mkosi-initrd: handle PermissionError when reading /etc/crypttab

Usually /etc/crypttab has 600 permissions, so display a warning to non-root
users rather than unhandling a PermissionError exception.

diff --git a/mkosi/initrd.py b/mkosi/initrd.py
index f71f6e48e823a5fed751a8300b2d0f198688d883..ef0f7110bf3c670130e668fe93230d79bd6df089 100644 (file)
--- a/mkosi/initrd.py
+++ b/mkosi/initrd.py
@@ -3,6 +3,7 @@
 import argparse
 import contextlib
 import dataclasses
+import logging
 import os
 import platform
 import shutil
@@ -102,20 +103,23 @@ def process_crypttab(staging_dir: str) -> list[str]:
 
     # Generate crypttab with all the x-initrd.attach entries
     if Path("/etc/crypttab").exists():
-        crypttab = [
-            line
-            for line in Path("/etc/crypttab").read_text().splitlines()
-            if (
-                len(entry := line.split()) >= 4
-                and not entry[0].startswith("#")
-                and "x-initrd.attach" in entry[3]
-            )
-        ]
-        if crypttab:
-            with (Path(staging_dir) / "crypttab").open("w") as f:
-                f.write("# Automatically generated by mkosi-initrd\n")
-                f.write("\n".join(crypttab))
-            cmdline += ["--extra-tree", f"{staging_dir}/crypttab:/etc/crypttab"]
+        try:
+            crypttab = [
+                line
+                for line in Path("/etc/crypttab").read_text().splitlines()
+                if (
+                    len(entry := line.split()) >= 4
+                    and not entry[0].startswith("#")
+                    and "x-initrd.attach" in entry[3]
+                )
+            ]
+            if crypttab:
+                with (Path(staging_dir) / "crypttab").open("w") as f:
+                    f.write("# Automatically generated by mkosi-initrd\n")
+                    f.write("\n".join(crypttab))
+                cmdline += ["--extra-tree", f"{staging_dir}/crypttab:/etc/crypttab"]
+        except PermissionError:
+            logging.warning("Permission denied to access /etc/crypttab, the initrd may be unbootable")
 
     return cmdline