba(c); /* Boundary where usable space starts */
1740 assert(first_lba <= UINT64_MAX/512);
1741 start = DISK_SIZE_ROUND_UP(first_lba * 512); /* Round up to multiple of 4K */
1742
1743 if (start == UINT64_MAX)
1744 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Overflow while rounding up start LBA.");
1745
1746 last_lba = fdisk_get_last_lba(c); /* One sector before boundary where usable space ends */
1747 assert(last_lba < UINT64_MAX/512);
1748 end = DISK_SIZE_ROUND_DOWN((last_lba + 1) * 512); /* Round down to multiple of 4K */
1749
1750 if (end <= start)
1751 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Resulting partition size zero or negative.");
1752
1753 r = fdisk_partition_set_start(p, start / 512);
1754 if (r < 0)
1755 return log_error_errno(r, "Failed to place partition at offset %" PRIu64 ": %m", start);
1756
1757 r = fdisk_partition_set_size(p, (end - start) / 512);
1758 if (r < 0)
1759 return log_error_errno(r, "Failed to end partition at offset %" PRIu64 ": %m", end);
1760
1761 r = fdisk_partition_set_name(p, label);
1762 if (r < 0)
1763 return log_error_errno(r, "Failed to set partition name: %m");
1764
1765 r = fdisk_partition_set_uuid(p, ID128_TO_UUID_STRING(uuid));
1766 if (r < 0)
1767 return log_error_errno(r, "Failed to set partition UUID: %m");
1768
1769 r = fdisk_add_partition(c, p, NULL);
1770 if (r < 0)
1771 return log_error_errno(r, "Failed to add partition: %m");
1772
1773 r = fdisk_write_disklabel(c);
1774 if (r < 0)
1775 return log_error_errno(r, "Failed to write disk label: %m");
1776
1777 r = fdisk_get_disklabel_id(c, &disk_uuid_as_string);
1778 if (r < 0)
1779 return log_error_errno(r, "Failed to determine disk label UUID: %m");
1780
1781 r = sd_id128_from_string(disk_uuid_as_string, &disk_uuid);
1782 if (r < 0)
1783 return log_error_errno(r, "Failed to parse disk label UUID: %m");
1784
1785 r = fdisk_get_partition(c, 0, &q);
1786 if (r < 0)
1787 return log_error_errno(r, "Failed to read created partition metadata: %m");
1788
1789 assert(fdisk_partition_has_start(q));
1790 offset = fdisk_partition_get_start(q);
1791 if (offset > UINT64_MAX / 512U)
1792 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Partition offset too large.");
1793
1794 assert(fdisk_partition_has_size(q));
1795 size = fdisk_partition_get_size(q);
1796 if (size > UINT64_MAX / 512U)
1797 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Partition size too large.");
1798
1799 *ret_offset = offset * 512U;
1800 *ret_size = size * 512U;
1801 *ret_disk_uuid = disk_uuid;
1802
1803 return 0;
1804 }
1805
1806 static bool supported_fs_size(const char *fstype, uint64_t host_size) {
1807 uint64_t m;
1808
1809 m = minimal_size_by_fs_name(fstype);
1810 if (m == UINT64_MAX)
1811 return false;
1812
1813 return host_size >= m;
1814 }
1815
1816 static int wait_for_devlink(const char *path) {
1817 _cleanup_close_ int inotify_fd = -1;
1818 usec_t until;
1819 int r;
1820
1821 /* let's wait for a device link to show up in /dev, with a timeout. This is good to do since we
1822 * return a /dev/disk/by-uuid/… link to our callers and they likely want to access it right-away,
1823 * hence let's wait until udev has caught up with our changes, and wait for the symlink to be
1824 * created. */
1825
1826 until = usec_add(now(CLOCK_MONOTONIC), 45 * USEC_PER_SEC);
1827
1828 for (;;) {
1829 _cleanup_free_ char *dn = NULL;
1830 usec_t w;
1831
1832 if (laccess(path, F_OK) < 0) {
1833 if (errno != ENOENT)
1834 return log_error_errno(errno, "Failed to determine whether %s exists: %m", path);
1835 } else
1836 return 0; /* Found it */
1837
1838 if (inotify_fd < 0) {
1839 /* We need to wait for the device symlink to show up, let's create an inotify watch for it */
1840 inotify_fd = inotify_init1(IN_NONBLOCK|IN_CLOEXEC);
1841 if (inotify_fd < 0)
1842 return log_error_errno(errno, "Failed to allocate inotify fd: %m");
1843 }
1844
1845 dn = dirname_malloc(path);
1846 for (;;) {
1847 if (!dn)
1848 return log_oom();
1849
1850 log_info("Watching %s", dn);
1851
1852 if (inotify_add_watch(inotify_fd, dn, IN_CREATE|IN_MOVED_TO|IN_ONLYDIR|IN_DELETE_SELF|IN_MOVE_SELF) < 0) {
1853 if (errno != ENOENT)
1854 return log_error_errno(errno, "Failed to add watch on %s: %m", dn);
1855 } else
1856 break;
1857
1858 if (empty_or_root(dn))
1859 break;
1860
1861 dn = dirname_malloc(dn);
1862 }
1863
1864 w = now(CLOCK_MONOTONIC);
1865 if (w >= until)
1866 return log_error_errno(SYNTHETIC_ERRNO(ETIMEDOUT), "Device link %s still hasn't shown up, giving up.", path);
1867
1868 r = fd_wait_for_event(inotify_fd, POLLIN, usec_sub_unsigned(until, w));
1869 if (r < 0)
1870 return log_error_errno(r, "Failed to watch inotify: %m");
1871
1872 (void) flush_fd(inotify_fd);
1873 }
1874 }
1875
1876 static int calculate_disk_size(UserRecord *h, const char *parent_dir, uint64_t *ret) {
1877 struct statfs sfs;
1878 uint64_t m;
1879
1880 assert(h);
1881 assert(parent_dir);
1882 assert(ret);
1883
1884 if (h->disk_size != UINT64_MAX) {
1885 *ret = DISK_SIZE_ROUND_DOWN(h->disk_size);
1886 return 0;
1887 }
1888
1889 if (statfs(parent_dir, &sfs) < 0)
1890 return log_error_errno(errno, "statfs() on %s failed: %m", parent_dir);
1891
1892 m = sfs.f_bsize * sfs.f_bavail;
1893
1894 if (h->disk_size_relative == UINT64_MAX) {
1895
1896 if (m > UINT64_MAX / USER_DISK_SIZE_DEFAULT_PERCENT)
1897 return log_error_errno(SYNTHETIC_ERRNO(EOVERFLOW), "Disk size too large.");
1898
1899 *ret = DISK_SIZE_ROUND_DOWN(m * USER_DISK_SIZE_DEFAULT_PERCENT / 100);
1900
1901 log_info("Sizing home to %u%% of available disk space, which is %s.",
1902 USER_DISK_SIZE_DEFAULT_PERCENT,
1903 FORMAT_BYTES(*ret));
1904 } else {
1905 *ret = DISK_SIZE_ROUND_DOWN((uint64_t) ((double) m * (double) h->disk_size_relative / (double) UINT32_MAX));
1906
1907 log_info("Sizing home to %" PRIu64 ".%01" PRIu64 "%% of available disk space, which is %s.",
1908 (h->disk_size_relative * 100) / UINT32_MAX,
1909 ((h->disk_size_relative * 1000) / UINT32_MAX) % 10,
1910 FORMAT_BYTES(*ret));
1911 }
1912
1913 if (*ret < USER_DISK_SIZE_MIN)
1914 *ret = USER_DISK_SIZE_MIN;
1915
1916 return 0;
1917 }
1918
1919 static int home_truncate(
1920 UserRecord *h,
1921 int fd,
1922 const char *path,
1923 uint64_t size) {
1924
1925 bool trunc;
1926 int r;
1927
1928 assert(h);
1929 assert(fd >= 0);
1930 assert(path);
1931
1932 trunc = user_record_luks_discard(h);
