]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/home/homework-luks.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #20488 from yuwata/timesync-fix
[thirdparty/systemd.git] / src / home / homework-luks.c
1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3 #include <libfdisk.h>
4 #include <linux/loop.h>
5 #include <poll.h>
6 #include <sys/file.h>
7 #include <sys/ioctl.h>
8 #include <sys/mount.h>
9 #include <sys/xattr.h>
10
11 #include "blkid-util.h"
12 #include "blockdev-util.h"
13 #include "btrfs-util.h"
14 #include "chattr-util.h"
15 #include "dm-util.h"
16 #include "errno-util.h"
17 #include "fd-util.h"
18 #include "fileio.h"
19 #include "fs-util.h"
20 #include "fsck-util.h"
21 #include "home-util.h"
22 #include "homework-luks.h"
23 #include "homework-mount.h"
24 #include "id128-util.h"
25 #include "io-util.h"
26 #include "memory-util.h"
27 #include "missing_magic.h"
28 #include "mkdir.h"
29 #include "mkfs-util.h"
30 #include "mount-util.h"
31 #include "openssl-util.h"
32 #include "parse-util.h"
33 #include "path-util.h"
34 #include "process-util.h"
35 #include "random-util.h"
36 #include "resize-fs.h"
37 #include "stat-util.h"
38 #include "strv.h"
39 #include "tmpfile-util.h"
40
41 /* Round down to the nearest 1K size. Note that Linux generally handles block devices with 512 blocks only,
42 * but actually doesn't accept uneven numbers in many cases. To avoid any confusion around this we'll
43 * strictly round disk sizes down to the next 1K boundary. */
44 #define DISK_SIZE_ROUND_DOWN(x) ((x) & ~UINT64_C(1023))
45
46 int run_mark_dirty(int fd, bool b) {
47 char x = '1';
48 int r, ret;
49
50 /* Sets or removes the 'user.home-dirty' xattr on the specified file. We use this to detect when a
51 * home directory was not properly unmounted. */
52
53 assert(fd >= 0);
54
55 r = fd_verify_regular(fd);
56 if (r < 0)
57 return r;
58
59 if (b) {
60 ret = fsetxattr(fd, "user.home-dirty", &x, 1, XATTR_CREATE);
61 if (ret < 0 && errno != EEXIST)
62 return log_debug_errno(errno, "Could not mark home directory as dirty: %m");
63
64 } else {
65 r = fsync_full(fd);
66 if (r < 0)
67 return log_debug_errno(r, "Failed to synchronize image before marking it clean: %m");
68
69 ret = fremovexattr(fd, "user.home-dirty");
70 if (ret < 0 && errno != ENODATA)
71 return log_debug_errno(errno, "Could not mark home directory as clean: %m");
72 }
73
74 r = fsync_full(fd);
75 if (r < 0)
76 return log_debug_errno(r, "Failed to synchronize dirty flag to disk: %m");
77
78 return ret >= 0;
79 }
80
81 int run_mark_dirty_by_path(const char *path, bool b) {
82 _cleanup_close_ int fd = -1;
83
84 assert(path);
85
86 fd = open(path, O_RDWR|O_CLOEXEC|O_NOCTTY);
87 if (fd < 0)
88 return log_debug_errno(errno, "Failed to open %s to mark dirty or clean: %m", path);
89
90 return run_mark_dirty(fd, b);
91 }
92
93 static int probe_file_system_by_fd(
94 int fd,
95 char **ret_fstype,
96 sd_id128_t *ret_uuid) {
97
98 _cleanup_(blkid_free_probep) blkid_probe b = NULL;
99 _cleanup_free_ char *s = NULL;
100 const char *fstype = NULL, *uuid = NULL;
101 sd_id128_t id;
102 int r;
103
104 assert(fd >= 0);
105 assert(ret_fstype);
106 assert(ret_uuid);
107
108 b = blkid_new_probe();
109 if (!b)
110 return -ENOMEM;
111
112 errno = 0;
113 r = blkid_probe_set_device(b, fd, 0, 0);
114 if (r != 0)
115 return errno > 0 ? -errno : -ENOMEM;
116
117 (void) blkid_probe_enable_superblocks(b, 1);
118 (void) blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE|BLKID_SUBLKS_UUID);
119
120 errno = 0;
121 r = blkid_do_safeprobe(b);
122 if (IN_SET(r, -2, 1)) /* nothing found or ambiguous result */
123 return -ENOPKG;
124 if (r != 0)
125 return errno > 0 ? -errno : -EIO;
126
127 (void) blkid_probe_lookup_value(b, "TYPE", &fstype, NULL);
128 if (!fstype)
129 return -ENOPKG;
130
131 (void) blkid_probe_lookup_value(b, "UUID", &uuid, NULL);
132 if (!uuid)
133 return -ENOPKG;
134
135 r = sd_id128_from_string(uuid, &id);
136 if (r < 0)
137 return r;
138
139 s = strdup(fstype);
140 if (!s)
141 return -ENOMEM;
142
143 *ret_fstype = TAKE_PTR(s);
144 *ret_uuid = id;
145
146 return 0;
147 }
148
149 static int probe_file_system_by_path(const char *path, char **ret_fstype, sd_id128_t *ret_uuid) {
150 _cleanup_close_ int fd = -1;
151
152 fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
153 if (fd < 0)
154 return -errno;
155
156 return probe_file_system_by_fd(fd, ret_fstype, ret_uuid);
157 }
158
159 static int block_get_size_by_fd(int fd, uint64_t *ret) {
160 struct stat st;
161
162 assert(fd >= 0);
163 assert(ret);
164
165 if (fstat(fd, &st) < 0)
166 return -errno;
167
168 if (!S_ISBLK(st.st_mode))
169 return -ENOTBLK;
170
171 if (ioctl(fd, BLKGETSIZE64, ret) < 0)
172 return -errno;
173
174 return 0;
175 }
176
177 static int block_get_size_by_path(const char *path, uint64_t *ret) {
178 _cleanup_close_ int fd = -1;
179
180 fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
181 if (fd < 0)
182 return -errno;
183
184 return block_get_size_by_fd(fd, ret);
185 }
186
187 static int run_fsck(const char *node, const char *fstype) {
188 int r, exit_status;
189 pid_t fsck_pid;
190
191 assert(node);
192 assert(fstype);
193
194 r = fsck_exists(fstype);
195 if (r < 0)
196 return log_error_errno(r, "Failed to check if fsck for file system %s exists: %m", fstype);
197 if (r == 0) {
198 log_warning("No fsck for file system %s installed, ignoring.", fstype);
199 return 0;
200 }
201
202 r = safe_fork("(fsck)",
203 FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_STDOUT_TO_STDERR|FORK_CLOSE_ALL_FDS,
204 &fsck_pid);
205 if (r < 0)
206 return r;
207 if (r == 0) {
208 /* Child */
209 execl("/sbin/fsck", "/sbin/fsck", "-aTl", node, NULL);
210 log_open();
211 log_error_errno(errno, "Failed to execute fsck: %m");
212 _exit(FSCK_OPERATIONAL_ERROR);
213 }
214
215 exit_status = wait_for_terminate_and_check("fsck", fsck_pid, WAIT_LOG_ABNORMAL);
216 if (exit_status < 0)
217 return exit_status;
218 if ((exit_status & ~FSCK_ERROR_CORRECTED) != 0) {
219 log_warning("fsck failed with exit status %i.", exit_status);
220
221 if ((exit_status & (FSCK_SYSTEM_SHOULD_REBOOT|FSCK_ERRORS_LEFT_UNCORRECTED)) != 0)
222 return log_error_errno(SYNTHETIC_ERRNO(EIO), "File system is corrupted, refusing.");
223
224 log_warning("Ignoring fsck error.");
225 }
226
227 log_info("File system check completed.");
228
229 return 1;
230 }
231
232 static int luks_try_passwords(
233 struct crypt_device *cd,
234 char **passwords,
235 void *volume_key,
236 size_t *volume_key_size) {
237
238 char **pp;
239 int r;
240
241 assert(cd);
242
243 STRV_FOREACH(pp, passwords) {
244 size_t vks = *volume_key_size;
245
246 r = sym_crypt_volume_key_get(
247 cd,
248 CRYPT_ANY_SLOT,
249 volume_key,
250 &vks,
251 *pp,
252 strlen(*pp));
253 if (r >= 0) {
254 *volume_key_size = vks;
255 return 0;
256 }
257
258 log_debug_errno(r, "Password %zu didn't work for unlocking LUKS superblock: %m", (size_t) (pp - passwords));
259 }
260
261 return -ENOKEY;
262 }
263
264 static int luks_setup(
265 const char *node,
266 const char *dm_name,
267 sd_id128_t uuid,
268 const char *cipher,
269 const char *cipher_mode,
270 uint64_t volume_key_size,
271 char **passwords,
272 const PasswordCache *cache,
273 bool discard,
274 struct crypt_device **ret,
275 sd_id128_t *ret_found_uuid,
276 void **ret_volume_key,
277 size_t *ret_volume_key_size) {
278
279 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
280 _cleanup_(erase_and_freep) void *vk = NULL;
281 sd_id128_t p;
282 size_t vks;
283 char **list;
284 int r;
285
286 assert(node);
287 assert(dm_name);
288 assert(ret);
289
290 r = sym_crypt_init(&cd, node);
291 if (r < 0)
292 return log_error_errno(r, "Failed to allocate libcryptsetup context: %m");
293
294 cryptsetup_enable_logging(cd);
295
296 r = sym_crypt_load(cd, CRYPT_LUKS2, NULL);
297 if (r < 0)
298 return log_error_errno(r, "Failed to load LUKS superblock: %m");
299
300 r = sym_crypt_get_volume_key_size(cd);
301 if (r <= 0)
302 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine LUKS volume key size");
303 vks = (size_t) r;
304
305 if (!sd_id128_is_null(uuid) || ret_found_uuid) {
306 const char *s;
307
308 s = sym_crypt_get_uuid(cd);
309 if (!s)
310 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has no UUID.");
311
312 r = sd_id128_from_string(s, &p);
313 if (r < 0)
314 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has invalid UUID.");
315
316 /* Check that the UUID matches, if specified */
317 if (!sd_id128_is_null(uuid) &&
318 !sd_id128_equal(uuid, p))
319 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has wrong UUID.");
320 }
321
322 if (cipher && !streq_ptr(cipher, sym_crypt_get_cipher(cd)))
323 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong cipher.");
324
325 if (cipher_mode && !streq_ptr(cipher_mode, sym_crypt_get_cipher_mode(cd)))
326 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong cipher mode.");
327
328 if (volume_key_size != UINT64_MAX && vks != volume_key_size)
329 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong volume key size.");
330
331 vk = malloc(vks);
332 if (!vk)
333 return log_oom();
334
335 r = -ENOKEY;
336 FOREACH_POINTER(list, cache->pkcs11_passwords, cache->fido2_passwords, passwords) {
337 r = luks_try_passwords(cd, list, vk, &vks);
338 if (r != -ENOKEY)
339 break;
340 }
341 if (r == -ENOKEY)
342 return log_error_errno(r, "No valid password for LUKS superblock.");
343 if (r < 0)
344 return log_error_errno(r, "Failed to unlocks LUKS superblock: %m");
345
346 r = sym_crypt_activate_by_volume_key(
347 cd,
348 dm_name,
349 vk, vks,
350 discard ? CRYPT_ACTIVATE_ALLOW_DISCARDS : 0);
351 if (r < 0)
352 return log_error_errno(r, "Failed to unlock LUKS superblock: %m");
353
354 log_info("Setting up LUKS device /dev/mapper/%s completed.", dm_name);
355
356 *ret = TAKE_PTR(cd);
357
358 if (ret_found_uuid) /* Return the UUID actually found if the caller wants to know */
359 *ret_found_uuid = p;
360 if (ret_volume_key)
361 *ret_volume_key = TAKE_PTR(vk);
362 if (ret_volume_key_size)
363 *ret_volume_key_size = vks;
364
365 return 0;
366 }
367
368 static int luks_open(
369 const char *dm_name,
370 char **passwords,
371 PasswordCache *cache,
372 struct crypt_device **ret,
373 sd_id128_t *ret_found_uuid,
374 void **ret_volume_key,
375 size_t *ret_volume_key_size) {
376
377 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
378 _cleanup_(erase_and_freep) void *vk = NULL;
379 sd_id128_t p;
380 char **list;
381 size_t vks;
382 int r;
383
384 assert(dm_name);
385 assert(ret);
386
387 /* Opens a LUKS device that is already set up. Re-validates the password while doing so (which also
388 * provides us with the volume key, which we want). */
389
390 r = sym_crypt_init_by_name(&cd, dm_name);
391 if (r < 0)
392 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
393
394 cryptsetup_enable_logging(cd);
395
396 r = sym_crypt_load(cd, CRYPT_LUKS2, NULL);
397 if (r < 0)
398 return log_error_errno(r, "Failed to load LUKS superblock: %m");
399
400 r = sym_crypt_get_volume_key_size(cd);
401 if (r <= 0)
402 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine LUKS volume key size");
403 vks = (size_t) r;
404
405 if (ret_found_uuid) {
406 const char *s;
407
408 s = sym_crypt_get_uuid(cd);
409 if (!s)
410 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has no UUID.");
411
412 r = sd_id128_from_string(s, &p);
413 if (r < 0)
414 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has invalid UUID.");
415 }
416
417 vk = malloc(vks);
418 if (!vk)
419 return log_oom();
420
421 r = -ENOKEY;
422 FOREACH_POINTER(list, cache->pkcs11_passwords, cache->fido2_passwords, passwords) {
423 r = luks_try_passwords(cd, list, vk, &vks);
424 if (r != -ENOKEY)
425 break;
426 }
427 if (r == -ENOKEY)
428 return log_error_errno(r, "No valid password for LUKS superblock.");
429 if (r < 0)
430 return log_error_errno(r, "Failed to unlocks LUKS superblock: %m");
431
432 log_info("Discovered used LUKS device /dev/mapper/%s, and validated password.", dm_name);
433
434 /* This is needed so that crypt_resize() can operate correctly for pre-existing LUKS devices. We need
435 * to tell libcryptsetup the volume key explicitly, so that it is in the kernel keyring. */
436 r = sym_crypt_activate_by_volume_key(cd, NULL, vk, vks, CRYPT_ACTIVATE_KEYRING_KEY);
437 if (r < 0)
438 return log_error_errno(r, "Failed to upload volume key again: %m");
439
440 log_info("Successfully re-activated LUKS device.");
441
442 *ret = TAKE_PTR(cd);
443
444 if (ret_found_uuid)
445 *ret_found_uuid = p;
446 if (ret_volume_key)
447 *ret_volume_key = TAKE_PTR(vk);
448 if (ret_volume_key_size)
449 *ret_volume_key_size = vks;
450
451 return 0;
452 }
453
