]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/home/homework-luks.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #15651 from poettering/newlocale-check
[thirdparty/systemd.git] / src / home / homework-luks.c
1 /* SPDX-License-Identifier: LGPL-2.1+ */
2
3 #include <libfdisk.h>
4 #include <linux/loop.h>
5 #include <poll.h>
6 #include <sys/file.h>
7 #include <sys/ioctl.h>
8
9 #include "blkid-util.h"
10 #include "blockdev-util.h"
11 #include "btrfs-util.h"
12 #include "chattr-util.h"
13 #include "dm-util.h"
14 #include "errno-util.h"
15 #include "fd-util.h"
16 #include "fileio.h"
17 #include "fs-util.h"
18 #include "fsck-util.h"
19 #include "homework-luks.h"
20 #include "homework-mount.h"
21 #include "id128-util.h"
22 #include "io-util.h"
23 #include "memory-util.h"
24 #include "missing_magic.h"
25 #include "mkdir.h"
26 #include "mount-util.h"
27 #include "openssl-util.h"
28 #include "parse-util.h"
29 #include "path-util.h"
30 #include "process-util.h"
31 #include "random-util.h"
32 #include "resize-fs.h"
33 #include "stat-util.h"
34 #include "strv.h"
35 #include "tmpfile-util.h"
36
37 /* Round down to the nearest 1K size. Note that Linux generally handles block devices with 512 blocks only,
38 * but actually doesn't accept uneven numbers in many cases. To avoid any confusion around this we'll
39 * strictly round disk sizes down to the next 1K boundary.*/
40 #define DISK_SIZE_ROUND_DOWN(x) ((x) & ~UINT64_C(1023))
41
42 static bool supported_fstype(const char *fstype) {
43 /* Limit the set of supported file systems a bit, as protection against little tested kernel file
44 * systems. Also, we only support the resize ioctls for these file systems. */
45 return STR_IN_SET(fstype, "ext4", "btrfs", "xfs");
46 }
47
48 static int probe_file_system_by_fd(
49 int fd,
50 char **ret_fstype,
51 sd_id128_t *ret_uuid) {
52
53 _cleanup_(blkid_free_probep) blkid_probe b = NULL;
54 _cleanup_free_ char *s = NULL;
55 const char *fstype = NULL, *uuid = NULL;
56 sd_id128_t id;
57 int r;
58
59 assert(fd >= 0);
60 assert(ret_fstype);
61 assert(ret_uuid);
62
63 b = blkid_new_probe();
64 if (!b)
65 return -ENOMEM;
66
67 errno = 0;
68 r = blkid_probe_set_device(b, fd, 0, 0);
69 if (r != 0)
70 return errno > 0 ? -errno : -ENOMEM;
71
72 (void) blkid_probe_enable_superblocks(b, 1);
73 (void) blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE|BLKID_SUBLKS_UUID);
74
75 errno = 0;
76 r = blkid_do_safeprobe(b);
77 if (IN_SET(r, -2, 1)) /* nothing found or ambiguous result */
78 return -ENOPKG;
79 if (r != 0)
80 return errno > 0 ? -errno : -EIO;
81
82 (void) blkid_probe_lookup_value(b, "TYPE", &fstype, NULL);
83 if (!fstype)
84 return -ENOPKG;
85
86 (void) blkid_probe_lookup_value(b, "UUID", &uuid, NULL);
87 if (!uuid)
88 return -ENOPKG;
89
90 r = sd_id128_from_string(uuid, &id);
91 if (r < 0)
92 return r;
93
94 s = strdup(fstype);
95 if (!s)
96 return -ENOMEM;
97
98 *ret_fstype = TAKE_PTR(s);
99 *ret_uuid = id;
100
101 return 0;
102 }
103
104 static int probe_file_system_by_path(const char *path, char **ret_fstype, sd_id128_t *ret_uuid) {
105 _cleanup_close_ int fd = -1;
106
107 fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
108 if (fd < 0)
109 return -errno;
110
111 return probe_file_system_by_fd(fd, ret_fstype, ret_uuid);
112 }
113
114 static int block_get_size_by_fd(int fd, uint64_t *ret) {
