src/home/homework-luks.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <linux/loop.h>
   4 #include <poll.h>
   5 #include <sys/file.h>
   6 #include <sys/ioctl.h>
   7 #include <sys/xattr.h>
   8
   9 #if HAVE_VALGRIND_MEMCHECK_H
  10 #include <valgrind/memcheck.h>
  11 #endif
  12
  13 #include "sd-daemon.h"
  14 #include "sd-device.h"
  15 #include "sd-event.h"
  16 #include "sd-id128.h"
  17
  18 #include "blkid-util.h"
  19 #include "blockdev-util.h"
  20 #include "btrfs-util.h"
  21 #include "chattr-util.h"
  22 #include "device-util.h"
  23 #include "devnum-util.h"
  24 #include "dm-util.h"
  25 #include "env-util.h"
  26 #include "errno-util.h"
  27 #include "fd-util.h"
  28 #include "fdisk-util.h"
  29 #include "fileio.h"
  30 #include "filesystems.h"
  31 #include "fs-util.h"
  32 #include "fsck-util.h"
  33 #include "glyph-util.h"
  34 #include "gpt.h"
  35 #include "home-util.h"
  36 #include "homework-luks.h"
  37 #include "homework-mount.h"
  38 #include "io-util.h"
  39 #include "keyring-util.h"
  40 #include "memory-util.h"
  41 #include "missing_magic.h"
  42 #include "mkdir.h"
  43 #include "mkfs-util.h"
  44 #include "mount-util.h"
  45 #include "openssl-util.h"
  46 #include "parse-util.h"
  47 #include "path-util.h"
  48 #include "process-util.h"
  49 #include "random-util.h"
  50 #include "resize-fs.h"
  51 #include "strv.h"
  52 #include "sync-util.h"
  53 #include "tmpfile-util.h"
  54 #include "udev-util.h"
  55 #include "user-util.h"
  56
  57 /* Round down to the nearest 4K size. Given that newer hardware generally prefers 4K sectors, let's align our
  58  * partitions to that too. In the worst case we'll waste 3.5K per partition that way, but I think I can live
  59  * with that. */
  60 #define DISK_SIZE_ROUND_DOWN(x) ((x) & ~UINT64_C(4095))
  61
  62 /* Rounds up to the nearest 4K boundary. Returns UINT64_MAX on overflow */
  63 #define DISK_SIZE_ROUND_UP(x)                                           \
  64         ({                                                              \
  65                 uint64_t _x = (x);                                      \
  66                 _x > UINT64_MAX - 4095U ? UINT64_MAX : (_x + 4095U) & ~UINT64_C(4095); \
  67         })
  68
  69 /* How much larger will the image on disk be than the fs inside it, i.e. the space we pay for the GPT and
  70  * LUKS2 envelope. (As measured on cryptsetup 2.4.1) */
  71 #define GPT_LUKS2_OVERHEAD UINT64_C(18874368)
  72
  73 static int resize_image_loop(UserRecord *h, HomeSetup *setup, uint64_t old_image_size, uint64_t new_image_size, uint64_t *ret_image_size);
  74
  75 int run_mark_dirty(int fd, bool b) {
  76         char x = '1';
  77         int r, ret;
  78
  79         /* Sets or removes the 'user.home-dirty' xattr on the specified file. We use this to detect when a
  80          * home directory was not properly unmounted. */
  81
  82         assert(fd >= 0);
  83
  84         r = fd_verify_regular(fd);
  85         if (r < 0)
  86                 return r;
  87
  88         if (b) {
  89                 ret = fsetxattr(fd, "user.home-dirty", &x, 1, XATTR_CREATE);
  90                 if (ret < 0 && errno != EEXIST)
  91                         return log_debug_errno(errno, "Could not mark home directory as dirty: %m");
  92
  93         } else {
  94                 r = fsync_full(fd);
  95                 if (r < 0)
  96                         return log_debug_errno(r, "Failed to synchronize image before marking it clean: %m");
  97
  98                 ret = fremovexattr(fd, "user.home-dirty");
  99                 if (ret < 0 && !ERRNO_IS_XATTR_ABSENT(errno))
 100                         return log_debug_errno(errno, "Could not mark home directory as clean: %m");
 101         }
 102
 103         r = fsync_full(fd);
 104         if (r < 0)
 105                 return log_debug_errno(r, "Failed to synchronize dirty flag to disk: %m");
 106
 107         return ret >= 0;
 108 }
 109
 110 int run_mark_dirty_by_path(const char *path, bool b) {
 111         _cleanup_close_ int fd = -EBADF;
 112
 113         assert(path);
 114
 115         fd = open(path, O_RDWR|O_CLOEXEC|O_NOCTTY);
 116         if (fd < 0)
 117                 return log_debug_errno(errno, "Failed to open %s to mark dirty or clean: %m", path);
 118
 119         return run_mark_dirty(fd, b);
 120 }
 121
 122 static int probe_file_system_by_fd(
 123                 int fd,
 124                 char **ret_fstype,
 125                 sd_id128_t *ret_uuid) {
 126
 127         _cleanup_(blkid_free_probep) blkid_probe b = NULL;
 128         _cleanup_free_ char *s = NULL;
 129         const char *fstype = NULL, *uuid = NULL;
 130         sd_id128_t id;
 131         int r;
 132
 133         assert(fd >= 0);
 134         assert(ret_fstype);
 135         assert(ret_uuid);
 136
 137         b = blkid_new_probe();
 138         if (!b)
 139                 return -ENOMEM;
 140
 141         errno = 0;
 142         r = blkid_probe_set_device(b, fd, 0, 0);
 143         if (r != 0)
 144                 return errno_or_else(ENOMEM);
 145
 146         (void) blkid_probe_enable_superblocks(b, 1);
 147         (void) blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE|BLKID_SUBLKS_UUID);
 148
 149         errno = 0;
 150         r = blkid_do_safeprobe(b);
 151         if (r == _BLKID_SAFEPROBE_ERROR)
 152                 return errno_or_else(EIO);
 153         if (IN_SET(r, _BLKID_SAFEPROBE_AMBIGUOUS, _BLKID_SAFEPROBE_NOT_FOUND))
 154                 return -ENOPKG;
 155
 156         assert(r == _BLKID_SAFEPROBE_FOUND);
 157
 158         (void) blkid_probe_lookup_value(b, "TYPE", &fstype, NULL);
 159         if (!fstype)
 160                 return -ENOPKG;
 161
 162         (void) blkid_probe_lookup_value(b, "UUID", &uuid, NULL);
 163         if (!uuid)
 164                 return -ENOPKG;
 165
 166         r = sd_id128_from_string(uuid, &id);
 167         if (r < 0)
 168                 return r;
 169
 170         s = strdup(fstype);
 171         if (!s)
 172                 return -ENOMEM;
 173
 174         *ret_fstype = TAKE_PTR(s);
 175         *ret_uuid = id;
 176
 177         return 0;
 178 }
 179
 180 static int probe_file_system_by_path(const char *path, char **ret_fstype, sd_id128_t *ret_uuid) {
 181         _cleanup_close_ int fd = -EBADF;
 182
 183         fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
 184         if (fd < 0)
 185                 return negative_errno();
 186
 187         return probe_file_system_by_fd(fd, ret_fstype, ret_uuid);
 188 }
 189
 190 static int block_get_size_by_fd(int fd, uint64_t *ret) {
 191         struct stat st;
 192
 193         assert(fd >= 0);
 194         assert(ret);
 195
 196         if (fstat(fd, &st) < 0)
 197                 return -errno;
 198
 199         if (!S_ISBLK(st.st_mode))
 200                 return -ENOTBLK;
 201
 202         return RET_NERRNO(ioctl(fd, BLKGETSIZE64, ret));
 203 }
 204
 205 static int block_get_size_by_path(const char *path, uint64_t *ret) {
 206         _cleanup_close_ int fd = -EBADF;
 207
 208         fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
 209         if (fd < 0)
 210                 return -errno;
 211
 212         return block_get_size_by_fd(fd, ret);
 213 }
 214
 215 static int run_fsck(const char *node, const char *fstype) {
 216         int r, exit_status;
 217         pid_t fsck_pid;
 218
 219         assert(node);
 220         assert(fstype);
 221
 222         r = fsck_exists_for_fstype(fstype);
 223         if (r < 0)
 224                 return log_error_errno(r, "Failed to check if fsck for file system %s exists: %m", fstype);
 225         if (r == 0) {
 226                 log_warning("No fsck for file system %s installed, ignoring.", fstype);
 227                 return 0;
 228         }
 229
 230         r = safe_fork("(fsck)",
 231                       FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_STDOUT_TO_STDERR|FORK_CLOSE_ALL_FDS,
 232                       &fsck_pid);
 233         if (r < 0)
 234                 return r;
 235         if (r == 0) {
 236                 /* Child */
 237                 execlp("fsck", "fsck", "-aTl", node, NULL);
 238                 log_open();
 239                 log_error_errno(errno, "Failed to execute fsck: %m");
 240                 _exit(FSCK_OPERATIONAL_ERROR);
 241         }
 242
 243         exit_status = wait_for_terminate_and_check("fsck", fsck_pid, WAIT_LOG_ABNORMAL);
 244         if (exit_status < 0)
 245                 return exit_status;
 246         if ((exit_status & ~FSCK_ERROR_CORRECTED) != 0) {
 247                 log_warning("fsck failed with exit status %i.", exit_status);
 248
 249                 if ((exit_status & (FSCK_SYSTEM_SHOULD_REBOOT|FSCK_ERRORS_LEFT_UNCORRECTED)) != 0)
 250                         return log_error_errno(SYNTHETIC_ERRNO(EIO), "File system is corrupted, refusing.");
 251
 252                 log_warning("Ignoring fsck error.");
 253         }
 254
 255         log_info("File system check completed.");
 256
 257         return 1;
 258 }
 259
 260 DEFINE_TRIVIAL_CLEANUP_FUNC_FULL(key_serial_t, keyring_unlink, -1);
 261
 262 static int upload_to_keyring(
 263                 UserRecord *h,
 264                 const char *password,
 265                 key_serial_t *ret_key_serial) {
 266
 267         _cleanup_free_ char *name = NULL;
 268         key_serial_t serial;
 269
 270         assert(h);
 271         assert(password);
 272
 273         /* If auto-shrink-on-logout is turned on, we need to keep the key we used to unlock the LUKS volume
 274          * around, since we'll need it when automatically resizing (since we can't ask the user there
 275          * again). We do this by uploading it into the kernel keyring, specifically the "session" one. This
 276          * is done under the assumption systemd-homed gets its private per-session keyring (i.e. default
 277          * service behaviour, given that KeyringMode=private is the default). It will survive between our
 278          * systemd-homework invocations that way.
 279          *
 280          * If auto-shrink-on-logout is disabled we'll skip this step, to be frugal with sensitive data. */
 281
 282         if (user_record_auto_resize_mode(h) != AUTO_RESIZE_SHRINK_AND_GROW) {  /* Won't need it */
 283                 if (ret_key_serial)
 284                         *ret_key_serial = -1;
 285                 return 0;
 286         }
 287
 288         name = strjoin("homework-user-", h->user_name);
 289         if (!name)
 290                 return -ENOMEM;
 291
 292         serial = add_key("user", name, password, strlen(password), KEY_SPEC_SESSION_KEYRING);
 293         if (serial == -1)
 294                 return -errno;
 295
 296         if (ret_key_serial)
 297                 *ret_key_serial = serial;
 298
 299         return 1;
 300 }
 301
 302 static int luks_try_passwords(
 303                 UserRecord *h,
 304                 struct crypt_device *cd,
 305                 char **passwords,
 306                 void *volume_key,
 307                 size_t *volume_key_size,
 308                 key_serial_t *ret_key_serial) {
 309
 310         int r;
 311
 312         assert(h);
 313         assert(cd);
 314
 315         STRV_FOREACH(pp, passwords) {
 316                 size_t vks = *volume_key_size;
 317
 318                 r = sym_crypt_volume_key_get(
 319                                 cd,
 320                                 CRYPT_ANY_SLOT,
 321                                 volume_key,
 322                                 &vks,
 323                                 *pp,
 324                                 strlen(*pp));
 325                 if (r >= 0) {
 326                         if (ret_key_serial) {
 327                                 /* If ret_key_serial is non-NULL, let's try to upload the password that
 328                                  * worked, and return its serial. */
 329                                 r = upload_to_keyring(h, *pp, ret_key_serial);
 330                                 if (r < 0) {
 331                                         log_debug_errno(r, "Failed to upload LUKS password to kernel keyring, ignoring: %m");
 332                                         *ret_key_serial = -1;
 333                                 }
 334                         }
 335
 336                         *volume_key_size = vks;
 337                         return 0;
 338                 }
 339
 340                 log_debug_errno(r, "Password %zu didn't work for unlocking LUKS superblock: %m", (size_t) (pp - passwords));
 341         }
 342
 343         return -ENOKEY;
 344 }
 345
 346 static int luks_setup(
 347                 UserRecord *h,
 348                 const char *node,
 349                 const char *dm_name,
 350                 sd_id128_t uuid,
 351                 const char *cipher,
 352                 const char *cipher_mode,
 353                 uint64_t volume_key_size,
 354                 char **passwords,
 355                 const PasswordCache *cache,
 356                 bool discard,
 357                 struct crypt_device **ret,
 358                 sd_id128_t *ret_found_uuid,
 359                 void **ret_volume_key,
 360                 size_t *ret_volume_key_size,
 361                 key_serial_t *ret_key_serial) {
 362
 363         _cleanup_(keyring_unlinkp) key_serial_t key_serial = -1;
 364         _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
 365         _cleanup_(erase_and_freep) void *vk = NULL;
 366         sd_id128_t p;
 367         size_t vks;
 368         char **list;
 369         int r;
 370
 371         assert(h);
 372         assert(node);
 373         assert(dm_name);
 374         assert(ret);
 375
 376         r = sym_crypt_init(&cd, node);
 377         if (r < 0)
 378                 return log_error_errno(r, "Failed to allocate libcryptsetup context: %m");
 379
 380         cryptsetup_enable_logging(cd);
 381
 382         r = sym_crypt_load(cd, CRYPT_LUKS2, NULL);
 383         if (r < 0)
 384                 return log_error_errno(r, "Failed to load LUKS superblock: %m");
 385
 386         r = sym_crypt_get_volume_key_size(cd);
 387         if (r <= 0)
 388                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine LUKS volume key size");
 389         vks = (size_t) r;
 390
 391         if (!sd_id128_is_null(uuid) || ret_found_uuid) {
 392                 const char *s;
 393
 394                 s = sym_crypt_get_uuid(cd);
 395                 if (!s)
 396                         return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has no UUID.");
 397
 398                 r = sd_id128_from_string(s, &p);
 399                 if (r < 0)
 400                         return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has invalid UUID.");
 401
 402                 /* Check that the UUID matches, if specified */
 403                 if (!sd_id128_is_null(uuid) &&
 404                     !sd_id128_equal(uuid, p))
 405                         return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has wrong UUID.");
 406         }
 407
 408         if (cipher && !streq_ptr(cipher, sym_crypt_get_cipher(cd)))
 409                 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong cipher.");
 410
 411         if (cipher_mode && !streq_ptr(cipher_mode, sym_crypt_get_cipher_mode(cd)))
 412                 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong cipher mode.");
 413
 414         if (volume_key_size != UINT64_MAX && vks != volume_key_size)
 415                 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong volume key size.");
 416
 417         vk = malloc(vks);
 418         if (!vk)
 419                 return log_oom();
 420
 421         r = -ENOKEY;
 422         FOREACH_POINTER(list,
 423                         cache ? cache->keyring_passswords : NULL,
 424                         cache ? cache->pkcs11_passwords : NULL,
 425                         cache ? cache->fido2_passwords : NULL,
 426                         passwords) {
 427                 r = luks_try_passwords(h, cd, list, vk, &vks, ret_key_serial ? &key_serial : NULL);
 428                 if (r != -ENOKEY)
 429                         break;
 430         }
 431         if (r == -ENOKEY)
 432                 return log_error_errno(r, "No valid password for LUKS superblock.");
 433         if (r < 0)
 434                 return log_error_errno(r, "Failed to unlock LUKS superblock: %m");
 435
 436         r = sym_crypt_activate_by_volume_key(
 437                         cd,
 438                         dm_name,
 439                         vk, vks,
 440                         discard ? CRYPT_ACTIVATE_ALLOW_DISCARDS : 0);
 441         if (r < 0)
 442                 return log_error_errno(r, "Failed to unlock LUKS superblock: %m");
 443
 444         log_info("Setting up LUKS device /dev/mapper/%s completed.", dm_name);
 445
 446         *ret = TAKE_PTR(cd);
 447
 448         if (ret_found_uuid) /* Return the UUID actually found if the caller wants to know */
 449                 *ret_found_uuid = p;
 450         if (ret_volume_key)
 451                 *ret_volume_key = TAKE_PTR(vk);
 452         if (ret_volume_key_size)
 453                 *ret_volume_key_size = vks;
 454         if (ret_key_serial)
 455                 *ret_key_serial = TAKE_KEY_SERIAL(key_serial);
 456
 457         return 0;
 458 }
 459
 460 static int make_dm_names(UserRecord *h, HomeSetup *setup) {
 461         assert(h);
 462         assert(h->user_name);
 463         assert(setup);
 464
 465         if (!setup->dm_name) {
 466                 setup->dm_name = strjoin("home-", h->user_name);
 467                 if (!setup->dm_name)
 468                         return log_oom();
 469         }
 470
 471         if (!setup->dm_node) {
 472                 setup->dm_node = path_join("/dev/mapper/", setup->dm_name);
 473                 if (!setup->dm_node)
 474                         return log_oom();
 475         }
 476
 477         return 0;
 478 }
 479
 480 static int acquire_open_luks_device(
 481                 UserRecord *h,
 482                 HomeSetup *setup,
 483                 bool graceful) {
 484
 485         _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
 486         int r;
 487
 488         assert(h);
 489         assert(setup);
 490         assert(!setup->crypt_device);
 491
 492         r = dlopen_cryptsetup();
 493         if (r < 0)
 494                 return r;
 495
 496         r = make_dm_names(h, setup);
 497         if (r < 0)
 498                 return r;
 499
 500         r = sym_crypt_init_by_name(&cd, setup->dm_name);
 501         if ((ERRNO_IS_DEVICE_ABSENT(r) || r == -EINVAL) && graceful)
 502                 return 0;
 503         if (r < 0)
 504                 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", setup->dm_name);
 505
 506         cryptsetup_enable_logging(cd);
 507
 508         setup->crypt_device = TAKE_PTR(cd);
 509         return 1;
 510 }
 511
 512 static int luks_open(
 513                 UserRecord *h,
 514                 HomeSetup *setup,
 515                 const PasswordCache *cache,
 516                 sd_id128_t *ret_found_uuid,
 517                 void **ret_volume_key,
 518                 size_t *ret_volume_key_size) {
 519
 520         _cleanup_(erase_and_freep) void *vk = NULL;
 521         sd_id128_t p;
 522         char **list;
 523         size_t vks;
 524         int r;
 525
 526         assert(h);
 527         assert(setup);
 528         assert(!setup->crypt_device);
 529
 530         /* Opens a LUKS device that is already set up. Re-validates the password while doing so (which also
 531          * provides us with the volume key, which we want). */
 532
 533         r = acquire_open_luks_device(h, setup, /* graceful= */ false);
 534         if (r < 0)
 535                 return r;
 536
 537         r = sym_crypt_load(setup->crypt_device, CRYPT_LUKS2, NULL);
 538         if (r < 0)
 539                 return log_error_errno(r, "Failed to load LUKS superblock: %m");
 540
 541         r = sym_crypt_get_volume_key_size(setup->crypt_device);
 542         if (r <= 0)
 543                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine LUKS volume key size");
 544         vks = (size_t) r;
 545
 546         if (ret_found_uuid) {
 547                 const char *s;
 548
 549                 s = sym_crypt_get_uuid(setup->crypt_device);
 550                 if (!s)
 551                         return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has no UUID.");
 552
 553                 r = sd_id128_from_string(s, &p);
 554                 if (r < 0)
 555                         return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has invalid UUID.");
 556         }
 557
 558         vk = malloc(vks);
 559         if (!vk)
 560                 return log_oom();
 561
 562         r = -ENOKEY;
 563         FOREACH_POINTER(list,
 564                         cache ? cache->keyring_passswords : NULL,
 565                         cache ? cache->pkcs11_passwords : NULL,
 566                         cache ? cache->fido2_passwords : NULL,
 567                         h->password) {
 568                 r = luks_try_passwords(h, setup->crypt_device, list, vk, &vks, NULL);
 569                 if (r != -ENOKEY)
 570                         break;
 571         }
 572         if (r == -ENOKEY)
 573                 return log_error_errno(r, "No valid password for LUKS superblock.");
 574         if (r < 0)
 575                 return log_error_errno(r, "Failed to unlocks LUKS superblock: %m");
 576
