src/cryptsetup/cryptsetup-generator.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <sys/stat.h>
   6 #include <sys/types.h>
   7
   8 #include "alloc-util.h"
   9 #include "dropin.h"
  10 #include "escape.h"
  11 #include "fd-util.h"
  12 #include "fileio.h"
  13 #include "fstab-util.h"
  14 #include "generator.h"
  15 #include "hashmap.h"
  16 #include "id128-util.h"
  17 #include "log.h"
  18 #include "mkdir.h"
  19 #include "parse-util.h"
  20 #include "path-util.h"
  21 #include "proc-cmdline.h"
  22 #include "specifier.h"
  23 #include "string-util.h"
  24 #include "strv.h"
  25 #include "unit-name.h"
  26 #include "util.h"
  27
  28 typedef struct crypto_device {
  29         char *uuid;
  30         char *keyfile;
  31         char *keydev;
  32         char *headerdev;
  33         char *datadev;
  34         char *name;
  35         char *options;
  36         bool create;
  37 } crypto_device;
  38
  39 static const char *arg_dest = NULL;
  40 static bool arg_enabled = true;
  41 static bool arg_read_crypttab = true;
  42 static const char *arg_crypttab = NULL;
  43 static const char *arg_runtime_directory = NULL;
  44 static bool arg_allow_list = false;
  45 static Hashmap *arg_disks = NULL;
  46 static char *arg_default_options = NULL;
  47 static char *arg_default_keyfile = NULL;
  48
  49 STATIC_DESTRUCTOR_REGISTER(arg_disks, hashmap_freep);
  50 STATIC_DESTRUCTOR_REGISTER(arg_default_options, freep);
  51 STATIC_DESTRUCTOR_REGISTER(arg_default_keyfile, freep);
  52
  53 static int split_locationspec(const char *locationspec, char **ret_file, char **ret_device) {
  54         _cleanup_free_ char *file = NULL, *device = NULL;
  55         const char *c;
  56
  57         assert(ret_file);
  58         assert(ret_device);
  59
  60         if (!locationspec) {
  61                 *ret_file = *ret_device = NULL;
  62                 return 0;
  63         }
  64
  65         c = strrchr(locationspec, ':');
  66         if (c) {
  67                 /* The device part has to be either an absolute path to device node (/dev/something,
  68                  * /dev/foo/something, or even possibly /dev/foo/something:part), or a fstab device
  69                  * specification starting with LABEL= or similar. The file part has the same syntax.
  70                  *
  71                  * Let's try to guess if the second part looks like a device specification, or just part of a
  72                  * filename with a colon. fstab_node_to_udev_node() will convert the fstab device syntax to
  73                  * an absolute path. If we didn't get an absolute path, assume that it is just part of the
  74                  * first file argument. */
  75
  76                 device = fstab_node_to_udev_node(c + 1);
  77                 if (!device)
  78                         return log_oom();
  79
  80                 if (path_is_absolute(device))
  81                         file = strndup(locationspec, c-locationspec);
  82                 else {
  83                         log_debug("Location specification argument contains a colon, but \"%s\" doesn't look like a device specification.\n"
  84                                   "Assuming that \"%s\" is a single device specification.",
  85                                   c + 1, locationspec);
  86                         device = mfree(device);
  87                         c = NULL;
  88                 }
  89         }
  90
  91         if (!c)
  92                 /* No device specified */
  93                 file = strdup(locationspec);
  94
  95         if (!file)
  96                 return log_oom();
  97
  98         *ret_file = TAKE_PTR(file);
  99         *ret_device = TAKE_PTR(device);
 100
 101         return 0;
 102 }
 103
 104 static int generate_device_mount(
 105                 const char *name,
 106                 const char *device,
 107                 const char *type_prefix, /* "keydev" or "headerdev" */
 108                 const char *device_timeout,
 109                 bool canfail,
 110                 bool readonly,
 111                 char **unit,
 112                 char **mount) {
 113
 114         _cleanup_free_ char *u = NULL, *where = NULL, *name_escaped = NULL, *device_unit = NULL;
 115         _cleanup_fclose_ FILE *f = NULL;
 116         int r;
 117         usec_t timeout_us;
 118
 119         assert(name);
 120         assert(device);
 121         assert(unit);