115 struct stat st;
116
117 assert(fd >= 0);
118 assert(ret);
119
120 if (fstat(fd, &st) < 0)
121 return -errno;
122
123 if (!S_ISBLK(st.st_mode))
124 return -ENOTBLK;
125
126 if (ioctl(fd, BLKGETSIZE64, ret) < 0)
127 return -errno;
128
129 return 0;
130 }
131
132 static int block_get_size_by_path(const char *path, uint64_t *ret) {
133 _cleanup_close_ int fd = -1;
134
135 fd = open(path, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
136 if (fd < 0)
137 return -errno;
138
139 return block_get_size_by_fd(fd, ret);
140 }
141
142 static int run_fsck(const char *node, const char *fstype) {
143 int r, exit_status;
144 pid_t fsck_pid;
145
146 assert(node);
147 assert(fstype);
148
149 r = fsck_exists(fstype);
150 if (r < 0)
151 return log_error_errno(r, "Failed to check if fsck for file system %s exists: %m", fstype);
152 if (r == 0) {
153 log_warning("No fsck for file system %s installed, ignoring.", fstype);
154 return 0;
155 }
156
157 r = safe_fork("(fsck)", FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_STDOUT_TO_STDERR, &fsck_pid);
158 if (r < 0)
159 return r;
160 if (r == 0) {
161 /* Child */
162 execl("/sbin/fsck", "/sbin/fsck", "-aTl", node, NULL);
163 log_error_errno(errno, "Failed to execute fsck: %m");
164 _exit(FSCK_OPERATIONAL_ERROR);
165 }
166
167 exit_status = wait_for_terminate_and_check("fsck", fsck_pid, WAIT_LOG_ABNORMAL);
168 if (exit_status < 0)
169 return exit_status;
170 if ((exit_status & ~FSCK_ERROR_CORRECTED) != 0) {
171 log_warning("fsck failed with exit status %i.", exit_status);
172
173 if ((exit_status & (FSCK_SYSTEM_SHOULD_REBOOT|FSCK_ERRORS_LEFT_UNCORRECTED)) != 0)
174 return log_error_errno(SYNTHETIC_ERRNO(EIO), "File system is corrupted, refusing.");
175
176 log_warning("Ignoring fsck error.");
177 }
178
179 log_info("File system check completed.");
180
181 return 1;
182 }
183
184 static int luks_try_passwords(
185 struct crypt_device *cd,
186 char **passwords,
187 void *volume_key,
188 size_t *volume_key_size) {
189
190 char **pp;
191 int r;
192
193 assert(cd);
194
195 STRV_FOREACH(pp, passwords) {
196 size_t vks = *volume_key_size;
197
198 r = crypt_volume_key_get(
199 cd,
200 CRYPT_ANY_SLOT,
201 volume_key,
202 &vks,
203 *pp,
204 strlen(*pp));
205 if (r >= 0) {
206 *volume_key_size = vks;
207 return 0;
208 }
209
210 log_debug_errno(r, "Password %zu didn't work for unlocking LUKS superblock: %m", (size_t) (pp - passwords));
211 }
212
213 return -ENOKEY;
214 }
215
216 static int luks_setup(
217 const char *node,
218 const char *dm_name,
219 sd_id128_t uuid,
220 const char *cipher,
221 const char *cipher_mode,
222 uint64_t volume_key_size,
223 char **passwords,
224 char **pkcs11_decrypted_passwords,
225 bool discard,
226 struct crypt_device **ret,
227 sd_id128_t *ret_found_uuid,
228 void **ret_volume_key,
229 size_t *ret_volume_key_size) {
230
231 _cleanup_(crypt_freep) struct crypt_device *cd = NULL;
232 _cleanup_(erase_and_freep) void *vk = NULL;
233 sd_id128_t p;
234 size_t vks;
235 int r;
236
237 assert(node);
238 assert(dm_name);
239 assert(ret);
240
241 r = crypt_init(&cd, node);
242 if (r < 0)
243 return log_error_errno(r, "Failed to allocate libcryptsetup context: %m");
244
245 crypt_set_log_callback(cd, cryptsetup_log_glue, NULL);
246
247 r = crypt_load(cd, CRYPT_LUKS2, NULL);
248 if (r < 0)
249 return log_error_errno(r, "Failed to load LUKS superblock: %m");