 577         log_info("Discovered used LUKS device /dev/mapper/%s, and validated password.", setup->dm_name);
 578
 579         /* This is needed so that crypt_resize() can operate correctly for pre-existing LUKS devices. We need
 580          * to tell libcryptsetup the volume key explicitly, so that it is in the kernel keyring. */
 581         r = sym_crypt_activate_by_volume_key(setup->crypt_device, NULL, vk, vks, CRYPT_ACTIVATE_KEYRING_KEY);
 582         if (r < 0)
 583                 return log_error_errno(r, "Failed to upload volume key again: %m");
 584
 585         log_info("Successfully re-activated LUKS device.");
 586
 587         if (ret_found_uuid)
 588                 *ret_found_uuid = p;
 589         if (ret_volume_key)
 590                 *ret_volume_key = TAKE_PTR(vk);
 591         if (ret_volume_key_size)
 592                 *ret_volume_key_size = vks;
 593
 594         return 0;
 595 }
 596
 597 static int fs_validate(
 598                 const char *dm_node,
 599                 sd_id128_t uuid,
 600                 char **ret_fstype,
 601                 sd_id128_t *ret_found_uuid) {
 602
 603         _cleanup_free_ char *fstype = NULL;
 604         sd_id128_t u;
 605         int r;
 606
 607         assert(dm_node);
 608         assert(ret_fstype);
 609
 610         r = probe_file_system_by_path(dm_node, &fstype, &u);
 611         if (r < 0)
 612                 return log_error_errno(r, "Failed to probe file system: %m");
 613
 614         /* Limit the set of supported file systems a bit, as protection against little tested kernel file
 615          * systems. Also, we only support the resize ioctls for these file systems. */
 616         if (!supported_fstype(fstype))
 617                 return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "Image contains unsupported file system: %s", strna(fstype));
 618
 619         if (!sd_id128_is_null(uuid) &&
 620             !sd_id128_equal(uuid, u))
 621                 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "File system has wrong UUID.");
 622
 623         log_info("Probing file system completed (found %s).", fstype);
 624
 625         *ret_fstype = TAKE_PTR(fstype);
 626
 627         if (ret_found_uuid) /* Return the UUID actually found if the caller wants to know */
 628                 *ret_found_uuid = u;
 629
 630         return 0;
 631 }
 632
 633 static int luks_validate(
 634                 int fd,
 635                 const char *label,
 636                 sd_id128_t partition_uuid,
 637                 sd_id128_t *ret_partition_uuid,
 638                 uint64_t *ret_offset,
 639                 uint64_t *ret_size) {
 640
 641         _cleanup_(blkid_free_probep) blkid_probe b = NULL;
 642         sd_id128_t found_partition_uuid = SD_ID128_NULL;
 643         const char *fstype = NULL, *pttype = NULL;
 644         blkid_loff_t offset = 0, size = 0;
 645         blkid_partlist pl;
 646         bool found = false;
 647         int r, n;
 648
 649         assert(fd >= 0);
 650         assert(label);
 651         assert(ret_offset);
 652         assert(ret_size);
 653
 654         b = blkid_new_probe();
 655         if (!b)
 656                 return -ENOMEM;
 657
 658         errno = 0;
 659         r = blkid_probe_set_device(b, fd, 0, 0);
 660         if (r != 0)
 661                 return errno_or_else(ENOMEM);
 662
 663         (void) blkid_probe_enable_superblocks(b, 1);
 664         (void) blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE);
 665         (void) blkid_probe_enable_partitions(b, 1);
 666         (void) blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
 667
 668         errno = 0;
 669         r = blkid_do_safeprobe(b);
 670         if (r == _BLKID_SAFEPROBE_ERROR)
 671                 return errno_or_else(EIO);
 672         if (IN_SET(r, _BLKID_SAFEPROBE_AMBIGUOUS, _BLKID_SAFEPROBE_NOT_FOUND))
 673                 return -ENOPKG;
 674
 675         assert(r == _BLKID_SAFEPROBE_FOUND);
 676
 677         (void) blkid_probe_lookup_value(b, "TYPE", &fstype, NULL);
 678         if (streq_ptr(fstype, "crypto_LUKS")) {
 679                 /* Directly a LUKS image */
 680                 *ret_offset = 0;
 681                 *ret_size = UINT64_MAX; /* full disk */
 682                 *ret_partition_uuid = SD_ID128_NULL;
 683                 return 0;
 684         } else if (fstype)
 685                 return -ENOPKG;
 686
 687         (void) blkid_probe_lookup_value(b, "PTTYPE", &pttype, NULL);
 688         if (!streq_ptr(pttype, "gpt"))
 689                 return -ENOPKG;
 690
 691         errno = 0;
 692         pl = blkid_probe_get_partitions(b);
 693         if (!pl)
 694                 return errno_or_else(ENOMEM);
 695
 696         errno = 0;
 697         n = blkid_partlist_numof_partitions(pl);
 698         if (n < 0)
 699                 return errno_or_else(EIO);
 700
 701         for (int i = 0; i < n; i++) {
 702                 sd_id128_t id = SD_ID128_NULL;
 703                 blkid_partition pp;
 704
 705                 errno = 0;
 706                 pp = blkid_partlist_get_partition(pl, i);
 707                 if (!pp)
 708                         return errno_or_else(EIO);
 709
 710                 if (sd_id128_string_equal(blkid_partition_get_type_string(pp), SD_GPT_USER_HOME) <= 0)
 711                         continue;
 712
 713                 if (!streq_ptr(blkid_partition_get_name(pp), label))
 714                         continue;
 715
 716
 717                 r = blkid_partition_get_uuid_id128(pp, &id);
 718                 if (r < 0)
 719                         log_debug_errno(r, "Failed to read partition UUID, ignoring: %m");
 720                 else if (!sd_id128_is_null(partition_uuid) && !sd_id128_equal(id, partition_uuid))
 721                         continue;
 722
 723                 if (found)
 724                         return -ENOPKG;
 725
 726                 offset = blkid_partition_get_start(pp);
 727                 size = blkid_partition_get_size(pp);
 728                 found_partition_uuid = id;
 729
 730                 found = true;
 731         }
 732
 733         if (!found)
 734                 return -ENOPKG;
 735
 736         if (offset < 0)
 737                 return -EINVAL;
 738         if ((uint64_t) offset > UINT64_MAX / 512U)
 739                 return -EINVAL;
 740         if (size <= 0)
 741                 return -EINVAL;
 742         if ((uint64_t) size > UINT64_MAX / 512U)
 743                 return -EINVAL;
 744
 745         *ret_offset = offset * 512U;
 746         *ret_size = size * 512U;
 747         *ret_partition_uuid = found_partition_uuid;
 748
 749         return 0;
 750 }
 751
 752 static int crypt_device_to_evp_cipher(struct crypt_device *cd, const EVP_CIPHER **ret) {
 753         _cleanup_free_ char *cipher_name = NULL;
 754         const char *cipher, *cipher_mode, *e;
 755         size_t key_size, key_bits;
 756         const EVP_CIPHER *cc;
 757         int r;
 758
 759         assert(cd);
 760
 761         /* Let's find the right OpenSSL EVP_CIPHER object that matches the encryption settings of the LUKS
 762          * device */
 763
 764         cipher = sym_crypt_get_cipher(cd);
 765         if (!cipher)
 766                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot get cipher from LUKS device.");
 767
 768         cipher_mode = sym_crypt_get_cipher_mode(cd);
 769         if (!cipher_mode)
 770                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot get cipher mode from LUKS device.");
 771
 772         e = strchr(cipher_mode, '-');
 773         if (e)
 774                 cipher_mode = strndupa_safe(cipher_mode, e - cipher_mode);
 775
 776         r = sym_crypt_get_volume_key_size(cd);
 777         if (r <= 0)
 778                 return log_error_errno(r < 0 ? r : SYNTHETIC_ERRNO(EINVAL), "Cannot get volume key size from LUKS device.");
 779
 780         key_size = r;
 781         key_bits = key_size * 8;
 782         if (streq(cipher_mode, "xts"))
 783                 key_bits /= 2;
 784
 785         if (asprintf(&cipher_name, "%s-%zu-%s", cipher, key_bits, cipher_mode) < 0)
 786                 return log_oom();
 787
 788         cc = EVP_get_cipherbyname(cipher_name);
 789         if (!cc)
 790                 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Selected cipher mode '%s' not supported, can't encrypt JSON record.", cipher_name);
 791
 792         /* Verify that our key length calculations match what OpenSSL thinks */
 793         r = EVP_CIPHER_key_length(cc);
 794         if (r < 0 || (uint64_t) r != key_size)
 795                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Key size of selected cipher doesn't meet our expectations.");
 796
 797         *ret = cc;
 798         return 0;
 799 }
 800
 801 static int luks_validate_home_record(
 802                 struct crypt_device *cd,
 803                 UserRecord *h,
 804                 const void *volume_key,
 805                 PasswordCache *cache,
 806                 UserRecord **ret_luks_home_record) {
 807
 808         int r;
 809
 810         assert(cd);
 811         assert(h);
 812
 813         for (int token = 0; token < sym_crypt_token_max(CRYPT_LUKS2); token++) {
 814                 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *rr = NULL;
 815                 _cleanup_(EVP_CIPHER_CTX_freep) EVP_CIPHER_CTX *context = NULL;
 816                 _cleanup_(user_record_unrefp) UserRecord *lhr = NULL;
 817                 _cleanup_free_ void *encrypted = NULL, *iv = NULL;
 818                 size_t decrypted_size, encrypted_size, iv_size;
 819                 int decrypted_size_out1, decrypted_size_out2;
 820                 _cleanup_free_ char *decrypted = NULL;
 821                 const char *text, *type;
 822                 crypt_token_info state;
 823                 JsonVariant *jr, *jiv;
 824                 unsigned line, column;
 825                 const EVP_CIPHER *cc;
 826
 827                 state = sym_crypt_token_status(cd, token, &type);
 828                 if (state == CRYPT_TOKEN_INACTIVE) /* First unconfigured token, give up */
 829                         break;
 830                 if (IN_SET(state, CRYPT_TOKEN_INTERNAL, CRYPT_TOKEN_INTERNAL_UNKNOWN, CRYPT_TOKEN_EXTERNAL))
 831                         continue;
 832                 if (state != CRYPT_TOKEN_EXTERNAL_UNKNOWN)
 833                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unexpected token state of token %i: %i", token, (int) state);
 834
 835                 if (!streq(type, "systemd-homed"))
 836                         continue;
 837
 838                 r = sym_crypt_token_json_get(cd, token, &text);
 839                 if (r < 0)
 840                         return log_error_errno(r, "Failed to read LUKS token %i: %m", token);
 841
 842                 r = json_parse(text, JSON_PARSE_SENSITIVE, &v, &line, &column);
 843                 if (r < 0)
 844                         return log_error_errno(r, "Failed to parse LUKS token JSON data %u:%u: %m", line, column);
 845
 846                 jr = json_variant_by_key(v, "record");
 847                 if (!jr)
 848                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "LUKS token lacks 'record' field.");
 849                 jiv = json_variant_by_key(v, "iv");
 850                 if (!jiv)
 851                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "LUKS token lacks 'iv' field.");
 852
 853                 r = json_variant_unbase64(jr, &encrypted, &encrypted_size);
 854                 if (r < 0)
 855                         return log_error_errno(r, "Failed to base64 decode record: %m");
 856
 857                 r = json_variant_unbase64(jiv, &iv, &iv_size);
 858                 if (r < 0)
 859                         return log_error_errno(r, "Failed to base64 decode IV: %m");
 860
 861                 r = crypt_device_to_evp_cipher(cd, &cc);
 862                 if (r < 0)
 863                         return r;
 864                 if (iv_size > INT_MAX || EVP_CIPHER_iv_length(cc) != (int) iv_size)
 865                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "IV size doesn't match.");
 866
 867                 context = EVP_CIPHER_CTX_new();
 868                 if (!context)
 869                         return log_oom();
 870
 871                 if (EVP_DecryptInit_ex(context, cc, NULL, volume_key, iv) != 1)
 872                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initialize decryption context.");
 873
 874                 decrypted_size = encrypted_size + EVP_CIPHER_key_length(cc) * 2;
 875                 decrypted = new(char, decrypted_size);
 876                 if (!decrypted)
 877                         return log_oom();
 878
 879                 if (EVP_DecryptUpdate(context, (uint8_t*) decrypted, &decrypted_size_out1, encrypted, encrypted_size) != 1)
 880                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to decrypt JSON record.");
 881
 882                 assert((size_t) decrypted_size_out1 <= decrypted_size);
 883
 884                 if (EVP_DecryptFinal_ex(context, (uint8_t*) decrypted + decrypted_size_out1, &decrypted_size_out2) != 1)
 885                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to finish decryption of JSON record.");
 886
 887                 assert((size_t) decrypted_size_out1 + (size_t) decrypted_size_out2 < decrypted_size);
 888                 decrypted_size = (size_t) decrypted_size_out1 + (size_t) decrypted_size_out2;
 889
 890                 if (memchr(decrypted, 0, decrypted_size))
 891                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Inner NUL byte in JSON record, refusing.");
 892
 893                 decrypted[decrypted_size] = 0;
 894
 895                 r = json_parse(decrypted, JSON_PARSE_SENSITIVE, &rr, NULL, NULL);
 896                 if (r < 0)
 897                         return log_error_errno(r, "Failed to parse decrypted JSON record, refusing.");
 898
 899                 lhr = user_record_new();
 900                 if (!lhr)
 901                         return log_oom();
 902
 903                 r = user_record_load(lhr, rr, USER_RECORD_LOAD_EMBEDDED|USER_RECORD_PERMISSIVE);
 904                 if (r < 0)
 905                         return log_error_errno(r, "Failed to parse user record: %m");
 906
 907                 if (!user_record_compatible(h, lhr))
 908                         return log_error_errno(SYNTHETIC_ERRNO(EREMCHG), "LUKS home record not compatible with host record, refusing.");
 909
 910                 r = user_record_authenticate(lhr, h, cache, /* strict_verify= */ true);
 911                 if (r < 0)
 912                         return r;
 913                 assert(r > 0); /* Insist that a password was verified */
 914
 915                 *ret_luks_home_record = TAKE_PTR(lhr);
 916                 return 0;
 917         }
 918
 919         return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Couldn't find home record in LUKS2 header, refusing.");
 920 }
 921
 922 static int format_luks_token_text(
 923                 struct crypt_device *cd,
 924                 UserRecord *hr,
 925                 const void *volume_key,
 926                 char **ret) {
 927
 928         int r, encrypted_size_out1 = 0, encrypted_size_out2 = 0, iv_size, key_size;
 929         _cleanup_(EVP_CIPHER_CTX_freep) EVP_CIPHER_CTX *context = NULL;
 930         _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
 931         _cleanup_free_ void *iv = NULL, *encrypted = NULL;
 932         size_t text_length, encrypted_size;
 933         _cleanup_free_ char *text = NULL;
 934         const EVP_CIPHER *cc;
 935
 936         assert(cd);
 937         assert(hr);
 938         assert(volume_key);
 939         assert(ret);
 940
 941         r = crypt_device_to_evp_cipher(cd, &cc);
 942         if (r < 0)
 943                 return r;
 944
 945         key_size = EVP_CIPHER_key_length(cc);
 946         iv_size = EVP_CIPHER_iv_length(cc);
 947
 948         if (iv_size > 0) {
 949                 iv = malloc(iv_size);
 950                 if (!iv)
 951                         return log_oom();
 952
 953                 r = crypto_random_bytes(iv, iv_size);
 954                 if (r < 0)
 955                         return log_error_errno(r, "Failed to generate IV: %m");
 956         }
 957
 958         context = EVP_CIPHER_CTX_new();
 959         if (!context)
 960                 return log_oom();
 961
 962         if (EVP_EncryptInit_ex(context, cc, NULL, volume_key, iv) != 1)
 963                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initialize encryption context.");
 964
 965         r = json_variant_format(hr->json, 0, &text);
 966         if (r < 0)
 967                 return log_error_errno(r, "Failed to format user record for LUKS: %m");
 968
 969         text_length = strlen(text);
 970         encrypted_size = text_length + 2*key_size - 1;
 971
 972         encrypted = malloc(encrypted_size);
 973         if (!encrypted)
 974                 return log_oom();
 975
 976         if (EVP_EncryptUpdate(context, encrypted, &encrypted_size_out1, (uint8_t*) text, text_length) != 1)
 977                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to encrypt JSON record.");
 978
 979         assert((size_t) encrypted_size_out1 <= encrypted_size);
 980
 981         if (EVP_EncryptFinal_ex(context, (uint8_t*) encrypted + encrypted_size_out1, &encrypted_size_out2) != 1)
 982                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to finish encryption of JSON record. ");
 983
 984         assert((size_t) encrypted_size_out1 + (size_t) encrypted_size_out2 <= encrypted_size);
 985
 986         r = json_build(&v,
 987                        JSON_BUILD_OBJECT(
 988                                        JSON_BUILD_PAIR("type", JSON_BUILD_CONST_STRING("systemd-homed")),
 989                                        JSON_BUILD_PAIR("keyslots", JSON_BUILD_EMPTY_ARRAY),
 990                                        JSON_BUILD_PAIR("record", JSON_BUILD_BASE64(encrypted, encrypted_size_out1 + encrypted_size_out2)),
 991                                        JSON_BUILD_PAIR("iv", JSON_BUILD_BASE64(iv, iv_size))));
 992         if (r < 0)
 993                 return log_error_errno(r, "Failed to prepare LUKS JSON token object: %m");
 994
 995         r = json_variant_format(v, 0, ret);
 996         if (r < 0)
 997                 return log_error_errno(r, "Failed to format encrypted user record for LUKS: %m");
 998
 999         return 0;
1000 }
1001
1002 int home_store_header_identity_luks(
1003                 UserRecord *h,
1004                 HomeSetup *setup,
1005                 UserRecord *old_home) {
1006
1007         _cleanup_(user_record_unrefp) UserRecord *header_home = NULL;
1008         _cleanup_free_ char *text = NULL;
1009         int r;
1010
1011         assert(h);
1012
1013         if (!setup->crypt_device)
1014                 return 0;
1015
1016         assert(setup->volume_key);
1017
1018         /* Let's store the user's identity record in the LUKS2 "token" header data fields, in an encrypted
1019          * fashion. Why that? If we'd rely on the record being embedded in the payload file system itself we
1020          * would have to mount the file system before we can validate the JSON record, its signatures and
1021          * whether it matches what we are looking for. However, kernel file system implementations are
1022          * generally not ready to be used on untrusted media. Hence let's store the record independently of
1023          * the file system, so that we can validate it first, and only then mount the file system. To keep
1024          * things simple we use the same encryption settings for this record as for the file system itself. */
1025
1026         r = user_record_clone(h, USER_RECORD_EXTRACT_EMBEDDED|USER_RECORD_PERMISSIVE, &header_home);
1027         if (r < 0)
1028                 return log_error_errno(r, "Failed to determine new header record: %m");
1029
1030         if (old_home && user_record_equal(old_home, header_home)) {
1031                 log_debug("Not updating header home record.");
1032                 return 0;
1033         }
1034
1035         r = format_luks_token_text(setup->crypt_device, header_home, setup->volume_key, &text);
1036         if (r < 0)
1037                 return r;
1038
1039         for (int token = 0; token < sym_crypt_token_max(CRYPT_LUKS2); token++) {
1040                 crypt_token_info state;
1041                 const char *type;
1042
1043                 state = sym_crypt_token_status(setup->crypt_device, token, &type);
1044                 if (state == CRYPT_TOKEN_INACTIVE) /* First unconfigured token, we are done */
1045                         break;
1046                 if (IN_SET(state, CRYPT_TOKEN_INTERNAL, CRYPT_TOKEN_INTERNAL_UNKNOWN, CRYPT_TOKEN_EXTERNAL))
1047                         continue; /* Not ours */
1048                 if (state != CRYPT_TOKEN_EXTERNAL_UNKNOWN)
1049                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unexpected token state of token %i: %i", token, (int) state);
1050
1051                 if (!streq(type, "systemd-homed"))
1052                         continue;
1053
1054                 r = sym_crypt_token_json_set(setup->crypt_device, token, text);
1055                 if (r < 0)
1056                         return log_error_errno(r, "Failed to set JSON token for slot %i: %m", token);
1057
1058                 /* Now, let's free the text so that for all further matching tokens we all crypt_json_token_set()
1059                  * with a NULL text in order to invalidate the tokens. */