1933 if (!trunc) {
1934 r = fallocate(fd, 0, 0, size);
1935 if (r < 0 && ERRNO_IS_NOT_SUPPORTED(errno)) {
1936 /* Some file systems do not support fallocate(), let's gracefully degrade
1937 * (ZFS, reiserfs, …) and fall back to truncation */
1938 log_notice_errno(errno, "Backing file system does not support fallocate(), falling back to ftruncate(), i.e. implicitly using non-discard mode.");
1939 trunc = true;
1940 }
1941 }
1942
1943 if (trunc)
1944 r = ftruncate(fd, size);
1945
1946 if (r < 0) {
1947 if (ERRNO_IS_DISK_SPACE(errno)) {
1948 log_error_errno(errno, "Not enough disk space to allocate home.");
1949 return -ENOSPC; /* make recognizable */
1950 }
1951
1952 return log_error_errno(errno, "Failed to truncate home image %s: %m", path);
1953 }
1954
1955 return 0;
1956 }
1957
1958 int home_create_luks(
1959 UserRecord *h,
1960 const PasswordCache *cache,
1961 char **effective_passwords,
1962 UserRecord **ret_home) {
1963
1964 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL, *subdir = NULL, *disk_uuid_path = NULL, *temporary_image_path = NULL;
1965 uint64_t encrypted_size,
1966 host_size = 0, partition_offset = 0, partition_size = 0; /* Unnecessary initialization to appease gcc */
1967 bool image_created = false, dm_activated = false, mounted = false;
1968 _cleanup_(user_record_unrefp) UserRecord *new_home = NULL;
1969 sd_id128_t partition_uuid, fs_uuid, luks_uuid, disk_uuid;
1970 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
1971 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
1972 _cleanup_close_ int image_fd = -1, root_fd = -1;
1973 const char *fstype, *ip;
1974 struct statfs sfs;
1975 int r;
1976
1977 assert(h);
1978 assert(h->storage < 0 || h->storage == USER_LUKS);
1979 assert(ret_home);
1980
1981 r = dlopen_cryptsetup();
1982 if (r < 0)
1983 return r;
1984
1985 assert_se(ip = user_record_image_path(h));
1986
1987 fstype = user_record_file_system_type(h);
1988 if (!supported_fstype(fstype))
1989 return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "Unsupported file system type: %s", fstype);
1990
1991 r = mkfs_exists(fstype);
1992 if (r < 0)
1993 return log_error_errno(r, "Failed to check if mkfs binary for %s exists: %m", fstype);
1994 if (r == 0) {
1995 if (h->file_system_type || streq(fstype, "ext4") || !supported_fstype("ext4"))
1996 return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "mkfs binary for file system type %s does not exist.", fstype);
1997
1998 /* If the record does not explicitly declare a file system to use, and the compiled-in
1999 * default does not actually exist, than do an automatic fallback onto ext4, as the baseline
2000 * fs of Linux. We won't search for a working fs type here beyond ext4, i.e. nothing fancier
2001 * than a single, conservative fallback to baseline. This should be useful in minimal
2002 * environments where mkfs.btrfs or so are not made available, but mkfs.ext4 as Linux' most
2003 * boring, most basic fs is. */
2004 log_info("Formatting tool for compiled-in default file system %s not available, falling back to ext4 instead.", fstype);
2005 fstype = "ext4";
2006 }
2007
2008 if (sd_id128_is_null(h->partition_uuid)) {
2009 r = sd_id128_randomize(&partition_uuid);
2010 if (r < 0)
2011 return log_error_errno(r, "Failed to acquire partition UUID: %m");
2012 } else
2013 partition_uuid = h->partition_uuid;
2014
2015 if (sd_id128_is_null(h->luks_uuid)) {
2016 r = sd_id128_randomize(&luks_uuid);
2017 if (r < 0)
2018 return log_error_errno(r, "Failed to acquire LUKS UUID: %m");
2019 } else
2020 luks_uuid = h->luks_uuid;
2021
2022 if (sd_id128_is_null(h->file_system_uuid)) {
2023 r = sd_id128_randomize(&fs_uuid);
2024 if (r < 0)
2025 return log_error_errno(r, "Failed to acquire file system UUID: %m");
2026 } else
2027 fs_uuid = h->file_system_uuid;
2028
2029 r = make_dm_names(h->user_name, &dm_name, &dm_node);
2030 if (r < 0)
2031 return r;
2032
2033 r = access(dm_node, F_OK);
2034 if (r < 0) {
2035 if (errno != ENOENT)
2036 return log_error_errno(errno, "Failed to determine whether %s exists: %m", dm_node);
2037 } else
2038 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Device mapper device %s already exists, refusing.", dm_node);
2039
2040 if (path_startswith(ip, "/dev/")) {
2041 _cleanup_free_ char *sysfs = NULL;
2042 uint64_t block_device_size;
2043 struct stat st;
2044
2045 /* Let's place the home directory on a real device, i.e. an USB stick or such */
2046
2047 image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2048 if (image_fd < 0)
2049 return log_error_errno(errno, "Failed to open device %s: %m", ip);
2050
2051 if (fstat(image_fd, &st) < 0)
2052 return log_error_errno(errno, "Failed to stat device %s: %m", ip);
2053 if (!S_ISBLK(st.st_mode))
2054 return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Device is not a block device, refusing.");
2055
2056 if (asprintf(&sysfs, "/sys/dev/block/%u:%u/partition", major(st.st_rdev), minor(st.st_rdev)) < 0)
2057 return log_oom();
2058 if (access(sysfs, F_OK) < 0) {
2059 if (errno != ENOENT)
2060 return log_error_errno(errno, "Failed to check whether %s exists: %m", sysfs);
2061 } else
2062 return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Operating on partitions is currently not supported, sorry. Please specify a top-level block device.");
2063
2064 if (flock(image_fd, LOCK_EX) < 0) /* make sure udev doesn't read from it while we operate on the device */
2065 return log_error_errno(errno, "Failed to lock block device %s: %m", ip);
2066
2067 if (ioctl(image_fd, BLKGETSIZE64, &block_device_size) < 0)
2068 return log_error_errno(errno, "Failed to read block device size: %m");
2069
2070 if (h->disk_size == UINT64_MAX) {
2071
2072 /* If a relative disk size is requested, apply it relative to the block device size */
2073 if (h->disk_size_relative < UINT32_MAX)
2074 host_size = CLAMP(DISK_SIZE_ROUND_DOWN(block_device_size * h->disk_size_relative / UINT32_MAX),
2075 USER_DISK_SIZE_MIN, USER_DISK_SIZE_MAX);
2076 else
2077 host_size = block_device_size; /* Otherwise, take the full device */
2078
2079 } else if (h->disk_size > block_device_size)
2080 return log_error_errno(SYNTHETIC_ERRNO(EMSGSIZE), "Selected disk size larger than backing block device, refusing.");
2081 else
2082 host_size = DISK_SIZE_ROUND_DOWN(h->disk_size);
2083
2084 if (!supported_fs_size(fstype, host_size))