 122         assert(mount);
 123
 124         r = mkdir_parents(arg_runtime_directory, 0755);
 125         if (r < 0)
 126                 return r;
 127
 128         r = mkdir(arg_runtime_directory, 0700);
 129         if (r < 0 && errno != EEXIST)
 130                 return -errno;
 131
 132         name_escaped = cescape(name);
 133         if (!name_escaped)
 134                 return -ENOMEM;
 135
 136         where = strjoin(arg_runtime_directory, "/", type_prefix, "-", name_escaped);
 137         if (!where)
 138                 return -ENOMEM;
 139
 140         r = mkdir(where, 0700);
 141         if (r < 0 && errno != EEXIST)
 142                 return -errno;
 143
 144         r = unit_name_from_path(where, ".mount", &u);
 145         if (r < 0)
 146                 return r;
 147
 148         r = generator_open_unit_file(arg_dest, NULL, u, &f);
 149         if (r < 0)
 150                 return r;
 151
 152         fprintf(f,
 153                 "[Unit]\n"
 154                 "DefaultDependencies=no\n\n"
 155                 "[Mount]\n"
 156                 "What=%s\n"
 157                 "Where=%s\n"
 158                 "Options=%s%s\n", device, where, readonly ? "ro" : "rw", canfail ? ",nofail" : "");
 159
 160         if (device_timeout) {
 161                 r = parse_sec_fix_0(device_timeout, &timeout_us);
 162                 if (r >= 0) {
 163                         r = unit_name_from_path(device, ".device", &device_unit);
 164                         if (r < 0)
 165                                 return log_error_errno(r, "Failed to generate unit name: %m");
 166
 167                         r = write_drop_in_format(arg_dest, device_unit, 90, "device-timeout",
 168                                 "# Automatically generated by systemd-cryptsetup-generator \n\n"
 169                                 "[Unit]\nJobRunningTimeoutSec=%s", device_timeout);
 170                         if (r < 0)
 171                                 return log_error_errno(r, "Failed to write device drop-in: %m");
 172
 173                 } else
 174                         log_warning_errno(r, "Failed to parse %s, ignoring: %m", device_timeout);
 175
 176         }
 177
 178         r = fflush_and_check(f);
 179         if (r < 0)
 180                 return r;
 181
 182         *unit = TAKE_PTR(u);
 183         *mount = TAKE_PTR(where);
 184
 185         return 0;
 186 }
 187
 188 static int generate_device_umount(const char *name,
 189                                   const char *device_mount,
 190                                   const char *type_prefix, /* "keydev" or "headerdev" */
 191                                   char **ret_umount_unit) {
 192         _cleanup_fclose_ FILE *f = NULL;
 193         _cleanup_free_ char *u = NULL, *name_escaped = NULL, *mount = NULL;
 194         int r;
 195
 196         assert(name);
 197         assert(ret_umount_unit);
 198
 199         name_escaped = cescape(name);
 200         if (!name_escaped)
 201                 return -ENOMEM;
 202
 203         u = strjoin(type_prefix, "-", name_escaped, "-umount.service");
 204         if (!u)
 205                 return -ENOMEM;
 206
 207         r = unit_name_from_path(device_mount, ".mount", &mount);
 208         if (r < 0)
 209                 return r;
 210
 211         r = generator_open_unit_file(arg_dest, NULL, u, &f);
 212         if (r < 0)
 213                 return r;
 214
 215         fprintf(f,
 216                 "[Unit]\n"
 217                 "DefaultDependencies=no\n"
 218                 "After=%s\n\n"
 219                 "[Service]\n"
 220                 "ExecStart=-" UMOUNT_PATH " %s\n\n", mount, device_mount);
 221
 222         r = fflush_and_check(f);
 223         if (r < 0)
 224                 return r;
 225
 226         *ret_umount_unit = TAKE_PTR(u);
 227         return 0;
 228 }
 229
 230 static int print_dependencies(FILE *f, const char* device_path) {
 231         int r;
 232
 233         if (STR_IN_SET(device_path, "-", "none"))
 234                 /* None, nothing to do */
 235                 return 0;
 236
 237         if (PATH_IN_SET(device_path,
 238                         "/dev/urandom",
 239                         "/dev/random",
 240                         "/dev/hw_random",
 241                         "/dev/hwrng")) {
 242                 /* RNG device, add random dep */
 243                 fputs("After=systemd-random-seed.service\n", f);