1060                 text = mfree(text);
1061         }
1062
1063         if (text)
1064                 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Didn't find any record token to update.");
1065
1066         log_info("Wrote LUKS header user record.");
1067
1068         return 1;
1069 }
1070
1071 int run_fitrim(int root_fd) {
1072         struct fstrim_range range = {
1073                 .len = UINT64_MAX,
1074         };
1075
1076         /* If discarding is on, discard everything right after mounting, so that the discard setting takes
1077          * effect on activation. (Also, optionally, trim on logout) */
1078
1079         assert(root_fd >= 0);
1080
1081         if (ioctl(root_fd, FITRIM, &range) < 0) {
1082                 if (ERRNO_IS_NOT_SUPPORTED(errno) || errno == EBADF) {
1083                         log_debug_errno(errno, "File system does not support FITRIM, not trimming.");
1084                         return 0;
1085                 }
1086
1087                 return log_warning_errno(errno, "Failed to invoke FITRIM, ignoring: %m");
1088         }
1089
1090         log_info("Discarded unused %s.", FORMAT_BYTES(range.len));
1091         return 1;
1092 }
1093
1094 int run_fallocate(int backing_fd, const struct stat *st) {
1095         struct stat stbuf;
1096
1097         assert(backing_fd >= 0);
1098
1099         /* If discarding is off, let's allocate the whole image before mounting, so that the setting takes
1100          * effect on activation */
1101
1102         if (!st) {
1103                 if (fstat(backing_fd, &stbuf) < 0)
1104                         return log_error_errno(errno, "Failed to fstat(): %m");
1105
1106                 st = &stbuf;
1107         }
1108
1109         if (!S_ISREG(st->st_mode))
1110                 return 0;
1111
1112         if (st->st_blocks >= DIV_ROUND_UP(st->st_size, 512)) {
1113                 log_info("Backing file is fully allocated already.");
1114                 return 0;
1115         }
1116
1117         if (fallocate(backing_fd, FALLOC_FL_KEEP_SIZE, 0, st->st_size) < 0) {
1118
1119                 if (ERRNO_IS_NOT_SUPPORTED(errno)) {
1120                         log_debug_errno(errno, "fallocate() not supported on file system, ignoring.");
1121                         return 0;
1122                 }
1123
1124                 if (ERRNO_IS_DISK_SPACE(errno)) {
1125                         log_debug_errno(errno, "Not enough disk space to fully allocate home.");
1126                         return -ENOSPC; /* make recognizable */
1127                 }
1128
1129                 return log_error_errno(errno, "Failed to allocate backing file blocks: %m");
1130         }
1131
1132         log_info("Allocated additional %s.",
1133                  FORMAT_BYTES((DIV_ROUND_UP(st->st_size, 512) - st->st_blocks) * 512));
1134         return 1;
1135 }
1136
1137 int run_fallocate_by_path(const char *backing_path) {
1138         _cleanup_close_ int backing_fd = -EBADF;
1139
1140         backing_fd = open(backing_path, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
1141         if (backing_fd < 0)
1142                 return log_error_errno(errno, "Failed to open '%s' for fallocate(): %m", backing_path);
1143
1144         return run_fallocate(backing_fd, NULL);
1145 }
1146
1147 static int lock_image_fd(int image_fd, const char *ip) {
1148         int r;
1149
1150         /* If the $SYSTEMD_LUKS_LOCK environment variable is set we'll take an exclusive BSD lock on the
1151          * image file, and send it to our parent. homed will keep it open to ensure no other instance of
1152          * homed (across the network or such) will also mount the file. */
1153
1154         assert(image_fd >= 0);
1155         assert(ip);
1156
1157         r = getenv_bool("SYSTEMD_LUKS_LOCK");
1158         if (r == -ENXIO)
1159                 return 0;
1160         if (r < 0)
1161                 return log_error_errno(r, "Failed to parse $SYSTEMD_LUKS_LOCK environment variable: %m");
1162         if (r == 0)
1163                 return 0;
1164
1165         if (flock(image_fd, LOCK_EX|LOCK_NB) < 0) {
1166
1167                 if (errno == EAGAIN)
1168                         log_error_errno(errno, "Image file '%s' already locked, can't use.", ip);
1169                 else
1170                         log_error_errno(errno, "Failed to lock image file '%s': %m", ip);
1171
1172                 return errno != EAGAIN ? -errno : -EADDRINUSE; /* Make error recognizable */
1173         }
1174
1175         log_info("Successfully locked image file '%s'.", ip);
1176
1177         /* Now send it to our parent to keep safe while the home dir is active */
1178         r = sd_pid_notify_with_fds(0, false, "SYSTEMD_LUKS_LOCK_FD=1", &image_fd, 1);
1179         if (r < 0)
1180                 log_warning_errno(r, "Failed to send LUKS lock fd to parent, ignoring: %m");
1181
1182         return 0;
1183 }
1184
1185 static int open_image_file(
1186                 UserRecord *h,
1187                 const char *force_image_path,
1188                 struct stat *ret_stat) {
1189
1190         _cleanup_close_ int image_fd = -EBADF;
1191         struct stat st;
1192         const char *ip;
1193         int r;
1194
1195         assert(h || force_image_path);
1196
1197         ip = force_image_path ?: user_record_image_path(h);
1198
1199         image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
1200         if (image_fd < 0)
1201                 return log_error_errno(errno, "Failed to open image file %s: %m", ip);
1202
1203         if (fstat(image_fd, &st) < 0)
1204                 return log_error_errno(errno, "Failed to fstat() image file: %m");
1205         if (!S_ISREG(st.st_mode) && !S_ISBLK(st.st_mode))
1206                 return log_error_errno(
1207                                 S_ISDIR(st.st_mode) ? SYNTHETIC_ERRNO(EISDIR) : SYNTHETIC_ERRNO(EBADFD),
1208                                 "Image file %s is not a regular file or block device: %m", ip);
1209
1210         /* Locking block devices doesn't really make sense, as this might interfere with
1211          * udev's workings, and these locks aren't network propagated anyway, hence not what
1212          * we are after here. */
1213         if (S_ISREG(st.st_mode)) {
1214                 r = lock_image_fd(image_fd, ip);
1215                 if (r < 0)
1216                         return r;
1217         }
1218
1219         if (ret_stat)
1220                 *ret_stat = st;
1221
1222         return TAKE_FD(image_fd);
1223 }
1224
1225 int home_setup_luks(
1226                 UserRecord *h,
1227                 HomeSetupFlags flags,
1228                 const char *force_image_path,
1229                 HomeSetup *setup,
1230                 PasswordCache *cache,
1231                 UserRecord **ret_luks_home) {
1232
1233         sd_id128_t found_partition_uuid, found_fs_uuid = SD_ID128_NULL, found_luks_uuid = SD_ID128_NULL;
1234         _cleanup_(user_record_unrefp) UserRecord *luks_home = NULL;
1235         _cleanup_(erase_and_freep) void *volume_key = NULL;
1236         size_t volume_key_size = 0;
1237         uint64_t offset, size;
1238         struct stat st;
1239         int r;
1240
1241         assert(h);
1242         assert(setup);
1243         assert(user_record_storage(h) == USER_LUKS);
1244
1245         r = dlopen_cryptsetup();
1246         if (r < 0)
1247                 return r;
1248
1249         r = make_dm_names(h, setup);
1250         if (r < 0)
1251                 return r;
1252
1253         /* Reuse the image fd if it has already been opened by an earlier step */
1254         if (setup->image_fd < 0) {
1255                 setup->image_fd = open_image_file(h, force_image_path, &st);
1256                 if (setup->image_fd < 0)
1257                         return setup->image_fd;
1258         } else if (fstat(setup->image_fd, &st) < 0)
1259                 return log_error_errno(errno, "Failed to stat image: %m");
1260
1261         if (FLAGS_SET(flags, HOME_SETUP_ALREADY_ACTIVATED)) {
1262                 struct loop_info64 info;
1263                 const char *n;
1264
1265                 if (!setup->crypt_device) {
1266                         r = luks_open(h,
1267                                       setup,
1268                                       cache,
1269                                       &found_luks_uuid,
1270                                       &volume_key,
1271                                       &volume_key_size);
1272                         if (r < 0)
1273                                 return r;
1274                 }
1275
1276                 if (ret_luks_home) {
1277                         r = luks_validate_home_record(setup->crypt_device, h, volume_key, cache, &luks_home);
1278                         if (r < 0)
1279                                 return r;
1280                 }
1281
1282                 n = sym_crypt_get_device_name(setup->crypt_device);
1283                 if (!n)
1284                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine backing device for DM %s.", setup->dm_name);
1285
1286                 if (!setup->loop) {
1287                         r = loop_device_open_from_path(n, O_RDWR, LOCK_UN, &setup->loop);
1288                         if (r < 0)
1289                                 return log_error_errno(r, "Failed to open loopback device %s: %m", n);
1290                 }
1291
1292                 if (ioctl(setup->loop->fd, LOOP_GET_STATUS64, &info) < 0) {
1293                         _cleanup_free_ char *sysfs = NULL;
1294
1295                         if (!IN_SET(errno, ENOTTY, EINVAL))
1296                                 return log_error_errno(errno, "Failed to get block device metrics of %s: %m", n);
1297
1298                         if (ioctl(setup->loop->fd, BLKGETSIZE64, &size) < 0)
1299                                 return log_error_errno(r, "Failed to read block device size of %s: %m", n);
1300
1301                         if (fstat(setup->loop->fd, &st) < 0)
1302                                 return log_error_errno(r, "Failed to stat block device %s: %m", n);
1303                         assert(S_ISBLK(st.st_mode));
1304
1305                         if (asprintf(&sysfs, "/sys/dev/block/" DEVNUM_FORMAT_STR "/partition", DEVNUM_FORMAT_VAL(st.st_rdev)) < 0)
1306                                 return log_oom();
1307
1308                         if (access(sysfs, F_OK) < 0) {
1309                                 if (errno != ENOENT)
1310                                         return log_error_errno(errno, "Failed to determine whether %s exists: %m", sysfs);
1311
1312                                 offset = 0;
1313                         } else {
1314                                 _cleanup_free_ char *buffer = NULL;
1315
1316                                 if (asprintf(&sysfs, "/sys/dev/block/" DEVNUM_FORMAT_STR "/start", DEVNUM_FORMAT_VAL(st.st_rdev)) < 0)
1317                                         return log_oom();
1318
1319                                 r = read_one_line_file(sysfs, &buffer);
1320                                 if (r < 0)
1321                                         return log_error_errno(r, "Failed to read partition start offset: %m");
1322
1323                                 r = safe_atou64(buffer, &offset);
1324                                 if (r < 0)
1325                                         return log_error_errno(r, "Failed to parse partition start offset: %m");
1326
1327                                 if (offset > UINT64_MAX / 512U)
1328                                         return log_error_errno(SYNTHETIC_ERRNO(E2BIG), "Offset too large for 64 byte range, refusing.");
1329
1330                                 offset *= 512U;
1331                         }
1332                 } else {
1333 #if HAVE_VALGRIND_MEMCHECK_H
1334                         VALGRIND_MAKE_MEM_DEFINED(&info, sizeof(info));
1335 #endif
1336
1337                         offset = info.lo_offset;
1338                         size = info.lo_sizelimit;
1339                 }
1340
1341                 found_partition_uuid = found_fs_uuid = SD_ID128_NULL;
1342
1343                 log_info("Discovered used loopback device %s.", setup->loop->node);
1344
1345                 if (setup->root_fd < 0) {
1346                         setup->root_fd = open(user_record_home_directory(h), O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
1347                         if (setup->root_fd < 0)
1348                                 return log_error_errno(errno, "Failed to open home directory: %m");
1349                 }
1350         } else {
1351                 _cleanup_free_ char *fstype = NULL, *subdir = NULL;
1352                 const char *ip;
1353
1354                 /* When we aren't reopening the home directory we are allocating it fresh, hence the relevant
1355                  * objects can't be allocated yet. */
1356                 assert(setup->root_fd < 0);
1357                 assert(!setup->crypt_device);
1358                 assert(!setup->loop);
1359
1360                 ip = force_image_path ?: user_record_image_path(h);
1361
1362                 subdir = path_join(HOME_RUNTIME_WORK_DIR, user_record_user_name_and_realm(h));
1363                 if (!subdir)
1364                         return log_oom();
1365
1366                 r = luks_validate(setup->image_fd, user_record_user_name_and_realm(h), h->partition_uuid, &found_partition_uuid, &offset, &size);
1367                 if (r < 0)
1368                         return log_error_errno(r, "Failed to validate disk label: %m");
1369
1370                 /* Everything before this point left the image untouched. We are now starting to make
1371                  * changes, hence mark the image dirty */
1372                 if (run_mark_dirty(setup->image_fd, true) > 0)
1373                         setup->do_mark_clean = true;
1374
1375                 if (!user_record_luks_discard(h)) {
1376                         r = run_fallocate(setup->image_fd, &st);
1377                         if (r < 0)
1378                                 return r;
1379                 }
1380
1381                 r = loop_device_make(
1382                                 setup->image_fd,
1383                                 O_RDWR,
1384                                 offset,
1385                                 size,
1386                                 h->luks_sector_size == UINT64_MAX ? UINT32_MAX : user_record_luks_sector_size(h), /* if sector size is not specified, select UINT32_MAX, i.e. auto-probe */
1387                                 /* loop_flags= */ 0,
1388                                 LOCK_UN,
1389                                 &setup->loop);
1390                 if (r == -ENOENT) {
1391                         log_error_errno(r, "Loopback block device support is not available on this system.");
1392                         return -ENOLINK; /* make recognizable */
1393                 }
1394                 if (r < 0)
1395                         return log_error_errno(r, "Failed to allocate loopback context: %m");
1396
1397                 log_info("Setting up loopback device %s completed.", setup->loop->node ?: ip);
1398
1399                 r = luks_setup(h,
1400                                setup->loop->node ?: ip,
1401                                setup->dm_name,
1402                                h->luks_uuid,
1403                                h->luks_cipher,
1404                                h->luks_cipher_mode,
1405                                h->luks_volume_key_size,
1406                                h->password,
1407                                cache,
1408                                user_record_luks_discard(h) || user_record_luks_offline_discard(h),
1409                                &setup->crypt_device,
1410                                &found_luks_uuid,
1411                                &volume_key,
1412                                &volume_key_size,
1413                                &setup->key_serial);
1414                 if (r < 0)
1415                         return r;
1416
1417                 setup->undo_dm = true;
1418
1419                 if (ret_luks_home) {
1420                         r = luks_validate_home_record(setup->crypt_device, h, volume_key, cache, &luks_home);
1421                         if (r < 0)
1422                                 return r;
1423                 }
1424
1425                 r = fs_validate(setup->dm_node, h->file_system_uuid, &fstype, &found_fs_uuid);
1426                 if (r < 0)
1427                         return r;
1428
1429                 r = run_fsck(setup->dm_node, fstype);
1430                 if (r < 0)
1431                         return r;
1432
1433                 r = home_unshare_and_mount(setup->dm_node, fstype, user_record_luks_discard(h), user_record_mount_flags(h), h->luks_extra_mount_options);
1434                 if (r < 0)
1435                         return r;
1436
1437                 setup->undo_mount = true;
1438
1439                 setup->root_fd = open(subdir, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
1440                 if (setup->root_fd < 0)
1441                         return log_error_errno(errno, "Failed to open home directory: %m");
1442
1443                 if (user_record_luks_discard(h))
1444                         (void) run_fitrim(setup->root_fd);
1445
1446                 setup->do_offline_fallocate = !(setup->do_offline_fitrim = user_record_luks_offline_discard(h));
1447         }
1448
1449         if (!sd_id128_is_null(found_partition_uuid))
1450                 setup->found_partition_uuid = found_partition_uuid;
1451         if (!sd_id128_is_null(found_luks_uuid))
1452                 setup->found_luks_uuid = found_luks_uuid;
1453         if (!sd_id128_is_null(found_fs_uuid))
1454                 setup->found_fs_uuid = found_fs_uuid;
1455
1456         setup->partition_offset = offset;
1457         setup->partition_size = size;
1458
1459         if (volume_key) {
1460                 erase_and_free(setup->volume_key);
1461                 setup->volume_key = TAKE_PTR(volume_key);
1462                 setup->volume_key_size = volume_key_size;
1463         }
1464
1465         if (ret_luks_home)
1466                 *ret_luks_home = TAKE_PTR(luks_home);
1467
1468         return 0;
1469 }
1470
1471 static void print_size_summary(uint64_t host_size, uint64_t encrypted_size, const struct statfs *sfs) {
1472         assert(sfs);
1473
1474         log_info("Image size is %s, file system size is %s, file system payload size is %s, file system free is %s.",
1475                  FORMAT_BYTES(host_size),
1476                  FORMAT_BYTES(encrypted_size),
1477                  FORMAT_BYTES((uint64_t) sfs->f_blocks * (uint64_t) sfs->f_frsize),
1478                  FORMAT_BYTES((uint64_t) sfs->f_bfree * (uint64_t) sfs->f_frsize));
1479 }
1480
1481 static int home_auto_grow_luks(
1482                 UserRecord *h,
1483                 HomeSetup *setup,
1484                 PasswordCache *cache) {
1485
1486         struct statfs sfs;
1487
1488         assert(h);
1489         assert(setup);
1490
1491         if (!IN_SET(user_record_auto_resize_mode(h), AUTO_RESIZE_GROW, AUTO_RESIZE_SHRINK_AND_GROW))
1492                 return 0;
1493
1494         assert(setup->root_fd >= 0);
1495
1496         if (fstatfs(setup->root_fd, &sfs) < 0)
1497                 return log_error_errno(errno, "Failed to statfs home directory: %m");
1498
1499         if (!fs_can_online_shrink_and_grow(sfs.f_type)) {
1500                 log_debug("Not auto-grow file system, since selected file system cannot do both online shrink and grow.");
1501                 return 0;
1502         }
1503
1504         log_debug("Initiating auto-grow...");
1505
1506         return home_resize_luks(
1507                         h,
1508                         HOME_SETUP_ALREADY_ACTIVATED|
1509                         HOME_SETUP_RESIZE_DONT_SYNC_IDENTITIES|
1510                         HOME_SETUP_RESIZE_DONT_SHRINK|
1511                         HOME_SETUP_RESIZE_DONT_UNDO,
1512                         setup,
1513                         cache,
1514                         NULL);
1515 }
1516
1517 int home_activate_luks(
1518                 UserRecord *h,
1519                 HomeSetupFlags flags,
1520                 HomeSetup *setup,
1521                 PasswordCache *cache,
1522                 UserRecord **ret_home) {
1523
1524         _cleanup_(user_record_unrefp) UserRecord *new_home = NULL, *luks_home_record = NULL;
1525         uint64_t host_size, encrypted_size;
1526         const char *hdo, *hd;
1527         struct statfs sfs;
1528         int r;
1529
1530         assert(h);
1531         assert(user_record_storage(h) == USER_LUKS);
1532         assert(setup);
1533         assert(ret_home);
1534
1535         r = dlopen_cryptsetup();
1536         if (r < 0)
1537                 return r;
1538
1539         assert_se(hdo = user_record_home_directory(h));
1540         hd = strdupa_safe(hdo); /* copy the string out, since it might change later in the home record object */
1541
1542         r = home_get_state_luks(h, setup);
1543         if (r < 0)
1544                 return r;
1545         if (r > 0)
1546                 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Device mapper device %s already exists, refusing.", setup->dm_node);
1547
1548         r = home_setup_luks(
1549                         h,
1550                         0,
1551                         NULL,
1552                         setup,
1553                         cache,
1554                         &luks_home_record);