2085 return log_error_errno(SYNTHETIC_ERRNO(ERANGE),
2086 "Selected file system size too small for %s.", fstype);
2087
2088 /* After creation we should reference this partition by its UUID instead of the block
2089 * device. That's preferable since the user might have specified a device node such as
2090 * /dev/sdb to us, which might look very different when replugged. */
2091 if (asprintf(&disk_uuid_path, "/dev/disk/by-uuid/" SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(luks_uuid)) < 0)
2092 return log_oom();
2093
2094 if (user_record_luks_discard(h) || user_record_luks_offline_discard(h)) {
2095 /* If we want online or offline discard, discard once before we start using things. */
2096
2097 if (ioctl(image_fd, BLKDISCARD, (uint64_t[]) { 0, block_device_size }) < 0)
2098 log_full_errno(errno == EOPNOTSUPP ? LOG_DEBUG : LOG_WARNING, errno,
2099 "Failed to issue full-device BLKDISCARD on device, ignoring: %m");
2100 else
2101 log_info("Full device discard completed.");
2102 }
2103 } else {
2104 _cleanup_free_ char *parent = NULL;
2105
2106 parent = dirname_malloc(ip);
2107 if (!parent)
2108 return log_oom();
2109
2110 r = mkdir_p(parent, 0755);
2111 if (r < 0)
2112 return log_error_errno(r, "Failed to create parent directory %s: %m", parent);
2113
2114 r = calculate_disk_size(h, parent, &host_size);
2115 if (r < 0)
2116 return r;
2117
2118 if (!supported_fs_size(fstype, host_size))
2119 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Selected file system size too small for %s.", fstype);
2120
2121 r = tempfn_random(ip, "homework", &temporary_image_path);
2122 if (r < 0)
2123 return log_error_errno(r, "Failed to derive temporary file name for %s: %m", ip);
2124
2125 image_fd = open(temporary_image_path, O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW, 0600);
2126 if (image_fd < 0)
2127 return log_error_errno(errno, "Failed to create home image %s: %m", temporary_image_path);
2128
2129 image_created = true;
2130
2131 r = chattr_fd(image_fd, FS_NOCOW_FL, FS_NOCOW_FL, NULL);
2132 if (r < 0)
2133 log_full_errno(ERRNO_IS_NOT_SUPPORTED(r) ? LOG_DEBUG : LOG_WARNING, r,
2134 "Failed to set file attributes on %s, ignoring: %m", temporary_image_path);
2135
2136 r = home_truncate(h, image_fd, temporary_image_path, host_size);
2137 if (r < 0)
2138 goto fail;
2139
2140 log_info("Allocating image file completed.");
2141 }
2142
2143 r = make_partition_table(
2144 image_fd,
2145 user_record_user_name_and_realm(h),
2146 partition_uuid,
2147 &partition_offset,
2148 &partition_size,
2149 &disk_uuid);
2150 if (r < 0)
2151 goto fail;
2152
2153 log_info("Writing of partition table completed.");
2154
2155 r = loop_device_make(image_fd, O_RDWR, partition_offset, partition_size, 0, &loop);
2156 if (r < 0) {
2157 if (r == -ENOENT) { /* this means /dev/loop-control doesn't exist, i.e. we are in a container
2158 * or similar and loopback bock devices are not available, return a
2159 * recognizable error in this case. */
2160 log_error_errno(r, "Loopback block device support is not available on this system.");
2161 r = -ENOLINK;
2162 goto fail;
2163 }
2164
2165 log_error_errno(r, "Failed to set up loopback device for %s: %m", temporary_image_path);
2166 goto fail;
2167 }
2168
2169 r = loop_device_flock(loop, LOCK_EX); /* make sure udev won't read before we are done */
2170 if (r < 0) {
2171 log_error_errno(r, "Failed to take lock on loop device: %m");
2172 goto fail;
2173 }
2174
2175 log_info("Setting up loopback device %s completed.", loop->node ?: ip);
2176
2177 r = luks_format(loop->node,
2178 dm_name,
2179 luks_uuid,
2180 user_record_user_name_and_realm(h),
2181 cache,
2182 effective_passwords,
2183 user_record_luks_discard(h) || user_record_luks_offline_discard(h),
2184 h,
2185 &cd);
2186 if (r < 0)
2187 goto fail;
2188
2189 dm_activated = true;
2190
2191 r = block_get_size_by_path(dm_node, &encrypted_size);
2192 if (r < 0) {
2193 log_error_errno(r, "Failed to get encrypted block device size: %m");
2194 goto fail;
2195 }
2196
2197 log_info("Setting up LUKS device %s completed.", dm_node);
2198
2199 r = make_filesystem(dm_node, fstype, user_record_user_name_and_realm(h), fs_uuid, user_record_luks_discard(h));
2200 if (r < 0)
2201 goto fail;
2202
2203 log_info("Formatting file system completed.");
2204
2205 r = home_unshare_and_mount(dm_node, fstype, user_record_luks_discard(h), user_record_mount_flags(h));
2206 if (r < 0)
2207 goto fail;
2208
2209 mounted = true;
2210
2211 subdir = path_join("/run/systemd/user-home-mount/", user_record_user_name_and_realm(h));
2212 if (!subdir) {
2213 r = log_oom();
2214 goto fail;
2215 }
2216
2217 /* Prefer using a btrfs subvolume if we can, fall back to directory otherwise */
2218 r = btrfs_subvol_make_fallback(subdir, 0700);
2219 if (r < 0) {
2220 log_error_errno(r, "Failed to create user directory in mounted image file: %m");
2221 goto fail;
2222 }
2223
2224 root_fd = open(subdir, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
2225 if (root_fd < 0) {
2226 r = log_error_errno(errno, "Failed to open user directory in mounted image file: %m");
2227 goto fail;
2228 }
2229
2230 r = home_populate(h, root_fd);
2231 if (r < 0)
2232 goto fail;
2233
2234 r = home_sync_and_statfs(root_fd, &sfs);
2235 if (r < 0)
2236 goto fail;
2237
2238 r = user_record_clone(h, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_LOG|USER_RECORD_PERMISSIVE, &new_home);
2239 if (r < 0) {
2240 log_error_errno(r, "Failed to clone record: %m");
2241 goto fail;
2242 }
2243
2244 r = user_record_add_binding(
2245 new_home,
2246 USER_LUKS,
2247 disk_uuid_path ?: ip,
2248 partition_uuid,
2249 luks_uuid,
2250 fs_uuid,
2251 sym_crypt_get_cipher(cd),
2252 sym_crypt_get_cipher_mode(cd),
2253 luks_volume_key_size_convert(cd),
2254 fstype,
2255 NULL,
2256 h->uid,
2257 (gid_t) h->uid);
2258 if (r < 0) {
2259 log_error_errno(r, "Failed to add binding to record: %m");
2260 goto fail;
2261 }
2262
2263 if (user_record_luks_offline_discard(h)) {
2264 r = run_fitrim(root_fd);
2265 if (r < 0)
2266 goto fail;
2267 }
2268
2269 root_fd = safe_close(root_fd);
2270
2271 r = umount_verbose(LOG_ERR, "/run/systemd/user-home-mount", UMOUNT_NOFOLLOW);
2272 if (r < 0)
2273 goto fail;
2274
2275 mounted = false;
2276
2277 r = sym_crypt_deactivate_by_name(cd, dm_name, 0);
2278 if (r < 0) {
2279 log_error_errno(r, "Failed to deactivate LUKS device: %m");