250
251 r = crypt_get_volume_key_size(cd);
252 if (r <= 0)
253 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine LUKS volume key size");
254 vks = (size_t) r;
255
256 if (!sd_id128_is_null(uuid) || ret_found_uuid) {
257 const char *s;
258
259 s = crypt_get_uuid(cd);
260 if (!s)
261 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has no UUID.");
262
263 r = sd_id128_from_string(s, &p);
264 if (r < 0)
265 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has invalid UUID.");
266
267 /* Check that the UUID matches, if specified */
268 if (!sd_id128_is_null(uuid) &&
269 !sd_id128_equal(uuid, p))
270 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has wrong UUID.");
271 }
272
273 if (cipher && !streq_ptr(cipher, crypt_get_cipher(cd)))
274 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong cipher.");
275
276 if (cipher_mode && !streq_ptr(cipher_mode, crypt_get_cipher_mode(cd)))
277 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong cipher mode.");
278
279 if (volume_key_size != UINT64_MAX && vks != volume_key_size)
280 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock declares wrong volume key size.");
281
282 vk = malloc(vks);
283 if (!vk)
284 return log_oom();
285
286 r = luks_try_passwords(cd, pkcs11_decrypted_passwords, vk, &vks);
287 if (r == -ENOKEY) {
288 r = luks_try_passwords(cd, passwords, vk, &vks);
289 if (r == -ENOKEY)
290 return log_error_errno(r, "No valid password for LUKS superblock.");
291 }
292 if (r < 0)
293 return log_error_errno(r, "Failed to unlocks LUKS superblock: %m");
294
295 r = crypt_activate_by_volume_key(
296 cd,
297 dm_name,
298 vk, vks,
299 discard ? CRYPT_ACTIVATE_ALLOW_DISCARDS : 0);
300 if (r < 0)
301 return log_error_errno(r, "Failed to unlock LUKS superblock: %m");
302
303 log_info("Setting up LUKS device /dev/mapper/%s completed.", dm_name);
304
305 *ret = TAKE_PTR(cd);
306
307 if (ret_found_uuid) /* Return the UUID actually found if the caller wants to know */
308 *ret_found_uuid = p;
309 if (ret_volume_key)
310 *ret_volume_key = TAKE_PTR(vk);
311 if (ret_volume_key_size)
312 *ret_volume_key_size = vks;
313
314 return 0;
315 }
316
317 static int luks_open(
318 const char *dm_name,
319 char **passwords,
320 char **pkcs11_decrypted_passwords,
321 struct crypt_device **ret,
322 sd_id128_t *ret_found_uuid,
323 void **ret_volume_key,
324 size_t *ret_volume_key_size) {
325
326 _cleanup_(crypt_freep) struct crypt_device *cd = NULL;
327 _cleanup_(erase_and_freep) void *vk = NULL;
328 sd_id128_t p;
329 size_t vks;
330 int r;
331
332 assert(dm_name);
333 assert(ret);
334
335 /* Opens a LUKS device that is already set up. Re-validates the password while doing so (which also
336 * provides us with the volume key, which we want). */
337
338 r = crypt_init_by_name(&cd, dm_name);
339 if (r < 0)
340 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
341
342 crypt_set_log_callback(cd, cryptsetup_log_glue, NULL);
343
344 r = crypt_load(cd, CRYPT_LUKS2, NULL);
345 if (r < 0)
346 return log_error_errno(r, "Failed to load LUKS superblock: %m");
347
348 r = crypt_get_volume_key_size(cd);
349 if (r <= 0)
350 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine LUKS volume key size");
351 vks = (size_t) r;
352
353 if (ret_found_uuid) {
354 const char *s;
355
356 s = crypt_get_uuid(cd);
357 if (!s)