1555         if (r < 0)
1556                 return r;
1557
1558         r = home_auto_grow_luks(h, setup, cache);
1559         if (r < 0)
1560                 return r;
1561
1562         r = block_get_size_by_fd(setup->loop->fd, &host_size);
1563         if (r < 0)
1564                 return log_error_errno(r, "Failed to get loopback block device size: %m");
1565
1566         r = block_get_size_by_path(setup->dm_node, &encrypted_size);
1567         if (r < 0)
1568                 return log_error_errno(r, "Failed to get LUKS block device size: %m");
1569
1570         r = home_refresh(
1571                         h,
1572                         flags,
1573                         setup,
1574                         luks_home_record,
1575                         cache,
1576                         &sfs,
1577                         &new_home);
1578         if (r < 0)
1579                 return r;
1580
1581         r = home_extend_embedded_identity(new_home, h, setup);
1582         if (r < 0)
1583                 return r;
1584
1585         setup->root_fd = safe_close(setup->root_fd);
1586
1587         r = home_move_mount(user_record_user_name_and_realm(h), hd);
1588         if (r < 0)
1589                 return r;
1590
1591         setup->undo_mount = false;
1592         setup->do_offline_fitrim = false;
1593
1594         loop_device_relinquish(setup->loop);
1595
1596         r = sym_crypt_deactivate_by_name(NULL, setup->dm_name, CRYPT_DEACTIVATE_DEFERRED);
1597         if (r < 0)
1598                 log_warning_errno(r, "Failed to relinquish DM device, ignoring: %m");
1599
1600         setup->undo_dm = false;
1601         setup->do_offline_fallocate = false;
1602         setup->do_mark_clean = false;
1603         setup->do_drop_caches = false;
1604         TAKE_KEY_SERIAL(setup->key_serial); /* Leave key in kernel keyring */
1605
1606         log_info("Activation completed.");
1607
1608         print_size_summary(host_size, encrypted_size, &sfs);
1609
1610         *ret_home = TAKE_PTR(new_home);
1611         return 1;
1612 }
1613
1614 int home_deactivate_luks(UserRecord *h, HomeSetup *setup) {
1615         bool we_detached = false;
1616         int r;
1617
1618         assert(h);
1619         assert(setup);
1620
1621         /* Note that the DM device and loopback device are set to auto-detach, hence strictly speaking we
1622          * don't have to explicitly have to detach them. However, we do that nonetheless (in case of the DM
1623          * device), to avoid races: by explicitly detaching them we know when the detaching is complete. We
1624          * don't bother about the loopback device because unlike the DM device it doesn't have a fixed
1625          * name. */
1626
1627         if (!setup->crypt_device) {
1628                 r = acquire_open_luks_device(h, setup, /* graceful= */ true);
1629                 if (r < 0)
1630                         return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", setup->dm_name);
1631                 if (r == 0)
1632                         log_debug("LUKS device %s has already been detached.", setup->dm_name);
1633         }
1634
1635         if (setup->crypt_device) {
1636                 log_info("Discovered used LUKS device %s.", setup->dm_node);
1637
1638                 cryptsetup_enable_logging(setup->crypt_device);
1639
1640                 r = sym_crypt_deactivate_by_name(setup->crypt_device, setup->dm_name, 0);
1641                 if (ERRNO_IS_DEVICE_ABSENT(r) || r == -EINVAL)
1642                         log_debug_errno(r, "LUKS device %s is already detached.", setup->dm_node);
1643                 else if (r < 0)
1644                         return log_info_errno(r, "LUKS device %s couldn't be deactivated: %m", setup->dm_node);
1645                 else {
1646                         log_info("LUKS device detaching completed.");
1647                         we_detached = true;
1648                 }
1649         }
1650
1651         (void) wait_for_block_device_gone(setup, USEC_PER_SEC * 30);
1652         setup->undo_dm = false;
1653
1654         if (user_record_luks_offline_discard(h))
1655                 log_debug("Not allocating on logout.");
1656         else
1657                 (void) run_fallocate_by_path(user_record_image_path(h));
1658
1659         run_mark_dirty_by_path(user_record_image_path(h), false);
1660         return we_detached;
1661 }
1662
1663 int home_trim_luks(UserRecord *h, HomeSetup *setup) {
1664         assert(h);
1665         assert(setup);
1666         assert(setup->root_fd >= 0);
1667
1668         if (!user_record_luks_offline_discard(h)) {
1669                 log_debug("Not trimming on logout.");
1670                 return 0;
1671         }
1672
1673         (void) run_fitrim(setup->root_fd);
1674         return 0;
1675 }
1676
1677 static struct crypt_pbkdf_type* build_good_pbkdf(struct crypt_pbkdf_type *buffer, UserRecord *hr) {
1678         assert(buffer);
1679         assert(hr);
1680
1681         bool benchmark = user_record_luks_pbkdf_force_iterations(hr) == UINT64_MAX;
1682
1683         *buffer = (struct crypt_pbkdf_type) {
1684                 .hash = user_record_luks_pbkdf_hash_algorithm(hr),
1685                 .type = user_record_luks_pbkdf_type(hr),
1686                 .time_ms = benchmark ? user_record_luks_pbkdf_time_cost_usec(hr) / USEC_PER_MSEC : 0,
1687                 .iterations = benchmark ? 0 : user_record_luks_pbkdf_force_iterations(hr),
1688                 .max_memory_kb = user_record_luks_pbkdf_memory_cost(hr) / 1024,
1689                 .parallel_threads = user_record_luks_pbkdf_parallel_threads(hr),
1690                 .flags = benchmark ? 0 : CRYPT_PBKDF_NO_BENCHMARK,
1691         };
1692
1693         return buffer;
1694 }
1695
1696 static struct crypt_pbkdf_type* build_minimal_pbkdf(struct crypt_pbkdf_type *buffer, UserRecord *hr) {
1697         assert(buffer);
1698         assert(hr);
1699
1700         /* For PKCS#11 derived keys (which are generated randomly and are of high quality already) we use a
1701          * minimal PBKDF */
1702         *buffer = (struct crypt_pbkdf_type) {
1703                 .hash = user_record_luks_pbkdf_hash_algorithm(hr),
1704                 .type = CRYPT_KDF_PBKDF2,
1705                 .iterations = 1,
1706                 .time_ms = 1,
1707         };
1708
1709         return buffer;
1710 }
1711
1712 static int luks_format(
1713                 const char *node,
1714                 const char *dm_name,
1715                 sd_id128_t uuid,
1716                 const char *label,
1717                 const PasswordCache *cache,
1718                 char **effective_passwords,
1719                 bool discard,
1720                 UserRecord *hr,
1721                 struct crypt_device **ret) {
1722
1723         _cleanup_(user_record_unrefp) UserRecord *reduced = NULL;
1724         _cleanup_(sym_crypt_freep) struct crypt_device *cd = NULL;
1725         _cleanup_(erase_and_freep) void *volume_key = NULL;
1726         struct crypt_pbkdf_type good_pbkdf, minimal_pbkdf;
1727         _cleanup_free_ char *text = NULL;
1728         size_t volume_key_size;
1729         int slot = 0, r;
1730
1731         assert(node);
1732         assert(dm_name);
1733         assert(hr);
1734         assert(ret);
1735
1736         r = sym_crypt_init(&cd, node);
1737         if (r < 0)
1738                 return log_error_errno(r, "Failed to allocate libcryptsetup context: %m");
1739
1740         cryptsetup_enable_logging(cd);
1741
1742         /* Normally we'd, just leave volume key generation to libcryptsetup. However, we can't, since we
1743          * can't extract the volume key from the library again, but we need it in order to encrypt the JSON
1744          * record. Hence, let's generate it on our own, so that we can keep track of it. */
1745
1746         volume_key_size = user_record_luks_volume_key_size(hr);
1747         volume_key = malloc(volume_key_size);
1748         if (!volume_key)
1749                 return log_oom();
1750
1751         r = crypto_random_bytes(volume_key, volume_key_size);
1752         if (r < 0)
1753                 return log_error_errno(r, "Failed to generate volume key: %m");
1754
1755 #if HAVE_CRYPT_SET_METADATA_SIZE
1756         /* Increase the metadata space to 4M, the largest LUKS2 supports */
1757         r = sym_crypt_set_metadata_size(cd, 4096U*1024U, 0);
1758         if (r < 0)
1759                 return log_error_errno(r, "Failed to change LUKS2 metadata size: %m");
1760 #endif
1761
1762         build_good_pbkdf(&good_pbkdf, hr);
1763         build_minimal_pbkdf(&minimal_pbkdf, hr);
1764
1765         r = sym_crypt_format(
1766                         cd,
1767                         CRYPT_LUKS2,
1768                         user_record_luks_cipher(hr),
1769                         user_record_luks_cipher_mode(hr),
1770                         SD_ID128_TO_UUID_STRING(uuid),
1771                         volume_key,
1772                         volume_key_size,
1773                         &(struct crypt_params_luks2) {
1774                                 .label = label,
1775                                 .subsystem = "systemd-home",
1776                                 .sector_size = user_record_luks_sector_size(hr),
1777                                 .pbkdf = &good_pbkdf,
1778                         });
1779         if (r < 0)
1780                 return log_error_errno(r, "Failed to format LUKS image: %m");
1781
1782         log_info("LUKS formatting completed.");
1783
1784         STRV_FOREACH(pp, effective_passwords) {
1785
1786                 if (password_cache_contains(cache, *pp)) { /* is this a fido2 or pkcs11 password? */
1787                         log_debug("Using minimal PBKDF for slot %i", slot);
1788                         r = sym_crypt_set_pbkdf_type(cd, &minimal_pbkdf);
1789                 } else {
1790                         log_debug("Using good PBKDF for slot %i", slot);
1791                         r = sym_crypt_set_pbkdf_type(cd, &good_pbkdf);
1792                 }
1793                 if (r < 0)
1794                         return log_error_errno(r, "Failed to tweak PBKDF for slot %i: %m", slot);
1795
1796                 r = sym_crypt_keyslot_add_by_volume_key(
1797                                 cd,
1798                                 slot,
1799                                 volume_key,
1800                                 volume_key_size,
1801                                 *pp,
1802                                 strlen(*pp));
1803                 if (r < 0)
1804                         return log_error_errno(r, "Failed to set up LUKS password for slot %i: %m", slot);
1805
1806                 log_info("Writing password to LUKS keyslot %i completed.", slot);
1807                 slot++;
1808         }
1809
1810         r = sym_crypt_activate_by_volume_key(
1811                         cd,
1812                         dm_name,
1813                         volume_key,
1814                         volume_key_size,
1815                         discard ? CRYPT_ACTIVATE_ALLOW_DISCARDS : 0);
1816         if (r < 0)
1817                 return log_error_errno(r, "Failed to activate LUKS superblock: %m");
1818
1819         log_info("LUKS activation by volume key succeeded.");
1820
1821         r = user_record_clone(hr, USER_RECORD_EXTRACT_EMBEDDED|USER_RECORD_PERMISSIVE, &reduced);
1822         if (r < 0)
1823                 return log_error_errno(r, "Failed to prepare home record for LUKS: %m");
1824
1825         r = format_luks_token_text(cd, reduced, volume_key, &text);
1826         if (r < 0)
1827                 return r;
1828
1829         r = sym_crypt_token_json_set(cd, CRYPT_ANY_TOKEN, text);
1830         if (r < 0)
1831                 return log_error_errno(r, "Failed to set LUKS JSON token: %m");
1832
1833         log_info("Writing user record as LUKS token completed.");
1834
1835         if (ret)
1836                 *ret = TAKE_PTR(cd);
1837
1838         return 0;
1839 }
1840
1841 static int make_partition_table(
1842                 int fd,
1843                 uint32_t sector_size,
1844                 const char *label,
1845                 sd_id128_t uuid,
1846                 uint64_t *ret_offset,
1847                 uint64_t *ret_size,
1848                 sd_id128_t *ret_disk_uuid) {
1849
1850         _cleanup_(fdisk_unref_partitionp) struct fdisk_partition *p = NULL, *q = NULL;
1851         _cleanup_(fdisk_unref_parttypep) struct fdisk_parttype *t = NULL;
1852         _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
1853         _cleanup_free_ char *disk_uuid_as_string = NULL;
1854         uint64_t offset, size, first_lba, start, last_lba, end;
1855         sd_id128_t disk_uuid;
1856         int r;
1857
1858         assert(fd >= 0);
1859         assert(label);
1860         assert(ret_offset);
1861         assert(ret_size);
1862
1863         t = fdisk_new_parttype();
1864         if (!t)
1865                 return log_oom();
1866
1867         r = fdisk_parttype_set_typestr(t, SD_GPT_USER_HOME_STR);
1868         if (r < 0)
1869                 return log_error_errno(r, "Failed to initialize partition type: %m");
1870
1871         r = fdisk_new_context_fd(fd, /* read_only= */ false, sector_size, &c);
1872         if (r < 0)
1873                 return log_error_errno(r, "Failed to open device: %m");
1874
1875         r = fdisk_create_disklabel(c, "gpt");
1876         if (r < 0)
1877                 return log_error_errno(r, "Failed to create GPT disk label: %m");
1878
1879         p = fdisk_new_partition();
1880         if (!p)
1881                 return log_oom();
1882
1883         r = fdisk_partition_set_type(p, t);
1884         if (r < 0)
1885                 return log_error_errno(r, "Failed to set partition type: %m");
1886
1887         r = fdisk_partition_partno_follow_default(p, 1);
1888         if (r < 0)
1889                 return log_error_errno(r, "Failed to place partition at first free partition index: %m");
1890
1891         first_lba = fdisk_get_first_lba(c); /* Boundary where usable space starts */
1892         assert(first_lba <= UINT64_MAX/512);
1893         start = DISK_SIZE_ROUND_UP(first_lba * 512); /* Round up to multiple of 4K */
1894
1895         log_debug("Starting partition at offset %" PRIu64, start);
1896
1897         if (start == UINT64_MAX)
1898                 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Overflow while rounding up start LBA.");
1899
1900         last_lba = fdisk_get_last_lba(c); /* One sector before boundary where usable space ends */
1901         assert(last_lba < UINT64_MAX/512);
1902         end = DISK_SIZE_ROUND_DOWN((last_lba + 1) * 512); /* Round down to multiple of 4K */
1903
1904         if (end <= start)
1905                 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Resulting partition size zero or negative.");
1906
1907         r = fdisk_partition_set_start(p, start / 512);
1908         if (r < 0)
1909                 return log_error_errno(r, "Failed to place partition at offset %" PRIu64 ": %m", start);
1910
1911         r = fdisk_partition_set_size(p, (end - start) / 512);
1912         if (r < 0)
1913                 return log_error_errno(r, "Failed to end partition at offset %" PRIu64 ": %m", end);
1914
1915         r = fdisk_partition_set_name(p, label);
1916         if (r < 0)
1917                 return log_error_errno(r, "Failed to set partition name: %m");
1918
1919         r = fdisk_partition_set_uuid(p, SD_ID128_TO_UUID_STRING(uuid));
1920         if (r < 0)
1921                 return log_error_errno(r, "Failed to set partition UUID: %m");
1922
1923         r = fdisk_add_partition(c, p, NULL);
1924         if (r < 0)
1925                 return log_error_errno(r, "Failed to add partition: %m");
1926
1927         r = fdisk_write_disklabel(c);
1928         if (r < 0)
1929                 return log_error_errno(r, "Failed to write disk label: %m");
1930
1931         r = fdisk_get_disklabel_id(c, &disk_uuid_as_string);
1932         if (r < 0)
1933                 return log_error_errno(r, "Failed to determine disk label UUID: %m");
1934
1935         r = sd_id128_from_string(disk_uuid_as_string, &disk_uuid);
1936         if (r < 0)
1937                 return log_error_errno(r, "Failed to parse disk label UUID: %m");
1938
1939         r = fdisk_get_partition(c, 0, &q);
1940         if (r < 0)
1941                 return log_error_errno(r, "Failed to read created partition metadata: %m");
1942
1943         assert(fdisk_partition_has_start(q));
1944         offset = fdisk_partition_get_start(q);
1945         if (offset > UINT64_MAX / 512U)
1946                 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Partition offset too large.");
1947
1948         assert(fdisk_partition_has_size(q));
1949         size = fdisk_partition_get_size(q);
1950         if (size > UINT64_MAX / 512U)
1951                 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Partition size too large.");
1952
1953         *ret_offset = offset * 512U;
1954         *ret_size = size * 512U;
1955         *ret_disk_uuid = disk_uuid;
1956
1957         return 0;
1958 }
1959
1960 static bool supported_fs_size(const char *fstype, uint64_t host_size) {
1961         uint64_t m;
1962
1963         m = minimal_size_by_fs_name(fstype);
1964         if (m == UINT64_MAX)
1965                 return false;
1966
1967         return host_size >= m;
1968 }
1969
1970 static int wait_for_devlink(const char *path) {
1971         _cleanup_close_ int inotify_fd = -EBADF;
1972         usec_t until;
1973         int r;
1974
1975         /* let's wait for a device link to show up in /dev, with a timeout. This is good to do since we
1976          * return a /dev/disk/by-uuid/… link to our callers and they likely want to access it right-away,
1977          * hence let's wait until udev has caught up with our changes, and wait for the symlink to be
1978          * created. */
1979
1980         until = usec_add(now(CLOCK_MONOTONIC), 45 * USEC_PER_SEC);
1981
1982         for (;;) {
1983                 _cleanup_free_ char *dn = NULL;
1984                 usec_t w;
1985
1986                 if (laccess(path, F_OK) < 0) {
1987                         if (errno != ENOENT)
1988                                 return log_error_errno(errno, "Failed to determine whether %s exists: %m", path);
1989                 } else
1990                         return 0; /* Found it */
1991
1992                 if (inotify_fd < 0) {
1993                         /* We need to wait for the device symlink to show up, let's create an inotify watch for it */
1994                         inotify_fd = inotify_init1(IN_NONBLOCK|IN_CLOEXEC);
1995                         if (inotify_fd < 0)
1996                                 return log_error_errno(errno, "Failed to allocate inotify fd: %m");
1997                 }
1998
1999                 r = path_extract_directory(path, &dn);
2000                 if (r < 0)
2001                         return log_error_errno(r, "Failed to extract directory from device node path '%s': %m", path);
2002                 for (;;) {
2003                         _cleanup_free_ char *ndn = NULL;
2004
2005                         log_info("Watching %s", dn);
2006
2007                         if (inotify_add_watch(inotify_fd, dn, IN_CREATE|IN_MOVED_TO|IN_ONLYDIR|IN_DELETE_SELF|IN_MOVE_SELF) < 0) {
2008                                 if (errno != ENOENT)
2009                                         return log_error_errno(errno, "Failed to add watch on %s: %m", dn);
2010                         } else
2011                                 break;
2012
2013                         r = path_extract_directory(dn, &ndn);
2014                         if (r == -EADDRNOTAVAIL) /* Arrived at the top? */
2015                                 break;
2016                         if (r < 0)
2017                                 return log_error_errno(r, "Failed to extract directory from device node path '%s': %m", dn);
2018
2019                         free_and_replace(dn, ndn);
2020                 }
2021
2022                 w = now(CLOCK_MONOTONIC);
2023                 if (w >= until)
2024                         return log_error_errno(SYNTHETIC_ERRNO(ETIMEDOUT), "Device link %s still hasn't shown up, giving up.", path);
2025
2026                 r = fd_wait_for_event(inotify_fd, POLLIN, until - w);
2027                 if (r < 0) {
2028                         if (ERRNO_IS_TRANSIENT(r))
2029                                 continue;
2030                         return log_error_errno(r, "Failed to watch inotify: %m");
2031                 }
2032
2033                 (void) flush_fd(inotify_fd);
2034         }
2035 }
2036
2037 static int calculate_initial_image_size(UserRecord *h, int image_fd, const char *fstype, uint64_t *ret) {
2038         uint64_t upper_boundary, lower_boundary;
2039         struct statfs sfs;
2040
2041         assert(h);
2042         assert(image_fd >= 0);
2043         assert(ret);
2044
2045         if (fstatfs(image_fd, &sfs) < 0)
2046                 return log_error_errno(errno, "statfs() on image failed: %m");
2047
2048         upper_boundary = DISK_SIZE_ROUND_DOWN((uint64_t) sfs.f_bsize * sfs.f_bavail);
2049
2050         if (h->disk_size != UINT64_MAX)
2051                 *ret = MIN(DISK_SIZE_ROUND_DOWN(h->disk_size), upper_boundary);
2052         else if (h->disk_size_relative == UINT64_MAX) {
2053
2054                 if (upper_boundary > UINT64_MAX / USER_DISK_SIZE_DEFAULT_PERCENT)
2055                         return log_error_errno(SYNTHETIC_ERRNO(EOVERFLOW), "Disk size too large.");
2056