2280 goto fail;
2281 }
2282
2283 sym_crypt_free(cd);
2284 cd = NULL;
2285
2286 dm_activated = false;
2287
2288 loop = loop_device_unref(loop);
2289
2290 if (!user_record_luks_offline_discard(h)) {
2291 r = run_fallocate(image_fd, NULL /* refresh stat() data */);
2292 if (r < 0)
2293 goto fail;
2294 }
2295
2296 /* Sync everything to disk before we move things into place under the final name. */
2297 if (fsync(image_fd) < 0) {
2298 r = log_error_errno(r, "Failed to synchronize image to disk: %m");
2299 goto fail;
2300 }
2301
2302 if (disk_uuid_path)
2303 (void) ioctl(image_fd, BLKRRPART, 0);
2304 else {
2305 /* If we operate on a file, sync the containing directory too. */
2306 r = fsync_directory_of_file(image_fd);
2307 if (r < 0) {
2308 log_error_errno(r, "Failed to synchronize directory of image file to disk: %m");
2309 goto fail;
2310 }
2311 }
2312
2313 /* Let's close the image fd now. If we are operating on a real block device this will release the BSD
2314 * lock that ensures udev doesn't interfere with what we are doing */
2315 image_fd = safe_close(image_fd);
2316
2317 if (temporary_image_path) {
2318 if (rename(temporary_image_path, ip) < 0) {
2319 log_error_errno(errno, "Failed to rename image file: %m");
2320 goto fail;
2321 }
2322
2323 log_info("Moved image file into place.");
2324 }
2325
2326 if (disk_uuid_path)
2327 (void) wait_for_devlink(disk_uuid_path);
2328
2329 log_info("Everything completed.");
2330
2331 print_size_summary(host_size, encrypted_size, &sfs);
2332
2333 *ret_home = TAKE_PTR(new_home);
2334 return 0;
2335
2336 fail:
2337 /* Let's close all files before we unmount the file system, to avoid EBUSY */
2338 root_fd = safe_close(root_fd);
2339
2340 if (mounted)
2341 (void) umount_verbose(LOG_WARNING, "/run/systemd/user-home-mount", UMOUNT_NOFOLLOW);
2342
2343 if (dm_activated)
2344 (void) sym_crypt_deactivate_by_name(cd, dm_name, 0);
2345
2346 loop = loop_device_unref(loop);
2347
2348 if (image_created)
2349 (void) unlink(temporary_image_path);
2350
2351 return r;
2352 }
2353
2354 int home_get_state_luks(UserRecord *h, HomeSetup *setup) {
2355 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
2356 int r;
2357
2358 assert(h);
2359 assert(setup);
2360
2361 r = make_dm_names(h->user_name, &dm_name, &dm_node);
2362 if (r < 0)
2363 return r;
2364
2365 r = access(dm_node, F_OK);
2366 if (r < 0 && errno != ENOENT)
2367 return log_error_errno(errno, "Failed to determine whether %s exists: %m", dm_node);
2368
2369 free_and_replace(setup->dm_name, dm_name);
2370 free_and_replace(setup->dm_node, dm_node);
2371
2372 return r >= 0;
2373 }
2374
2375 enum {
2376 CAN_RESIZE_ONLINE,
2377 CAN_RESIZE_OFFLINE,
2378 };
2379
2380 static int can_resize_fs(int fd, uint64_t old_size, uint64_t new_size) {
2381 struct statfs sfs;
2382
2383 assert(fd >= 0);
2384
2385 /* Filter out bogus requests early */
2386 if (old_size == 0 || old_size == UINT64_MAX ||
2387 new_size == 0 || new_size == UINT64_MAX)
2388 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid resize parameters.");
2389
2390 if ((old_size & 511) != 0 || (new_size & 511) != 0)
2391 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Resize parameters not multiple of 512.");
2392
2393 if (fstatfs(fd, &sfs) < 0)
2394 return log_error_errno(errno, "Failed to fstatfs() file system: %m");
2395
2396 if (is_fs_type(&sfs, BTRFS_SUPER_MAGIC)) {
2397
2398 if (new_size < BTRFS_MINIMAL_SIZE)
2399 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for btrfs (needs to be 256M at least.");
2400
2401 /* btrfs can grow and shrink online */
2402
2403 } else if (is_fs_type(&sfs, XFS_SB_MAGIC)) {
2404
2405 if (new_size < XFS_MINIMAL_SIZE)
2406 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for xfs (needs to be 14M at least).");
2407
2408 /* XFS can grow, but not shrink */
2409 if (new_size < old_size)
2410 return log_error_errno(SYNTHETIC_ERRNO(EMSGSIZE), "Shrinking this type of file system is not supported.");
2411
2412 } else if (is_fs_type(&sfs, EXT4_SUPER_MAGIC)) {
2413
2414 if (new_size < EXT4_MINIMAL_SIZE)
2415 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for ext4 (needs to be 1M at least).");
2416
2417 /* ext4 can grow online, and shrink offline */
2418 if (new_size < old_size)
2419 return CAN_RESIZE_OFFLINE;
2420
2421 } else
2422 return log_error_errno(SYNTHETIC_ERRNO(ESOCKTNOSUPPORT), "Resizing this type of file system is not supported.");
2423
2424 return CAN_RESIZE_ONLINE;
2425 }
2426
2427 static int ext4_offline_resize_fs(HomeSetup *setup, uint64_t new_size, bool discard, unsigned long flags) {
2428 _cleanup_free_ char *size_str = NULL;
2429 bool re_open = false, re_mount = false;
2430 pid_t resize_pid, fsck_pid;
2431 int r, exit_status;
2432
2433 assert(setup);
2434 assert(setup->dm_node);
2435
2436 /* First, unmount the file system */
2437 if (setup->root_fd >= 0) {
2438 setup->root_fd = safe_close(setup->root_fd);
2439 re_open = true;
2440 }
2441
2442 if (setup->undo_mount) {
2443 r = umount_verbose(LOG_ERR, "/run/systemd/user-home-mount", UMOUNT_NOFOLLOW);
2444 if (r < 0)
2445 return r;
2446
2447 setup->undo_mount = false;
2448 re_mount = true;
2449 }
2450
2451 log_info("Temporary unmounting of file system completed.");
2452
2453 /* resize2fs requires that the file system is force checked first, do so. */
2454 r = safe_fork("(e2fsck)",
2455 FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_STDOUT_TO_STDERR|FORK_CLOSE_ALL_FDS,
2456 &fsck_pid);
2457 if (r < 0)
2458 return r;
2459 if (r == 0) {
2460 /* Child */
2461 execlp("e2fsck" ,"e2fsck", "-fp", setup->dm_node, NULL);
2462 log_open();
2463 log_error_errno(errno, "Failed to execute e2fsck: %m");
2464 _exit(EXIT_FAILURE);
2465 }
2466
2467 exit_status = wait_for_terminate_and_check("e2fsck", fsck_pid, WAIT_LOG_ABNORMAL);
2468 if (exit_status < 0)
2469 return exit_status;
2470 if ((exit_status & ~FSCK_ERROR_CORRECTED) != 0) {
2471 log_warning("e2fsck failed with exit status %i.", exit_status);
2472
2473 if ((exit_status & (FSCK_SYSTEM_SHOULD_REBOOT|FSCK_ERRORS_LEFT_UNCORRECTED)) != 0)
2474 return log_error_errno(SYNTHETIC_ERRNO(EIO), "File system is corrupted, refusing.");
2475
2476 log_warning("Ignoring fsck error.");
2477 }
2478
2479 log_info("Forced file system check completed.");
2480
2481 /* We use 512 sectors here, because resize2fs doesn't do byte sizes */