454 static int fs_validate(
455 const char *dm_node,
456 sd_id128_t uuid,
457 char **ret_fstype,
458 sd_id128_t *ret_found_uuid) {
459
460 _cleanup_free_ char *fstype = NULL;
461 sd_id128_t u;
462 int r;
463
464 assert(dm_node);
465 assert(ret_fstype);
466
467 r = probe_file_system_by_path(dm_node, &fstype, &u);
468 if (r < 0)
469 return log_error_errno(r, "Failed to probe file system: %m");
470
471 /* Limit the set of supported file systems a bit, as protection against little tested kernel file
472 * systems. Also, we only support the resize ioctls for these file systems. */
473 if (!supported_fstype(fstype))
474 return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "Image contains unsupported file system: %s", strna(fstype));
475
476 if (!sd_id128_is_null(uuid) &&
477 !sd_id128_equal(uuid, u))
478 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "File system has wrong UUID.");
479
480 log_info("Probing file system completed (found %s).", fstype);
481
482 *ret_fstype = TAKE_PTR(fstype);
483
484 if (ret_found_uuid) /* Return the UUID actually found if the caller wants to know */
485 *ret_found_uuid = u;
486
487 return 0;
488 }
489
490 static int make_dm_names(const char *user_name, char **ret_dm_name, char **ret_dm_node) {
491 _cleanup_free_ char *name = NULL, *node = NULL;
492
493 assert(user_name);
494 assert(ret_dm_name);
495 assert(ret_dm_node);
496
497 name = strjoin("home-", user_name);
498 if (!name)
499 return log_oom();
500
501 node = path_join("/dev/mapper/", name);
502 if (!node)
503 return log_oom();
504
505 *ret_dm_name = TAKE_PTR(name);
506 *ret_dm_node = TAKE_PTR(node);
507 return 0;
508 }
509
510 static int luks_validate(
511 int fd,
512 const char *label,
513 sd_id128_t partition_uuid,
514 sd_id128_t *ret_partition_uuid,
515 uint64_t *ret_offset,
516 uint64_t *ret_size) {
517
518 _cleanup_(blkid_free_probep) blkid_probe b = NULL;
519 sd_id128_t found_partition_uuid = SD_ID128_NULL;
520 const char *fstype = NULL, *pttype = NULL;
521 blkid_loff_t offset = 0, size = 0;
522 blkid_partlist pl;
523 bool found = false;
524 int r, n;
525
526 assert(fd >= 0);
527 assert(label);
528 assert(ret_offset);
529 assert(ret_size);
530
531 b = blkid_new_probe();
532 if (!b)
533 return -ENOMEM;
534
535 errno = 0;
536 r = blkid_probe_set_device(b, fd, 0, 0);
537 if (r != 0)
538 return errno > 0 ? -errno : -ENOMEM;
539
540 (void) blkid_probe_enable_superblocks(b, 1);
541 (void) blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE);
542 (void) blkid_probe_enable_partitions(b, 1);
543 (void) blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
544
545 errno = 0;
546 r = blkid_do_safeprobe(b);
547 if (IN_SET(r, -2, 1)) /* nothing found or ambiguous result */
548 return -ENOPKG;
549 if (r != 0)
550 return errno > 0 ? -errno : -EIO;
551
552 (void) blkid_probe_lookup_value(b, "TYPE", &fstype, NULL);
553 if (streq_ptr(fstype, "crypto_LUKS")) {
554 /* Directly a LUKS image */
555 *ret_offset = 0;
556 *ret_size = UINT64_MAX; /* full disk */
557 *ret_partition_uuid = SD_ID128_NULL;
558 return 0;
559 } else if (fstype)
560 return -ENOPKG;
561
562 (void) blkid_probe_lookup_value(b, "PTTYPE", &pttype, NULL);
563 if (!streq_ptr(pttype, "gpt"))
564 return -ENOPKG;
565
566 errno = 0;
567 pl = blkid_probe_get_partitions(b);
568 if (!pl)
569 return errno > 0 ? -errno : -ENOMEM;
570
571 errno = 0;
572 n = blkid_partlist_numof_partitions(pl);
573 if (n < 0)
574 return errno > 0 ? -errno : -EIO;
575
576 for (int i = 0; i < n; i++) {
577 blkid_partition pp;
578 sd_id128_t id = SD_ID128_NULL;
579 const char *sid;
580
581 errno = 0;
582 pp = blkid_partlist_get_partition(pl, i);
583 if (!pp)
584 return errno > 0 ? -errno : -EIO;
585
586 if (!streq_ptr(blkid_partition_get_type_string(pp), "773f91ef-66d4-49b5-bd83-d683bf40ad16"))
587 continue;
588
589 if (!streq_ptr(blkid_partition_get_name(pp), label))
590 continue;
591
592 sid = blkid_partition_get_uuid(pp);
593 if (sid) {
594 r = sd_id128_from_string(sid, &id);
595 if (r < 0)
596 log_debug_errno(r, "Couldn't parse partition UUID %s, weird: %m", sid);
597
598 if (!sd_id128_is_null(partition_uuid) && !sd_id128_equal(id, partition_uuid))
599 continue;
600 }
601
602 if (found)
603 return -ENOPKG;
604
605 offset = blkid_partition_get_start(pp);
606 size = blkid_partition_get_size(pp);
607 found_partition_uuid = id;
608
609 found = true;
610 }
611
612 if (!found)
613 return -ENOPKG;
614
615 if (offset < 0)
616 return -EINVAL;
617 if ((uint64_t) offset > UINT64_MAX / 512U)
618 return -EINVAL;
619 if (size <= 0)
620 return -EINVAL;
621 if ((uint64_t) size > UINT64_MAX / 512U)
622 return -EINVAL;
623
624 *ret_offset = offset * 512U;
625 *ret_size = size * 512U;
626 *ret_partition_uuid = found_partition_uuid;
627
628 return 0;
629 }
630
631 static int crypt_device_to_evp_cipher(struct crypt_device *cd, const EVP_CIPHER **ret) {
632 _cleanup_free_ char *cipher_name = NULL;
633 const char *cipher, *cipher_mode, *e;
634 size_t key_size, key_bits;
635 const EVP_CIPHER *cc;
636 int r;
637
638 assert(cd);
639
640 /* Let's find the right OpenSSL EVP_CIPHER object that matches the encryption settings of the LUKS
641 * device */
642
643 cipher = sym_crypt_get_cipher(cd);
644 if (!cipher)
645 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot get cipher from LUKS device.");
646
647 cipher_mode = sym_crypt_get_cipher_mode(cd);
648 if (!cipher_mode)
649 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot get cipher mode from LUKS device.");
650
651 e = strchr(cipher_mode, '-');
652 if (e)
653 cipher_mode = strndupa(cipher_mode, e - cipher_mode);
654
655 r = sym_crypt_get_volume_key_size(cd);
656 if (r <= 0)
657 return log_error_errno(r < 0 ? r : SYNTHETIC_ERRNO(EINVAL), "Cannot get volume key size from LUKS device.");
658
659 key_size = r;
660 key_bits = key_size * 8;
661 if (streq(cipher_mode, "xts"))
662 key_bits /= 2;
663
664 if (asprintf(&cipher_name, "%s-%zu-%s", cipher, key_bits, cipher_mode) < 0)
665 return log_oom();
666
667 cc = EVP_get_cipherbyname(cipher_name);
668 if (!cc)
669 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Selected cipher mode '%s' not supported, can't encrypt JSON record.", cipher_name);
670
671 /* Verify that our key length calculations match what OpenSSL thinks */
672 r = EVP_CIPHER_key_length(cc);
673 if (r < 0 || (uint64_t) r != key_size)
674 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Key size of selected cipher doesn't meet our expectations.");
675
676 *ret = cc;
677 return 0;
678 }
679
680 static int luks_validate_home_record(
681 struct crypt_device *cd,
682 UserRecord *h,
683 const void *volume_key,
684 PasswordCache *cache,
685 UserRecord **ret_luks_home_record) {
686
687 int r;
688
689 assert(cd);
690 assert(h);
691
692 for (int token = 0;; token++) {
693 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *rr = NULL;
694 _cleanup_(EVP_CIPHER_CTX_freep) EVP_CIPHER_CTX *context = NULL;
695 _cleanup_(user_record_unrefp) UserRecord *lhr = NULL;
696 _cleanup_free_ void *encrypted = NULL, *iv = NULL;
697 size_t decrypted_size, encrypted_size, iv_size;
698 int decrypted_size_out1, decrypted_size_out2;
699 _cleanup_free_ char *decrypted = NULL;
700 const char *text, *type;
701 crypt_token_info state;
702 JsonVariant *jr, *jiv;
703 unsigned line, column;
704 const EVP_CIPHER *cc;
705
706 state = sym_crypt_token_status(cd, token, &type);
707 if (state == CRYPT_TOKEN_INACTIVE) /* First unconfigured token, give up */
708 break;
709 if (IN_SET(state, CRYPT_TOKEN_INTERNAL, CRYPT_TOKEN_INTERNAL_UNKNOWN, CRYPT_TOKEN_EXTERNAL))
710 continue;
711 if (state != CRYPT_TOKEN_EXTERNAL_UNKNOWN)
712 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unexpected token state of token %i: %i", token, (int) state);
713
714 if (!streq(type, "systemd-homed"))
715 continue;
716
717 r = sym_crypt_token_json_get(cd, token, &text);
718 if (r < 0)
719 return log_error_errno(r, "Failed to read LUKS token %i: %m", token);
720
721 r = json_parse(text, JSON_PARSE_SENSITIVE, &v, &line, &column);
722 if (r < 0)
723 return log_error_errno(r, "Failed to parse LUKS token JSON data %u:%u: %m", line, column);
724
725 jr = json_variant_by_key(v, "record");
726 if (!jr)
727 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "LUKS token lacks 'record' field.");
728 jiv = json_variant_by_key(v, "iv");
729 if (!jiv)
730 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "LUKS token lacks 'iv' field.");
731
732 r = json_variant_unbase64(jr, &encrypted, &encrypted_size);
733 if (r < 0)
734 return log_error_errno(r, "Failed to base64 decode record: %m");
735
736 r = json_variant_unbase64(jiv, &iv, &iv_size);
737 if (r < 0)
738 return log_error_errno(r, "Failed to base64 decode IV: %m");
739
740 r = crypt_device_to_evp_cipher(cd, &cc);
741 if (r < 0)
742 return r;
743 if (iv_size > INT_MAX || EVP_CIPHER_iv_length(cc) != (int) iv_size)
744 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "IV size doesn't match.");
745
746 context = EVP_CIPHER_CTX_new();
747 if (!context)
748 return log_oom();
749
750 if (EVP_DecryptInit_ex(context, cc, NULL, volume_key, iv) != 1)
751 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initialize decryption context.");
752
753 decrypted_size = encrypted_size + EVP_CIPHER_key_length(cc) * 2;
754 decrypted = new(char, decrypted_size);
755 if (!decrypted)
756 return log_oom();
757
758 if (EVP_DecryptUpdate(context, (uint8_t*) decrypted, &decrypted_size_out1, encrypted, encrypted_size) != 1)
759 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to decrypt JSON record.");
760
761 assert((size_t) decrypted_size_out1 <= decrypted_size);
762
763 if (EVP_DecryptFinal_ex(context, (uint8_t*) decrypted + decrypted_size_out1, &decrypted_size_out2) != 1)
764 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to finish decryption of JSON record.");
765
766 assert((size_t) decrypted_size_out1 + (size_t) decrypted_size_out2 < decrypted_size);
767 decrypted_size = (size_t) decrypted_size_out1 + (size_t) decrypted_size_out2;
768
769 if (memchr(decrypted, 0, decrypted_size))
770 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Inner NUL byte in JSON record, refusing.");
771
772 decrypted[decrypted_size] = 0;
773
774 r = json_parse(decrypted, JSON_PARSE_SENSITIVE, &rr, NULL, NULL);
775 if (r < 0)
776 return log_error_errno(r, "Failed to parse decrypted JSON record, refusing.");
777
778 lhr = user_record_new();
779 if (!lhr)
780 return log_oom();
781
782 r = user_record_load(lhr, rr, USER_RECORD_LOAD_EMBEDDED|USER_RECORD_PERMISSIVE);
783 if (r < 0)
784 return log_error_errno(r, "Failed to parse user record: %m");
785
786 if (!user_record_compatible(h, lhr))
787 return log_error_errno(SYNTHETIC_ERRNO(EREMCHG), "LUKS home record not compatible with host record, refusing.");
788
789 r = user_record_authenticate(lhr, h, cache, /* strict_verify= */ true);
790 if (r < 0)
791 return r;
792 assert(r > 0); /* Insist that a password was verified */
793
794 *ret_luks_home_record = TAKE_PTR(lhr);
795 return 0;
796 }
797
798 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Couldn't find home record in LUKS2 header, refusing.");
799 }
800
801 static int format_luks_token_text(
802 struct crypt_device *cd,
803 UserRecord *hr,
804 const void *volume_key,
805 char **ret) {
806
807 int r, encrypted_size_out1 = 0, encrypted_size_out2 = 0, iv_size, key_size;
808 _cleanup_(EVP_CIPHER_CTX_freep) EVP_CIPHER_CTX *context = NULL;
809 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
810 _cleanup_free_ void *iv = NULL, *encrypted = NULL;
811 size_t text_length, encrypted_size;
812 _cleanup_free_ char *text = NULL;
813 const EVP_CIPHER *cc;
814
815 assert(cd);
816 assert(hr);
817 assert(volume_key);
818 assert(ret);
819
820 r = crypt_device_to_evp_cipher(cd, &cc);
821 if (r < 0)
822 return r;
823
824 key_size = EVP_CIPHER_key_length(cc);
825 iv_size = EVP_CIPHER_iv_length(cc);
826
827 if (iv_size > 0) {
828 iv = malloc(iv_size);
829 if (!iv)
830 return log_oom();
831
832 r = genuine_random_bytes(iv, iv_size, RANDOM_BLOCK);
833 if (r < 0)
834 return log_error_errno(r, "Failed to generate IV: %m");
835 }
836
837 context = EVP_CIPHER_CTX_new();
838 if (!context)
839 return log_oom();
840
841 if (EVP_EncryptInit_ex(context, cc, NULL, volume_key, iv) != 1)
842 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initialize encryption context.");
843
844 r = json_variant_format(hr->json, 0, &text);
845 if (r < 0)
846 return log_error_errno(r, "Failed to format user record for LUKS: %m");
847
848 text_length = strlen(text);
849 encrypted_size = text_length + 2*key_size - 1;
850
851 encrypted = malloc(encrypted_size);
852 if (!encrypted)
853 return log_oom();
854