2057                 *ret = DISK_SIZE_ROUND_DOWN(upper_boundary * USER_DISK_SIZE_DEFAULT_PERCENT / 100);
2058
2059                 log_info("Sizing home to %u%% of available disk space, which is %s.",
2060                          USER_DISK_SIZE_DEFAULT_PERCENT,
2061                          FORMAT_BYTES(*ret));
2062         } else {
2063                 *ret = DISK_SIZE_ROUND_DOWN((uint64_t) ((double) upper_boundary * (double) CLAMP(h->disk_size_relative, 0U, UINT32_MAX) / (double) UINT32_MAX));
2064
2065                 log_info("Sizing home to %" PRIu64 ".%01" PRIu64 "%% of available disk space, which is %s.",
2066                          (h->disk_size_relative * 100) / UINT32_MAX,
2067                          ((h->disk_size_relative * 1000) / UINT32_MAX) % 10,
2068                          FORMAT_BYTES(*ret));
2069         }
2070
2071         lower_boundary = minimal_size_by_fs_name(fstype);
2072         if (lower_boundary != UINT64_MAX) {
2073                 assert(GPT_LUKS2_OVERHEAD < UINT64_MAX - lower_boundary);
2074                 lower_boundary += GPT_LUKS2_OVERHEAD;
2075         }
2076         if (lower_boundary == UINT64_MAX || lower_boundary < USER_DISK_SIZE_MIN)
2077                 lower_boundary = USER_DISK_SIZE_MIN;
2078
2079         if (*ret < lower_boundary)
2080                 *ret = lower_boundary;
2081
2082         return 0;
2083 }
2084
2085 static int home_truncate(
2086                 UserRecord *h,
2087                 int fd,
2088                 uint64_t size) {
2089
2090         bool trunc;
2091         int r;
2092
2093         assert(h);
2094         assert(fd >= 0);
2095
2096         trunc = user_record_luks_discard(h);
2097         if (!trunc) {
2098                 r = fallocate(fd, 0, 0, size);
2099                 if (r < 0 && ERRNO_IS_NOT_SUPPORTED(errno)) {
2100                         /* Some file systems do not support fallocate(), let's gracefully degrade
2101                          * (ZFS, reiserfs, …) and fall back to truncation */
2102                         log_notice_errno(errno, "Backing file system does not support fallocate(), falling back to ftruncate(), i.e. implicitly using non-discard mode.");
2103                         trunc = true;
2104                 }
2105         }
2106
2107         if (trunc)
2108                 r = ftruncate(fd, size);
2109
2110         if (r < 0) {
2111                 if (ERRNO_IS_DISK_SPACE(errno)) {
2112                         log_debug_errno(errno, "Not enough disk space to allocate home of size %s.", FORMAT_BYTES(size));
2113                         return -ENOSPC; /* make recognizable */
2114                 }
2115
2116                 return log_error_errno(errno, "Failed to truncate home image: %m");
2117         }
2118
2119         return !trunc; /* Return == 0 if we managed to truncate, > 0 if we managed to allocate */
2120 }
2121
2122 int home_create_luks(
2123                 UserRecord *h,
2124                 HomeSetup *setup,
2125                 const PasswordCache *cache,
2126                 char **effective_passwords,
2127                 UserRecord **ret_home) {
2128
2129         _cleanup_free_ char *subdir = NULL, *disk_uuid_path = NULL;
2130         uint64_t encrypted_size,
2131                 host_size = 0, partition_offset = 0, partition_size = 0; /* Unnecessary initialization to appease gcc */
2132         _cleanup_(user_record_unrefp) UserRecord *new_home = NULL;
2133         sd_id128_t partition_uuid, fs_uuid, luks_uuid, disk_uuid;
2134         _cleanup_close_ int mount_fd = -EBADF;
2135         const char *fstype, *ip;
2136         struct statfs sfs;
2137         int r;
2138         _cleanup_strv_free_ char **extra_mkfs_options = NULL;
2139
2140         assert(h);
2141         assert(h->storage < 0 || h->storage == USER_LUKS);
2142         assert(setup);
2143         assert(!setup->temporary_image_path);
2144         assert(setup->image_fd < 0);
2145         assert(ret_home);
2146
2147         r = dlopen_cryptsetup();
2148         if (r < 0)
2149                 return r;
2150
2151         assert_se(ip = user_record_image_path(h));
2152
2153         fstype = user_record_file_system_type(h);
2154         if (!supported_fstype(fstype))
2155                 return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "Unsupported file system type: %s", fstype);
2156
2157         r = mkfs_exists(fstype);
2158         if (r < 0)
2159                 return log_error_errno(r, "Failed to check if mkfs binary for %s exists: %m", fstype);
2160         if (r == 0) {
2161                 if (h->file_system_type || streq(fstype, "ext4") || !supported_fstype("ext4"))
2162                         return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "mkfs binary for file system type %s does not exist.", fstype);
2163
2164                 /* If the record does not explicitly declare a file system to use, and the compiled-in
2165                  * default does not actually exist, than do an automatic fallback onto ext4, as the baseline
2166                  * fs of Linux. We won't search for a working fs type here beyond ext4, i.e. nothing fancier
2167                  * than a single, conservative fallback to baseline. This should be useful in minimal
2168                  * environments where mkfs.btrfs or so are not made available, but mkfs.ext4 as Linux' most
2169                  * boring, most basic fs is. */
2170                 log_info("Formatting tool for compiled-in default file system %s not available, falling back to ext4 instead.", fstype);
2171                 fstype = "ext4";
2172         }
2173
2174         if (sd_id128_is_null(h->partition_uuid)) {
2175                 r = sd_id128_randomize(&partition_uuid);
2176                 if (r < 0)
2177                         return log_error_errno(r, "Failed to acquire partition UUID: %m");
2178         } else
2179                 partition_uuid = h->partition_uuid;
2180
2181         if (sd_id128_is_null(h->luks_uuid)) {
2182                 r = sd_id128_randomize(&luks_uuid);
2183                 if (r < 0)
2184                         return log_error_errno(r, "Failed to acquire LUKS UUID: %m");
2185         } else
2186                 luks_uuid = h->luks_uuid;
2187
2188         if (sd_id128_is_null(h->file_system_uuid)) {
2189                 r = sd_id128_randomize(&fs_uuid);
2190                 if (r < 0)
2191                         return log_error_errno(r, "Failed to acquire file system UUID: %m");
2192         } else
2193                 fs_uuid = h->file_system_uuid;
2194
2195         r = make_dm_names(h, setup);
2196         if (r < 0)
2197                 return r;
2198
2199         r = access(setup->dm_node, F_OK);
2200         if (r < 0) {
2201                 if (errno != ENOENT)
2202                         return log_error_errno(errno, "Failed to determine whether %s exists: %m", setup->dm_node);
2203         } else
2204                 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Device mapper device %s already exists, refusing.", setup->dm_node);
2205
2206         if (path_startswith(ip, "/dev/")) {
2207                 _cleanup_free_ char *sysfs = NULL;
2208                 uint64_t block_device_size;
2209                 struct stat st;
2210
2211                 /* Let's place the home directory on a real device, i.e. an USB stick or such */
2212
2213                 setup->image_fd = open_image_file(h, ip, &st);
2214                 if (setup->image_fd < 0)
2215                         return setup->image_fd;
2216
2217                 if (!S_ISBLK(st.st_mode))
2218                         return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Device is not a block device, refusing.");
2219
2220                 if (asprintf(&sysfs, "/sys/dev/block/" DEVNUM_FORMAT_STR "/partition", DEVNUM_FORMAT_VAL(st.st_rdev)) < 0)
2221                         return log_oom();
2222                 if (access(sysfs, F_OK) < 0) {
2223                         if (errno != ENOENT)
2224                                 return log_error_errno(errno, "Failed to check whether %s exists: %m", sysfs);
2225                 } else
2226                         return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Operating on partitions is currently not supported, sorry. Please specify a top-level block device.");
2227
2228                 if (flock(setup->image_fd, LOCK_EX) < 0) /* make sure udev doesn't read from it while we operate on the device */
2229                         return log_error_errno(errno, "Failed to lock block device %s: %m", ip);
2230
2231                 if (ioctl(setup->image_fd, BLKGETSIZE64, &block_device_size) < 0)
2232                         return log_error_errno(errno, "Failed to read block device size: %m");
2233
2234                 if (h->disk_size == UINT64_MAX) {
2235
2236                         /* If a relative disk size is requested, apply it relative to the block device size */
2237                         if (h->disk_size_relative < UINT32_MAX)
2238                                 host_size = CLAMP(DISK_SIZE_ROUND_DOWN(block_device_size * h->disk_size_relative / UINT32_MAX),
2239                                                   USER_DISK_SIZE_MIN, USER_DISK_SIZE_MAX);
2240                         else
2241                                 host_size = block_device_size; /* Otherwise, take the full device */
2242
2243                 } else if (h->disk_size > block_device_size)
2244                         return log_error_errno(SYNTHETIC_ERRNO(EMSGSIZE), "Selected disk size larger than backing block device, refusing.");
2245                 else
2246                         host_size = DISK_SIZE_ROUND_DOWN(h->disk_size);
2247
2248                 if (!supported_fs_size(fstype, LESS_BY(host_size, GPT_LUKS2_OVERHEAD)))
2249                         return log_error_errno(SYNTHETIC_ERRNO(ERANGE),
2250                                                "Selected file system size too small for %s.", fstype);
2251
2252                 /* After creation we should reference this partition by its UUID instead of the block
2253                  * device. That's preferable since the user might have specified a device node such as
2254                  * /dev/sdb to us, which might look very different when replugged. */
2255                 if (asprintf(&disk_uuid_path, "/dev/disk/by-uuid/" SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(luks_uuid)) < 0)
2256                         return log_oom();
2257
2258                 if (user_record_luks_discard(h) || user_record_luks_offline_discard(h)) {
2259                         /* If we want online or offline discard, discard once before we start using things. */
2260
2261                         if (ioctl(setup->image_fd, BLKDISCARD, (uint64_t[]) { 0, block_device_size }) < 0)
2262                                 log_full_errno(errno == EOPNOTSUPP ? LOG_DEBUG : LOG_WARNING, errno,
2263                                                "Failed to issue full-device BLKDISCARD on device, ignoring: %m");
2264                         else
2265                                 log_info("Full device discard completed.");
2266                 }
2267         } else {
2268                 _cleanup_free_ char *t = NULL;
2269
2270                 r = mkdir_parents(ip, 0755);
2271                 if (r < 0)
2272                         return log_error_errno(r, "Failed to create parent directory of %s: %m", ip);
2273
2274                 r = tempfn_random(ip, "homework", &t);
2275                 if (r < 0)
2276                         return log_error_errno(r, "Failed to derive temporary file name for %s: %m", ip);
2277
2278                 setup->image_fd = open(t, O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW, 0600);
2279                 if (setup->image_fd < 0)
2280                         return log_error_errno(errno, "Failed to create home image %s: %m", t);
2281
2282                 setup->temporary_image_path = TAKE_PTR(t);
2283
2284                 r = chattr_full(setup->image_fd, NULL, FS_NOCOW_FL|FS_NOCOMP_FL, FS_NOCOW_FL|FS_NOCOMP_FL, NULL, NULL, CHATTR_FALLBACK_BITWISE);
2285                 if (r < 0 && r != -ENOANO) /* ENOANO → some bits didn't work; which we skip logging about because chattr_full() already debug logs about those flags */
2286                         log_full_errno(ERRNO_IS_NOT_SUPPORTED(r) ? LOG_DEBUG : LOG_WARNING, r,
2287                                        "Failed to set file attributes on %s, ignoring: %m", setup->temporary_image_path);
2288
2289                 r = calculate_initial_image_size(h, setup->image_fd, fstype, &host_size);
2290                 if (r < 0)
2291                         return r;
2292
2293                 r = resize_image_loop(h, setup, 0, host_size, &host_size);
2294                 if (r < 0)
2295                         return r;
2296
2297                 log_info("Allocating image file completed.");
2298         }
2299
2300         r = make_partition_table(
2301                         setup->image_fd,
2302                         user_record_luks_sector_size(h),
2303                         user_record_user_name_and_realm(h),
2304                         partition_uuid,
2305                         &partition_offset,
2306                         &partition_size,
2307                         &disk_uuid);
2308         if (r < 0)
2309                 return r;
2310
2311         log_info("Writing of partition table completed.");
2312
2313         r = loop_device_make(
2314                         setup->image_fd,
2315                         O_RDWR,
2316                         partition_offset,
2317                         partition_size,
2318                         user_record_luks_sector_size(h),
2319                         0,
2320                         LOCK_EX,
2321                         &setup->loop);
2322         if (r < 0) {
2323                 if (r == -ENOENT) { /* this means /dev/loop-control doesn't exist, i.e. we are in a container
2324                                      * or similar and loopback bock devices are not available, return a
2325                                      * recognizable error in this case. */
2326                         log_error_errno(r, "Loopback block device support is not available on this system.");
2327                         return -ENOLINK; /* Make recognizable */
2328                 }
2329
2330                 return log_error_errno(r, "Failed to set up loopback device for %s: %m", setup->temporary_image_path);
2331         }
2332
2333         log_info("Setting up loopback device %s completed.", setup->loop->node ?: ip);
2334
2335         r = luks_format(setup->loop->node,
2336                         setup->dm_name,
2337                         luks_uuid,
2338                         user_record_user_name_and_realm(h),
2339                         cache,
2340                         effective_passwords,
2341                         user_record_luks_discard(h) || user_record_luks_offline_discard(h),
2342                         h,
2343                         &setup->crypt_device);
2344         if (r < 0)
2345                 return r;
2346
2347         setup->undo_dm = true;
2348
2349         r = block_get_size_by_path(setup->dm_node, &encrypted_size);
2350         if (r < 0)
2351                 return log_error_errno(r, "Failed to get encrypted block device size: %m");
2352
2353         log_info("Setting up LUKS device %s completed.", setup->dm_node);
2354
2355         r = mkfs_options_from_env("HOME", fstype, &extra_mkfs_options);
2356         if (r < 0)
2357                 return log_error_errno(r, "Failed to determine mkfs command line options for '%s': %m", fstype);
2358
2359         r = make_filesystem(setup->dm_node,
2360                             fstype,
2361                             user_record_user_name_and_realm(h),
2362                             /* root = */ NULL,
2363                             fs_uuid,
2364                             user_record_luks_discard(h),
2365                             /* quiet = */ true,
2366                             /* sector_size = */ 0,
2367                             extra_mkfs_options);
2368         if (r < 0)
2369                 return r;
2370
2371         log_info("Formatting file system completed.");
2372
2373         r = home_unshare_and_mount(setup->dm_node, fstype, user_record_luks_discard(h), user_record_mount_flags(h), h->luks_extra_mount_options);
2374         if (r < 0)
2375                 return r;
2376
2377         setup->undo_mount = true;
2378
2379         subdir = path_join(HOME_RUNTIME_WORK_DIR, user_record_user_name_and_realm(h));
2380         if (!subdir)
2381                 return log_oom();
2382
2383         /* Prefer using a btrfs subvolume if we can, fall back to directory otherwise */
2384         r = btrfs_subvol_make_fallback(subdir, 0700);
2385         if (r < 0)
2386                 return log_error_errno(r, "Failed to create user directory in mounted image file: %m");
2387
2388         setup->root_fd = open(subdir, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
2389         if (setup->root_fd < 0)
2390                 return log_error_errno(errno, "Failed to open user directory in mounted image file: %m");
2391
2392         (void) home_shift_uid(setup->root_fd, NULL, UID_NOBODY, h->uid, &mount_fd);
2393
2394         if (mount_fd >= 0) {
2395                 /* If we have established a new mount, then we can use that as new root fd to our home directory. */
2396                 safe_close(setup->root_fd);
2397
2398                 setup->root_fd = fd_reopen(mount_fd, O_RDONLY|O_CLOEXEC|O_DIRECTORY);
2399                 if (setup->root_fd < 0)
2400                         return log_error_errno(setup->root_fd, "Unable to convert mount fd into proper directory fd: %m");
2401
2402                 mount_fd = safe_close(mount_fd);
2403         }
2404
2405         r = home_populate(h, setup->root_fd);
2406         if (r < 0)
2407                 return r;
2408
2409         r = home_sync_and_statfs(setup->root_fd, &sfs);
2410         if (r < 0)
2411                 return r;
2412
2413         r = user_record_clone(h, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_LOG|USER_RECORD_PERMISSIVE, &new_home);
2414         if (r < 0)
2415                 return log_error_errno(r, "Failed to clone record: %m");
2416
2417         r = user_record_add_binding(
2418                         new_home,
2419                         USER_LUKS,
2420                         disk_uuid_path ?: ip,
2421                         partition_uuid,
2422                         luks_uuid,
2423                         fs_uuid,
2424                         sym_crypt_get_cipher(setup->crypt_device),
2425                         sym_crypt_get_cipher_mode(setup->crypt_device),
2426                         luks_volume_key_size_convert(setup->crypt_device),
2427                         fstype,
2428                         NULL,
2429                         h->uid,
2430                         (gid_t) h->uid);
2431         if (r < 0)
2432                 return log_error_errno(r, "Failed to add binding to record: %m");
2433
2434         if (user_record_luks_offline_discard(h)) {
2435                 r = run_fitrim(setup->root_fd);
2436                 if (r < 0)
2437                         return r;
2438         }
2439
2440         setup->root_fd = safe_close(setup->root_fd);
2441
2442         r = home_setup_undo_mount(setup, LOG_ERR);
2443         if (r < 0)
2444                 return r;
2445
2446         r = home_setup_undo_dm(setup, LOG_ERR);
2447         if (r < 0)
2448                 return r;
2449
2450         setup->loop = loop_device_unref(setup->loop);
2451
2452         if (!user_record_luks_offline_discard(h)) {
2453                 r= run_fallocate(setup->image_fd, NULL /* refresh stat() data */);
2454                 if (r < 0)
2455                         return r;
2456         }
2457
2458         /* Sync everything to disk before we move things into place under the final name. */
2459         if (fsync(setup->image_fd) < 0)
2460                 return log_error_errno(r, "Failed to synchronize image to disk: %m");
2461
2462         if (disk_uuid_path)
2463                 /* Reread partition table if this is a block device */
2464                 (void) ioctl(setup->image_fd, BLKRRPART, 0);
2465         else {
2466                 assert(setup->temporary_image_path);
2467
2468                 if (rename(setup->temporary_image_path, ip) < 0)
2469                         return log_error_errno(errno, "Failed to rename image file: %m");
2470
2471                 setup->temporary_image_path = mfree(setup->temporary_image_path);
2472
2473                 /* If we operate on a file, sync the containing directory too. */
2474                 r = fsync_directory_of_file(setup->image_fd);
2475                 if (r < 0)
2476                         return log_error_errno(r, "Failed to synchronize directory of image file to disk: %m");
2477
2478                 log_info("Moved image file into place.");
2479         }
2480
2481         /* Let's close the image fd now. If we are operating on a real block device this will release the BSD
2482          * lock that ensures udev doesn't interfere with what we are doing */
2483         setup->image_fd = safe_close(setup->image_fd);
2484
2485         if (disk_uuid_path)
2486                 (void) wait_for_devlink(disk_uuid_path);
2487
2488         log_info("Creation completed.");
2489
2490         print_size_summary(host_size, encrypted_size, &sfs);
2491
2492         log_debug("GPT + LUKS2 overhead is %" PRIu64 " (expected %" PRIu64 ")", host_size - encrypted_size, GPT_LUKS2_OVERHEAD);