 244                 return 0;
 245         }
 246
 247         _cleanup_free_ char *udev_node = fstab_node_to_udev_node(device_path);
 248         if (!udev_node)
 249                 return log_oom();
 250
 251         if (path_equal(udev_node, "/dev/null"))
 252                 return 0;
 253
 254         if (path_startswith(udev_node, "/dev/")) {
 255                 /* We are dealing with a block device, add dependency for corresponding unit */
 256                 _cleanup_free_ char *unit = NULL;
 257
 258                 r = unit_name_from_path(udev_node, ".device", &unit);
 259                 if (r < 0)
 260                         return log_error_errno(r, "Failed to generate unit name: %m");
 261
 262                 fprintf(f,
 263                         "After=%1$s\n"
 264                         "Requires=%1$s\n", unit);
 265         } else {
 266                 /* Regular file, add mount dependency */
 267                 _cleanup_free_ char *escaped_path = specifier_escape(device_path);
 268                 if (!escaped_path)
 269                         return log_oom();
 270
 271                 fprintf(f, "RequiresMountsFor=%s\n", escaped_path);
 272         }
 273
 274         return 0;
 275 }
 276
 277 static int create_disk(
 278                 const char *name,
 279                 const char *device,
 280                 const char *password,
 281                 const char *keydev,
 282                 const char *headerdev,
 283                 const char *options,
 284                 const char *source) {
 285
 286         _cleanup_free_ char *n = NULL, *d = NULL, *u = NULL, *e = NULL,
 287                 *keydev_mount = NULL, *keyfile_timeout_value = NULL,
 288                 *filtered = NULL, *u_escaped = NULL, *name_escaped = NULL, *header_path = NULL, *password_buffer = NULL,
 289                 *tmp_fstype = NULL, *filtered_header = NULL, *headerdev_mount = NULL;
 290         _cleanup_fclose_ FILE *f = NULL;
 291         const char *dmname;
 292         bool noauto, nofail, swap, netdev, attach_in_initrd;
 293         int r, detached_header, keyfile_can_timeout, tmp;
 294
 295         assert(name);
 296         assert(device);
 297
 298         noauto = fstab_test_yes_no_option(options, "noauto\0" "auto\0");
 299         nofail = fstab_test_yes_no_option(options, "nofail\0" "fail\0");
 300         swap = fstab_test_option(options, "swap\0");
 301         netdev = fstab_test_option(options, "_netdev\0");
 302         attach_in_initrd = fstab_test_option(options, "x-initrd.attach\0");
 303
 304         keyfile_can_timeout = fstab_filter_options(options, "keyfile-timeout\0", NULL, &keyfile_timeout_value, NULL);
 305         if (keyfile_can_timeout < 0)
 306                 return log_error_errno(keyfile_can_timeout, "Failed to parse keyfile-timeout= option value: %m");
 307
 308         detached_header = fstab_filter_options(
 309                 options,
 310                 "header\0",
 311                 NULL,
 312                 &header_path,
 313                 headerdev ? &filtered_header : NULL);
 314         if (detached_header < 0)
 315                 return log_error_errno(detached_header, "Failed to parse header= option value: %m");
 316
 317         tmp = fstab_filter_options(options, "tmp\0", NULL, &tmp_fstype, NULL);
 318         if (tmp < 0)
 319                 return log_error_errno(tmp, "Failed to parse tmp= option value: %m");
 320
 321         if (tmp && swap)
 322                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 323                                        "Device '%s' cannot be both 'tmp' and 'swap'. Ignoring.",
 324                                        name);
 325
 326         name_escaped = specifier_escape(name);
 327         if (!name_escaped)
 328                 return log_oom();
 329
 330         e = unit_name_escape(name);
 331         if (!e)
 332                 return log_oom();
 333
 334         u = fstab_node_to_udev_node(device);
 335         if (!u)
 336                 return log_oom();
 337
 338         r = unit_name_build("systemd-cryptsetup", e, ".service", &n);
 339         if (r < 0)
 340                 return log_error_errno(r, "Failed to generate unit name: %m");
 341
 342         u_escaped = specifier_escape(u);
 343         if (!u_escaped)
 344                 return log_oom();
 345
 346         r = unit_name_from_path(u, ".device", &d);