855 if (EVP_EncryptUpdate(context, encrypted, &encrypted_size_out1, (uint8_t*) text, text_length) != 1)
856 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to encrypt JSON record.");
857
858 assert((size_t) encrypted_size_out1 <= encrypted_size);
859
860 if (EVP_EncryptFinal_ex(context, (uint8_t*) encrypted + encrypted_size_out1, &encrypted_size_out2) != 1)
861 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to finish encryption of JSON record. ");
862
863 assert((size_t) encrypted_size_out1 + (size_t) encrypted_size_out2 <= encrypted_size);
864
865 r = json_build(&v,
866 JSON_BUILD_OBJECT(
867 JSON_BUILD_PAIR("type", JSON_BUILD_STRING("systemd-homed")),
868 JSON_BUILD_PAIR("keyslots", JSON_BUILD_EMPTY_ARRAY),
869 JSON_BUILD_PAIR("record", JSON_BUILD_BASE64(encrypted, encrypted_size_out1 + encrypted_size_out2)),
870 JSON_BUILD_PAIR("iv", JSON_BUILD_BASE64(iv, iv_size))));
871 if (r < 0)
872 return log_error_errno(r, "Failed to prepare LUKS JSON token object: %m");
873
874 r = json_variant_format(v, 0, ret);
875 if (r < 0)
876 return log_error_errno(r, "Failed to format encrypted user record for LUKS: %m");
877
878 return 0;
879 }
880
881 int home_store_header_identity_luks(
882 UserRecord *h,
883 HomeSetup *setup,
884 UserRecord *old_home) {
885
886 _cleanup_(user_record_unrefp) UserRecord *header_home = NULL;
887 _cleanup_free_ char *text = NULL;
888 int token = 0, r;
889
890 assert(h);
891
892 if (!setup->crypt_device)
893 return 0;
894
895 assert(setup->volume_key);
896
897 /* Let's store the user's identity record in the LUKS2 "token" header data fields, in an encrypted
898 * fashion. Why that? If we'd rely on the record being embedded in the payload file system itself we
899 * would have to mount the file system before we can validate the JSON record, its signatures and
900 * whether it matches what we are looking for. However, kernel file system implementations are
901 * generally not ready to be used on untrusted media. Hence let's store the record independently of
902 * the file system, so that we can validate it first, and only then mount the file system. To keep
903 * things simple we use the same encryption settings for this record as for the file system itself. */
904
905 r = user_record_clone(h, USER_RECORD_EXTRACT_EMBEDDED|USER_RECORD_PERMISSIVE, &header_home);
906 if (r < 0)
907 return log_error_errno(r, "Failed to determine new header record: %m");
908
909 if (old_home && user_record_equal(old_home, header_home)) {
910 log_debug("Not updating header home record.");
911 return 0;
912 }
913
914 r = format_luks_token_text(setup->crypt_device, header_home, setup->volume_key, &text);
915 if (r < 0)
916 return r;
917
918 for (;; token++) {
919 crypt_token_info state;
920 const char *type;
921
922 state = sym_crypt_token_status(setup->crypt_device, token, &type);
923 if (state == CRYPT_TOKEN_INACTIVE) /* First unconfigured token, we are done */
924 break;
925 if (IN_SET(state, CRYPT_TOKEN_INTERNAL, CRYPT_TOKEN_INTERNAL_UNKNOWN, CRYPT_TOKEN_EXTERNAL))
926 continue; /* Not ours */
927 if (state != CRYPT_TOKEN_EXTERNAL_UNKNOWN)
928 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unexpected token state of token %i: %i", token, (int) state);
929
930 if (!streq(type, "systemd-homed"))
931 continue;
932
933 r = sym_crypt_token_json_set(setup->crypt_device, token, text);
934 if (r < 0)
935 return log_error_errno(r, "Failed to set JSON token for slot %i: %m", token);
936
937 /* Now, let's free the text so that for all further matching tokens we all crypt_json_token_set()
938 * with a NULL text in order to invalidate the tokens. */
939 text = mfree(text);
940 token++;
941 }
942
943 if (text)
944 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Didn't find any record token to update.");
945
946 log_info("Wrote LUKS header user record.");
947
948 return 1;
949 }
950
951 int run_fitrim(int root_fd) {
952 struct fstrim_range range = {
953 .len = UINT64_MAX,
954 };
955
956 /* If discarding is on, discard everything right after mounting, so that the discard setting takes
957 * effect on activation. (Also, optionally, trim on logout) */
958
959 assert(root_fd >= 0);
960
961 if (ioctl(root_fd, FITRIM, &range) < 0) {
962 if (ERRNO_IS_NOT_SUPPORTED(errno) || errno == EBADF) {
963 log_debug_errno(errno, "File system does not support FITRIM, not trimming.");
964 return 0;
965 }
966
967 return log_warning_errno(errno, "Failed to invoke FITRIM, ignoring: %m");
968 }
969
970 log_info("Discarded unused %s.", FORMAT_BYTES(range.len));
971 return 1;
972 }
973
974 int run_fitrim_by_path(const char *root_path) {
975 _cleanup_close_ int root_fd = -1;
976
977 root_fd = open(root_path, O_RDONLY|O_DIRECTORY|O_CLOEXEC);
978 if (root_fd < 0)
979 return log_error_errno(errno, "Failed to open file system '%s' for trimming: %m", root_path);
980
981 return run_fitrim(root_fd);
982 }
983
984 int run_fallocate(int backing_fd, const struct stat *st) {
985 struct stat stbuf;
986
987 assert(backing_fd >= 0);
988
989 /* If discarding is off, let's allocate the whole image before mounting, so that the setting takes
990 * effect on activation */
991
992 if (!st) {
993 if (fstat(backing_fd, &stbuf) < 0)
994 return log_error_errno(errno, "Failed to fstat(): %m");
995
996 st = &stbuf;
997 }
998
999 if (!S_ISREG(st->st_mode))
1000 return 0;
1001
1002 if (st->st_blocks >= DIV_ROUND_UP(st->st_size, 512)) {
1003 log_info("Backing file is fully allocated already.");
1004 return 0;
1005 }
1006
1007 if (fallocate(backing_fd, FALLOC_FL_KEEP_SIZE, 0, st->st_size) < 0) {
1008
1009 if (ERRNO_IS_NOT_SUPPORTED(errno)) {
1010 log_debug_errno(errno, "fallocate() not supported on file system, ignoring.");
1011 return 0;
1012 }
1013
1014 if (ERRNO_IS_DISK_SPACE(errno)) {
1015 log_debug_errno(errno, "Not enough disk space to fully allocate home.");
1016 return -ENOSPC; /* make recognizable */
1017 }
1018
1019 return log_error_errno(errno, "Failed to allocate backing file blocks: %m");
1020 }
1021
1022 log_info("Allocated additional %s.",
1023 FORMAT_BYTES((DIV_ROUND_UP(st->st_size, 512) - st->st_blocks) * 512));
1024 return 1;
1025 }
1026
1027 int run_fallocate_by_path(const char *backing_path) {
1028 _cleanup_close_ int backing_fd = -1;
1029
1030 backing_fd = open(backing_path, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
1031 if (backing_fd < 0)
1032 return log_error_errno(errno, "Failed to open '%s' for fallocate(): %m", backing_path);
1033
1034 return run_fallocate(backing_fd, NULL);
1035 }
1036
1037 int home_prepare_luks(
1038 UserRecord *h,
1039 bool already_activated,
1040 const char *force_image_path,
1041 PasswordCache *cache,
1042 HomeSetup *setup,
1043 UserRecord **ret_luks_home) {
1044
1045 sd_id128_t found_partition_uuid, found_luks_uuid, found_fs_uuid;
1046 _cleanup_(user_record_unrefp) UserRecord *luks_home = NULL;
1047 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
1048 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
1049 _cleanup_(erase_and_freep) void *volume_key = NULL;
1050 _cleanup_close_ int root_fd = -1, image_fd = -1;
1051 bool dm_activated = false, mounted = false;
1052 size_t volume_key_size = 0;
1053 bool marked_dirty = false;
1054 uint64_t offset, size;
1055 int r;
1056
1057 assert(h);
1058 assert(setup);
1059 assert(setup->dm_name);
1060 assert(setup->dm_node);
1061
1062 assert(user_record_storage(h) == USER_LUKS);
1063
1064 r = dlopen_cryptsetup();
1065 if (r < 0)
1066 return r;
1067
1068 if (already_activated) {
1069 struct loop_info64 info;
1070 const char *n;
1071
1072 r = luks_open(setup->dm_name,
1073 h->password,
1074 cache,
1075 &cd,
1076 &found_luks_uuid,
1077 &volume_key,
1078 &volume_key_size);
1079 if (r < 0)
1080 return r;
1081
1082 r = luks_validate_home_record(cd, h, volume_key, cache, &luks_home);
1083 if (r < 0)
1084 return r;
1085
1086 n = sym_crypt_get_device_name(cd);
1087 if (!n)
1088 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine backing device for DM %s.", setup->dm_name);
1089
1090 r = loop_device_open(n, O_RDWR, &loop);
1091 if (r < 0)
1092 return log_error_errno(r, "Failed to open loopback device %s: %m", n);
1093
1094 if (ioctl(loop->fd, LOOP_GET_STATUS64, &info) < 0) {
1095 _cleanup_free_ char *sysfs = NULL;
1096 struct stat st;
1097
1098 if (!IN_SET(errno, ENOTTY, EINVAL))
1099 return log_error_errno(errno, "Failed to get block device metrics of %s: %m", n);
1100
1101 if (ioctl(loop->fd, BLKGETSIZE64, &size) < 0)
1102 return log_error_errno(r, "Failed to read block device size of %s: %m", n);
1103
1104 if (fstat(loop->fd, &st) < 0)
1105 return log_error_errno(r, "Failed to stat block device %s: %m", n);
1106 assert(S_ISBLK(st.st_mode));
1107
1108 if (asprintf(&sysfs, "/sys/dev/block/%u:%u/partition", major(st.st_rdev), minor(st.st_rdev)) < 0)
1109 return log_oom();
1110
1111 if (access(sysfs, F_OK) < 0) {
1112 if (errno != ENOENT)
1113 return log_error_errno(errno, "Failed to determine whether %s exists: %m", sysfs);
1114
1115 offset = 0;
1116 } else {
1117 _cleanup_free_ char *buffer = NULL;
1118
1119 if (asprintf(&sysfs, "/sys/dev/block/%u:%u/start", major(st.st_rdev), minor(st.st_rdev)) < 0)
1120 return log_oom();
1121
1122 r = read_one_line_file(sysfs, &buffer);
1123 if (r < 0)
1124 return log_error_errno(r, "Failed to read partition start offset: %m");
1125
1126 r = safe_atou64(buffer, &offset);
1127 if (r < 0)
1128 return log_error_errno(r, "Failed to parse partition start offset: %m");
1129
1130 if (offset > UINT64_MAX / 512U)
1131 return log_error_errno(SYNTHETIC_ERRNO(E2BIG), "Offset too large for 64 byte range, refusing.");
1132
1133 offset *= 512U;
1134 }
1135 } else {
1136 offset = info.lo_offset;
1137 size = info.lo_sizelimit;
1138 }
1139
1140 found_partition_uuid = found_fs_uuid = SD_ID128_NULL;
1141
1142 log_info("Discovered used loopback device %s.", loop->node);
1143
1144 root_fd = open(user_record_home_directory(h), O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
1145 if (root_fd < 0) {
1146 r = log_error_errno(r, "Failed to open home directory: %m");
1147 goto fail;
1148 }
1149 } else {
1150 _cleanup_free_ char *fstype = NULL, *subdir = NULL;
1151 const char *ip;
1152 struct stat st;
1153
1154 ip = force_image_path ?: user_record_image_path(h);
1155
1156 subdir = path_join("/run/systemd/user-home-mount/", user_record_user_name_and_realm(h));
1157 if (!subdir)
1158 return log_oom();
1159
1160 image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
1161 if (image_fd < 0)
1162 return log_error_errno(errno, "Failed to open image file %s: %m", ip);
1163
1164 if (fstat(image_fd, &st) < 0)
1165 return log_error_errno(errno, "Failed to fstat() image file: %m");
1166 if (!S_ISREG(st.st_mode) && !S_ISBLK(st.st_mode))
1167 return log_error_errno(
1168 S_ISDIR(st.st_mode) ? SYNTHETIC_ERRNO(EISDIR) : SYNTHETIC_ERRNO(EBADFD),
1169 "Image file %s is not a regular file or block device: %m", ip);
1170
1171 r = luks_validate(image_fd, user_record_user_name_and_realm(h), h->partition_uuid, &found_partition_uuid, &offset, &size);
1172 if (r < 0)
1173 return log_error_errno(r, "Failed to validate disk label: %m");
1174
1175 /* Everything before this point left the image untouched. We are now starting to make
1176 * changes, hence mark the image dirty */
1177 marked_dirty = run_mark_dirty(image_fd, true) > 0;
1178
1179 if (!user_record_luks_discard(h)) {
1180 r = run_fallocate(image_fd, &st);
1181 if (r < 0)
1182 return r;
1183 }
1184
1185 r = loop_device_make(image_fd, O_RDWR, offset, size, 0, &loop);
1186 if (r == -ENOENT) {
1187 log_error_errno(r, "Loopback block device support is not available on this system.");
1188 return -ENOLINK; /* make recognizable */
1189 }
1190 if (r < 0)
1191 return log_error_errno(r, "Failed to allocate loopback context: %m");
1192
1193 log_info("Setting up loopback device %s completed.", loop->node ?: ip);
1194
1195 r = luks_setup(loop->node ?: ip,
1196 setup->dm_name,
1197 h->luks_uuid,
1198 h->luks_cipher,
1199 h->luks_cipher_mode,
1200 h->luks_volume_key_size,
1201 h->password,
1202 cache,
1203 user_record_luks_discard(h) || user_record_luks_offline_discard(h),
1204 &cd,
1205 &found_luks_uuid,
1206 &volume_key,
1207 &volume_key_size);
1208 if (r < 0)
1209 return r;
1210
1211 dm_activated = true;
1212
1213 r = luks_validate_home_record(cd, h, volume_key, cache, &luks_home);
1214 if (r < 0)
1215 goto fail;
1216
1217 r = fs_validate(setup->dm_node, h->file_system_uuid, &fstype, &found_fs_uuid);
1218 if (r < 0)
1219 goto fail;
1220
1221 r = run_fsck(setup->dm_node, fstype);
1222 if (r < 0)
1223 goto fail;
1224
1225 r = home_unshare_and_mount(setup->dm_node, fstype, user_record_luks_discard(h), user_record_mount_flags(h));
1226 if (r < 0)