2493
2494         *ret_home = TAKE_PTR(new_home);
2495         return 0;
2496 }
2497
2498 int home_get_state_luks(UserRecord *h, HomeSetup *setup) {
2499         int r;
2500
2501         assert(h);
2502         assert(setup);
2503
2504         r = make_dm_names(h, setup);
2505         if (r < 0)
2506                 return r;
2507
2508         r = access(setup->dm_node, F_OK);
2509         if (r < 0 && errno != ENOENT)
2510                 return log_error_errno(errno, "Failed to determine whether %s exists: %m", setup->dm_node);
2511
2512         return r >= 0;
2513 }
2514
2515 enum {
2516         CAN_RESIZE_ONLINE,
2517         CAN_RESIZE_OFFLINE,
2518 };
2519
2520 static int can_resize_fs(int fd, uint64_t old_size, uint64_t new_size) {
2521         struct statfs sfs;
2522
2523         assert(fd >= 0);
2524
2525         /* Filter out bogus requests early */
2526         if (old_size == 0 || old_size == UINT64_MAX ||
2527             new_size == 0 || new_size == UINT64_MAX)
2528                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid resize parameters.");
2529
2530         if ((old_size & 511) != 0 || (new_size & 511) != 0)
2531                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Resize parameters not multiple of 512.");
2532
2533         if (fstatfs(fd, &sfs) < 0)
2534                 return log_error_errno(errno, "Failed to fstatfs() file system: %m");
2535
2536         if (is_fs_type(&sfs, BTRFS_SUPER_MAGIC)) {
2537
2538                 if (new_size < BTRFS_MINIMAL_SIZE)
2539                         return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for btrfs (needs to be 256M at least.");
2540
2541                 /* btrfs can grow and shrink online */
2542
2543         } else if (is_fs_type(&sfs, XFS_SB_MAGIC)) {
2544
2545                 if (new_size < XFS_MINIMAL_SIZE)
2546                         return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for xfs (needs to be 14M at least).");
2547
2548                 /* XFS can grow, but not shrink */
2549                 if (new_size < old_size)
2550                         return log_error_errno(SYNTHETIC_ERRNO(EMSGSIZE), "Shrinking this type of file system is not supported.");
2551
2552         } else if (is_fs_type(&sfs, EXT4_SUPER_MAGIC)) {
2553
2554                 if (new_size < EXT4_MINIMAL_SIZE)
2555                         return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for ext4 (needs to be 1M at least).");
2556
2557                 /* ext4 can grow online, and shrink offline */
2558                 if (new_size < old_size)
2559                         return CAN_RESIZE_OFFLINE;
2560
2561         } else
2562                 return log_error_errno(SYNTHETIC_ERRNO(ESOCKTNOSUPPORT), "Resizing this type of file system is not supported.");
2563
2564         return CAN_RESIZE_ONLINE;
2565 }
2566
2567 static int ext4_offline_resize_fs(
2568                 HomeSetup *setup,
2569                 uint64_t new_size,
2570                 bool discard,
2571                 unsigned long flags,
2572                 const char *extra_mount_options) {
2573
2574         _cleanup_free_ char *size_str = NULL;
2575         bool re_open = false, re_mount = false;
2576         pid_t resize_pid, fsck_pid;
2577         int r, exit_status;
2578
2579         assert(setup);
2580         assert(setup->dm_node);
2581
2582         /* First, unmount the file system */
2583         if (setup->root_fd >= 0) {
2584                 setup->root_fd = safe_close(setup->root_fd);
2585                 re_open = true;
2586         }
2587
2588         if (setup->undo_mount) {
2589                 r = home_setup_undo_mount(setup, LOG_ERR);
2590                 if (r < 0)
2591                         return r;
2592
2593                 re_mount = true;
2594         }
2595
2596         log_info("Temporary unmounting of file system completed.");
2597
2598         /* resize2fs requires that the file system is force checked first, do so. */
2599         r = safe_fork("(e2fsck)",
2600                       FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_STDOUT_TO_STDERR|FORK_CLOSE_ALL_FDS,
2601                       &fsck_pid);
2602         if (r < 0)
2603                 return r;
2604         if (r == 0) {
2605                 /* Child */
2606                 execlp("e2fsck" ,"e2fsck", "-fp", setup->dm_node, NULL);
2607                 log_open();
2608                 log_error_errno(errno, "Failed to execute e2fsck: %m");
2609                 _exit(EXIT_FAILURE);
2610         }
2611
2612         exit_status = wait_for_terminate_and_check("e2fsck", fsck_pid, WAIT_LOG_ABNORMAL);
2613         if (exit_status < 0)
2614                 return exit_status;
2615         if ((exit_status & ~FSCK_ERROR_CORRECTED) != 0) {
2616                 log_warning("e2fsck failed with exit status %i.", exit_status);
2617
2618                 if ((exit_status & (FSCK_SYSTEM_SHOULD_REBOOT|FSCK_ERRORS_LEFT_UNCORRECTED)) != 0)
2619                         return log_error_errno(SYNTHETIC_ERRNO(EIO), "File system is corrupted, refusing.");
2620
2621                 log_warning("Ignoring fsck error.");
2622         }
2623
2624         log_info("Forced file system check completed.");
2625
2626         /* We use 512 sectors here, because resize2fs doesn't do byte sizes */
2627         if (asprintf(&size_str, "%" PRIu64 "s", new_size / 512) < 0)
2628                 return log_oom();
2629
2630         /* Resize the thing */
2631         r = safe_fork("(e2resize)",
2632                       FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_WAIT|FORK_STDOUT_TO_STDERR|FORK_CLOSE_ALL_FDS,
2633                       &resize_pid);
2634         if (r < 0)
2635                 return r;
2636         if (r == 0) {
2637                 /* Child */
2638                 execlp("resize2fs" ,"resize2fs", setup->dm_node, size_str, NULL);
2639                 log_open();
2640                 log_error_errno(errno, "Failed to execute resize2fs: %m");
2641                 _exit(EXIT_FAILURE);
2642         }
2643
2644         log_info("Offline file system resize completed.");
2645
2646         /* Re-establish mounts and reopen the directory */
2647         if (re_mount) {
2648                 r = home_mount_node(setup->dm_node, "ext4", discard, flags, extra_mount_options);
2649                 if (r < 0)
2650                         return r;
2651
2652                 setup->undo_mount = true;
2653         }
2654
2655         if (re_open) {
2656                 setup->root_fd = open(HOME_RUNTIME_WORK_DIR, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
2657                 if (setup->root_fd < 0)
2658                         return log_error_errno(errno, "Failed to reopen file system: %m");
2659         }
2660
2661         log_info("File system mounted again.");
2662
2663         return 0;
2664 }
2665
2666 static int prepare_resize_partition(
2667                 int fd,
2668                 uint64_t partition_offset,
2669                 uint64_t old_partition_size,
2670                 sd_id128_t *ret_disk_uuid,
2671                 struct fdisk_table **ret_table,
2672                 struct fdisk_partition **ret_partition) {
2673
2674         _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
2675         _cleanup_(fdisk_unref_tablep) struct fdisk_table *t = NULL;
2676         _cleanup_free_ char *disk_uuid_as_string = NULL;
2677         struct fdisk_partition *found = NULL;
2678         sd_id128_t disk_uuid;
2679         size_t n_partitions;
2680         int r;
2681
2682         assert(fd >= 0);
2683         assert(ret_disk_uuid);
2684         assert(ret_table);
2685
2686         assert((partition_offset & 511) == 0);
2687         assert((old_partition_size & 511) == 0);
2688         assert(UINT64_MAX - old_partition_size >= partition_offset);
2689
2690         if (partition_offset == 0) {
2691                 /* If the offset is at the beginning we assume no partition table, let's exit early. */
2692                 log_debug("Not rewriting partition table, operating on naked device.");
2693                 *ret_disk_uuid = SD_ID128_NULL;
2694                 *ret_table = NULL;
2695                 *ret_partition = NULL;
2696                 return 0;
2697         }
2698
2699         r = fdisk_new_context_fd(fd, /* read_only= */ false, UINT32_MAX, &c);
2700         if (r < 0)
2701                 return log_error_errno(r, "Failed to open device: %m");
2702
2703         if (!fdisk_is_labeltype(c, FDISK_DISKLABEL_GPT))
2704                 return log_error_errno(SYNTHETIC_ERRNO(ENOMEDIUM), "Disk has no GPT partition table.");
2705
2706         r = fdisk_get_disklabel_id(c, &disk_uuid_as_string);
2707         if (r < 0)
2708                 return log_error_errno(r, "Failed to acquire disk UUID: %m");
2709
2710         r = sd_id128_from_string(disk_uuid_as_string, &disk_uuid);
2711         if (r < 0)
2712                 return log_error_errno(r, "Failed parse disk UUID: %m");
2713
2714         r = fdisk_get_partitions(c, &t);
2715         if (r < 0)
2716                 return log_error_errno(r, "Failed to acquire partition table: %m");
2717
2718         n_partitions = fdisk_table_get_nents(t);
2719         for (size_t i = 0; i < n_partitions; i++)  {
2720                 struct fdisk_partition *p;
2721
2722                 p = fdisk_table_get_partition(t, i);
2723                 if (!p)
2724                         return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to read partition metadata: %m");
2725
2726                 if (fdisk_partition_is_used(p) <= 0)
2727                         continue;
2728                 if (fdisk_partition_has_start(p) <= 0 || fdisk_partition_has_size(p) <= 0 || fdisk_partition_has_end(p) <= 0)
2729                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Found partition without a size.");
2730
2731                 if (fdisk_partition_get_start(p) == partition_offset / 512U &&
2732                     fdisk_partition_get_size(p) == old_partition_size / 512U) {
2733
2734                         if (found)
2735                                 return log_error_errno(SYNTHETIC_ERRNO(ENOTUNIQ), "Partition found twice, refusing.");
2736
2737                         found = p;
2738                 } else if (fdisk_partition_get_end(p) > partition_offset / 512U)
2739                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Can't extend, not last partition in image.");
2740         }
2741
2742         if (!found)
2743                 return log_error_errno(SYNTHETIC_ERRNO(ENOPKG), "Failed to find matching partition to resize.");
2744
2745         *ret_disk_uuid = disk_uuid;
2746         *ret_table = TAKE_PTR(t);
2747         *ret_partition = found;
2748
2749         return 1;
2750 }
2751
2752 static int get_maximum_partition_size(
2753                 int fd,
2754                 struct fdisk_partition *p,
2755                 uint64_t *ret_maximum_partition_size) {
2756
2757         _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
2758         uint64_t start_lba, start, last_lba, end;
2759         int r;
2760
2761         assert(fd >= 0);
2762         assert(p);
2763         assert(ret_maximum_partition_size);
2764
2765         c = fdisk_new_context();
2766         if (!c)
2767                 return log_oom();
2768
2769         r = fdisk_assign_device(c, FORMAT_PROC_FD_PATH(fd), 0);
2770         if (r < 0)
2771                 return log_error_errno(r, "Failed to open device: %m");
2772
2773         start_lba = fdisk_partition_get_start(p);
2774         assert(start_lba <= UINT64_MAX/512);
2775         start = start_lba * 512;
2776
2777         last_lba = fdisk_get_last_lba(c); /* One sector before boundary where usable space ends */
2778         assert(last_lba < UINT64_MAX/512);
2779         end = DISK_SIZE_ROUND_DOWN((last_lba + 1) * 512); /* Round down to multiple of 4K */
2780
2781         if (start > end)
2782                 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Last LBA is before partition start.");
2783
2784         *ret_maximum_partition_size = DISK_SIZE_ROUND_DOWN(end - start);
2785
2786         return 1;
2787 }
2788
2789 static int ask_cb(struct fdisk_context *c, struct fdisk_ask *ask, void *userdata) {
2790         char *result;
2791
2792         assert(c);
2793
2794         switch (fdisk_ask_get_type(ask)) {
2795
2796         case FDISK_ASKTYPE_STRING:
2797                 result = new(char, 37);
2798                 if (!result)
2799                         return log_oom();
2800
2801                 fdisk_ask_string_set_result(ask, sd_id128_to_uuid_string(*(sd_id128_t*) userdata, result));
2802                 break;
2803
2804         default:
2805                 log_debug("Unexpected question from libfdisk, ignoring.");
2806         }
2807
2808         return 0;
2809 }
2810
2811 static int apply_resize_partition(
2812                 int fd,
2813                 sd_id128_t disk_uuids,
2814                 struct fdisk_table *t,
2815                 struct fdisk_partition *p,
2816                 size_t new_partition_size) {
2817
2818         _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
2819         _cleanup_free_ void *two_zero_lbas = NULL;
2820         uint32_t ssz;
2821         ssize_t n;
2822         int r;
2823
2824         assert(fd >= 0);
2825         assert(!t == !p);
2826
2827         if (!t) /* no partition table to apply, exit early */
2828                 return 0;
2829
2830         assert(p);
2831
2832         /* Before writing our partition patch the final size in */
2833         r = fdisk_partition_size_explicit(p, 1);
2834         if (r < 0)
2835                 return log_error_errno(r, "Failed to enable explicit partition size: %m");
2836
2837         r = fdisk_partition_set_size(p, new_partition_size / 512U);
2838         if (r < 0)
2839                 return log_error_errno(r, "Failed to change partition size: %m");
2840
2841         r = probe_sector_size(fd, &ssz);
2842         if (r < 0)
2843                 return log_error_errno(r, "Failed to determine current sector size: %m");
2844
2845         two_zero_lbas = malloc0(ssz * 2);
2846         if (!two_zero_lbas)
2847                 return log_oom();
2848
2849         /* libfdisk appears to get confused by the existing PMBR. Let's explicitly flush it out. */
2850         n = pwrite(fd, two_zero_lbas, ssz * 2, 0);
2851         if (n < 0)
2852                 return log_error_errno(errno, "Failed to wipe partition table: %m");
2853         if ((size_t) n != ssz * 2)
2854                 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while wiping partition table.");
2855
2856         r = fdisk_new_context_fd(fd, /* read_only= */ false, ssz, &c);
2857         if (r < 0)
2858                 return log_error_errno(r, "Failed to open device: %m");
2859
2860         r = fdisk_create_disklabel(c, "gpt");
2861         if (r < 0)
2862                 return log_error_errno(r, "Failed to create GPT disk label: %m");
2863
2864         r = fdisk_apply_table(c, t);
2865         if (r < 0)
2866                 return log_error_errno(r, "Failed to apply partition table: %m");
2867
2868         r = fdisk_set_ask(c, ask_cb, &disk_uuids);
2869         if (r < 0)
2870                 return log_error_errno(r, "Failed to set libfdisk query function: %m");
2871
2872         r = fdisk_set_disklabel_id(c);
2873         if (r < 0)
2874                 return log_error_errno(r, "Failed to change disklabel ID: %m");
2875
2876         r = fdisk_write_disklabel(c);
2877         if (r < 0)
2878                 return log_error_errno(r, "Failed to write disk label: %m");
2879
2880         return 1;
2881 }
2882
2883 /* Always keep at least 16M free, so that we can safely log in and update the user record while doing so */
2884 #define HOME_MIN_FREE (16U*1024U*1024U)
2885
2886 static int get_smallest_fs_size(int fd, uint64_t *ret) {
2887         uint64_t minsz, needed;
2888         struct statfs sfs;
2889
2890         assert(fd >= 0);
2891         assert(ret);
2892
2893         /* Determines the minimal disk size we might be able to shrink the file system referenced by the fd to. */
2894
2895         if (syncfs(fd) < 0) /* let's sync before we query the size, so that the values returned are accurate */
2896                 return log_error_errno(errno, "Failed to synchronize home file system: %m");
2897
2898         if (fstatfs(fd, &sfs) < 0)
2899                 return log_error_errno(errno, "Failed to statfs() home file system: %m");
2900
2901         /* Let's determine the minimal file system size of the used fstype */
2902         minsz = minimal_size_by_fs_magic(sfs.f_type);
2903         if (minsz == UINT64_MAX)
2904                 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Don't know minimum file system size of file system type '%s' of home directory.", fs_type_to_string(sfs.f_type));
2905
2906         if (minsz < USER_DISK_SIZE_MIN)
2907                 minsz = USER_DISK_SIZE_MIN;
2908
2909         if (sfs.f_bfree > sfs.f_blocks)
2910                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Detected amount of free blocks is greater than the total amount of file system blocks. Refusing.");
2911
2912         /* Calculate how much disk space is currently in use. */
2913         needed = sfs.f_blocks - sfs.f_bfree;
2914         if (needed > UINT64_MAX / sfs.f_bsize)
2915                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "File system size out of range.");
2916
2917         needed *= sfs.f_bsize;
2918
2919         /* Add some safety margin of free space we'll always keep */
2920         if (needed > UINT64_MAX - HOME_MIN_FREE) /* Check for overflow */
2921                 needed = UINT64_MAX;
2922         else
2923                 needed += HOME_MIN_FREE;
2924
2925         *ret = DISK_SIZE_ROUND_UP(MAX(needed, minsz));
2926         return 0;
2927 }
2928
2929 static int get_largest_image_size(int fd, const struct stat *st, uint64_t *ret) {
2930         uint64_t used, avail, sum;
2931         struct statfs sfs;
2932         int r;
2933
2934         assert(fd >= 0);
2935         assert(st);
2936         assert(ret);
2937
2938         /* Determines the maximum file size we might be able to grow the image file referenced by the fd to. */
2939
2940         r = stat_verify_regular(st);
2941         if (r < 0)
2942                 return log_error_errno(r, "Image file is not a regular file, refusing: %m");
2943
2944         if (syncfs(fd) < 0)
2945                 return log_error_errno(errno, "Failed to synchronize file system backing image file: %m");
2946
2947         if (fstatfs(fd, &sfs) < 0)
2948                 return log_error_errno(errno, "Failed to statfs() image file: %m");
2949
2950         used = (uint64_t) st->st_blocks * 512;
2951         avail = (uint64_t) sfs.f_bsize * sfs.f_bavail;
2952
2953         if (avail > UINT64_MAX - used)
2954                 sum = UINT64_MAX;
2955         else
2956                 sum = avail + used;
2957
2958         *ret = DISK_SIZE_ROUND_DOWN(MIN(sum, USER_DISK_SIZE_MAX));
2959         return 0;
2960 }
2961
2962 static int resize_fs_loop(
2963                 UserRecord *h,
2964                 HomeSetup *setup,
2965                 int resize_type,
2966                 uint64_t old_fs_size,
2967                 uint64_t new_fs_size,
2968                 uint64_t *ret_fs_size) {
2969
2970         uint64_t current_fs_size;
2971         unsigned n_iterations = 0;
2972         int r;
2973
2974         assert(h);
2975         assert(setup);
2976         assert(setup->root_fd >= 0);
2977
2978         /* A bisection loop trying to find the closest size to what the user asked for. (Well, we bisect like
2979          * this only when we *shrink* the fs — if we grow the fs there's no need to bisect.) */
2980
2981         current_fs_size = old_fs_size;
2982         for (uint64_t lower_boundary = new_fs_size, upper_boundary = old_fs_size, try_fs_size = new_fs_size;;) {
2983                 bool worked;
2984
2985                 n_iterations++;
2986
2987                 /* Now resize the file system */
2988                 if (resize_type == CAN_RESIZE_ONLINE) {
2989                         r = resize_fs(setup->root_fd, try_fs_size, NULL);
2990                         if (r < 0) {
2991                                 if (!ERRNO_IS_DISK_SPACE(r) || new_fs_size > old_fs_size) /* Not a disk space issue? Not trying to shrink? */
2992                                         return log_error_errno(r, "Failed to resize file system: %m");
2993
2994                                 log_debug_errno(r, "Shrinking from %s to %s didn't work, not enough space for contained data.", FORMAT_BYTES(current_fs_size), FORMAT_BYTES(try_fs_size));
2995                                 worked = false;
2996                         } else {
2997                                 log_debug("Successfully resized from %s to %s.", FORMAT_BYTES(current_fs_size), FORMAT_BYTES(try_fs_size));
2998                                 current_fs_size = try_fs_size;
2999                                 worked = true;
3000                         }
3001
3002                         /* If we hit a disk space issue and are shrinking the fs, then maybe it helps to
3003                          * increase the image size. */
3004                 } else {
3005                         r = ext4_offline_resize_fs(setup, try_fs_size, user_record_luks_discard(h), user_record_mount_flags(h), h->luks_extra_mount_options);
3006                         if (r < 0)
3007                                 return r;
3008
3009                         /* For now, when we fail to shrink an ext4 image we'll not try again via the