 347         if (r < 0)
 348                 return log_error_errno(r, "Failed to generate unit name: %m");
 349
 350         if (keydev && !password)
 351                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
 352                                        "Key device is specified, but path to the password file is missing.");
 353
 354         r = generator_open_unit_file(arg_dest, NULL, n, &f);
 355         if (r < 0)
 356                 return r;
 357
 358         r = generator_write_cryptsetup_unit_section(f, source);
 359         if (r < 0)
 360                 return r;
 361
 362         if (netdev)
 363                 fprintf(f, "After=remote-fs-pre.target\n");
 364
 365         /* If initrd takes care of attaching the disk then it should also detach it during shutdown. */
 366         if (!attach_in_initrd)
 367                 fprintf(f, "Conflicts=umount.target\n");
 368
 369         if (keydev) {
 370                 _cleanup_free_ char *unit = NULL, *umount_unit = NULL;
 371
 372                 r = generate_device_mount(
 373                         name,
 374                         keydev,
 375                         "keydev",
 376                         keyfile_timeout_value,
 377                         /* canfail = */ keyfile_can_timeout > 0,
 378                         /* readonly= */ true,
 379                         &unit,
 380                         &keydev_mount);
 381                 if (r < 0)
 382                         return log_error_errno(r, "Failed to generate keydev mount unit: %m");
 383
 384                 r = generate_device_umount(name, keydev_mount, "keydev", &umount_unit);
 385                 if (r < 0)
 386                         return log_error_errno(r, "Failed to generate keydev umount unit: %m");
 387
 388                 password_buffer = path_join(keydev_mount, password);
 389                 if (!password_buffer)
 390                         return log_oom();
 391
 392                 password = password_buffer;
 393
 394                 fprintf(f, "After=%s\n", unit);
 395                 if (keyfile_can_timeout > 0)
 396                         fprintf(f, "Wants=%s\n", unit);
 397                 else
 398                         fprintf(f, "Requires=%s\n", unit);
 399
 400                 if (umount_unit) {
 401                         fprintf(f,
 402                                 "Wants=%s\n"
 403                                 "Before=%s\n",
 404                                 umount_unit,
 405                                 umount_unit
 406                         );
 407                 }
 408         }
 409
 410         if (headerdev) {
 411                 _cleanup_free_ char *unit = NULL, *umount_unit = NULL, *p = NULL;
 412
 413                 r = generate_device_mount(
 414                         name,
 415                         headerdev,
 416                         "headerdev",
 417                         NULL,
 418                         /* canfail=  */ false, /* header is always necessary */
 419                         /* readonly= */ false, /* LUKS2 recovery requires rw header access */
 420                         &unit,
 421                         &headerdev_mount);
 422                 if (r < 0)
 423                         return log_error_errno(r, "Failed to generate header device mount unit: %m");
 424
 425                 r = generate_device_umount(name, headerdev_mount, "headerdev", &umount_unit);
 426                 if (r < 0)
 427                         return log_error_errno(r, "Failed to generate header device umount unit: %m");
 428
 429                 p = path_join(headerdev_mount, header_path);
 430                 if (!p)
 431                         return log_oom();
 432
 433                 free_and_replace(header_path, p);
 434
 435                 if (isempty(filtered_header))
 436                         p = strjoin("header=", header_path);
 437                 else
 438                         p = strjoin(filtered_header, ",header=", header_path);
 439
 440                 if (!p)
 441                         return log_oom();
 442
 443                 free_and_replace(filtered_header, p);
 444                 options = filtered_header;
 445
 446                 fprintf(f, "After=%s\n"
 447                            "Requires=%s\n", unit, unit);
 448
 449                 if (umount_unit) {
 450                         fprintf(f,