358 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has no UUID.");
359
360 r = sd_id128_from_string(s, &p);
361 if (r < 0)
362 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "LUKS superblock has invalid UUID.");
363 }
364
365 vk = malloc(vks);
366 if (!vk)
367 return log_oom();
368
369 r = luks_try_passwords(cd, pkcs11_decrypted_passwords, vk, &vks);
370 if (r == -ENOKEY) {
371 r = luks_try_passwords(cd, passwords, vk, &vks);
372 if (r == -ENOKEY)
373 return log_error_errno(r, "No valid password for LUKS superblock.");
374 }
375 if (r < 0)
376 return log_error_errno(r, "Failed to unlocks LUKS superblock: %m");
377
378 log_info("Discovered used LUKS device /dev/mapper/%s, and validated password.", dm_name);
379
380 /* This is needed so that crypt_resize() can operate correctly for pre-existing LUKS devices. We need
381 * to tell libcryptsetup the volume key explicitly, so that it is in the kernel keyring. */
382 r = crypt_activate_by_volume_key(cd, NULL, vk, vks, CRYPT_ACTIVATE_KEYRING_KEY);
383 if (r < 0)
384 return log_error_errno(r, "Failed to upload volume key again: %m");
385
386 log_info("Successfully re-activated LUKS device.");
387
388 *ret = TAKE_PTR(cd);
389
390 if (ret_found_uuid)
391 *ret_found_uuid = p;
392 if (ret_volume_key)
393 *ret_volume_key = TAKE_PTR(vk);
394 if (ret_volume_key_size)
395 *ret_volume_key_size = vks;
396
397 return 0;
398 }
399
400 static int fs_validate(
401 const char *dm_node,
402 sd_id128_t uuid,
403 char **ret_fstype,
404 sd_id128_t *ret_found_uuid) {
405
406 _cleanup_free_ char *fstype = NULL;
407 sd_id128_t u;
408 int r;
409
410 assert(dm_node);
411 assert(ret_fstype);
412
413 r = probe_file_system_by_path(dm_node, &fstype, &u);
414 if (r < 0)
415 return log_error_errno(r, "Failed to probe file system: %m");
416
417 /* Limit the set of supported file systems a bit, as protection against little tested kernel file
418 * systems. Also, we only support the resize ioctls for these file systems. */
419 if (!supported_fstype(fstype))
420 return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "Image contains unsupported file system: %s", strna(fstype));
421
422 if (!sd_id128_is_null(uuid) &&
423 !sd_id128_equal(uuid, u))
424 return log_error_errno(SYNTHETIC_ERRNO(EMEDIUMTYPE), "File system has wrong UUID.");
425
426 log_info("Probing file system completed (found %s).", fstype);
427
428 *ret_fstype = TAKE_PTR(fstype);
429
430 if (ret_found_uuid) /* Return the UUID actually found if the caller wants to know */
431 *ret_found_uuid = u;
432
433 return 0;
434 }
435
436 static int make_dm_names(const char *user_name, char **ret_dm_name, char **ret_dm_node) {
437 _cleanup_free_ char *name = NULL, *node = NULL;
438
439 assert(user_name);
440 assert(ret_dm_name);
441 assert(ret_dm_node);
442
443 name = strjoin("home-", user_name);
444 if (!name)
445 return log_oom();
446
447 node = path_join("/dev/mapper/", name);
448 if (!node)
449 return log_oom();
450
451 *ret_dm_name = TAKE_PTR(name);
452 *ret_dm_node = TAKE_PTR(node);
453 return 0;
454 }
455
456 static int luks_validate(
457 int fd,
458 const char *label,
459 sd_id128_t partition_uuid,
460 sd_id128_t *ret_partition_uuid,
461 uint64_t *ret_offset,
462 uint64_t *ret_size) {
463
464 _cleanup_(blkid_free_probep) blkid_probe b = NULL;
465 sd_id128_t found_partition_uuid = SD_ID128_NULL;