2482 if (asprintf(&size_str, "%" PRIu64 "s", new_size / 512) < 0)
2483 return log_oom();
2484
2485 /* Resize the thing */
2486 r = safe_fork("(e2resize)",
2487 FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_WAIT|FORK_STDOUT_TO_STDERR|FORK_CLOSE_ALL_FDS,
2488 &resize_pid);
2489 if (r < 0)
2490 return r;
2491 if (r == 0) {
2492 /* Child */
2493 execlp("resize2fs" ,"resize2fs", setup->dm_node, size_str, NULL);
2494 log_open();
2495 log_error_errno(errno, "Failed to execute resize2fs: %m");
2496 _exit(EXIT_FAILURE);
2497 }
2498
2499 log_info("Offline file system resize completed.");
2500
2501 /* Re-establish mounts and reopen the directory */
2502 if (re_mount) {
2503 r = home_mount_node(setup->dm_node, "ext4", discard, flags);
2504 if (r < 0)
2505 return r;
2506
2507 setup->undo_mount = true;
2508 }
2509
2510 if (re_open) {
2511 setup->root_fd = open("/run/systemd/user-home-mount", O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
2512 if (setup->root_fd < 0)
2513 return log_error_errno(errno, "Failed to reopen file system: %m");
2514 }
2515
2516 log_info("File system mounted again.");
2517
2518 return 0;
2519 }
2520
2521 static int prepare_resize_partition(
2522 int fd,
2523 uint64_t partition_offset,
2524 uint64_t old_partition_size,
2525 uint64_t new_partition_size,
2526 sd_id128_t *ret_disk_uuid,
2527 struct fdisk_table **ret_table) {
2528
2529 _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
2530 _cleanup_(fdisk_unref_tablep) struct fdisk_table *t = NULL;
2531 _cleanup_free_ char *path = NULL, *disk_uuid_as_string = NULL;
2532 size_t n_partitions;
2533 sd_id128_t disk_uuid;
2534 bool found = false;
2535 int r;
2536
2537 assert(fd >= 0);
2538 assert(ret_disk_uuid);
2539 assert(ret_table);
2540
2541 assert((partition_offset & 511) == 0);
2542 assert((old_partition_size & 511) == 0);
2543 assert((new_partition_size & 511) == 0);
2544 assert(UINT64_MAX - old_partition_size >= partition_offset);
2545 assert(UINT64_MAX - new_partition_size >= partition_offset);
2546
2547 if (partition_offset == 0) {
2548 /* If the offset is at the beginning we assume no partition table, let's exit early. */
2549 log_debug("Not rewriting partition table, operating on naked device.");
2550 *ret_disk_uuid = SD_ID128_NULL;
2551 *ret_table = NULL;
2552 return 0;
2553 }
2554
2555 c = fdisk_new_context();
2556 if (!c)
2557 return log_oom();
2558
2559 if (asprintf(&path, "/proc/self/fd/%i", fd) < 0)
2560 return log_oom();
2561
2562 r = fdisk_assign_device(c, path, 0);
2563 if (r < 0)
2564 return log_error_errno(r, "Failed to open device: %m");
2565
2566 if (!fdisk_is_labeltype(c, FDISK_DISKLABEL_GPT))
2567 return log_error_errno(SYNTHETIC_ERRNO(ENOMEDIUM), "Disk has no GPT partition table.");
2568
2569 r = fdisk_get_disklabel_id(c, &disk_uuid_as_string);
2570 if (r < 0)
2571 return log_error_errno(r, "Failed to acquire disk UUID: %m");
2572
2573 r = sd_id128_from_string(disk_uuid_as_string, &disk_uuid);
2574 if (r < 0)
2575 return log_error_errno(r, "Failed parse disk UUID: %m");
2576
2577 r = fdisk_get_partitions(c, &t);
2578 if (r < 0)
2579 return log_error_errno(r, "Failed to acquire partition table: %m");
2580
2581 n_partitions = fdisk_table_get_nents(t);
2582 for (size_t i = 0; i < n_partitions; i++) {
2583 struct fdisk_partition *p;
2584
2585 p = fdisk_table_get_partition(t, i);
2586 if (!p)
2587 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to read partition metadata: %m");
2588
2589 if (fdisk_partition_is_used(p) <= 0)
2590 continue;
2591 if (fdisk_partition_has_start(p) <= 0 || fdisk_partition_has_size(p) <= 0 || fdisk_partition_has_end(p) <= 0)
2592 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Found partition without a size.");
2593
2594 if (fdisk_partition_get_start(p) == partition_offset / 512U &&
2595 fdisk_partition_get_size(p) == old_partition_size / 512U) {
2596
2597 if (found)
2598 return log_error_errno(SYNTHETIC_ERRNO(ENOTUNIQ), "Partition found twice, refusing.");
2599
2600 /* Found our partition, now patch it */
2601 r = fdisk_partition_size_explicit(p, 1);
2602 if (r < 0)
2603 return log_error_errno(r, "Failed to enable explicit partition size: %m");
2604
2605 r = fdisk_partition_set_size(p, new_partition_size / 512U);
2606 if (r < 0)
2607 return log_error_errno(r, "Failed to change partition size: %m");
2608
2609 found = true;
2610 continue;
2611
2612 } else {
2613 if (fdisk_partition_get_start(p) < partition_offset + new_partition_size / 512U &&
2614 fdisk_partition_get_end(p) >= partition_offset / 512)
2615 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Can't extend, conflicting partition found.");
2616 }
2617 }
2618
2619 if (!found)
2620 return log_error_errno(SYNTHETIC_ERRNO(ENOPKG), "Failed to find matching partition to resize.");
2621
2622 *ret_table = TAKE_PTR(t);
2623 *ret_disk_uuid = disk_uuid;
2624
2625 return 1;
2626 }
2627
2628 static int ask_cb(struct fdisk_context *c, struct fdisk_ask *ask, void *userdata) {
2629 char *result;
2630
2631 assert(c);
2632
2633 switch (fdisk_ask_get_type(ask)) {
2634
2635 case FDISK_ASKTYPE_STRING:
2636 result = new(char, 37);
2637 if (!result)
2638 return log_oom();
2639
2640 fdisk_ask_string_set_result(ask, id128_to_uuid_string(*(sd_id128_t*) userdata, result));
2641 break;
2642
2643 default:
2644 log_debug("Unexpected question from libfdisk, ignoring.");
2645 }
2646
2647 return 0;
2648 }
2649
2650 static int apply_resize_partition(int fd, sd_id128_t disk_uuids, struct fdisk_table *t) {
2651 _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
2652 _cleanup_free_ void *two_zero_lbas = NULL;
2653 _cleanup_free_ char *path = NULL;
2654 ssize_t n;
2655 int r;
2656
2657 assert(fd >= 0);
2658
2659 if (!t) /* no partition table to apply, exit early */
2660 return 0;
2661
2662 two_zero_lbas = malloc0(1024U);
2663 if (!two_zero_lbas)
2664 return log_oom();
2665
2666 /* libfdisk appears to get confused by the existing PMBR. Let's explicitly flush it out. */
2667 n = pwrite(fd, two_zero_lbas, 1024U, 0);
2668 if (n < 0)
2669 return log_error_errno(errno, "Failed to wipe partition table: %m");
2670 if (n != 1024)
2671 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while wiping partition table.");
2672
2673 c = fdisk_new_context();
2674 if (!c)
2675 return log_oom();
2676
2677 if (asprintf(&path, "/proc/self/fd/%i", fd) < 0)