3010                          * bisection logic. We might add that later, but given this involves shelling out
3011                          * multiple programs, it's a bit too cumbersome for my taste. */
3012
3013                         worked = true;
3014                         current_fs_size = try_fs_size;
3015                 }
3016
3017                 if (new_fs_size > old_fs_size) /* If we are growing we are done after one iteration */
3018                         break;
3019
3020                 /* If we are shrinking then let's adjust our bisection boundaries and try again. */
3021                 if (worked)
3022                         upper_boundary = MIN(upper_boundary, try_fs_size);
3023                 else
3024                         lower_boundary = MAX(lower_boundary, try_fs_size);
3025
3026                 /* OK, this attempt to shrink didn't work. Let's try between the old size and what worked. */
3027                 if (lower_boundary >= upper_boundary) {
3028                         log_debug("Image can't be shrunk further (range to try is empty).");
3029                         break;
3030                 }
3031
3032                 /* Let's find a new value to try half-way between the lower boundary and the upper boundary
3033                  * to try now. */
3034                 try_fs_size = DISK_SIZE_ROUND_DOWN(lower_boundary + (upper_boundary - lower_boundary) / 2);
3035                 if (try_fs_size <= lower_boundary || try_fs_size >= upper_boundary) {
3036                         log_debug("Image can't be shrunk further (remaining range to try too small).");
3037                         break;
3038                 }
3039         }
3040
3041         log_debug("Bisection loop completed after %u iterations.", n_iterations);
3042
3043         if (ret_fs_size)
3044                 *ret_fs_size = current_fs_size;
3045
3046         return 0;
3047 }
3048
3049 static int resize_image_loop(
3050                 UserRecord *h,
3051                 HomeSetup *setup,
3052                 uint64_t old_image_size,
3053                 uint64_t new_image_size,
3054                 uint64_t *ret_image_size) {
3055
3056         uint64_t current_image_size;
3057         unsigned n_iterations = 0;
3058         int r;
3059
3060         assert(h);
3061         assert(setup);
3062         assert(setup->image_fd >= 0);
3063
3064         /* A bisection loop trying to find the closest size to what the user asked for. (Well, we bisect like
3065          * this only when we *grow* the image — if we shrink the image then there's no need to bisect.) */
3066
3067         current_image_size = old_image_size;
3068         for (uint64_t lower_boundary = old_image_size, upper_boundary = new_image_size, try_image_size = new_image_size;;) {
3069                 bool worked;
3070
3071                 n_iterations++;
3072
3073                 r = home_truncate(h, setup->image_fd, try_image_size);
3074                 if (r < 0) {
3075                         if (!ERRNO_IS_DISK_SPACE(r) || new_image_size < old_image_size) /* Not a disk space issue? Not trying to grow? */
3076                                 return r;
3077
3078                         log_debug_errno(r, "Growing from %s to %s didn't work, not enough space on backing disk.", FORMAT_BYTES(current_image_size), FORMAT_BYTES(try_image_size));
3079                         worked = false;
3080                 } else if (r > 0) { /* Success: allocation worked */
3081                         log_debug("Resizing from %s to %s via allocation worked successfully.", FORMAT_BYTES(current_image_size), FORMAT_BYTES(try_image_size));
3082                         current_image_size = try_image_size;
3083                         worked = true;
3084                 } else { /* Success, but through truncation, not allocation. */
3085                         log_debug("Resizing from %s to %s via truncation worked successfully.", FORMAT_BYTES(old_image_size), FORMAT_BYTES(try_image_size));
3086                         current_image_size = try_image_size;
3087                         break; /* there's no point in the bisection logic if this was plain truncation and
3088                                 * not allocation, let's exit immediately. */
3089                 }
3090
3091                 if (new_image_size < old_image_size) /* If we are shrinking we are done after one iteration */
3092                         break;
3093
3094                 /* If we are growing then let's adjust our bisection boundaries and try again */
3095                 if (worked)
3096                         lower_boundary = MAX(lower_boundary, try_image_size);
3097                 else
3098                         upper_boundary = MIN(upper_boundary, try_image_size);
3099
3100                 if (lower_boundary >= upper_boundary) {
3101                         log_debug("Image can't be grown further (range to try is empty).");
3102                         break;
3103                 }
3104
3105                 try_image_size = DISK_SIZE_ROUND_DOWN(lower_boundary + (upper_boundary - lower_boundary) / 2);
3106                 if (try_image_size <= lower_boundary || try_image_size >= upper_boundary) {
3107                         log_debug("Image can't be grown further (remaining range to try too small).");
3108                         break;
3109                 }
3110         }
3111
3112         log_debug("Bisection loop completed after %u iterations.", n_iterations);
3113
3114         if (ret_image_size)
3115                 *ret_image_size = current_image_size;
3116
3117         return 0;
3118 }
3119
3120 int home_resize_luks(
3121                 UserRecord *h,
3122                 HomeSetupFlags flags,
3123                 HomeSetup *setup,
3124                 PasswordCache *cache,
3125                 UserRecord **ret_home) {
3126
3127         uint64_t old_image_size, new_image_size, old_fs_size, new_fs_size, crypto_offset, crypto_offset_bytes,
3128                 new_partition_size, smallest_fs_size, resized_fs_size;
3129         _cleanup_(user_record_unrefp) UserRecord *header_home = NULL, *embedded_home = NULL, *new_home = NULL;
3130         _cleanup_(fdisk_unref_tablep) struct fdisk_table *table = NULL;
3131         struct fdisk_partition *partition = NULL;
3132         _cleanup_close_ int opened_image_fd = -EBADF;
3133         _cleanup_free_ char *whole_disk = NULL;
3134         int r, resize_type, image_fd = -EBADF;
3135         sd_id128_t disk_uuid;
3136         const char *ip, *ipo;
3137         struct statfs sfs;
3138         struct stat st;
3139         enum {
3140                 INTENTION_DONT_KNOW = 0,    /* These happen to match the return codes of CMP() */
3141                 INTENTION_SHRINK = -1,
3142                 INTENTION_GROW = 1,
3143         } intention = INTENTION_DONT_KNOW;
3144
3145         assert(h);
3146         assert(user_record_storage(h) == USER_LUKS);
3147         assert(setup);
3148
3149         r = dlopen_cryptsetup();
3150         if (r < 0)
3151                 return r;
3152
3153         assert_se(ipo = user_record_image_path(h));
3154         ip = strdupa_safe(ipo); /* copy out since original might change later in home record object */
3155
3156         if (setup->image_fd < 0) {
3157                 setup->image_fd = open_image_file(h, NULL, &st);
3158                 if (setup->image_fd < 0)
3159                         return setup->image_fd;
3160         } else {
3161                 if (fstat(setup->image_fd, &st) < 0)
3162                         return log_error_errno(errno, "Failed to stat image file %s: %m", ip);
3163         }
3164
3165         image_fd = setup->image_fd;
3166
3167         if (S_ISBLK(st.st_mode)) {
3168                 dev_t parent;
3169
3170                 r = block_get_whole_disk(st.st_rdev, &parent);
3171                 if (r < 0)
3172                         return log_error_errno(r, "Failed to acquire whole block device for %s: %m", ip);
3173                 if (r > 0) {
3174                         /* If we shall resize a file system on a partition device, then let's figure out the
3175                          * whole disk device and operate on that instead, since we need to rewrite the
3176                          * partition table to resize the partition. */
3177
3178                         log_info("Operating on partition device %s, using parent device.", ip);
3179
3180                         opened_image_fd = r = device_open_from_devnum(S_IFBLK, parent, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK, &whole_disk);
3181                         if (r < 0)
3182                                 return log_error_errno(r, "Failed to open whole block device for %s: %m", ip);
3183
3184                         image_fd = opened_image_fd;
3185
3186                         if (fstat(image_fd, &st) < 0)
3187                                 return log_error_errno(errno, "Failed to stat whole block device %s: %m", whole_disk);
3188                 } else
3189                         log_info("Operating on whole block device %s.", ip);
3190
3191                 if (ioctl(image_fd, BLKGETSIZE64, &old_image_size) < 0)
3192                         return log_error_errno(errno, "Failed to determine size of original block device: %m");
3193
3194                 if (flock(image_fd, LOCK_EX) < 0) /* make sure udev doesn't read from it while we operate on the device */
3195                         return log_error_errno(errno, "Failed to lock block device %s: %m", ip);
3196
3197                 new_image_size = old_image_size; /* we can't resize physical block devices */
3198         } else {
3199                 r = stat_verify_regular(&st);
3200                 if (r < 0)
3201                         return log_error_errno(r, "Image %s is not a block device nor regular file: %m", ip);
3202
3203                 old_image_size = st.st_size;
3204
3205                 /* Note an asymetry here: when we operate on loopback files the specified disk size we get we
3206                  * apply onto the loopback file as a whole. When we operate on block devices we instead apply
3207                  * to the partition itself only. */
3208
3209                 if (FLAGS_SET(flags, HOME_SETUP_RESIZE_MINIMIZE)) {
3210                         new_image_size = 0;
3211                         intention = INTENTION_SHRINK;
3212                 } else {
3213                         uint64_t new_image_size_rounded;
3214
3215                         new_image_size_rounded = DISK_SIZE_ROUND_DOWN(h->disk_size);
3216
3217                         if (old_image_size >= new_image_size_rounded && old_image_size <= h->disk_size) {
3218                                 /* If exact match, or a match after we rounded down, don't do a thing */
3219                                 log_info("Image size already matching, skipping operation.");
3220                                 return 0;
3221                         }
3222
3223                         new_image_size = new_image_size_rounded;
3224                         intention = CMP(new_image_size, old_image_size); /* Is this a shrink */
3225                 }
3226         }
3227
3228         r = home_setup_luks(
3229                         h,
3230                         flags,
3231                         whole_disk,
3232                         setup,
3233                         cache,
3234                         FLAGS_SET(flags, HOME_SETUP_RESIZE_DONT_SYNC_IDENTITIES) ? NULL : &header_home);
3235         if (r < 0)
3236                 return r;
3237
3238         if (!FLAGS_SET(flags, HOME_SETUP_RESIZE_DONT_SYNC_IDENTITIES)) {
3239                 r = home_load_embedded_identity(h, setup->root_fd, header_home, USER_RECONCILE_REQUIRE_NEWER_OR_EQUAL, cache, &embedded_home, &new_home);
3240                 if (r < 0)
3241                         return r;
3242         }
3243
3244         r = home_maybe_shift_uid(h, flags, setup);
3245         if (r < 0)
3246                 return r;
3247
3248         log_info("offset = %" PRIu64 ", size = %" PRIu64 ", image = %" PRIu64, setup->partition_offset, setup->partition_size, old_image_size);
3249
3250         if ((UINT64_MAX - setup->partition_offset) < setup->partition_size ||
3251             setup->partition_offset + setup->partition_size > old_image_size)
3252                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Old partition doesn't fit in backing storage, refusing.");
3253
3254         /* Get target partition information in here for new_partition_size calculation */
3255         r = prepare_resize_partition(
3256                         image_fd,
3257                         setup->partition_offset,
3258                         setup->partition_size,
3259                         &disk_uuid,
3260                         &table,
3261                         &partition);
3262         if (r < 0)
3263                 return r;
3264
3265         if (S_ISREG(st.st_mode)) {
3266                 uint64_t partition_table_extra, largest_size;
3267
3268                 partition_table_extra = old_image_size - setup->partition_size;
3269
3270                 r = get_largest_image_size(setup->image_fd, &st, &largest_size);
3271                 if (r < 0)
3272                         return r;
3273                 if (new_image_size > largest_size)
3274                         new_image_size = largest_size;
3275
3276                 if (new_image_size < partition_table_extra)
3277                         new_image_size = partition_table_extra;
3278
3279                 new_partition_size = DISK_SIZE_ROUND_DOWN(new_image_size - partition_table_extra);
3280         } else {
3281                 assert(S_ISBLK(st.st_mode));
3282
3283                 if (FLAGS_SET(flags, HOME_SETUP_RESIZE_MINIMIZE)) {
3284                         new_partition_size = 0;
3285                         intention = INTENTION_SHRINK;
3286                 } else {
3287                         uint64_t new_partition_size_rounded = DISK_SIZE_ROUND_DOWN(h->disk_size);
3288
3289                         if (h->disk_size == UINT64_MAX && partition) {
3290                                 r = get_maximum_partition_size(image_fd, partition, &new_partition_size_rounded);
3291                                 if (r < 0)
3292                                         return r;
3293                         }
3294
3295                         if (setup->partition_size >= new_partition_size_rounded &&
3296                             setup->partition_size <= h->disk_size) {
3297                                 log_info("Partition size already matching, skipping operation.");
3298                                 return 0;
3299                         }
3300
3301                         new_partition_size = new_partition_size_rounded;
3302                         intention = CMP(new_partition_size, setup->partition_size);
3303                 }
3304         }
3305
3306         if ((UINT64_MAX - setup->partition_offset) < new_partition_size ||
3307             setup->partition_offset + new_partition_size > new_image_size)
3308                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "New partition doesn't fit into backing storage, refusing.");
3309
3310         crypto_offset = sym_crypt_get_data_offset(setup->crypt_device);
3311         if (crypto_offset > UINT64_MAX/512U)
3312                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "LUKS2 data offset out of range, refusing.");
3313         crypto_offset_bytes = (uint64_t) crypto_offset * 512U;
3314         if (setup->partition_size <= crypto_offset_bytes)
3315                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Weird, old crypto payload offset doesn't actually fit in partition size?");
3316
3317         /* Make sure at least the LUKS header fit in */
3318         if (new_partition_size <= crypto_offset_bytes) {
3319                 uint64_t add;
3320
3321                 add = DISK_SIZE_ROUND_UP(crypto_offset_bytes) - new_partition_size;
3322                 new_partition_size += add;
3323                 if (S_ISREG(st.st_mode))
3324                         new_image_size += add;
3325         }
3326
3327         old_fs_size = setup->partition_size - crypto_offset_bytes;
3328         new_fs_size = DISK_SIZE_ROUND_DOWN(new_partition_size - crypto_offset_bytes);
3329
3330         r = get_smallest_fs_size(setup->root_fd, &smallest_fs_size);
3331         if (r < 0)
3332                 return r;
3333
3334         if (new_fs_size < smallest_fs_size) {
3335                 uint64_t add;
3336
3337                 add = DISK_SIZE_ROUND_UP(smallest_fs_size) - new_fs_size;
3338                 new_fs_size += add;
3339                 new_partition_size += add;
3340                 if (S_ISREG(st.st_mode))
3341                         new_image_size += add;
3342         }
3343
3344         if (new_fs_size == old_fs_size) {
3345                 log_info("New file system size identical to old file system size, skipping operation.");
3346                 return 0;
3347         }
3348
3349         if (FLAGS_SET(flags, HOME_SETUP_RESIZE_DONT_GROW) && new_fs_size > old_fs_size) {
3350                 log_info("New file system size would be larger than old, but shrinking requested, skipping operation.");
3351                 return 0;
3352         }
3353
3354         if (FLAGS_SET(flags, HOME_SETUP_RESIZE_DONT_SHRINK) && new_fs_size < old_fs_size) {
3355                 log_info("New file system size would be smaller than old, but growing requested, skipping operation.");
3356                 return 0;
3357         }
3358
3359         if (CMP(new_fs_size, old_fs_size) != intention) {
3360                 if (intention < 0)
3361                         log_info("Shrink operation would enlarge file system, skipping operation.");
3362                 else {
3363                         assert(intention > 0);
3364                         log_info("Grow operation would shrink file system, skipping operation.");
3365                 }
3366                 return 0;
3367         }
3368
3369         /* Before we start doing anything, let's figure out if we actually can */
3370         resize_type = can_resize_fs(setup->root_fd, old_fs_size, new_fs_size);
3371         if (resize_type < 0)
3372                 return resize_type;
3373         if (resize_type == CAN_RESIZE_OFFLINE && FLAGS_SET(flags, HOME_SETUP_ALREADY_ACTIVATED))
3374                 return log_error_errno(SYNTHETIC_ERRNO(ETXTBSY), "File systems of this type can only be resized offline, but is currently online.");
3375
3376         log_info("Ready to resize image size %s %s %s, partition size %s %s %s, file system size %s %s %s.",
3377                  FORMAT_BYTES(old_image_size),
3378                  special_glyph(SPECIAL_GLYPH_ARROW_RIGHT),
3379                  FORMAT_BYTES(new_image_size),
3380                  FORMAT_BYTES(setup->partition_size),
3381                  special_glyph(SPECIAL_GLYPH_ARROW_RIGHT),
3382                  FORMAT_BYTES(new_partition_size),
3383                  FORMAT_BYTES(old_fs_size),
3384                  special_glyph(SPECIAL_GLYPH_ARROW_RIGHT),
3385                  FORMAT_BYTES(new_fs_size));
3386
3387         if (new_fs_size > old_fs_size) { /* → Grow */
3388
3389                 if (S_ISREG(st.st_mode)) {
3390                         uint64_t resized_image_size;
3391
3392                         /* Grow file size */
3393                         r = resize_image_loop(h, setup, old_image_size, new_image_size, &resized_image_size);
3394                         if (r < 0)
3395                                 return r;
3396
3397                         if (resized_image_size == old_image_size) {
3398                                 log_info("Couldn't change image size.");
3399                                 return 0;
3400                         }
3401
3402                         assert(resized_image_size > old_image_size);
3403
3404                         log_info("Growing of image file from %s to %s completed.", FORMAT_BYTES(old_image_size), FORMAT_BYTES(resized_image_size));
3405
3406                         if (resized_image_size < new_image_size) {
3407                                 uint64_t sub;
3408
3409                                 /* If the growing we managed to do is smaller than what we wanted we need to
3410                                  * adjust the partition/file system sizes we are going for, too */
3411                                 sub = new_image_size - resized_image_size;
3412                                 assert(new_partition_size >= sub);
3413                                 new_partition_size -= sub;
3414                                 assert(new_fs_size >= sub);
3415                                 new_fs_size -= sub;
3416                         }
3417
3418                         new_image_size = resized_image_size;
3419                 } else {
3420                         assert(S_ISBLK(st.st_mode));
3421                         assert(new_image_size == old_image_size);
3422                 }
3423
3424                 /* Make sure loopback device sees the new bigger size */
3425                 r = loop_device_refresh_size(setup->loop, UINT64_MAX, new_partition_size);
3426                 if (r == -ENOTTY)
3427                         log_debug_errno(r, "Device is not a loopback device, not refreshing size.");
3428                 else if (r < 0)
3429                         return log_error_errno(r, "Failed to refresh loopback device size: %m");
3430                 else
3431                         log_info("Refreshing loop device size completed.");
3432
3433                 r = apply_resize_partition(image_fd, disk_uuid, table, partition, new_partition_size);