 451                                 "Wants=%s\n"
 452                                 "Before=%s\n",
 453                                 umount_unit,
 454                                 umount_unit
 455                         );
 456                 }
 457         }
 458
 459         if (!nofail)
 460                 fprintf(f,
 461                         "Before=%s\n",
 462                         netdev ? "remote-cryptsetup.target" : "cryptsetup.target");
 463
 464         if (password && !keydev) {
 465                 r = print_dependencies(f, password);
 466                 if (r < 0)
 467                         return r;
 468         }
 469
 470         /* Check if a header option was specified */
 471         if (detached_header > 0 && !headerdev) {
 472                 r = print_dependencies(f, header_path);
 473                 if (r < 0)
 474                         return r;
 475         }
 476
 477         if (path_startswith(u, "/dev/"))
 478                 fprintf(f,
 479                         "BindsTo=%s\n"
 480                         "After=%s\n"
 481                         "Before=umount.target\n",
 482                         d, d);
 483         else
 484                 /* For loopback devices, add systemd-tmpfiles-setup-dev.service
 485                    dependency to ensure that loopback support is available in
 486                    the kernel (/dev/loop-control needs to exist) */
 487                 fprintf(f,
 488                         "RequiresMountsFor=%s\n"
 489                         "Requires=systemd-tmpfiles-setup-dev.service\n"
 490                         "After=systemd-tmpfiles-setup-dev.service\n",
 491                         u_escaped);
 492
 493         r = generator_write_timeouts(arg_dest, device, name, options, &filtered);
 494         if (r < 0)
 495                 log_warning_errno(r, "Failed to write device timeout drop-in: %m");
 496
 497         r = generator_write_cryptsetup_service_section(f, name, u, password, filtered);
 498         if (r < 0)
 499                 return r;
 500
 501         if (tmp) {
 502                 _cleanup_free_ char *tmp_fstype_escaped = NULL;
 503
 504                 if (tmp_fstype) {
 505                         tmp_fstype_escaped = specifier_escape(tmp_fstype);
 506                         if (!tmp_fstype_escaped)
 507                                 return log_oom();
 508                 }
 509
 510                 fprintf(f,
 511                         "ExecStartPost=" ROOTLIBEXECDIR "/systemd-makefs '%s' '/dev/mapper/%s'\n",
 512                         tmp_fstype_escaped ?: "ext4", name_escaped);
 513         }
 514
 515         if (swap)
 516                 fprintf(f,
 517                         "ExecStartPost=" ROOTLIBEXECDIR "/systemd-makefs swap '/dev/mapper/%s'\n",
 518                         name_escaped);
 519
 520         r = fflush_and_check(f);
 521         if (r < 0)
 522                 return log_error_errno(r, "Failed to write unit file %s: %m", n);
 523
 524         if (!noauto) {
 525                 r = generator_add_symlink(arg_dest,
 526                                           netdev ? "remote-cryptsetup.target" : "cryptsetup.target",
 527                                           nofail ? "wants" : "requires", n);
 528                 if (r < 0)
 529                         return r;
 530         }
 531
 532         dmname = strjoina("dev-mapper-", e, ".device");
 533         r = generator_add_symlink(arg_dest, dmname, "requires", n);
 534         if (r < 0)
 535                 return r;
 536
 537         if (!noauto && !nofail) {
 538                 r = write_drop_in(arg_dest, dmname, 40, "device-timeout",
 539                                   "# Automatically generated by systemd-cryptsetup-generator\n\n"
 540                                   "[Unit]\nJobTimeoutSec=0");
 541                 if (r < 0)
 542                         log_warning_errno(r, "Failed to write device timeout drop-in: %m");
 543         }
 544
 545         return 0;
 546 }
 547
 548 static crypto_device* crypt_device_free(crypto_device *d) {
 549         if (!d)
 550                 return NULL;
 551
 552         free(d->uuid);
 553         free(d->keyfile);
 554         free(d->keydev);
 555         free(d->name);
 556         free(d->options);
 557         return mfree(d);
 558 }
 559
 560 static crypto_device *get_crypto_device(const char *uuid) {
 561         int r;