2678 return log_oom();
2679
2680 r = fdisk_assign_device(c, path, 0);
2681 if (r < 0)
2682 return log_error_errno(r, "Failed to open device: %m");
2683
2684 r = fdisk_create_disklabel(c, "gpt");
2685 if (r < 0)
2686 return log_error_errno(r, "Failed to create GPT disk label: %m");
2687
2688 r = fdisk_apply_table(c, t);
2689 if (r < 0)
2690 return log_error_errno(r, "Failed to apply partition table: %m");
2691
2692 r = fdisk_set_ask(c, ask_cb, &disk_uuids);
2693 if (r < 0)
2694 return log_error_errno(r, "Failed to set libfdisk query function: %m");
2695
2696 r = fdisk_set_disklabel_id(c);
2697 if (r < 0)
2698 return log_error_errno(r, "Failed to change disklabel ID: %m");
2699
2700 r = fdisk_write_disklabel(c);
2701 if (r < 0)
2702 return log_error_errno(r, "Failed to write disk label: %m");
2703
2704 return 1;
2705 }
2706
2707 int home_resize_luks(
2708 UserRecord *h,
2709 HomeSetupFlags flags,
2710 PasswordCache *cache,
2711 HomeSetup *setup,
2712 UserRecord **ret_home) {
2713
2714 uint64_t old_image_size, new_image_size, old_fs_size, new_fs_size, crypto_offset, new_partition_size;
2715 _cleanup_(user_record_unrefp) UserRecord *header_home = NULL, *embedded_home = NULL, *new_home = NULL;
2716 _cleanup_(fdisk_unref_tablep) struct fdisk_table *table = NULL;
2717 _cleanup_free_ char *whole_disk = NULL;
2718 _cleanup_close_ int image_fd = -1;
2719 sd_id128_t disk_uuid;
2720 const char *ip, *ipo;
2721 struct statfs sfs;
2722 struct stat st;
2723 int r, resize_type;
2724
2725 assert(h);
2726 assert(user_record_storage(h) == USER_LUKS);
2727 assert(setup);
2728 assert(ret_home);
2729
2730 r = dlopen_cryptsetup();
2731 if (r < 0)
2732 return r;
2733
2734 assert_se(ipo = user_record_image_path(h));
2735 ip = strdupa_safe(ipo); /* copy out since original might change later in home record object */
2736
2737 image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2738 if (image_fd < 0)
2739 return log_error_errno(errno, "Failed to open image file %s: %m", ip);
2740
2741 if (fstat(image_fd, &st) < 0)
2742 return log_error_errno(errno, "Failed to stat image file %s: %m", ip);
2743 if (S_ISBLK(st.st_mode)) {
2744 dev_t parent;
2745
2746 r = block_get_whole_disk(st.st_rdev, &parent);
2747 if (r < 0)
2748 return log_error_errno(r, "Failed to acquire whole block device for %s: %m", ip);
2749 if (r > 0) {
2750 /* If we shall resize a file system on a partition device, then let's figure out the
2751 * whole disk device and operate on that instead, since we need to rewrite the
2752 * partition table to resize the partition. */
2753
2754 log_info("Operating on partition device %s, using parent device.", ip);
2755
2756 r = device_path_make_major_minor(st.st_mode, parent, &whole_disk);
2757 if (r < 0)
2758 return log_error_errno(r, "Failed to derive whole disk path for %s: %m", ip);
2759
2760 safe_close(image_fd);
2761
2762 image_fd = open(whole_disk, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2763 if (image_fd < 0)
2764 return log_error_errno(errno, "Failed to open whole block device %s: %m", whole_disk);
2765
2766 if (fstat(image_fd, &st) < 0)
2767 return log_error_errno(errno, "Failed to stat whole block device %s: %m", whole_disk);
2768 if (!S_ISBLK(st.st_mode))
2769 return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Whole block device %s is not actually a block device, refusing.", whole_disk);
2770 } else
2771 log_info("Operating on whole block device %s.", ip);
2772
2773 if (ioctl(image_fd, BLKGETSIZE64, &old_image_size) < 0)
2774 return log_error_errno(errno, "Failed to determine size of original block device: %m");
2775
2776 if (flock(image_fd, LOCK_EX) < 0) /* make sure udev doesn't read from it while we operate on the device */
2777 return log_error_errno(errno, "Failed to lock block device %s: %m", ip);
2778
2779 new_image_size = old_image_size; /* we can't resize physical block devices */
2780 } else {
2781 uint64_t new_image_size_rounded;
2782
2783 r = stat_verify_regular(&st);
2784 if (r < 0)
2785 return log_error_errno(r, "Image %s is not a block device nor regular file: %m", ip);
2786
2787 old_image_size = st.st_size;
2788
2789 /* Note an asymetry here: when we operate on loopback files the specified disk size we get we
2790 * apply onto the loopback file as a whole. When we operate on block devices we instead apply
2791 * to the partition itself only. */
2792
2793 new_image_size_rounded = DISK_SIZE_ROUND_DOWN(h->disk_size);
2794
2795 if (old_image_size == h->disk_size ||
2796 old_image_size == new_image_size_rounded) {
2797 /* If exact match, or a match after we rounded down, don't do a thing */
2798 log_info("Image size already matching, skipping operation.");
2799 return 0;
2800 }
2801
2802 new_image_size = new_image_size_rounded;
2803 }
2804
2805 r = home_setup_luks(h, flags, whole_disk, cache, setup, &header_home);
2806 if (r < 0)
2807 return r;
2808
2809 r = home_load_embedded_identity(h, setup->root_fd, header_home, USER_RECONCILE_REQUIRE_NEWER_OR_EQUAL, cache, &embedded_home, &new_home);
2810 if (r < 0)
2811 return r;
2812
2813 log_info("offset = %" PRIu64 ", size = %" PRIu64 ", image = %" PRIu64, setup->partition_offset, setup->partition_size, old_image_size);
2814
2815 if ((UINT64_MAX - setup->partition_offset) < setup->partition_size ||
2816 setup->partition_offset + setup->partition_size > old_image_size)
2817 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Old partition doesn't fit in backing storage, refusing.");
2818
2819 if (S_ISREG(st.st_mode)) {
2820 uint64_t partition_table_extra;
2821
2822 partition_table_extra = old_image_size - setup->partition_size;
2823 if (new_image_size <= partition_table_extra)
2824 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "New size smaller than partition table metadata.");
2825
2826 new_partition_size = DISK_SIZE_ROUND_DOWN(new_image_size - partition_table_extra);
2827 } else {
2828 uint64_t new_partition_size_rounded;
2829
2830 assert(S_ISBLK(st.st_mode));
2831
2832 new_partition_size_rounded = DISK_SIZE_ROUND_DOWN(h->disk_size);
2833
2834 if (h->disk_size == setup->partition_size ||
2835 new_partition_size_rounded == setup->partition_size) {
2836 log_info("Partition size already matching, skipping operation.");
2837 return 0;
2838 }
2839
2840 new_partition_size = new_partition_size_rounded;
2841 }
2842
2843 if ((UINT64_MAX - setup->partition_offset) < new_partition_size ||