1227 goto fail;
1228
1229 mounted = true;
1230
1231 root_fd = open(subdir, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
1232 if (root_fd < 0) {
1233 r = log_error_errno(r, "Failed to open home directory: %m");
1234 goto fail;
1235 }
1236
1237 if (user_record_luks_discard(h))
1238 (void) run_fitrim(root_fd);
1239
1240 setup->image_fd = TAKE_FD(image_fd);
1241 setup->do_offline_fallocate = !(setup->do_offline_fitrim = user_record_luks_offline_discard(h));
1242 setup->do_mark_clean = marked_dirty;
1243 }
1244
1245 setup->loop = TAKE_PTR(loop);
1246 setup->crypt_device = TAKE_PTR(cd);
1247 setup->root_fd = TAKE_FD(root_fd);
1248 setup->found_partition_uuid = found_partition_uuid;
1249 setup->found_luks_uuid = found_luks_uuid;
1250 setup->found_fs_uuid = found_fs_uuid;
1251 setup->partition_offset = offset;
1252 setup->partition_size = size;
1253 setup->volume_key = TAKE_PTR(volume_key);
1254 setup->volume_key_size = volume_key_size;
1255
1256 setup->undo_mount = mounted;
1257 setup->undo_dm = dm_activated;
1258
1259 if (ret_luks_home)
1260 *ret_luks_home = TAKE_PTR(luks_home);
1261
1262 return 0;
1263
1264 fail:
1265 if (mounted)
1266 (void) umount_verbose(LOG_ERR, "/run/systemd/user-home-mount", UMOUNT_NOFOLLOW);
1267
1268 if (dm_activated)
1269 (void) sym_crypt_deactivate_by_name(cd, setup->dm_name, 0);
1270
1271 if (image_fd >= 0 && marked_dirty)
1272 (void) run_mark_dirty(image_fd, false);
1273
1274 return r;
1275 }
1276
1277 static void print_size_summary(uint64_t host_size, uint64_t encrypted_size, struct statfs *sfs) {
1278 assert(sfs);
1279
1280 log_info("Image size is %s, file system size is %s, file system payload size is %s, file system free is %s.",
1281 FORMAT_BYTES(host_size),
1282 FORMAT_BYTES(encrypted_size),
1283 FORMAT_BYTES((uint64_t) sfs->f_blocks * (uint64_t) sfs->f_frsize),
1284 FORMAT_BYTES((uint64_t) sfs->f_bfree * (uint64_t) sfs->f_frsize));
1285 }
1286
1287 int home_activate_luks(
1288 UserRecord *h,
1289 PasswordCache *cache,
1290 UserRecord **ret_home) {
1291
1292 _cleanup_(user_record_unrefp) UserRecord *new_home = NULL, *luks_home_record = NULL;
1293 _cleanup_(home_setup_undo) HomeSetup setup = HOME_SETUP_INIT;
1294 uint64_t host_size, encrypted_size;
1295 const char *hdo, *hd;
1296 struct statfs sfs;
1297 int r;
1298
1299 assert(h);
1300 assert(user_record_storage(h) == USER_LUKS);
1301 assert(ret_home);
1302
1303 r = dlopen_cryptsetup();
1304 if (r < 0)
1305 return r;
1306
1307 assert_se(hdo = user_record_home_directory(h));
1308 hd = strdupa(hdo); /* copy the string out, since it might change later in the home record object */
1309
1310 r = make_dm_names(h->user_name, &setup.dm_name, &setup.dm_node);
1311 if (r < 0)
1312 return r;
1313
1314 r = access(setup.dm_node, F_OK);
1315 if (r < 0) {
1316 if (errno != ENOENT)
1317 return log_error_errno(errno, "Failed to determine whether %s exists: %m", setup.dm_node);
1318 } else
1319 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Device mapper device %s already exists, refusing.", setup.dm_node);
1320
1321 r = home_prepare_luks(
1322 h,
1323 false,
1324 NULL,
1325 cache,
1326 &setup,
1327 &luks_home_record);
1328 if (r < 0)
1329 return r;
1330
1331 r = block_get_size_by_fd(setup.loop->fd, &host_size);
1332 if (r < 0)
1333 return log_error_errno(r, "Failed to get loopback block device size: %m");
1334
1335 r = block_get_size_by_path(setup.dm_node, &encrypted_size);
1336 if (r < 0)
1337 return log_error_errno(r, "Failed to get LUKS block device size: %m");
1338
1339 r = home_refresh(
1340 h,
1341 &setup,
1342 luks_home_record,
1343 cache,
1344 &sfs,
1345 &new_home);
1346 if (r < 0)
1347 return r;
1348
1349 r = home_extend_embedded_identity(new_home, h, &setup);
1350 if (r < 0)
1351 return r;
1352
1353 setup.root_fd = safe_close(setup.root_fd);
1354
1355 r = home_move_mount(user_record_user_name_and_realm(h), hd);
1356 if (r < 0)
1357 return r;
1358
1359 setup.undo_mount = false;
1360 setup.do_offline_fitrim = false;
1361
1362 loop_device_relinquish(setup.loop);
1363
1364 r = sym_crypt_deactivate_by_name(NULL, setup.dm_name, CRYPT_DEACTIVATE_DEFERRED);
1365 if (r < 0)
1366 log_warning_errno(r, "Failed to relinquish DM device, ignoring: %m");
1367
1368 setup.undo_dm = false;
1369 setup.do_offline_fallocate = false;
1370 setup.do_mark_clean = false;
1371
1372 log_info("Everything completed.");
1373
1374 print_size_summary(host_size, encrypted_size, &sfs);
1375
1376 *ret_home = TAKE_PTR(new_home);
1377 return 1;
1378 }
1379
1380 int home_deactivate_luks(UserRecord *h) {
1381 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
1382 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
1383 bool we_detached;
1384 int r;
1385
1386 /* Note that the DM device and loopback device are set to auto-detach, hence strictly speaking we
1387 * don't have to explicitly have to detach them. However, we do that nonetheless (in case of the DM
1388 * device), to avoid races: by explicitly detaching them we know when the detaching is complete. We
1389 * don't bother about the loopback device because unlike the DM device it doesn't have a fixed
1390 * name. */
1391
1392 r = dlopen_cryptsetup();
1393 if (r < 0)
1394 return r;
1395
1396 r = make_dm_names(h->user_name, &dm_name, &dm_node);
1397 if (r < 0)
1398 return r;
1399
1400 r = sym_crypt_init_by_name(&cd, dm_name);
1401 if (IN_SET(r, -ENODEV, -EINVAL, -ENOENT)) {
1402 log_debug_errno(r, "LUKS device %s has already been detached.", dm_name);
1403 we_detached = false;
1404 } else if (r < 0)
1405 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
1406 else {
1407 log_info("Discovered used LUKS device %s.", dm_node);
1408
1409 cryptsetup_enable_logging(cd);
1410
1411 r = sym_crypt_deactivate_by_name(cd, dm_name, 0);
1412 if (IN_SET(r, -ENODEV, -EINVAL, -ENOENT)) {
1413 log_debug_errno(r, "LUKS device %s is already detached.", dm_node);
1414 we_detached = false;
1415 } else if (r < 0)
1416 return log_info_errno(r, "LUKS device %s couldn't be deactivated: %m", dm_node);
1417 else {
1418 log_info("LUKS device detaching completed.");
1419 we_detached = true;
1420 }
1421 }
1422
1423 if (user_record_luks_offline_discard(h))
1424 log_debug("Not allocating on logout.");
1425 else
1426 (void) run_fallocate_by_path(user_record_image_path(h));
1427
1428 run_mark_dirty_by_path(user_record_image_path(h), false);
1429 return we_detached;
1430 }
1431
1432 int home_trim_luks(UserRecord *h) {
1433 assert(h);
1434
1435 if (!user_record_luks_offline_discard(h)) {
1436 log_debug("Not trimming on logout.");
1437 return 0;
1438 }
1439
1440 (void) run_fitrim_by_path(user_record_home_directory(h));
1441 return 0;
1442 }
1443
1444 static struct crypt_pbkdf_type* build_good_pbkdf(struct crypt_pbkdf_type *buffer, UserRecord *hr) {
1445 assert(buffer);
1446 assert(hr);
1447
1448 *buffer = (struct crypt_pbkdf_type) {
1449 .hash = user_record_luks_pbkdf_hash_algorithm(hr),
1450 .type = user_record_luks_pbkdf_type(hr),
1451 .time_ms = user_record_luks_pbkdf_time_cost_usec(hr) / USEC_PER_MSEC,
1452 .max_memory_kb = user_record_luks_pbkdf_memory_cost(hr) / 1024,
1453 .parallel_threads = user_record_luks_pbkdf_parallel_threads(hr),
1454 };
1455
1456 return buffer;
1457 }
1458
1459 static struct crypt_pbkdf_type* build_minimal_pbkdf(struct crypt_pbkdf_type *buffer, UserRecord *hr) {
1460 assert(buffer);
1461 assert(hr);
1462
1463 /* For PKCS#11 derived keys (which are generated randomly and are of high quality already) we use a
1464 * minimal PBKDF */
1465 *buffer = (struct crypt_pbkdf_type) {
1466 .hash = user_record_luks_pbkdf_hash_algorithm(hr),
1467 .type = CRYPT_KDF_PBKDF2,
1468 .iterations = 1,
1469 .time_ms = 1,
1470 };
1471
1472 return buffer;
1473 }
1474
1475 static int luks_format(
1476 const char *node,
1477 const char *dm_name,
1478 sd_id128_t uuid,
1479 const char *label,
1480 const PasswordCache *cache,
1481 char **effective_passwords,
1482 bool discard,
1483 UserRecord *hr,
1484 struct crypt_device **ret) {
1485
1486 _cleanup_(user_record_unrefp) UserRecord *reduced = NULL;
1487 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
1488 _cleanup_(erase_and_freep) void *volume_key = NULL;
1489 struct crypt_pbkdf_type good_pbkdf, minimal_pbkdf;
1490 _cleanup_free_ char *text = NULL;
1491 size_t volume_key_size;
1492 int slot = 0, r;
1493 char **pp;
1494
1495 assert(node);
1496 assert(dm_name);
1497 assert(hr);
1498 assert(ret);
1499
1500 r = sym_crypt_init(&cd, node);
1501 if (r < 0)
1502 return log_error_errno(r, "Failed to allocate libcryptsetup context: %m");
1503
1504 cryptsetup_enable_logging(cd);
1505
1506 /* Normally we'd, just leave volume key generation to libcryptsetup. However, we can't, since we
1507 * can't extract the volume key from the library again, but we need it in order to encrypt the JSON
1508 * record. Hence, let's generate it on our own, so that we can keep track of it. */
1509
1510 volume_key_size = user_record_luks_volume_key_size(hr);
1511 volume_key = malloc(volume_key_size);
1512 if (!volume_key)
1513 return log_oom();
1514
1515 r = genuine_random_bytes(volume_key, volume_key_size, RANDOM_BLOCK);
1516 if (r < 0)
1517 return log_error_errno(r, "Failed to generate volume key: %m");
1518
1519 #if HAVE_CRYPT_SET_METADATA_SIZE
1520 /* Increase the metadata space to 4M, the largest LUKS2 supports */
1521 r = sym_crypt_set_metadata_size(cd, 4096U*1024U, 0);
1522 if (r < 0)
1523 return log_error_errno(r, "Failed to change LUKS2 metadata size: %m");
1524 #endif
1525
1526 build_good_pbkdf(&good_pbkdf, hr);
1527 build_minimal_pbkdf(&minimal_pbkdf, hr);
1528
1529 r = sym_crypt_format(
1530 cd,
1531 CRYPT_LUKS2,
1532 user_record_luks_cipher(hr),
1533 user_record_luks_cipher_mode(hr),
1534 ID128_TO_UUID_STRING(uuid),
1535 volume_key,
1536 volume_key_size,
1537 &(struct crypt_params_luks2) {
1538 .label = label,
1539 .subsystem = "systemd-home",
1540 .sector_size = 512U,
1541 .pbkdf = &good_pbkdf,
1542 });
1543 if (r < 0)
1544 return log_error_errno(r, "Failed to format LUKS image: %m");
1545
1546 log_info("LUKS formatting completed.");
1547
1548 STRV_FOREACH(pp, effective_passwords) {
1549
1550 if (strv_contains(cache->pkcs11_passwords, *pp) ||
1551 strv_contains(cache->fido2_passwords, *pp)) {
1552 log_debug("Using minimal PBKDF for slot %i", slot);
1553 r = sym_crypt_set_pbkdf_type(cd, &minimal_pbkdf);
1554 } else {
1555 log_debug("Using good PBKDF for slot %i", slot);
1556 r = sym_crypt_set_pbkdf_type(cd, &good_pbkdf);
1557 }
1558 if (r < 0)
1559 return log_error_errno(r, "Failed to tweak PBKDF for slot %i: %m", slot);
1560
1561 r = sym_crypt_keyslot_add_by_volume_key(
1562 cd,
1563 slot,
1564 volume_key,
1565 volume_key_size,
1566 *pp,
1567 strlen(*pp));
1568 if (r < 0)
1569 return log_error_errno(r, "Failed to set up LUKS password for slot %i: %m", slot);
1570
1571 log_info("Writing password to LUKS keyslot %i completed.", slot);
1572 slot++;
1573 }
1574
1575 r = sym_crypt_activate_by_volume_key(
1576 cd,
1577 dm_name,
1578 volume_key,
1579 volume_key_size,
1580 discard ? CRYPT_ACTIVATE_ALLOW_DISCARDS : 0);
1581 if (r < 0)
1582 return log_error_errno(r, "Failed to activate LUKS superblock: %m");
1583
1584 log_info("LUKS activation by volume key succeeded.");
1585
1586 r = user_record_clone(hr, USER_RECORD_EXTRACT_EMBEDDED|USER_RECORD_PERMISSIVE, &reduced);
1587 if (r < 0)
1588 return log_error_errno(r, "Failed to prepare home record for LUKS: %m");
1589
1590 r = format_luks_token_text(cd, reduced, volume_key, &text);
1591 if (r < 0)
1592 return r;
1593
1594 r = sym_crypt_token_json_set(cd, CRYPT_ANY_TOKEN, text);
1595 if (r < 0)
1596 return log_error_errno(r, "Failed to set LUKS JSON token: %m");
1597
1598 log_info("Writing user record as LUKS token completed.");
1599
1600 if (ret)
1601 *ret = TAKE_PTR(cd);
1602
1603 return 0;
1604 }
1605
1606 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct fdisk_context*, fdisk_unref_context, NULL);
1607 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct fdisk_partition*, fdisk_unref_partition, NULL);
1608 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct fdisk_parttype*, fdisk_unref_parttype, NULL);
1609 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(struct fdisk_table*, fdisk_unref_table, NULL);
1610
1611 static int make_partition_table(
1612 int fd,
1613 const char *label,
1614 sd_id128_t uuid,
1615 uint64_t *ret_offset,
1616 uint64_t *ret_size,
1617 sd_id128_t *ret_disk_uuid) {
1618
1619 _cleanup_(fdisk_unref_partitionp) struct fdisk_partition *p = NULL, *q = NULL;
1620 _cleanup_(fdisk_unref_parttypep) struct fdisk_parttype *t = NULL;
1621 _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