 562         crypto_device *d;
 563
 564         assert(uuid);
 565
 566         d = hashmap_get(arg_disks, uuid);
 567         if (!d) {
 568                 d = new0(struct crypto_device, 1);
 569                 if (!d)
 570                         return NULL;
 571
 572                 d->uuid = strdup(uuid);
 573                 if (!d->uuid)
 574                         return mfree(d);
 575
 576                 r = hashmap_put(arg_disks, d->uuid, d);
 577                 if (r < 0) {
 578                         free(d->uuid);
 579                         return mfree(d);
 580                 }
 581         }
 582
 583         return d;
 584 }
 585
 586 static bool warn_uuid_invalid(const char *uuid, const char *key) {
 587         assert(key);
 588
 589         if (!id128_is_valid(uuid)) {
 590                 log_warning("Failed to parse %s= kernel command line switch. UUID is invalid, ignoring.", key);
 591                 return true;
 592         }
 593
 594         return false;
 595 }
 596
 597 static int filter_header_device(const char *options,
 598                                 char **ret_headerdev,
 599                                 char **ret_filtered_headerdev_options) {
 600         int r;
 601         _cleanup_free_ char *headerfile = NULL, *headerdev = NULL, *headerspec = NULL,
 602                             *filtered_headerdev = NULL, *filtered_headerspec = NULL;
 603
 604         assert(ret_headerdev);
 605         assert(ret_filtered_headerdev_options);
 606
 607         r = fstab_filter_options(options, "header\0", NULL, &headerspec, &filtered_headerspec);
 608         if (r < 0)
 609                 return log_error_errno(r, "Failed to parse header= option value: %m");
 610
 611         if (r > 0) {
 612                 r = split_locationspec(headerspec, &headerfile, &headerdev);
 613                 if (r < 0)
 614                         return r;
 615
 616                 if (isempty(filtered_headerspec))
 617                         filtered_headerdev = strjoin("header=", headerfile);
 618                 else
 619                         filtered_headerdev = strjoin(filtered_headerspec, ",header=", headerfile);
 620
 621                 if (!filtered_headerdev)
 622                         return log_oom();
 623         } else
 624                 filtered_headerdev = TAKE_PTR(filtered_headerspec);
 625
 626         *ret_filtered_headerdev_options = TAKE_PTR(filtered_headerdev);
 627         *ret_headerdev = TAKE_PTR(headerdev);
 628
 629         return 0;
 630 }
 631
 632 static int parse_proc_cmdline_item(const char *key, const char *value, void *data) {
 633         _cleanup_free_ char *uuid = NULL, *uuid_value = NULL;
 634         crypto_device *d;
 635         int r;
 636
 637         if (streq(key, "luks")) {
 638
 639                 r = value ? parse_boolean(value) : 1;
 640                 if (r < 0)
 641                         log_warning("Failed to parse luks= kernel command line switch %s. Ignoring.", value);
 642                 else
 643                         arg_enabled = r;
 644
 645         } else if (streq(key, "luks.crypttab")) {
 646
 647                 r = value ? parse_boolean(value) : 1;
 648                 if (r < 0)
 649                         log_warning("Failed to parse luks.crypttab= kernel command line switch %s. Ignoring.", value);
 650                 else
 651                         arg_read_crypttab = r;
 652
 653         } else if (streq(key, "luks.uuid")) {
 654
 655                 if (proc_cmdline_value_missing(key, value))
 656                         return 0;
 657
 658                 d = get_crypto_device(startswith(value, "luks-") ?: value);
 659                 if (!d)
 660                         return log_oom();
 661
 662                 d->create = arg_allow_list = true;
 663
 664         } else if (streq(key, "luks.options")) {
 665                 _cleanup_free_ char *headerdev = NULL, *filtered_headerdev_options = NULL;
 666
 667                 if (proc_cmdline_value_missing(key, value))
 668                         return 0;
 669
 670                 r = sscanf(value, "%m[0-9a-fA-F-]=%ms", &uuid, &uuid_value);
 671                 if (r != 2)
 672                         return free_and_strdup(&arg_default_options, value) < 0 ? log_oom() : 0;
 673
 674                 if (warn_uuid_invalid(uuid, key))
 675                         return 0;
 676
 677                 d = get_crypto_device(uuid);