2844 setup->partition_offset + new_partition_size > new_image_size)
2845 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "New partition doesn't fit into backing storage, refusing.");
2846
2847 crypto_offset = sym_crypt_get_data_offset(setup->crypt_device);
2848 if (setup->partition_size / 512U <= crypto_offset)
2849 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Weird, old crypto payload offset doesn't actually fit in partition size?");
2850 if (new_partition_size / 512U <= crypto_offset)
2851 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "New size smaller than crypto payload offset?");
2852
2853 old_fs_size = (setup->partition_size / 512U - crypto_offset) * 512U;
2854 new_fs_size = DISK_SIZE_ROUND_DOWN((new_partition_size / 512U - crypto_offset) * 512U);
2855
2856 /* Before we start doing anything, let's figure out if we actually can */
2857 resize_type = can_resize_fs(setup->root_fd, old_fs_size, new_fs_size);
2858 if (resize_type < 0)
2859 return resize_type;
2860 if (resize_type == CAN_RESIZE_OFFLINE && FLAGS_SET(flags, HOME_SETUP_ALREADY_ACTIVATED))
2861 return log_error_errno(SYNTHETIC_ERRNO(ETXTBSY), "File systems of this type can only be resized offline, but is currently online.");
2862
2863 log_info("Ready to resize image size %s → %s, partition size %s → %s, file system size %s → %s.",
2864 FORMAT_BYTES(old_image_size),
2865 FORMAT_BYTES(new_image_size),
2866 FORMAT_BYTES(setup->partition_size),
2867 FORMAT_BYTES(new_partition_size),
2868 FORMAT_BYTES(old_fs_size),
2869 FORMAT_BYTES(new_fs_size));
2870
2871 r = prepare_resize_partition(
2872 image_fd,
2873 setup->partition_offset,
2874 setup->partition_size,
2875 new_partition_size,
2876 &disk_uuid,
2877 &table);
2878 if (r < 0)
2879 return r;
2880
2881 if (new_fs_size > old_fs_size) {
2882
2883 if (S_ISREG(st.st_mode)) {
2884 /* Grow file size */
2885 r = home_truncate(h, image_fd, ip, new_image_size);
2886 if (r < 0)
2887 return r;
2888
2889 log_info("Growing of image file completed.");
2890 }
2891
2892 /* Make sure loopback device sees the new bigger size */
2893 r = loop_device_refresh_size(setup->loop, UINT64_MAX, new_partition_size);
2894 if (r == -ENOTTY)
2895 log_debug_errno(r, "Device is not a loopback device, not refreshing size.");
2896 else if (r < 0)
2897 return log_error_errno(r, "Failed to refresh loopback device size: %m");
2898 else
2899 log_info("Refreshing loop device size completed.");
2900
2901 r = apply_resize_partition(image_fd, disk_uuid, table);
2902 if (r < 0)
2903 return r;
2904 if (r > 0)
2905 log_info("Growing of partition completed.");
2906
2907 if (S_ISBLK(st.st_mode) && ioctl(image_fd, BLKRRPART, 0) < 0)
2908 log_debug_errno(errno, "BLKRRPART failed on block device, ignoring: %m");
2909
2910 /* Tell LUKS about the new bigger size too */
2911 r = sym_crypt_resize(setup->crypt_device, setup->dm_name, new_fs_size / 512U);
2912 if (r < 0)
2913 return log_error_errno(r, "Failed to grow LUKS device: %m");
2914
2915 log_info("LUKS device growing completed.");
2916 } else {
2917 r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
2918 if (r < 0)
2919 return r;
2920
2921 if (S_ISREG(st.st_mode)) {
2922 if (user_record_luks_discard(h))
2923 /* Before we shrink, let's trim the file system, so that we need less space on disk during the shrinking */
2924 (void) run_fitrim(setup->root_fd);
2925 else {
2926 /* If discard is off, let's ensure all backing blocks are allocated, so that our resize operation doesn't fail half-way */
2927 r = run_fallocate(image_fd, &st);
2928 if (r < 0)
2929 return r;
2930 }
2931 }
2932 }
2933
2934 /* Now resize the file system */
2935 if (resize_type == CAN_RESIZE_ONLINE) {
2936 r = resize_fs(setup->root_fd, new_fs_size, NULL);
2937 if (r < 0)
2938 return log_error_errno(r, "Failed to resize file system: %m");
2939 } else {
2940 r = ext4_offline_resize_fs(setup, new_fs_size, user_record_luks_discard(h), user_record_mount_flags(h));
2941 if (r < 0)
2942 return r;
2943 }
2944
2945 log_info("File system resizing completed.");
2946
2947 /* Immediately sync afterwards */
2948 r = home_sync_and_statfs(setup->root_fd, NULL);
2949 if (r < 0)
2950 return r;
2951
2952 if (new_fs_size < old_fs_size) {
2953
2954 /* Shrink the LUKS device now, matching the new file system size */
2955 r = sym_crypt_resize(setup->crypt_device, setup->dm_name, new_fs_size / 512);
2956 if (r < 0)
2957 return log_error_errno(r, "Failed to shrink LUKS device: %m");
2958
2959 log_info("LUKS device shrinking completed.");
2960
2961 if (S_ISREG(st.st_mode)) {
2962 /* Shrink the image file */
2963 if (ftruncate(image_fd, new_image_size) < 0)
2964 return log_error_errno(errno, "Failed to shrink image file %s: %m", ip);
2965
2966 log_info("Shrinking of image file completed.");
2967 }
2968
2969 /* Refresh the loop devices size */
2970 r = loop_device_refresh_size(setup->loop, UINT64_MAX, new_partition_size);
2971 if (r == -ENOTTY)
2972 log_debug_errno(r, "Device is not a loopback device, not refreshing size.");
2973 else if (r < 0)
2974 return log_error_errno(r, "Failed to refresh loopback device size: %m");
2975 else
2976 log_info("Refreshing loop device size completed.");
2977
2978 r = apply_resize_partition(image_fd, disk_uuid, table);
2979 if (r < 0)
2980 return r;
2981 if (r > 0)
2982 log_info("Shrinking of partition completed.");
2983
2984 if (S_ISBLK(st.st_mode) && ioctl(image_fd, BLKRRPART, 0) < 0)
2985 log_debug_errno(errno, "BLKRRPART failed on block device, ignoring: %m");
2986 } else {
2987 r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
2988 if (r < 0)
2989 return r;
2990 }
2991
2992 r = home_store_header_identity_luks(new_home, setup, header_home);
2993 if (r < 0)
2994 return r;
2995
2996 r = home_extend_embedded_identity(new_home, h, setup);
2997 if (r < 0)
2998 return r;
2999
3000 if (user_record_luks_discard(h))
3001 (void) run_fitrim(setup->root_fd);
3002
3003 r = home_sync_and_statfs(setup->root_fd, &sfs);
3004 if (r < 0)
3005 return r;
3006
3007 r = home_setup_done(setup);
3008 if (r < 0)
3009 return r;
3010
3011 log_info("Everything completed.");
3012
3013 print_size_summary(new_image_size, new_fs_size, &sfs);
3014
3015 *ret_home = TAKE_PTR(new_home);
3016 return 0;
3017 }
3018
3019 int home_passwd_luks(
3020 UserRecord *h,
3021 HomeSetup *setup,