3434                 if (r < 0)
3435                         return r;
3436                 if (r > 0)
3437                         log_info("Growing of partition completed.");
3438
3439                 if (S_ISBLK(st.st_mode) && ioctl(image_fd, BLKRRPART, 0) < 0)
3440                         log_debug_errno(errno, "BLKRRPART failed on block device, ignoring: %m");
3441
3442                 /* Tell LUKS about the new bigger size too */
3443                 r = sym_crypt_resize(setup->crypt_device, setup->dm_name, new_fs_size / 512U);
3444                 if (r < 0)
3445                         return log_error_errno(r, "Failed to grow LUKS device: %m");
3446
3447                 log_info("LUKS device growing completed.");
3448         } else {
3449                 /* → Shrink */
3450
3451                 if (!FLAGS_SET(flags, HOME_SETUP_RESIZE_DONT_SYNC_IDENTITIES)) {
3452                         r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
3453                         if (r < 0)
3454                                 return r;
3455                 }
3456
3457                 if (S_ISREG(st.st_mode)) {
3458                         if (user_record_luks_discard(h))
3459                                 /* Before we shrink, let's trim the file system, so that we need less space on disk during the shrinking */
3460                                 (void) run_fitrim(setup->root_fd);
3461                         else {
3462                                 /* If discard is off, let's ensure all backing blocks are allocated, so that our resize operation doesn't fail half-way */
3463                                 r = run_fallocate(image_fd, &st);
3464                                 if (r < 0)
3465                                         return r;
3466                         }
3467                 }
3468         }
3469
3470         /* Now try to resize the file system. The requested size might not always be possible, in which case
3471          * we'll try to get as close as we can get. The result is returned in 'resized_fs_size' */
3472         r = resize_fs_loop(h, setup, resize_type, old_fs_size, new_fs_size, &resized_fs_size);
3473         if (r < 0)
3474                 return r;
3475
3476         if (resized_fs_size == old_fs_size) {
3477                 log_info("Couldn't change file system size.");
3478                 return 0;
3479         }
3480
3481         log_info("File system resizing from %s to %s completed.", FORMAT_BYTES(old_fs_size), FORMAT_BYTES(resized_fs_size));
3482
3483         if (resized_fs_size > new_fs_size) {
3484                 uint64_t add;
3485
3486                 /* If the shrinking we managed to do is larger than what we wanted we need to adjust the partition/image sizes. */
3487                 add = resized_fs_size - new_fs_size;
3488                 new_partition_size += add;
3489                 if (S_ISREG(st.st_mode))
3490                         new_image_size += add;
3491         }
3492
3493         new_fs_size = resized_fs_size;
3494
3495         /* Immediately sync afterwards */
3496         r = home_sync_and_statfs(setup->root_fd, NULL);
3497         if (r < 0)
3498                 return r;
3499
3500         if (new_fs_size < old_fs_size) { /* → Shrink */
3501
3502                 /* Shrink the LUKS device now, matching the new file system size */
3503                 r = sym_crypt_resize(setup->crypt_device, setup->dm_name, new_fs_size / 512);
3504                 if (r < 0)
3505                         return log_error_errno(r, "Failed to shrink LUKS device: %m");
3506
3507                 log_info("LUKS device shrinking completed.");
3508
3509                 /* Refresh the loop devices size */
3510                 r = loop_device_refresh_size(setup->loop, UINT64_MAX, new_partition_size);
3511                 if (r == -ENOTTY)
3512                         log_debug_errno(r, "Device is not a loopback device, not refreshing size.");
3513                 else if (r < 0)
3514                         return log_error_errno(r, "Failed to refresh loopback device size: %m");
3515                 else
3516                         log_info("Refreshing loop device size completed.");
3517
3518                 if (S_ISREG(st.st_mode)) {
3519                         /* Shrink the image file */
3520                         if (ftruncate(image_fd, new_image_size) < 0)
3521                                 return log_error_errno(errno, "Failed to shrink image file %s: %m", ip);
3522
3523                         log_info("Shrinking of image file completed.");
3524                 } else {
3525                         assert(S_ISBLK(st.st_mode));
3526                         assert(new_image_size == old_image_size);
3527                 }
3528
3529                 r = apply_resize_partition(image_fd, disk_uuid, table, partition, new_partition_size);
3530                 if (r < 0)
3531                         return r;
3532                 if (r > 0)
3533                         log_info("Shrinking of partition completed.");
3534
3535                 if (S_ISBLK(st.st_mode) && ioctl(image_fd, BLKRRPART, 0) < 0)
3536                         log_debug_errno(errno, "BLKRRPART failed on block device, ignoring: %m");
3537
3538         } else { /* → Grow */
3539                 if (!FLAGS_SET(flags, HOME_SETUP_RESIZE_DONT_SYNC_IDENTITIES)) {
3540                         r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
3541                         if (r < 0)
3542                                 return r;
3543                 }
3544         }
3545
3546         if (!FLAGS_SET(flags, HOME_SETUP_RESIZE_DONT_SYNC_IDENTITIES)) {
3547                 r = home_store_header_identity_luks(new_home, setup, header_home);
3548                 if (r < 0)
3549                         return r;
3550
3551                 r = home_extend_embedded_identity(new_home, h, setup);
3552                 if (r < 0)
3553                         return r;
3554         }
3555
3556         if (user_record_luks_discard(h))
3557                 (void) run_fitrim(setup->root_fd);
3558
3559         r = home_sync_and_statfs(setup->root_fd, &sfs);
3560         if (r < 0)
3561                 return r;
3562
3563         if (!FLAGS_SET(flags, HOME_SETUP_RESIZE_DONT_UNDO)) {
3564                 r = home_setup_done(setup);
3565                 if (r < 0)
3566                         return r;
3567         }
3568
3569         log_info("Resizing completed.");
3570
3571         print_size_summary(new_image_size, new_fs_size, &sfs);
3572
3573         if (ret_home)
3574                 *ret_home = TAKE_PTR(new_home);
3575
3576         return 0;
3577 }
3578
3579 int home_passwd_luks(
3580                 UserRecord *h,
3581                 HomeSetupFlags flags,
3582                 HomeSetup *setup,
3583                 const PasswordCache *cache, /* the passwords acquired via PKCS#11/FIDO2 security tokens */
3584                 char **effective_passwords  /* new passwords */) {
3585
3586         size_t volume_key_size, max_key_slots, n_effective;
3587         _cleanup_(erase_and_freep) void *volume_key = NULL;
3588         struct crypt_pbkdf_type good_pbkdf, minimal_pbkdf;
3589         const char *type;
3590         char **list;
3591         int r;
3592
3593         assert(h);
3594         assert(user_record_storage(h) == USER_LUKS);
3595         assert(setup);
3596
3597         r = dlopen_cryptsetup();
3598         if (r < 0)
3599                 return r;
3600
3601         type = sym_crypt_get_type(setup->crypt_device);
3602         if (!type)
3603                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine crypto device type.");
3604
3605         r = sym_crypt_keyslot_max(type);
3606         if (r <= 0)
3607                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine number of key slots.");
3608         max_key_slots = r;
3609
3610         r = sym_crypt_get_volume_key_size(setup->crypt_device);
3611         if (r <= 0)
3612                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine volume key size.");
3613         volume_key_size = (size_t) r;
3614
3615         volume_key = malloc(volume_key_size);
3616         if (!volume_key)
3617                 return log_oom();
3618
3619         r = -ENOKEY;
3620         FOREACH_POINTER(list,
3621                         cache ? cache->keyring_passswords : NULL,
3622                         cache ? cache->pkcs11_passwords : NULL,
3623                         cache ? cache->fido2_passwords : NULL,
3624                         h->password) {
3625
3626                 r = luks_try_passwords(h, setup->crypt_device, list, volume_key, &volume_key_size, NULL);
3627                 if (r != -ENOKEY)
3628                         break;
3629         }
3630         if (r == -ENOKEY)
3631                 return log_error_errno(SYNTHETIC_ERRNO(ENOKEY), "Failed to unlock LUKS superblock with supplied passwords.");
3632         if (r < 0)
3633                 return log_error_errno(r, "Failed to unlocks LUKS superblock: %m");
3634
3635         n_effective = strv_length(effective_passwords);
3636
3637         build_good_pbkdf(&good_pbkdf, h);
3638         build_minimal_pbkdf(&minimal_pbkdf, h);
3639
3640         for (size_t i = 0; i < max_key_slots; i++) {
3641                 r = sym_crypt_keyslot_destroy(setup->crypt_device, i);
3642                 if (r < 0 && !IN_SET(r, -ENOENT, -EINVAL)) /* Returns EINVAL or ENOENT if there's no key in this slot already */
3643                         return log_error_errno(r, "Failed to destroy LUKS password: %m");
3644
3645                 if (i >= n_effective) {
3646                         if (r >= 0)
3647                                 log_info("Destroyed LUKS key slot %zu.", i);
3648                         continue;
3649                 }
3650
3651                 if (password_cache_contains(cache, effective_passwords[i])) { /* Is this a FIDO2 or PKCS#11 password? */
3652                         log_debug("Using minimal PBKDF for slot %zu", i);
3653                         r = sym_crypt_set_pbkdf_type(setup->crypt_device, &minimal_pbkdf);
3654                 } else {
3655                         log_debug("Using good PBKDF for slot %zu", i);
3656                         r = sym_crypt_set_pbkdf_type(setup->crypt_device, &good_pbkdf);
3657                 }
3658                 if (r < 0)
3659                         return log_error_errno(r, "Failed to tweak PBKDF for slot %zu: %m", i);
3660
3661                 r = sym_crypt_keyslot_add_by_volume_key(
3662                                 setup->crypt_device,
3663                                 i,
3664                                 volume_key,
3665                                 volume_key_size,
3666                                 effective_passwords[i],
3667                                 strlen(effective_passwords[i]));
3668                 if (r < 0)
3669                         return log_error_errno(r, "Failed to set up LUKS password: %m");
3670
3671                 log_info("Updated LUKS key slot %zu.", i);
3672
3673                 /* If we changed the password, then make sure to update the copy in the keyring, so that
3674                  * auto-rebalance continues to work. We only do this if we operate on an active home dir. */
3675                 if (i == 0 && FLAGS_SET(flags, HOME_SETUP_ALREADY_ACTIVATED))
3676                         upload_to_keyring(h, effective_passwords[i], NULL);
3677         }
3678
3679         return 1;
3680 }
3681
3682 int home_lock_luks(UserRecord *h, HomeSetup *setup) {
3683         const char *p;
3684         int r;
3685
3686         assert(h);
3687         assert(setup);
3688         assert(setup->root_fd < 0);
3689         assert(!setup->crypt_device);
3690
3691         r = acquire_open_luks_device(h, setup, /* graceful= */ false);
3692         if (r < 0)
3693                 return r;
3694
3695         log_info("Discovered used LUKS device %s.", setup->dm_node);
3696
3697         assert_se(p = user_record_home_directory(h));
3698         r = syncfs_path(AT_FDCWD, p);
3699         if (r < 0) /* Snake oil, but let's better be safe than sorry */
3700                 return log_error_errno(r, "Failed to synchronize file system %s: %m", p);
3701
3702         log_info("File system synchronized.");
3703
3704         /* Note that we don't invoke FIFREEZE here, it appears libcryptsetup/device-mapper already does that on its own for us */
3705
3706         r = sym_crypt_suspend(setup->crypt_device, setup->dm_name);
3707         if (r < 0)
3708                 return log_error_errno(r, "Failed to suspend cryptsetup device: %s: %m", setup->dm_node);
3709
3710         log_info("LUKS device suspended.");
3711         return 0;
3712 }
3713
3714 static int luks_try_resume(
3715                 struct crypt_device *cd,
3716                 const char *dm_name,
3717                 char **password) {
3718
3719         int r;
3720
3721         assert(cd);
3722         assert(dm_name);
3723
3724         STRV_FOREACH(pp, password) {
3725                 r = sym_crypt_resume_by_passphrase(
3726                                 cd,
3727                                 dm_name,
3728                                 CRYPT_ANY_SLOT,
3729                                 *pp,
3730                                 strlen(*pp));
3731                 if (r >= 0) {
3732                         log_info("Resumed LUKS device %s.", dm_name);
3733                         return 0;
3734                 }
3735
3736                 log_debug_errno(r, "Password %zu didn't work for resuming device: %m", (size_t) (pp - password));
3737         }
3738
3739         return -ENOKEY;
3740 }
3741
3742 int home_unlock_luks(UserRecord *h, HomeSetup *setup, const PasswordCache *cache) {
3743         char **list;
3744         int r;
3745
3746         assert(h);
3747         assert(setup);
3748         assert(!setup->crypt_device);
3749
3750         r = acquire_open_luks_device(h, setup, /* graceful= */ false);
3751         if (r < 0)
3752                 return r;
3753
3754         log_info("Discovered used LUKS device %s.", setup->dm_node);
3755
3756         r = -ENOKEY;
3757         FOREACH_POINTER(list,
3758                         cache ? cache->pkcs11_passwords : NULL,
3759                         cache ? cache->fido2_passwords : NULL,
3760                         h->password) {
3761                 r = luks_try_resume(setup->crypt_device, setup->dm_name, list);
3762                 if (r != -ENOKEY)
3763                         break;
3764         }
3765         if (r == -ENOKEY)
3766                 return log_error_errno(r, "No valid password for LUKS superblock.");
3767         if (r < 0)
3768                 return log_error_errno(r, "Failed to resume LUKS superblock: %m");
3769
3770         log_info("LUKS device resumed.");
3771         return 0;
3772 }
3773
3774 static int device_is_gone(HomeSetup *setup) {
3775         _cleanup_(sd_device_unrefp) sd_device *d = NULL;
3776         struct stat st;
3777         int r;
3778
3779         assert(setup);
3780
3781         if (!setup->dm_node)
3782                 return true;
3783
3784         if (stat(setup->dm_node, &st) < 0) {
3785                 if (errno != ENOENT)
3786                         return log_error_errno(errno, "Failed to stat block device node %s: %m", setup->dm_node);
3787
3788                 return true;
3789         }
3790
3791         r = sd_device_new_from_stat_rdev(&d, &st);
3792         if (r < 0) {
3793                 if (r != -ENODEV)
3794                         return log_error_errno(errno, "Failed to allocate device object from block device node %s: %m", setup->dm_node);
3795
3796                 return true;
3797         }
3798
3799         return false;
3800 }
3801
3802 static int device_monitor_handler(sd_device_monitor *monitor, sd_device *device, void *userdata) {
3803         HomeSetup *setup = ASSERT_PTR(userdata);
3804         int r;
3805
3806         if (!device_for_action(device, SD_DEVICE_REMOVE))
3807                 return 0;
3808
3809         /* We don't really care for the device object passed to us, we just check if the device node still
3810          * exists */
3811
3812         r = device_is_gone(setup);
3813         if (r < 0)
3814                 return r;
3815         if (r > 0) /* Yay! we are done! */
3816                 (void) sd_event_exit(sd_device_monitor_get_event(monitor), 0);
3817
3818         return 0;
3819 }
3820
3821 int wait_for_block_device_gone(HomeSetup *setup, usec_t timeout_usec) {
3822         _cleanup_(sd_device_monitor_unrefp) sd_device_monitor *m = NULL;
3823         _cleanup_(sd_event_unrefp) sd_event *event = NULL;
3824         int r;
3825
3826         assert(setup);
3827
3828         /* So here's the thing: we enable "deferred deactivation" on our dm-crypt volumes. This means they
3829          * are automatically torn down once not used anymore (i.e. once unmounted). Which is great. It also
3830          * means that when we deactivate a home directory and try to tear down the volume that backs it, it
3831          * possibly is already torn down or in the process of being torn down, since we race against the
3832          * automatic tearing down. Which is fine, we handle errors from that. However, we lose the ability to
3833          * naturally wait for the tear down operation to complete: if we are not the ones who tear down the
3834          * device we are also not the ones who naturally block on that operation. Hence let's add some code
3835          * to actively wait for the device to go away, via sd-device. We'll call this whenever tearing down a
3836          * LUKS device, to ensure the device is really really gone before we proceed. Net effect: "homectl
3837          * deactivate foo && homectl activate foo" will work reliably, i.e. deactivation immediately followed
3838          * by activation will work. Also, by the time deactivation completes we can guarantee that all data
3839          * is sync'ed down to the lowest block layer as all higher levels are fully and entirely
3840          * destructed. */
3841
3842         if (!setup->dm_name)
3843                 return 0;
3844
3845         assert(setup->dm_node);
3846         log_debug("Waiting until %s disappears.", setup->dm_node);
3847
3848         r = sd_event_new(&event);
3849         if (r < 0)
3850                 return log_error_errno(r, "Failed to allocate event loop: %m");
3851
3852         r = sd_device_monitor_new(&m);
3853         if (r < 0)
3854                 return log_error_errno(r, "Failed to allocate device monitor: %m");
3855
3856         r = sd_device_monitor_filter_add_match_subsystem_devtype(m, "block", "disk");
3857         if (r < 0)
3858                 return log_error_errno(r, "Failed to configure device monitor match: %m");
3859
3860         r = sd_device_monitor_attach_event(m, event);
3861         if (r < 0)
3862                 return log_error_errno(r, "Failed to attach device monitor to event loop: %m");
3863
3864         r = sd_device_monitor_start(m, device_monitor_handler, setup);
3865         if (r < 0)
3866                 return log_error_errno(r, "Failed to start device monitor: %m");
3867
3868         r = device_is_gone(setup);
3869         if (r < 0)
3870                 return r;
3871         if (r > 0) {
3872                 log_debug("%s has already disappeared before entering wait loop.", setup->dm_node);
3873                 return 0; /* gone already */
3874         }
3875
3876         if (timeout_usec != USEC_INFINITY) {
3877                 r = sd_event_add_time_relative(event, NULL, CLOCK_MONOTONIC, timeout_usec, 0, NULL, NULL);
3878                 if (r < 0)
3879                         return log_error_errno(r, "Failed to add timer event: %m");
3880         }
3881
3882         r = sd_event_loop(event);
3883         if (r < 0)
3884                 return log_error_errno(r, "Failed to run event loop: %m");
3885
3886         r = device_is_gone(setup);
3887         if (r < 0)
3888                 return r;
3889         if (r == 0)
3890                 return log_error_errno(r, "Device %s still around.", setup->dm_node);
3891
3892         log_debug("Successfully waited until device %s disappeared.", setup->dm_node);
3893         return 0;
3894 }
3895
3896 int home_auto_shrink_luks(UserRecord *h, HomeSetup *setup, PasswordCache *cache) {
3897         struct statfs sfs;
3898         int r;
3899
3900         assert(h);
3901         assert(user_record_storage(h) == USER_LUKS);
3902         assert(setup);
3903         assert(setup->root_fd >= 0);
3904
3905         if (user_record_auto_resize_mode(h) != AUTO_RESIZE_SHRINK_AND_GROW)
3906                 return 0;
3907
3908         if (fstatfs(setup->root_fd, &sfs) < 0)
3909                 return log_error_errno(errno, "Failed to statfs home directory: %m");
3910
3911         if (!fs_can_online_shrink_and_grow(sfs.f_type)) {
3912                 log_debug("Not auto-shrinking file system, since selected file system cannot do both online shrink and grow.");
3913                 return 0;
3914         }
3915
3916         r = home_resize_luks(
3917                         h,
3918                         HOME_SETUP_ALREADY_ACTIVATED|
3919                         HOME_SETUP_RESIZE_DONT_SYNC_IDENTITIES|
3920                         HOME_SETUP_RESIZE_MINIMIZE|
3921                         HOME_SETUP_RESIZE_DONT_GROW|
3922                         HOME_SETUP_RESIZE_DONT_UNDO,
3923                         setup,
3924                         cache,
3925                         NULL);
3926         if (r < 0)
3927                 return r;
3928
3929         return 1;
3930 }