1622 _cleanup_free_ char *path = NULL, *disk_uuid_as_string = NULL;
1623 uint64_t offset, size;
1624 sd_id128_t disk_uuid;
1625 int r;
1626
1627 assert(fd >= 0);
1628 assert(label);
1629 assert(ret_offset);
1630 assert(ret_size);
1631
1632 t = fdisk_new_parttype();
1633 if (!t)
1634 return log_oom();
1635
1636 r = fdisk_parttype_set_typestr(t, "773f91ef-66d4-49b5-bd83-d683bf40ad16");
1637 if (r < 0)
1638 return log_error_errno(r, "Failed to initialize partition type: %m");
1639
1640 c = fdisk_new_context();
1641 if (!c)
1642 return log_oom();
1643
1644 if (asprintf(&path, "/proc/self/fd/%i", fd) < 0)
1645 return log_oom();
1646
1647 r = fdisk_assign_device(c, path, 0);
1648 if (r < 0)
1649 return log_error_errno(r, "Failed to open device: %m");
1650
1651 r = fdisk_create_disklabel(c, "gpt");
1652 if (r < 0)
1653 return log_error_errno(r, "Failed to create GPT disk label: %m");
1654
1655 p = fdisk_new_partition();
1656 if (!p)
1657 return log_oom();
1658
1659 r = fdisk_partition_set_type(p, t);
1660 if (r < 0)
1661 return log_error_errno(r, "Failed to set partition type: %m");
1662
1663 r = fdisk_partition_start_follow_default(p, 1);
1664 if (r < 0)
1665 return log_error_errno(r, "Failed to place partition at beginning of space: %m");
1666
1667 r = fdisk_partition_partno_follow_default(p, 1);
1668 if (r < 0)
1669 return log_error_errno(r, "Failed to place partition at first free partition index: %m");
1670
1671 r = fdisk_partition_end_follow_default(p, 1);
1672 if (r < 0)
1673 return log_error_errno(r, "Failed to make partition cover all free space: %m");
1674
1675 r = fdisk_partition_set_name(p, label);
1676 if (r < 0)
1677 return log_error_errno(r, "Failed to set partition name: %m");
1678
1679 r = fdisk_partition_set_uuid(p, ID128_TO_UUID_STRING(uuid));
1680 if (r < 0)
1681 return log_error_errno(r, "Failed to set partition UUID: %m");
1682
1683 r = fdisk_add_partition(c, p, NULL);
1684 if (r < 0)
1685 return log_error_errno(r, "Failed to add partition: %m");
1686
1687 r = fdisk_write_disklabel(c);
1688 if (r < 0)
1689 return log_error_errno(r, "Failed to write disk label: %m");
1690
1691 r = fdisk_get_disklabel_id(c, &disk_uuid_as_string);
1692 if (r < 0)
1693 return log_error_errno(r, "Failed to determine disk label UUID: %m");
1694
1695 r = sd_id128_from_string(disk_uuid_as_string, &disk_uuid);
1696 if (r < 0)
1697 return log_error_errno(r, "Failed to parse disk label UUID: %m");
1698
1699 r = fdisk_get_partition(c, 0, &q);
1700 if (r < 0)
1701 return log_error_errno(r, "Failed to read created partition metadata: %m");
1702
1703 assert(fdisk_partition_has_start(q));
1704 offset = fdisk_partition_get_start(q);
1705 if (offset > UINT64_MAX / 512U)
1706 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Partition offset too large.");
1707
1708 assert(fdisk_partition_has_size(q));
1709 size = fdisk_partition_get_size(q);
1710 if (size > UINT64_MAX / 512U)
1711 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Partition size too large.");
1712
1713 *ret_offset = offset * 512U;
1714 *ret_size = size * 512U;
1715 *ret_disk_uuid = disk_uuid;
1716
1717 return 0;
1718 }
1719
1720 static bool supported_fs_size(const char *fstype, uint64_t host_size) {
1721 uint64_t m;
1722
1723 m = minimal_size_by_fs_name(fstype);
1724 if (m == UINT64_MAX)
1725 return false;
1726
1727 return host_size >= m;
1728 }
1729
1730 static int wait_for_devlink(const char *path) {
1731 _cleanup_close_ int inotify_fd = -1;
1732 usec_t until;
1733 int r;
1734
1735 /* let's wait for a device link to show up in /dev, with a timeout. This is good to do since we
1736 * return a /dev/disk/by-uuid/… link to our callers and they likely want to access it right-away,
1737 * hence let's wait until udev has caught up with our changes, and wait for the symlink to be
1738 * created. */
1739
1740 until = usec_add(now(CLOCK_MONOTONIC), 45 * USEC_PER_SEC);
1741
1742 for (;;) {
1743 _cleanup_free_ char *dn = NULL;
1744 usec_t w;
1745
1746 if (laccess(path, F_OK) < 0) {
1747 if (errno != ENOENT)
1748 return log_error_errno(errno, "Failed to determine whether %s exists: %m", path);
1749 } else
1750 return 0; /* Found it */
1751
1752 if (inotify_fd < 0) {
1753 /* We need to wait for the device symlink to show up, let's create an inotify watch for it */
1754 inotify_fd = inotify_init1(IN_NONBLOCK|IN_CLOEXEC);
1755 if (inotify_fd < 0)
1756 return log_error_errno(errno, "Failed to allocate inotify fd: %m");
1757 }
1758
1759 dn = dirname_malloc(path);
1760 for (;;) {
1761 if (!dn)
1762 return log_oom();
1763
1764 log_info("Watching %s", dn);
1765
1766 if (inotify_add_watch(inotify_fd, dn, IN_CREATE|IN_MOVED_TO|IN_ONLYDIR|IN_DELETE_SELF|IN_MOVE_SELF) < 0) {
1767 if (errno != ENOENT)
1768 return log_error_errno(errno, "Failed to add watch on %s: %m", dn);
1769 } else
1770 break;
1771
1772 if (empty_or_root(dn))
1773 break;
1774
1775 dn = dirname_malloc(dn);
1776 }
1777
1778 w = now(CLOCK_MONOTONIC);
1779 if (w >= until)
1780 return log_error_errno(SYNTHETIC_ERRNO(ETIMEDOUT), "Device link %s still hasn't shown up, giving up.", path);
1781
1782 r = fd_wait_for_event(inotify_fd, POLLIN, usec_sub_unsigned(until, w));
1783 if (r < 0)
1784 return log_error_errno(r, "Failed to watch inotify: %m");
1785
1786 (void) flush_fd(inotify_fd);
1787 }
1788 }
1789
1790 static int calculate_disk_size(UserRecord *h, const char *parent_dir, uint64_t *ret) {
1791 struct statfs sfs;
1792 uint64_t m;
1793
1794 assert(h);
1795 assert(parent_dir);
1796 assert(ret);
1797
1798 if (h->disk_size != UINT64_MAX) {
1799 *ret = DISK_SIZE_ROUND_DOWN(h->disk_size);
1800 return 0;
1801 }
1802
1803 if (statfs(parent_dir, &sfs) < 0)
1804 return log_error_errno(errno, "statfs() on %s failed: %m", parent_dir);
1805
1806 m = sfs.f_bsize * sfs.f_bavail;
1807
1808 if (h->disk_size_relative == UINT64_MAX) {
1809
1810 if (m > UINT64_MAX / USER_DISK_SIZE_DEFAULT_PERCENT)
1811 return log_error_errno(SYNTHETIC_ERRNO(EOVERFLOW), "Disk size too large.");
1812
1813 *ret = DISK_SIZE_ROUND_DOWN(m * USER_DISK_SIZE_DEFAULT_PERCENT / 100);
1814
1815 log_info("Sizing home to %u%% of available disk space, which is %s.",
1816 USER_DISK_SIZE_DEFAULT_PERCENT,
1817 FORMAT_BYTES(*ret));
1818 } else {
1819 *ret = DISK_SIZE_ROUND_DOWN((uint64_t) ((double) m * (double) h->disk_size_relative / (double) UINT32_MAX));
1820
1821 log_info("Sizing home to %" PRIu64 ".%01" PRIu64 "%% of available disk space, which is %s.",
1822 (h->disk_size_relative * 100) / UINT32_MAX,
1823 ((h->disk_size_relative * 1000) / UINT32_MAX) % 10,
1824 FORMAT_BYTES(*ret));
1825 }
1826
1827 if (*ret < USER_DISK_SIZE_MIN)
1828 *ret = USER_DISK_SIZE_MIN;
1829
1830 return 0;
1831 }
1832
1833 static int home_truncate(
1834 UserRecord *h,
1835 int fd,
1836 const char *path,
1837 uint64_t size) {
1838
1839 bool trunc;
1840 int r;
1841
1842 assert(h);
1843 assert(fd >= 0);
1844 assert(path);
1845
1846 trunc = user_record_luks_discard(h);
1847 if (!trunc) {
1848 r = fallocate(fd, 0, 0, size);
1849 if (r < 0 && ERRNO_IS_NOT_SUPPORTED(errno)) {
1850 /* Some file systems do not support fallocate(), let's gracefully degrade
1851 * (ZFS, reiserfs, …) and fall back to truncation */
1852 log_notice_errno(errno, "Backing file system does not support fallocate(), falling back to ftruncate(), i.e. implicitly using non-discard mode.");
1853 trunc = true;
1854 }
1855 }
1856
1857 if (trunc)
1858 r = ftruncate(fd, size);
1859
1860 if (r < 0) {
1861 if (ERRNO_IS_DISK_SPACE(errno)) {
1862 log_error_errno(errno, "Not enough disk space to allocate home.");
1863 return -ENOSPC; /* make recognizable */
1864 }
1865
1866 return log_error_errno(errno, "Failed to truncate home image %s: %m", path);
1867 }
1868
1869 return 0;
1870 }
1871
1872 int home_create_luks(
1873 UserRecord *h,
1874 PasswordCache *cache,
1875 char **effective_passwords,
1876 UserRecord **ret_home) {
1877
1878 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL, *subdir = NULL, *disk_uuid_path = NULL, *temporary_image_path = NULL;
1879 uint64_t encrypted_size,
1880 host_size = 0, partition_offset = 0, partition_size = 0; /* Unnecessary initialization to appease gcc */
1881 bool image_created = false, dm_activated = false, mounted = false;
1882 _cleanup_(user_record_unrefp) UserRecord *new_home = NULL;
1883 sd_id128_t partition_uuid, fs_uuid, luks_uuid, disk_uuid;
1884 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
1885 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
1886 _cleanup_close_ int image_fd = -1, root_fd = -1;
1887 const char *fstype, *ip;
1888 struct statfs sfs;
1889 int r;
1890
1891 assert(h);
1892 assert(h->storage < 0 || h->storage == USER_LUKS);
1893 assert(ret_home);
1894
1895 r = dlopen_cryptsetup();
1896 if (r < 0)
1897 return r;
1898
1899 assert_se(ip = user_record_image_path(h));
1900
1901 fstype = user_record_file_system_type(h);
1902 if (!supported_fstype(fstype))
1903 return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "Unsupported file system type: %s", fstype);
1904
1905 r = mkfs_exists(fstype);
1906 if (r < 0)
1907 return log_error_errno(r, "Failed to check if mkfs binary for %s exists: %m", fstype);
1908 if (r == 0) {
1909 if (h->file_system_type || streq(fstype, "ext4") || !supported_fstype("ext4"))
1910 return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "mkfs binary for file system type %s does not exist.", fstype);
1911
1912 /* If the record does not explicitly declare a file system to use, and the compiled-in
1913 * default does not actually exist, than do an automatic fallback onto ext4, as the baseline
1914 * fs of Linux. We won't search for a working fs type here beyond ext4, i.e. nothing fancier
1915 * than a single, conservative fallback to baseline. This should be useful in minimal
1916 * environments where mkfs.btrfs or so are not made available, but mkfs.ext4 as Linux' most
1917 * boring, most basic fs is. */
1918 log_info("Formatting tool for compiled-in default file system %s not available, falling back to ext4 instead.", fstype);
1919 fstype = "ext4";
1920 }
1921
1922 if (sd_id128_is_null(h->partition_uuid)) {
1923 r = sd_id128_randomize(&partition_uuid);
1924 if (r < 0)
1925 return log_error_errno(r, "Failed to acquire partition UUID: %m");
1926 } else
1927 partition_uuid = h->partition_uuid;
1928
1929 if (sd_id128_is_null(h->luks_uuid)) {
1930 r = sd_id128_randomize(&luks_uuid);
1931 if (r < 0)
1932 return log_error_errno(r, "Failed to acquire LUKS UUID: %m");
1933 } else
1934 luks_uuid = h->luks_uuid;
1935
1936 if (sd_id128_is_null(h->file_system_uuid)) {
1937 r = sd_id128_randomize(&fs_uuid);
1938 if (r < 0)
1939 return log_error_errno(r, "Failed to acquire file system UUID: %m");
1940 } else
1941 fs_uuid = h->file_system_uuid;
1942
1943 r = make_dm_names(h->user_name, &dm_name, &dm_node);
1944 if (r < 0)
1945 return r;
1946
1947 r = access(dm_node, F_OK);
1948 if (r < 0) {
1949 if (errno != ENOENT)
1950 return log_error_errno(errno, "Failed to determine whether %s exists: %m", dm_node);
1951 } else
1952 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Device mapper device %s already exists, refusing.", dm_node);
1953
1954 if (path_startswith(ip, "/dev/")) {
1955 _cleanup_free_ char *sysfs = NULL;
1956 uint64_t block_device_size;
1957 struct stat st;
1958
1959 /* Let's place the home directory on a real device, i.e. an USB stick or such */
1960
1961 image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
1962 if (image_fd < 0)
1963 return log_error_errno(errno, "Failed to open device %s: %m", ip);
1964
1965 if (fstat(image_fd, &st) < 0)
1966 return log_error_errno(errno, "Failed to stat device %s: %m", ip);
1967 if (!S_ISBLK(st.st_mode))
1968 return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Device is not a block device, refusing.");
1969
1970 if (asprintf(&sysfs, "/sys/dev/block/%u:%u/partition", major(st.st_rdev), minor(st.st_rdev)) < 0)
1971 return log_oom();
1972 if (access(sysfs, F_OK) < 0) {
1973 if (errno != ENOENT)
1974 return log_error_errno(errno, "Failed to check whether %s exists: %m", sysfs);
1975 } else
1976 return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Operating on partitions is currently not supported, sorry. Please specify a top-level block device.");
1977
1978 if (flock(image_fd, LOCK_EX) < 0) /* make sure udev doesn't read from it while we operate on the device */
1979 return log_error_errno(errno, "Failed to lock block device %s: %m", ip);
1980
1981 if (ioctl(image_fd, BLKGETSIZE64, &block_device_size) < 0)
1982 return log_error_errno(errno, "Failed to read block device size: %m");
1983
1984 if (h->disk_size == UINT64_MAX) {
1985
1986 /* If a relative disk size is requested, apply it relative to the block device size */