 678                 if (!d)
 679                         return log_oom();
 680
 681                 r = filter_header_device(uuid_value, &headerdev, &filtered_headerdev_options);
 682                 if (r < 0)
 683                         return r;
 684
 685                 free_and_replace(d->options, filtered_headerdev_options);
 686                 free_and_replace(d->headerdev, headerdev);
 687         } else if (streq(key, "luks.key")) {
 688                 size_t n;
 689                 _cleanup_free_ char *keyfile = NULL, *keydev = NULL;
 690                 const char *keyspec;
 691
 692                 if (proc_cmdline_value_missing(key, value))
 693                         return 0;
 694
 695                 n = strspn(value, ALPHANUMERICAL "-");
 696                 if (value[n] != '=') {
 697                         if (free_and_strdup(&arg_default_keyfile, value) < 0)
 698                                  return log_oom();
 699                         return 0;
 700                 }
 701
 702                 uuid = strndup(value, n);
 703                 if (!uuid)
 704                         return log_oom();
 705
 706                 if (warn_uuid_invalid(uuid, key))
 707                         return 0;
 708
 709                 d = get_crypto_device(uuid);
 710                 if (!d)
 711                         return log_oom();
 712
 713                 keyspec = value + n + 1;
 714                 r = split_locationspec(keyspec, &keyfile, &keydev);
 715                 if (r < 0)
 716                         return r;
 717
 718                 free_and_replace(d->keyfile, keyfile);
 719                 free_and_replace(d->keydev, keydev);
 720         } else if (streq(key, "luks.data")) {
 721                 size_t n;
 722                 _cleanup_free_ char *datadev = NULL;
 723
 724                 if (proc_cmdline_value_missing(key, value))
 725                         return 0;
 726
 727                 n = strspn(value, ALPHANUMERICAL "-");
 728                 if (value[n] != '=') {
 729                         log_warning("Failed to parse luks.data= kernel command line switch. UUID is invalid, ignoring.");
 730                         return 0;
 731                 }
 732
 733                 uuid = strndup(value, n);
 734                 if (!uuid)
 735                         return log_oom();
 736
 737                 if (warn_uuid_invalid(uuid, key))
 738                         return 0;
 739
 740                 d = get_crypto_device(uuid);
 741                 if (!d)
 742                         return log_oom();
 743
 744                 datadev = fstab_node_to_udev_node(value + n + 1);
 745                 if (!datadev)
 746                         return log_oom();
 747
 748                 free_and_replace(d->datadev, datadev);
 749         } else if (streq(key, "luks.name")) {
 750
 751                 if (proc_cmdline_value_missing(key, value))
 752                         return 0;
 753
 754                 r = sscanf(value, "%m[0-9a-fA-F-]=%ms", &uuid, &uuid_value);
 755                 if (r == 2) {
 756                         d = get_crypto_device(uuid);
 757                         if (!d)
 758                                 return log_oom();
 759
 760                         d->create = arg_allow_list = true;
 761
 762                         free_and_replace(d->name, uuid_value);
 763                 } else
 764                         log_warning("Failed to parse luks name switch %s. Ignoring.", value);
 765         }
 766
 767         return 0;
 768 }
 769
 770 static int add_crypttab_devices(void) {
 771         _cleanup_fclose_ FILE *f = NULL;
 772         unsigned crypttab_line = 0;
 773         struct stat st;
 774         int r;
 775
 776         if (!arg_read_crypttab)
 777                 return 0;
 778
 779         r = fopen_unlocked(arg_crypttab, "re", &f);
 780         if (r < 0) {
 781                 if (errno != ENOENT)
 782                         log_error_errno(errno, "Failed to open %s: %m", arg_crypttab);
 783                 return 0;
 784         }
 785
 786         if (fstat(fileno(f), &st) < 0) {
 787                 log_error_errno(errno, "Failed to stat %s: %m", arg_crypttab);
 788                 return 0;
 789         }
 790
 791         for (;;) {
 792                 _cleanup_free_ char *line = NULL, *name = NULL, *device = NULL, *keyspec = NULL, *options = NULL, *keyfile = NULL, *keydev = NULL;