3022 const PasswordCache *cache, /* the passwords acquired via PKCS#11/FIDO2 security tokens */
3023 char **effective_passwords /* new passwords */) {
3024
3025 size_t volume_key_size, max_key_slots, n_effective;
3026 _cleanup_(erase_and_freep) void *volume_key = NULL;
3027 struct crypt_pbkdf_type good_pbkdf, minimal_pbkdf;
3028 const char *type;
3029 char **list;
3030 int r;
3031
3032 assert(h);
3033 assert(user_record_storage(h) == USER_LUKS);
3034 assert(setup);
3035
3036 r = dlopen_cryptsetup();
3037 if (r < 0)
3038 return r;
3039
3040 type = sym_crypt_get_type(setup->crypt_device);
3041 if (!type)
3042 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine crypto device type.");
3043
3044 r = sym_crypt_keyslot_max(type);
3045 if (r <= 0)
3046 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine number of key slots.");
3047 max_key_slots = r;
3048
3049 r = sym_crypt_get_volume_key_size(setup->crypt_device);
3050 if (r <= 0)
3051 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine volume key size.");
3052 volume_key_size = (size_t) r;
3053
3054 volume_key = malloc(volume_key_size);
3055 if (!volume_key)
3056 return log_oom();
3057
3058 r = -ENOKEY;
3059 FOREACH_POINTER(list,
3060 cache ? cache->pkcs11_passwords : NULL,
3061 cache ? cache->fido2_passwords : NULL,
3062 h->password) {
3063
3064 r = luks_try_passwords(setup->crypt_device, list, volume_key, &volume_key_size);
3065 if (r != -ENOKEY)
3066 break;
3067 }
3068 if (r == -ENOKEY)
3069 return log_error_errno(SYNTHETIC_ERRNO(ENOKEY), "Failed to unlock LUKS superblock with supplied passwords.");
3070 if (r < 0)
3071 return log_error_errno(r, "Failed to unlocks LUKS superblock: %m");
3072
3073 n_effective = strv_length(effective_passwords);
3074
3075 build_good_pbkdf(&good_pbkdf, h);
3076 build_minimal_pbkdf(&minimal_pbkdf, h);
3077
3078 for (size_t i = 0; i < max_key_slots; i++) {
3079 r = sym_crypt_keyslot_destroy(setup->crypt_device, i);
3080 if (r < 0 && !IN_SET(r, -ENOENT, -EINVAL)) /* Returns EINVAL or ENOENT if there's no key in this slot already */
3081 return log_error_errno(r, "Failed to destroy LUKS password: %m");
3082
3083 if (i >= n_effective) {
3084 if (r >= 0)
3085 log_info("Destroyed LUKS key slot %zu.", i);
3086 continue;
3087 }
3088
3089 if (password_cache_contains(cache, effective_passwords[i])) { /* Is this a FIDO2 or PKCS#11 password? */
3090 log_debug("Using minimal PBKDF for slot %zu", i);
3091 r = sym_crypt_set_pbkdf_type(setup->crypt_device, &minimal_pbkdf);
3092 } else {
3093 log_debug("Using good PBKDF for slot %zu", i);
3094 r = sym_crypt_set_pbkdf_type(setup->crypt_device, &good_pbkdf);
3095 }
3096 if (r < 0)
3097 return log_error_errno(r, "Failed to tweak PBKDF for slot %zu: %m", i);
3098
3099 r = sym_crypt_keyslot_add_by_volume_key(
3100 setup->crypt_device,
3101 i,
3102 volume_key,
3103 volume_key_size,
3104 effective_passwords[i],
3105 strlen(effective_passwords[i]));
3106 if (r < 0)
3107 return log_error_errno(r, "Failed to set up LUKS password: %m");
3108
3109 log_info("Updated LUKS key slot %zu.", i);
3110 }
3111
3112 return 1;
3113 }
3114
3115 int home_lock_luks(UserRecord *h) {
3116 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
3117 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
3118 _cleanup_close_ int root_fd = -1;
3119 const char *p;
3120 int r;
3121
3122 assert(h);
3123
3124 assert_se(p = user_record_home_directory(h));
3125 root_fd = open(p, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
3126 if (root_fd < 0)
3127 return log_error_errno(errno, "Failed to open home directory: %m");
3128
3129 r = make_dm_names(h->user_name, &dm_name, &dm_node);
3130 if (r < 0)
3131 return r;
3132
3133 r = dlopen_cryptsetup();
3134 if (r < 0)
3135 return r;
3136
3137 r = sym_crypt_init_by_name(&cd, dm_name);
3138 if (r < 0)
3139 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
3140
3141 log_info("Discovered used LUKS device %s.", dm_node);
3142 cryptsetup_enable_logging(cd);
3143
3144 if (syncfs(root_fd) < 0) /* Snake oil, but let's better be safe than sorry */
3145 return log_error_errno(errno, "Failed to synchronize file system %s: %m", p);
3146
3147 root_fd = safe_close(root_fd);
3148
3149 log_info("File system synchronized.");
3150
3151 /* Note that we don't invoke FIFREEZE here, it appears libcryptsetup/device-mapper already does that on its own for us */
3152
3153 r = sym_crypt_suspend(cd, dm_name);
3154 if (r < 0)
3155 return log_error_errno(r, "Failed to suspend cryptsetup device: %s: %m", dm_node);
3156
3157 log_info("LUKS device suspended.");
3158 return 0;
3159 }
3160
3161 static int luks_try_resume(
3162 struct crypt_device *cd,
3163 const char *dm_name,
3164 char **password) {
3165
3166 char **pp;
3167 int r;
3168
3169 assert(cd);
3170 assert(dm_name);
3171
3172 STRV_FOREACH(pp, password) {
3173 r = sym_crypt_resume_by_passphrase(
3174 cd,
3175 dm_name,
3176 CRYPT_ANY_SLOT,
3177 *pp,
3178 strlen(*pp));
3179 if (r >= 0) {
3180 log_info("Resumed LUKS device %s.", dm_name);
3181 return 0;
3182 }
3183
3184 log_debug_errno(r, "Password %zu didn't work for resuming device: %m", (size_t) (pp - password));
3185 }
3186
3187 return -ENOKEY;
3188 }
3189
3190 int home_unlock_luks(UserRecord *h, const PasswordCache *cache) {
3191 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
3192 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
3193 char **list;
3194 int r;
3195
3196 assert(h);
3197
3198 r = make_dm_names(h->user_name, &dm_name, &dm_node);
3199 if (r < 0)
3200 return r;
3201
3202 r = dlopen_cryptsetup();
3203 if (r < 0)
3204 return r;
3205
3206 r = sym_crypt_init_by_name(&cd, dm_name);
3207 if (r < 0)
3208 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
3209
3210 log_info("Discovered used LUKS device %s.", dm_node);
3211 cryptsetup_enable_logging(cd);
3212
3213 r = -ENOKEY;
3214 FOREACH_POINTER(list,
3215 cache ? cache->pkcs11_passwords : NULL,
3216 cache ? cache->fido2_passwords : NULL,
3217 h->password) {
3218 r = luks_try_resume(cd, dm_name, list);
3219 if (r != -ENOKEY)
3220 break;
3221 }
3222 if (r == -ENOKEY)
3223 return log_error_errno(r, "No valid password for LUKS superblock.");
3224 if (r < 0)
3225 return log_error_errno(r, "Failed to resume LUKS superblock: %m");
3226
3227 log_info("LUKS device resumed.");
3228 return 0;
3229 }
Unnamed repository; edit this file 'description' to name the repository.