1987 if (h->disk_size_relative < UINT32_MAX)
1988 host_size = CLAMP(DISK_SIZE_ROUND_DOWN(block_device_size * h->disk_size_relative / UINT32_MAX),
1989 USER_DISK_SIZE_MIN, USER_DISK_SIZE_MAX);
1990 else
1991 host_size = block_device_size; /* Otherwise, take the full device */
1992
1993 } else if (h->disk_size > block_device_size)
1994 return log_error_errno(SYNTHETIC_ERRNO(EMSGSIZE), "Selected disk size larger than backing block device, refusing.");
1995 else
1996 host_size = DISK_SIZE_ROUND_DOWN(h->disk_size);
1997
1998 if (!supported_fs_size(fstype, host_size))
1999 return log_error_errno(SYNTHETIC_ERRNO(ERANGE),
2000 "Selected file system size too small for %s.", fstype);
2001
2002 /* After creation we should reference this partition by its UUID instead of the block
2003 * device. That's preferable since the user might have specified a device node such as
2004 * /dev/sdb to us, which might look very different when replugged. */
2005 if (asprintf(&disk_uuid_path, "/dev/disk/by-uuid/" SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(luks_uuid)) < 0)
2006 return log_oom();
2007
2008 if (user_record_luks_discard(h) || user_record_luks_offline_discard(h)) {
2009 /* If we want online or offline discard, discard once before we start using things. */
2010
2011 if (ioctl(image_fd, BLKDISCARD, (uint64_t[]) { 0, block_device_size }) < 0)
2012 log_full_errno(errno == EOPNOTSUPP ? LOG_DEBUG : LOG_WARNING, errno,
2013 "Failed to issue full-device BLKDISCARD on device, ignoring: %m");
2014 else
2015 log_info("Full device discard completed.");
2016 }
2017 } else {
2018 _cleanup_free_ char *parent = NULL;
2019
2020 parent = dirname_malloc(ip);
2021 if (!parent)
2022 return log_oom();
2023
2024 r = mkdir_p(parent, 0755);
2025 if (r < 0)
2026 return log_error_errno(r, "Failed to create parent directory %s: %m", parent);
2027
2028 r = calculate_disk_size(h, parent, &host_size);
2029 if (r < 0)
2030 return r;
2031
2032 if (!supported_fs_size(fstype, host_size))
2033 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Selected file system size too small for %s.", fstype);
2034
2035 r = tempfn_random(ip, "homework", &temporary_image_path);
2036 if (r < 0)
2037 return log_error_errno(r, "Failed to derive temporary file name for %s: %m", ip);
2038
2039 image_fd = open(temporary_image_path, O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW, 0600);
2040 if (image_fd < 0)
2041 return log_error_errno(errno, "Failed to create home image %s: %m", temporary_image_path);
2042
2043 image_created = true;
2044
2045 r = chattr_fd(image_fd, FS_NOCOW_FL, FS_NOCOW_FL, NULL);
2046 if (r < 0)
2047 log_full_errno(ERRNO_IS_NOT_SUPPORTED(r) ? LOG_DEBUG : LOG_WARNING, r,
2048 "Failed to set file attributes on %s, ignoring: %m", temporary_image_path);
2049
2050 r = home_truncate(h, image_fd, temporary_image_path, host_size);
2051 if (r < 0)
2052 goto fail;
2053
2054 log_info("Allocating image file completed.");
2055 }
2056
2057 r = make_partition_table(
2058 image_fd,
2059 user_record_user_name_and_realm(h),
2060 partition_uuid,
2061 &partition_offset,
2062 &partition_size,
2063 &disk_uuid);
2064 if (r < 0)
2065 goto fail;
2066
2067 log_info("Writing of partition table completed.");
2068
2069 r = loop_device_make(image_fd, O_RDWR, partition_offset, partition_size, 0, &loop);
2070 if (r < 0) {
2071 if (r == -ENOENT) { /* this means /dev/loop-control doesn't exist, i.e. we are in a container
2072 * or similar and loopback bock devices are not available, return a
2073 * recognizable error in this case. */
2074 log_error_errno(r, "Loopback block device support is not available on this system.");
2075 r = -ENOLINK;
2076 goto fail;
2077 }
2078
2079 log_error_errno(r, "Failed to set up loopback device for %s: %m", temporary_image_path);
2080 goto fail;
2081 }
2082
2083 r = loop_device_flock(loop, LOCK_EX); /* make sure udev won't read before we are done */
2084 if (r < 0) {
2085 log_error_errno(r, "Failed to take lock on loop device: %m");
2086 goto fail;
2087 }
2088
2089 log_info("Setting up loopback device %s completed.", loop->node ?: ip);
2090
2091 r = luks_format(loop->node,
2092 dm_name,
2093 luks_uuid,
2094 user_record_user_name_and_realm(h),
2095 cache,
2096 effective_passwords,
2097 user_record_luks_discard(h) || user_record_luks_offline_discard(h),
2098 h,
2099 &cd);
2100 if (r < 0)
2101 goto fail;
2102
2103 dm_activated = true;
2104
2105 r = block_get_size_by_path(dm_node, &encrypted_size);
2106 if (r < 0) {
2107 log_error_errno(r, "Failed to get encrypted block device size: %m");
2108 goto fail;
2109 }
2110
2111 log_info("Setting up LUKS device %s completed.", dm_node);
2112
2113 r = make_filesystem(dm_node, fstype, user_record_user_name_and_realm(h), fs_uuid, user_record_luks_discard(h));
2114 if (r < 0)
2115 goto fail;
2116
2117 log_info("Formatting file system completed.");
2118
2119 r = home_unshare_and_mount(dm_node, fstype, user_record_luks_discard(h), user_record_mount_flags(h));
2120 if (r < 0)
2121 goto fail;
2122
2123 mounted = true;
2124
2125 subdir = path_join("/run/systemd/user-home-mount/", user_record_user_name_and_realm(h));
2126 if (!subdir) {
2127 r = log_oom();
2128 goto fail;
2129 }
2130
2131 /* Prefer using a btrfs subvolume if we can, fall back to directory otherwise */
2132 r = btrfs_subvol_make_fallback(subdir, 0700);
2133 if (r < 0) {
2134 log_error_errno(r, "Failed to create user directory in mounted image file: %m");
2135 goto fail;
2136 }
2137
2138 root_fd = open(subdir, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
2139 if (root_fd < 0) {
2140 r = log_error_errno(errno, "Failed to open user directory in mounted image file: %m");
2141 goto fail;
2142 }
2143
2144 r = home_populate(h, root_fd);
2145 if (r < 0)
2146 goto fail;
2147
2148 r = home_sync_and_statfs(root_fd, &sfs);
2149 if (r < 0)
2150 goto fail;
2151
2152 r = user_record_clone(h, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_LOG|USER_RECORD_PERMISSIVE, &new_home);
2153 if (r < 0) {
2154 log_error_errno(r, "Failed to clone record: %m");
2155 goto fail;
2156 }
2157
2158 r = user_record_add_binding(
2159 new_home,
2160 USER_LUKS,
2161 disk_uuid_path ?: ip,
2162 partition_uuid,
2163 luks_uuid,
2164 fs_uuid,
2165 sym_crypt_get_cipher(cd),
2166 sym_crypt_get_cipher_mode(cd),
2167 luks_volume_key_size_convert(cd),
2168 fstype,
2169 NULL,
2170 h->uid,
2171 (gid_t) h->uid);
2172 if (r < 0) {
2173 log_error_errno(r, "Failed to add binding to record: %m");
2174 goto fail;
2175 }
2176
2177 if (user_record_luks_offline_discard(h)) {
2178 r = run_fitrim(root_fd);
2179 if (r < 0)
2180 goto fail;
2181 }
2182
2183 root_fd = safe_close(root_fd);
2184
2185 r = umount_verbose(LOG_ERR, "/run/systemd/user-home-mount", UMOUNT_NOFOLLOW);
2186 if (r < 0)
2187 goto fail;
2188
2189 mounted = false;
2190
2191 r = sym_crypt_deactivate_by_name(cd, dm_name, 0);
2192 if (r < 0) {
2193 log_error_errno(r, "Failed to deactivate LUKS device: %m");
2194 goto fail;
2195 }
2196
2197 sym_crypt_free(cd);
2198 cd = NULL;
2199
2200 dm_activated = false;
2201
2202 loop = loop_device_unref(loop);
2203
2204 if (!user_record_luks_offline_discard(h)) {
2205 r = run_fallocate(image_fd, NULL /* refresh stat() data */);
2206 if (r < 0)
2207 goto fail;
2208 }
2209
2210 /* Sync everything to disk before we move things into place under the final name. */
2211 if (fsync(image_fd) < 0) {
2212 r = log_error_errno(r, "Failed to synchronize image to disk: %m");
2213 goto fail;
2214 }
2215
2216 if (disk_uuid_path)
2217 (void) ioctl(image_fd, BLKRRPART, 0);
2218 else {
2219 /* If we operate on a file, sync the containing directory too. */
2220 r = fsync_directory_of_file(image_fd);
2221 if (r < 0) {
2222 log_error_errno(r, "Failed to synchronize directory of image file to disk: %m");
2223 goto fail;
2224 }
2225 }
2226
2227 /* Let's close the image fd now. If we are operating on a real block device this will release the BSD
2228 * lock that ensures udev doesn't interfere with what we are doing */
2229 image_fd = safe_close(image_fd);
2230
2231 if (temporary_image_path) {
2232 if (rename(temporary_image_path, ip) < 0) {
2233 log_error_errno(errno, "Failed to rename image file: %m");
2234 goto fail;
2235 }
2236
2237 log_info("Moved image file into place.");
2238 }
2239
2240 if (disk_uuid_path)
2241 (void) wait_for_devlink(disk_uuid_path);
2242
2243 log_info("Everything completed.");
2244
2245 print_size_summary(host_size, encrypted_size, &sfs);
2246
2247 *ret_home = TAKE_PTR(new_home);
2248 return 0;
2249
2250 fail:
2251 /* Let's close all files before we unmount the file system, to avoid EBUSY */
2252 root_fd = safe_close(root_fd);
2253
2254 if (mounted)
2255 (void) umount_verbose(LOG_WARNING, "/run/systemd/user-home-mount", UMOUNT_NOFOLLOW);
2256
2257 if (dm_activated)
2258 (void) sym_crypt_deactivate_by_name(cd, dm_name, 0);
2259
2260 loop = loop_device_unref(loop);
2261
2262 if (image_created)
2263 (void) unlink(temporary_image_path);
2264
2265 return r;
2266 }
2267
2268 int home_validate_update_luks(UserRecord *h, HomeSetup *setup) {
2269 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
2270 int r;
2271
2272 assert(h);
2273 assert(setup);
2274
2275 r = make_dm_names(h->user_name, &dm_name, &dm_node);
2276 if (r < 0)
2277 return r;
2278
2279 r = access(dm_node, F_OK);
2280 if (r < 0 && errno != ENOENT)
2281 return log_error_errno(errno, "Failed to determine whether %s exists: %m", dm_node);
2282
2283 free_and_replace(setup->dm_name, dm_name);
2284 free_and_replace(setup->dm_node, dm_node);
2285
2286 return r >= 0;
2287 }
2288
2289 enum {
2290 CAN_RESIZE_ONLINE,
2291 CAN_RESIZE_OFFLINE,
2292 };
2293
2294 static int can_resize_fs(int fd, uint64_t old_size, uint64_t new_size) {
2295 struct statfs sfs;
2296
2297 assert(fd >= 0);
2298
2299 /* Filter out bogus requests early */
2300 if (old_size == 0 || old_size == UINT64_MAX ||
2301 new_size == 0 || new_size == UINT64_MAX)
2302 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid resize parameters.");
2303
2304 if ((old_size & 511) != 0 || (new_size & 511) != 0)
2305 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Resize parameters not multiple of 512.");
2306
2307 if (fstatfs(fd, &sfs) < 0)
2308 return log_error_errno(errno, "Failed to fstatfs() file system: %m");
2309
2310 if (is_fs_type(&sfs, BTRFS_SUPER_MAGIC)) {
2311
2312 if (new_size < BTRFS_MINIMAL_SIZE)
2313 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for btrfs (needs to be 256M at least.");
2314
2315 /* btrfs can grow and shrink online */
2316
2317 } else if (is_fs_type(&sfs, XFS_SB_MAGIC)) {
2318
2319 if (new_size < XFS_MINIMAL_SIZE)
2320 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for xfs (needs to be 14M at least).");
2321
2322 /* XFS can grow, but not shrink */
2323 if (new_size < old_size)
2324 return log_error_errno(SYNTHETIC_ERRNO(EMSGSIZE), "Shrinking this type of file system is not supported.");
2325
2326 } else if (is_fs_type(&sfs, EXT4_SUPER_MAGIC)) {
2327
2328 if (new_size < EXT4_MINIMAL_SIZE)
2329 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for ext4 (needs to be 1M at least).");
2330
2331 /* ext4 can grow online, and shrink offline */
2332 if (new_size < old_size)
2333 return CAN_RESIZE_OFFLINE;
2334
2335 } else
2336 return log_error_errno(SYNTHETIC_ERRNO(ESOCKTNOSUPPORT), "Resizing this type of file system is not supported.");
2337
2338 return CAN_RESIZE_ONLINE;
2339 }
2340
2341 static int ext4_offline_resize_fs(HomeSetup *setup, uint64_t new_size, bool discard, unsigned long flags) {
2342 _cleanup_free_ char *size_str = NULL;
2343 bool re_open = false, re_mount = false;
2344 pid_t resize_pid, fsck_pid;
2345 int r, exit_status;
2346
2347 assert(setup);
2348 assert(setup->dm_node);
2349
2350 /* First, unmount the file system */
2351 if (setup->root_fd >= 0) {
2352 setup->root_fd = safe_close(setup->root_fd);
2353 re_open = true;
2354 }
2355
2356 if (setup->undo_mount) {
2357 r = umount_verbose(LOG_ERR, "/run/systemd/user-home-mount", UMOUNT_NOFOLLOW);
2358 if (r < 0)
2359 return r;
2360
2361 setup->undo_mount = false;
2362 re_mount = true;
2363 }
2364
2365 log_info("Temporary unmounting of file system completed.");
2366
2367 /* resize2fs requires that the file system is force checked first, do so. */
2368 r = safe_fork("(e2fsck)",
2369 FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_STDOUT_TO_STDERR|FORK_CLOSE_ALL_FDS,
2370 &fsck_pid);
2371 if (r < 0)
2372 return r;
2373 if (r == 0) {
2374 /* Child */
2375 execlp("e2fsck" ,"e2fsck", "-fp", setup->dm_node, NULL);
2376 log_open();
2377 log_error_errno(errno, "Failed to execute e2fsck: %m");
2378 _exit(EXIT_FAILURE);
2379 }
2380
2381 exit_status = wait_for_terminate_and_check("e2fsck", fsck_pid, WAIT_LOG_ABNORMAL);