 793                 crypto_device *d = NULL;
 794                 char *l, *uuid;
 795                 int k;
 796
 797                 r = read_line(f, LONG_LINE_MAX, &line);
 798                 if (r < 0)
 799                         return log_error_errno(r, "Failed to read %s: %m", arg_crypttab);
 800                 if (r == 0)
 801                         break;
 802
 803                 crypttab_line++;
 804
 805                 l = strstrip(line);
 806                 if (IN_SET(l[0], 0, '#'))
 807                         continue;
 808
 809                 k = sscanf(l, "%ms %ms %ms %ms", &name, &device, &keyspec, &options);
 810                 if (k < 2 || k > 4) {
 811                         log_error("Failed to parse %s:%u, ignoring.", arg_crypttab, crypttab_line);
 812                         continue;
 813                 }
 814
 815                 uuid = startswith(device, "UUID=");
 816                 if (!uuid)
 817                         uuid = path_startswith(device, "/dev/disk/by-uuid/");
 818                 if (!uuid)
 819                         uuid = startswith(name, "luks-");
 820                 if (uuid)
 821                         d = hashmap_get(arg_disks, uuid);
 822
 823                 if (arg_allow_list && !d) {
 824                         log_info("Not creating device '%s' because it was not specified on the kernel command line.", name);
 825                         continue;
 826                 }
 827
 828                 r = split_locationspec(keyspec, &keyfile, &keydev);
 829                 if (r < 0)
 830                         return r;
 831
 832                 r = create_disk(name, device, keyfile, keydev, d ? d->headerdev : NULL, (d && d->options) ? d->options : options, arg_crypttab);
 833                 if (r < 0)
 834                         return r;
 835
 836                 if (d)
 837                         d->create = false;
 838         }
 839
 840         return 0;
 841 }
 842
 843 static int add_proc_cmdline_devices(void) {
 844         int r;
 845         crypto_device *d;
 846
 847         HASHMAP_FOREACH(d, arg_disks) {
 848                 _cleanup_free_ char *device = NULL;
 849
 850                 if (!d->create)
 851                         continue;
 852
 853                 if (!d->name) {
 854                         d->name = strjoin("luks-", d->uuid);
 855                         if (!d->name)
 856                                 return log_oom();
 857                 }
 858
 859                 device = strjoin("UUID=", d->uuid);
 860                 if (!device)
 861                         return log_oom();
 862
 863                 r = create_disk(d->name,
 864                                 d->datadev ?: device,
 865                                 d->keyfile ?: arg_default_keyfile,
 866                                 d->keydev,
 867                                 d->headerdev,
 868                                 d->options ?: arg_default_options,
 869                                 "/proc/cmdline");
 870                 if (r < 0)
 871                         return r;
 872         }
 873
 874         return 0;
 875 }
 876
 877 DEFINE_PRIVATE_HASH_OPS_WITH_VALUE_DESTRUCTOR(crypt_device_hash_ops, char, string_hash_func, string_compare_func,
 878                                               crypto_device, crypt_device_free);
 879
 880 static int run(const char *dest, const char *dest_early, const char *dest_late) {
 881         int r;
 882
 883         assert_se(arg_dest = dest);
 884
 885         arg_crypttab = getenv("SYSTEMD_CRYPTTAB") ?: "/etc/crypttab";
 886         arg_runtime_directory = getenv("RUNTIME_DIRECTORY") ?: "/run/systemd/cryptsetup";
 887
 888         arg_disks = hashmap_new(&crypt_device_hash_ops);
 889         if (!arg_disks)
 890                 return log_oom();
 891
 892         r = proc_cmdline_parse(parse_proc_cmdline_item, NULL, PROC_CMDLINE_STRIP_RD_PREFIX);
 893         if (r < 0)
 894                 return log_warning_errno(r, "Failed to parse kernel command line: %m");
 895
 896         if (!arg_enabled)
 897                 return 0;
 898
 899         r = add_crypttab_devices();
 900         if (r < 0)
 901                 return r;
 902
 903         r = add_proc_cmdline_devices();
 904         if (r < 0)
 905                 return r;
 906
 907         return 0;
 908 }
 909
 910 DEFINE_MAIN_GENERATOR_FUNCTION(run);