2382 if (exit_status < 0)
2383 return exit_status;
2384 if ((exit_status & ~FSCK_ERROR_CORRECTED) != 0) {
2385 log_warning("e2fsck failed with exit status %i.", exit_status);
2386
2387 if ((exit_status & (FSCK_SYSTEM_SHOULD_REBOOT|FSCK_ERRORS_LEFT_UNCORRECTED)) != 0)
2388 return log_error_errno(SYNTHETIC_ERRNO(EIO), "File system is corrupted, refusing.");
2389
2390 log_warning("Ignoring fsck error.");
2391 }
2392
2393 log_info("Forced file system check completed.");
2394
2395 /* We use 512 sectors here, because resize2fs doesn't do byte sizes */
2396 if (asprintf(&size_str, "%" PRIu64 "s", new_size / 512) < 0)
2397 return log_oom();
2398
2399 /* Resize the thing */
2400 r = safe_fork("(e2resize)",
2401 FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_WAIT|FORK_STDOUT_TO_STDERR|FORK_CLOSE_ALL_FDS,
2402 &resize_pid);
2403 if (r < 0)
2404 return r;
2405 if (r == 0) {
2406 /* Child */
2407 execlp("resize2fs" ,"resize2fs", setup->dm_node, size_str, NULL);
2408 log_open();
2409 log_error_errno(errno, "Failed to execute resize2fs: %m");
2410 _exit(EXIT_FAILURE);
2411 }
2412
2413 log_info("Offline file system resize completed.");
2414
2415 /* Re-establish mounts and reopen the directory */
2416 if (re_mount) {
2417 r = home_mount_node(setup->dm_node, "ext4", discard, flags);
2418 if (r < 0)
2419 return r;
2420
2421 setup->undo_mount = true;
2422 }
2423
2424 if (re_open) {
2425 setup->root_fd = open("/run/systemd/user-home-mount", O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
2426 if (setup->root_fd < 0)
2427 return log_error_errno(errno, "Failed to reopen file system: %m");
2428 }
2429
2430 log_info("File system mounted again.");
2431
2432 return 0;
2433 }
2434
2435 static int prepare_resize_partition(
2436 int fd,
2437 uint64_t partition_offset,
2438 uint64_t old_partition_size,
2439 uint64_t new_partition_size,
2440 sd_id128_t *ret_disk_uuid,
2441 struct fdisk_table **ret_table) {
2442
2443 _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
2444 _cleanup_(fdisk_unref_tablep) struct fdisk_table *t = NULL;
2445 _cleanup_free_ char *path = NULL, *disk_uuid_as_string = NULL;
2446 size_t n_partitions;
2447 sd_id128_t disk_uuid;
2448 bool found = false;
2449 int r;
2450
2451 assert(fd >= 0);
2452 assert(ret_disk_uuid);
2453 assert(ret_table);
2454
2455 assert((partition_offset & 511) == 0);
2456 assert((old_partition_size & 511) == 0);
2457 assert((new_partition_size & 511) == 0);
2458 assert(UINT64_MAX - old_partition_size >= partition_offset);
2459 assert(UINT64_MAX - new_partition_size >= partition_offset);
2460
2461 if (partition_offset == 0) {
2462 /* If the offset is at the beginning we assume no partition table, let's exit early. */
2463 log_debug("Not rewriting partition table, operating on naked device.");
2464 *ret_disk_uuid = SD_ID128_NULL;
2465 *ret_table = NULL;
2466 return 0;
2467 }
2468
2469 c = fdisk_new_context();
2470 if (!c)
2471 return log_oom();
2472
2473 if (asprintf(&path, "/proc/self/fd/%i", fd) < 0)
2474 return log_oom();
2475
2476 r = fdisk_assign_device(c, path, 0);
2477 if (r < 0)
2478 return log_error_errno(r, "Failed to open device: %m");
2479
2480 if (!fdisk_is_labeltype(c, FDISK_DISKLABEL_GPT))
2481 return log_error_errno(SYNTHETIC_ERRNO(ENOMEDIUM), "Disk has no GPT partition table.");
2482
2483 r = fdisk_get_disklabel_id(c, &disk_uuid_as_string);
2484 if (r < 0)
2485 return log_error_errno(r, "Failed to acquire disk UUID: %m");
2486
2487 r = sd_id128_from_string(disk_uuid_as_string, &disk_uuid);
2488 if (r < 0)
2489 return log_error_errno(r, "Failed parse disk UUID: %m");
2490
2491 r = fdisk_get_partitions(c, &t);
2492 if (r < 0)
2493 return log_error_errno(r, "Failed to acquire partition table: %m");
2494
2495 n_partitions = fdisk_table_get_nents(t);
2496 for (size_t i = 0; i < n_partitions; i++) {
2497 struct fdisk_partition *p;
2498
2499 p = fdisk_table_get_partition(t, i);
2500 if (!p)
2501 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to read partition metadata: %m");
2502
2503 if (fdisk_partition_is_used(p) <= 0)
2504 continue;
2505 if (fdisk_partition_has_start(p) <= 0 || fdisk_partition_has_size(p) <= 0 || fdisk_partition_has_end(p) <= 0)
2506 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Found partition without a size.");
2507
2508 if (fdisk_partition_get_start(p) == partition_offset / 512U &&
2509 fdisk_partition_get_size(p) == old_partition_size / 512U) {
2510
2511 if (found)
2512 return log_error_errno(SYNTHETIC_ERRNO(ENOTUNIQ), "Partition found twice, refusing.");
2513
2514 /* Found our partition, now patch it */
2515 r = fdisk_partition_size_explicit(p, 1);
2516 if (r < 0)
2517 return log_error_errno(r, "Failed to enable explicit partition size: %m");
2518
2519 r = fdisk_partition_set_size(p, new_partition_size / 512U);
2520 if (r < 0)
2521 return log_error_errno(r, "Failed to change partition size: %m");
2522
2523 found = true;
2524 continue;
2525
2526 } else {
2527 if (fdisk_partition_get_start(p) < partition_offset + new_partition_size / 512U &&
2528 fdisk_partition_get_end(p) >= partition_offset / 512)
2529 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Can't extend, conflicting partition found.");
2530 }
2531 }
2532
2533 if (!found)
2534 return log_error_errno(SYNTHETIC_ERRNO(ENOPKG), "Failed to find matching partition to resize.");
2535
2536 *ret_table = TAKE_PTR(t);
2537 *ret_disk_uuid = disk_uuid;
2538
2539 return 1;
2540 }
2541
2542 static int ask_cb(struct fdisk_context *c, struct fdisk_ask *ask, void *userdata) {
2543 char *result;
2544
2545 assert(c);
2546
2547 switch (fdisk_ask_get_type(ask)) {
2548
2549 case FDISK_ASKTYPE_STRING:
2550 result = new(char, 37);
2551 if (!result)
2552 return log_oom();
2553
2554 fdisk_ask_string_set_result(ask, id128_to_uuid_string(*(sd_id128_t*) userdata, result));
2555 break;
2556
2557 default:
2558 log_debug("Unexpected question from libfdisk, ignoring.");
2559 }
2560
2561 return 0;
2562 }
2563
2564 static int apply_resize_partition(int fd, sd_id128_t disk_uuids, struct fdisk_table *t) {
2565 _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
2566 _cleanup_free_ void *two_zero_lbas = NULL;
2567 _cleanup_free_ char *path = NULL;
2568 ssize_t n;
2569 int r;
2570
2571 assert(fd >= 0);
2572
2573 if (!t) /* no partition table to apply, exit early */
2574 return 0;
2575
2576 two_zero_lbas = malloc0(1024U);
2577 if (!two_zero_lbas)
2578 return log_oom();
2579
2580 /* libfdisk appears to get confused by the existing PMBR. Let's explicitly flush it out. */
2581 n = pwrite(fd, two_zero_lbas, 1024U, 0);
2582 if (n < 0)
2583 return log_error_errno(errno, "Failed to wipe partition table: %m");
2584 if (n != 1024)
2585 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while wiping partition table.");
2586
2587 c = fdisk_new_context();
2588 if (!c)
2589 return log_oom();
2590
2591 if (asprintf(&path, "/proc/self/fd/%i", fd) < 0)
2592 return log_oom();
2593
2594 r = fdisk_assign_device(c, path, 0);
2595 if (r < 0)
2596 return log_error_errno(r, "Failed to open device: %m");
2597
2598 r = fdisk_create_disklabel(c, "gpt");
2599 if (r < 0)
2600 return log_error_errno(r, "Failed to create GPT disk label: %m");
2601
2602 r = fdisk_apply_table(c, t);
2603 if (r < 0)
2604 return log_error_errno(r, "Failed to apply partition table: %m");
2605
2606 r = fdisk_set_ask(c, ask_cb, &disk_uuids);
2607 if (r < 0)
2608 return log_error_errno(r, "Failed to set libfdisk query function: %m");
2609
2610 r = fdisk_set_disklabel_id(c);
2611 if (r < 0)
2612 return log_error_errno(r, "Failed to change disklabel ID: %m");
2613
2614 r = fdisk_write_disklabel(c);
2615 if (r < 0)
2616 return log_error_errno(r, "Failed to write disk label: %m");
2617
2618 return 1;
2619 }
2620
2621 int home_resize_luks(
2622 UserRecord *h,
2623 bool already_activated,
2624 PasswordCache *cache,
2625 HomeSetup *setup,
2626 UserRecord **ret_home) {
2627
2628 uint64_t old_image_size, new_image_size, old_fs_size, new_fs_size, crypto_offset, new_partition_size;
2629 _cleanup_(user_record_unrefp) UserRecord *header_home = NULL, *embedded_home = NULL, *new_home = NULL;
2630 _cleanup_(fdisk_unref_tablep) struct fdisk_table *table = NULL;
2631 _cleanup_free_ char *whole_disk = NULL;
2632 _cleanup_close_ int image_fd = -1;
2633 sd_id128_t disk_uuid;
2634 const char *ip, *ipo;
2635 struct statfs sfs;
2636 struct stat st;
2637 int r, resize_type;
2638
2639 assert(h);
2640 assert(user_record_storage(h) == USER_LUKS);
2641 assert(setup);
2642 assert(ret_home);
2643
2644 r = dlopen_cryptsetup();
2645 if (r < 0)
2646 return r;
2647
2648 assert_se(ipo = user_record_image_path(h));
2649 ip = strdupa(ipo); /* copy out since original might change later in home record object */
2650
2651 image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2652 if (image_fd < 0)
2653 return log_error_errno(errno, "Failed to open image file %s: %m", ip);
2654
2655 if (fstat(image_fd, &st) < 0)
2656 return log_error_errno(errno, "Failed to stat image file %s: %m", ip);
2657 if (S_ISBLK(st.st_mode)) {
2658 dev_t parent;
2659
2660 r = block_get_whole_disk(st.st_rdev, &parent);
2661 if (r < 0)
2662 return log_error_errno(r, "Failed to acquire whole block device for %s: %m", ip);
2663 if (r > 0) {
2664 /* If we shall resize a file system on a partition device, then let's figure out the
2665 * whole disk device and operate on that instead, since we need to rewrite the
2666 * partition table to resize the partition. */
2667
2668 log_info("Operating on partition device %s, using parent device.", ip);
2669
2670 r = device_path_make_major_minor(st.st_mode, parent, &whole_disk);
2671 if (r < 0)
2672 return log_error_errno(r, "Failed to derive whole disk path for %s: %m", ip);
2673
2674 safe_close(image_fd);
2675
2676 image_fd = open(whole_disk, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2677 if (image_fd < 0)
2678 return log_error_errno(errno, "Failed to open whole block device %s: %m", whole_disk);
2679
2680 if (fstat(image_fd, &st) < 0)
2681 return log_error_errno(errno, "Failed to stat whole block device %s: %m", whole_disk);
2682 if (!S_ISBLK(st.st_mode))
2683 return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Whole block device %s is not actually a block device, refusing.", whole_disk);
2684 } else
2685 log_info("Operating on whole block device %s.", ip);
2686
2687 if (ioctl(image_fd, BLKGETSIZE64, &old_image_size) < 0)
2688 return log_error_errno(errno, "Failed to determine size of original block device: %m");
2689
2690 if (flock(image_fd, LOCK_EX) < 0) /* make sure udev doesn't read from it while we operate on the device */
2691 return log_error_errno(errno, "Failed to lock block device %s: %m", ip);
2692
2693 new_image_size = old_image_size; /* we can't resize physical block devices */
2694 } else {
2695 r = stat_verify_regular(&st);
2696 if (r < 0)
2697 return log_error_errno(r, "Image %s is not a block device nor regular file: %m", ip);
2698
2699 old_image_size = st.st_size;
2700
2701 /* Note an asymetry here: when we operate on loopback files the specified disk size we get we
2702 * apply onto the loopback file as a whole. When we operate on block devices we instead apply
2703 * to the partition itself only. */
2704
2705 new_image_size = DISK_SIZE_ROUND_DOWN(h->disk_size);
2706 if (new_image_size == old_image_size) {
2707 log_info("Image size already matching, skipping operation.");
2708 return 0;
2709 }
2710 }
2711
2712 r = home_prepare_luks(h, already_activated, whole_disk, cache, setup, &header_home);
2713 if (r < 0)
2714 return r;
2715
2716 r = home_load_embedded_identity(h, setup->root_fd, header_home, USER_RECONCILE_REQUIRE_NEWER_OR_EQUAL, cache, &embedded_home, &new_home);
2717 if (r < 0)
2718 return r;
2719
2720 log_info("offset = %" PRIu64 ", size = %" PRIu64 ", image = %" PRIu64, setup->partition_offset, setup->partition_size, old_image_size);
2721
2722 if ((UINT64_MAX - setup->partition_offset) < setup->partition_size ||
2723 setup->partition_offset + setup->partition_size > old_image_size)
2724 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Old partition doesn't fit in backing storage, refusing.");
2725
2726 if (S_ISREG(st.st_mode)) {
2727 uint64_t partition_table_extra;
2728
2729 partition_table_extra = old_image_size - setup->partition_size;
2730 if (new_image_size <= partition_table_extra)
2731 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "New size smaller than partition table metadata.");
2732
2733 new_partition_size = new_image_size - partition_table_extra;
2734 } else {
2735 assert(S_ISBLK(st.st_mode));
2736
2737 new_partition_size = DISK_SIZE_ROUND_DOWN(h->disk_size);
2738 if (new_partition_size == setup->partition_size) {
2739 log_info("Partition size already matching, skipping operation.");
2740 return 0;
2741 }
2742 }
2743
2744 if ((UINT64_MAX - setup->partition_offset) < new_partition_size ||
2745 setup->partition_offset + new_partition_size > new_image_size)
2746 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "New partition doesn't fit into backing storage, refusing.");
2747
2748 crypto_offset = sym_crypt_get_data_offset(setup->crypt_device);
2749 if (setup->partition_size / 512U <= crypto_offset)
2750 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Weird, old crypto payload offset doesn't actually fit in partition size?");
2751 if (new_partition_size / 512U <= crypto_offset)
2752 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "New size smaller than crypto payload offset?");
2753
2754 old_fs_size = (setup->partition_size / 512U - crypto_offset) * 512U;
2755 new_fs_size = (new_partition_size / 512U - crypto_offset) * 512U;
2756
2757 /* Before we start doing anything, let's figure out if we actually can */
2758 resize_type = can_resize_fs(setup->root_fd, old_fs_size, new_fs_size);
2759 if (resize_type < 0)
2760 return resize_type;
2761 if (resize_type == CAN_RESIZE_OFFLINE && already_activated)
2762 return log_error_errno(SYNTHETIC_ERRNO(ETXTBSY), "File systems of this type can only be resized offline, but is currently online.");
2763
2764 log_info("Ready to resize image size %s → %s, partition size %s → %s, file system size %s → %s.",
2765 FORMAT_BYTES(old_image_size),
2766 FORMAT_BYTES(new_image_size),
2767 FORMAT_BYTES(setup->partition_size),
2768 FORMAT_BYTES(new_partition_size),
2769 FORMAT_BYTES(old_fs_size),
2770 FORMAT_BYTES(new_fs_size));
2771
2772 r = prepare_resize_partition(
2773 image_fd,
2774 setup->partition_offset,
2775 setup->partition_size,
2776 new_partition_size,
2777 &disk_uuid,
2778 &table);
2779 if (r < 0)
2780 return r;
2781
2782 if (new_fs_size > old_fs_size) {
2783
2784 if (S_ISREG(st.st_mode)) {
2785 /* Grow file size */
2786 r = home_truncate(h, image_fd, ip, new_image_size);
2787 if (r < 0)
2788 return r;
2789
2790 log_info("Growing of image file completed.");
2791 }
2792
2793 /* Make sure loopback device sees the new bigger size */
2794 r = loop_device_refresh_size(setup->loop, UINT64_MAX, new_partition_size);
2795 if (r == -ENOTTY)
2796 log_debug_errno(r, "Device is not a loopback device, not refreshing size.");
2797 else if (r < 0)
2798 return log_error_errno(r, "Failed to refresh loopback device size: %m");
2799 else
2800 log_info("Refreshing loop device size completed.");
2801
2802 r = apply_resize_partition(image_fd, disk_uuid, table);
2803 if (r < 0)
2804 return r;
2805 if (r > 0)
2806 log_info("Growing of partition completed.");
2807
2808 if (ioctl(image_fd, BLKRRPART, 0) < 0)
2809 log_debug_errno(errno, "BLKRRPART failed on block device, ignoring: %m");
2810
2811 /* Tell LUKS about the new bigger size too */
2812 r = sym_crypt_resize(setup->crypt_device, setup->dm_name, new_fs_size / 512U);
2813 if (r < 0)
2814 return log_error_errno(r, "Failed to grow LUKS device: %m");
2815
2816 log_info("LUKS device growing completed.");
2817 } else {
2818 r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
2819 if (r < 0)
2820 return r;
2821
2822 if (S_ISREG(st.st_mode)) {
2823 if (user_record_luks_discard(h))
2824 /* Before we shrink, let's trim the file system, so that we need less space on disk during the shrinking */
2825 (void) run_fitrim(setup->root_fd);
2826 else {
2827 /* If discard is off, let's ensure all backing blocks are allocated, so that our resize operation doesn't fail half-way */
2828 r = run_fallocate(image_fd, &st);
2829 if (r < 0)
2830 return r;
2831 }
2832 }
2833 }
2834
2835 /* Now resize the file system */
2836 if (resize_type == CAN_RESIZE_ONLINE)
2837 r = resize_fs(setup->root_fd, new_fs_size, NULL);
2838 else
2839 r = ext4_offline_resize_fs(setup, new_fs_size, user_record_luks_discard(h), user_record_mount_flags(h));
2840 if (r < 0)
2841 return log_error_errno(r, "Failed to resize file system: %m");
2842
2843 log_info("File system resizing completed.");
2844
2845 /* Immediately sync afterwards */
2846 r = home_sync_and_statfs(setup->root_fd, NULL);
2847 if (r < 0)
2848 return r;
2849
2850 if (new_fs_size < old_fs_size) {
2851
2852 /* Shrink the LUKS device now, matching the new file system size */
2853 r = sym_crypt_resize(setup->crypt_device, setup->dm_name, new_fs_size / 512);
2854 if (r < 0)
2855 return log_error_errno(r, "Failed to shrink LUKS device: %m");
2856
2857 log_info("LUKS device shrinking completed.");
2858
2859 if (S_ISREG(st.st_mode)) {
2860 /* Shrink the image file */
2861 if (ftruncate(image_fd, new_image_size) < 0)
2862 return log_error_errno(errno, "Failed to shrink image file %s: %m", ip);
2863
2864 log_info("Shrinking of image file completed.");
2865 }
2866
2867 /* Refresh the loop devices size */
2868 r = loop_device_refresh_size(setup->loop, UINT64_MAX, new_partition_size);
2869 if (r == -ENOTTY)
2870 log_debug_errno(r, "Device is not a loopback device, not refreshing size.");
2871 else if (r < 0)
2872 return log_error_errno(r, "Failed to refresh loopback device size: %m");
2873 else
2874 log_info("Refreshing loop device size completed.");
2875
2876 r = apply_resize_partition(image_fd, disk_uuid, table);
2877 if (r < 0)
2878 return r;
2879 if (r > 0)
2880 log_info("Shrinking of partition completed.");
2881
2882 if (ioctl(image_fd, BLKRRPART, 0) < 0)
2883 log_debug_errno(errno, "BLKRRPART failed on block device, ignoring: %m");
2884 } else {
2885 r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
2886 if (r < 0)
2887 return r;
2888 }
2889
2890 r = home_store_header_identity_luks(new_home, setup, header_home);
2891 if (r < 0)
2892 return r;
2893
2894 r = home_extend_embedded_identity(new_home, h, setup);
2895 if (r < 0)
2896 return r;
2897
2898 if (user_record_luks_discard(h))
2899 (void) run_fitrim(setup->root_fd);
2900
2901 r = home_sync_and_statfs(setup->root_fd, &sfs);
2902 if (r < 0)
2903 return r;
2904
2905 r = home_setup_undo(setup);
2906 if (r < 0)
2907 return r;
2908
2909 log_info("Everything completed.");
2910
2911 print_size_summary(new_image_size, new_fs_size, &sfs);
2912
2913 *ret_home = TAKE_PTR(new_home);
2914 return 0;
2915 }
2916
2917 int home_passwd_luks(
2918 UserRecord *h,
2919 HomeSetup *setup,
2920 PasswordCache *cache, /* the passwords acquired via PKCS#11/FIDO2 security tokens */
2921 char **effective_passwords /* new passwords */) {
2922
2923 size_t volume_key_size, max_key_slots, n_effective;
2924 _cleanup_(erase_and_freep) void *volume_key = NULL;
2925 struct crypt_pbkdf_type good_pbkdf, minimal_pbkdf;
2926 const char *type;
2927 char **list;
2928 int r;
2929
2930 assert(h);
2931 assert(user_record_storage(h) == USER_LUKS);
2932 assert(setup);
2933
2934 r = dlopen_cryptsetup();
2935 if (r < 0)
2936 return r;
2937
2938 type = sym_crypt_get_type(setup->crypt_device);
2939 if (!type)
2940 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine crypto device type.");
2941
2942 r = sym_crypt_keyslot_max(type);
2943 if (r <= 0)
2944 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine number of key slots.");
2945 max_key_slots = r;
2946
2947 r = sym_crypt_get_volume_key_size(setup->crypt_device);
2948 if (r <= 0)
2949 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine volume key size.");
2950 volume_key_size = (size_t) r;
2951
2952 volume_key = malloc(volume_key_size);
2953 if (!volume_key)
2954 return log_oom();
2955
2956 r = -ENOKEY;
2957 FOREACH_POINTER(list, cache->pkcs11_passwords, cache->fido2_passwords, h->password) {
2958 r = luks_try_passwords(setup->crypt_device, list, volume_key, &volume_key_size);
2959 if (r != -ENOKEY)
2960 break;
2961 }
2962 if (r == -ENOKEY)
2963 return log_error_errno(SYNTHETIC_ERRNO(ENOKEY), "Failed to unlock LUKS superblock with supplied passwords.");
2964 if (r < 0)
2965 return log_error_errno(r, "Failed to unlocks LUKS superblock: %m");
2966
2967 n_effective = strv_length(effective_passwords);
2968
2969 build_good_pbkdf(&good_pbkdf, h);
2970 build_minimal_pbkdf(&minimal_pbkdf, h);
2971
2972 for (size_t i = 0; i < max_key_slots; i++) {
2973 r = sym_crypt_keyslot_destroy(setup->crypt_device, i);
2974 if (r < 0 && !IN_SET(r, -ENOENT, -EINVAL)) /* Returns EINVAL or ENOENT if there's no key in this slot already */
2975 return log_error_errno(r, "Failed to destroy LUKS password: %m");
2976
2977 if (i >= n_effective) {
2978 if (r >= 0)
2979 log_info("Destroyed LUKS key slot %zu.", i);
2980 continue;
2981 }
2982
2983 if (strv_contains(cache->pkcs11_passwords, effective_passwords[i]) ||
2984 strv_contains(cache->fido2_passwords, effective_passwords[i])) {
2985 log_debug("Using minimal PBKDF for slot %zu", i);
2986 r = sym_crypt_set_pbkdf_type(setup->crypt_device, &minimal_pbkdf);
2987 } else {
2988 log_debug("Using good PBKDF for slot %zu", i);
2989 r = sym_crypt_set_pbkdf_type(setup->crypt_device, &good_pbkdf);
2990 }
2991 if (r < 0)
2992 return log_error_errno(r, "Failed to tweak PBKDF for slot %zu: %m", i);
2993
2994 r = sym_crypt_keyslot_add_by_volume_key(
2995 setup->crypt_device,
2996 i,
2997 volume_key,
2998 volume_key_size,
2999 effective_passwords[i],
3000 strlen(effective_passwords[i]));
3001 if (r < 0)
3002 return log_error_errno(r, "Failed to set up LUKS password: %m");
3003
3004 log_info("Updated LUKS key slot %zu.", i);
3005 }
3006
3007 return 1;
3008 }
3009
3010 int home_lock_luks(UserRecord *h) {
3011 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
3012 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
3013 _cleanup_close_ int root_fd = -1;
3014 const char *p;
3015 int r;
3016
3017 assert(h);
3018
3019 assert_se(p = user_record_home_directory(h));
3020 root_fd = open(p, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
3021 if (root_fd < 0)
3022 return log_error_errno(errno, "Failed to open home directory: %m");
3023
3024 r = make_dm_names(h->user_name, &dm_name, &dm_node);
3025 if (r < 0)
3026 return r;
3027
3028 r = dlopen_cryptsetup();
3029 if (r < 0)
3030 return r;
3031
3032 r = sym_crypt_init_by_name(&cd, dm_name);
3033 if (r < 0)
3034 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
3035
3036 log_info("Discovered used LUKS device %s.", dm_node);
3037 cryptsetup_enable_logging(cd);
3038
3039 if (syncfs(root_fd) < 0) /* Snake oil, but let's better be safe than sorry */
3040 return log_error_errno(errno, "Failed to synchronize file system %s: %m", p);
3041
3042 root_fd = safe_close(root_fd);
3043
3044 log_info("File system synchronized.");
3045
3046 /* Note that we don't invoke FIFREEZE here, it appears libcryptsetup/device-mapper already does that on its own for us */
3047
3048 r = sym_crypt_suspend(cd, dm_name);
3049 if (r < 0)
3050 return log_error_errno(r, "Failed to suspend cryptsetup device: %s: %m", dm_node);
3051
3052 log_info("LUKS device suspended.");
3053 return 0;
3054 }
3055
3056 static int luks_try_resume(
3057 struct crypt_device *cd,
3058 const char *dm_name,
3059 char **password) {
3060
3061 char **pp;
3062 int r;
3063
3064 assert(cd);
3065 assert(dm_name);
3066
3067 STRV_FOREACH(pp, password) {
3068 r = sym_crypt_resume_by_passphrase(
3069 cd,
3070 dm_name,
3071 CRYPT_ANY_SLOT,
3072 *pp,
3073 strlen(*pp));
3074 if (r >= 0) {
3075 log_info("Resumed LUKS device %s.", dm_name);
3076 return 0;
3077 }
3078
3079 log_debug_errno(r, "Password %zu didn't work for resuming device: %m", (size_t) (pp - password));
3080 }
3081
3082 return -ENOKEY;
3083 }
3084
3085 int home_unlock_luks(UserRecord *h, PasswordCache *cache) {
3086 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
3087 _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
3088 char **list;
3089 int r;
3090
3091 assert(h);
3092
3093 r = make_dm_names(h->user_name, &dm_name, &dm_node);
3094 if (r < 0)
3095 return r;
3096
3097 r = dlopen_cryptsetup();
3098 if (r < 0)
3099 return r;
3100
3101 r = sym_crypt_init_by_name(&cd, dm_name);
3102 if (r < 0)
3103 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
3104
3105 log_info("Discovered used LUKS device %s.", dm_node);
3106 cryptsetup_enable_logging(cd);
3107
3108 r = -ENOKEY;
3109 FOREACH_POINTER(list, cache->pkcs11_passwords, cache->fido2_passwords, h->password) {
3110 r = luks_try_resume(cd, dm_name, list);
3111 if (r != -ENOKEY)
3112 break;
3113 }
3114 if (r == -ENOKEY)
3115 return log_error_errno(r, "No valid password for LUKS superblock.");
3116 if (r < 0)
3117 return log_error_errno(r, "Failed to resume LUKS superblock: %m");
3118
3119 log_info("LUKS device resumed.");
3120 return 0;
3121 }
Unnamed repository; edit this file 'description' to name the repository.