466 const char *fstype = NULL, *pttype = NULL;
467 blkid_loff_t offset = 0, size = 0;
468 blkid_partlist pl;
469 bool found = false;
470 int r, i, n;
471
472 assert(fd >= 0);
473 assert(label);
474 assert(ret_offset);
475 assert(ret_size);
476
477 b = blkid_new_probe();
478 if (!b)
479 return -ENOMEM;
480
481 errno = 0;
482 r = blkid_probe_set_device(b, fd, 0, 0);
483 if (r != 0)
484 return errno > 0 ? -errno : -ENOMEM;
485
486 (void) blkid_probe_enable_superblocks(b, 1);
487 (void) blkid_probe_set_superblocks_flags(b, BLKID_SUBLKS_TYPE);
488 (void) blkid_probe_enable_partitions(b, 1);
489 (void) blkid_probe_set_partitions_flags(b, BLKID_PARTS_ENTRY_DETAILS);
490
491 errno = 0;
492 r = blkid_do_safeprobe(b);
493 if (IN_SET(r, -2, 1)) /* nothing found or ambiguous result */
494 return -ENOPKG;
495 if (r != 0)
496 return errno > 0 ? -errno : -EIO;
497
498 (void) blkid_probe_lookup_value(b, "TYPE", &fstype, NULL);
499 if (streq_ptr(fstype, "crypto_LUKS")) {
500 /* Directly a LUKS image */
501 *ret_offset = 0;
502 *ret_size = UINT64_MAX; /* full disk */
503 *ret_partition_uuid = SD_ID128_NULL;
504 return 0;
505 } else if (fstype)
506 return -ENOPKG;
507
508 (void) blkid_probe_lookup_value(b, "PTTYPE", &pttype, NULL);
509 if (!streq_ptr(pttype, "gpt"))
510 return -ENOPKG;
511
512 errno = 0;
513 pl = blkid_probe_get_partitions(b);
514 if (!pl)
515 return errno > 0 ? -errno : -ENOMEM;
516
517 errno = 0;
518 n = blkid_partlist_numof_partitions(pl);
519 if (n < 0)
520 return errno > 0 ? -errno : -EIO;
521
522 for (i = 0; i < n; i++) {
523 blkid_partition pp;
524 sd_id128_t id;
525 const char *sid;
526
527 errno = 0;
528 pp = blkid_partlist_get_partition(pl, i);
529 if (!pp)
530 return errno > 0 ? -errno : -EIO;
531
532 if (!streq_ptr(blkid_partition_get_type_string(pp), "773f91ef-66d4-49b5-bd83-d683bf40ad16"))
533 continue;
534
535 if (!streq_ptr(blkid_partition_get_name(pp), label))
536 continue;
537
538 sid = blkid_partition_get_uuid(pp);
539 if (sid) {
540 r = sd_id128_from_string(sid, &id);
541 if (r < 0)
542 log_debug_errno(r, "Couldn't parse partition UUID %s, weird: %m", sid);
543
544 if (!sd_id128_is_null(partition_uuid) && !sd_id128_equal(id, partition_uuid))
545 continue;
546 }
547
548 if (found)
549 return -ENOPKG;
550
551 offset = blkid_partition_get_start(pp);
552 size = blkid_partition_get_size(pp);
553 found_partition_uuid = id;
554
555 found = true;
556 }
557
558 if (!found)
559 return -ENOPKG;
560
561 if (offset < 0)
562 return -EINVAL;
563 if ((uint64_t) offset > UINT64_MAX / 512U)
564 return -EINVAL;
565 if (size <= 0)
566 return -EINVAL;
567 if ((uint64_t) size > UINT64_MAX / 512U)
568 return -EINVAL;
569
570 *ret_offset = offset * 512U;
571 *ret_size = size * 512U;
572 *ret_partition_uuid = found_partition_uuid;
573
574 return 0;
575 }
576
577 static int crypt_device_to_evp_cipher(struct crypt_device *cd, const EVP_CIPHER **ret) {
578 _cleanup_free_ char *cipher_name = NULL;
579 const char *cipher, *cipher_mode, *e;
580 size_t key_size, key_bits;
581 const EVP_CIPHER *cc;
582 int r;
583
584 assert(cd);
585
586 /* Let's find the right OpenSSL EVP_CIPHER object that matches the encryption settings of the LUKS
587 * device */
588
589 cipher = crypt_get_cipher(cd);
590 if (!cipher)
591 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot get cipher from LUKS device.");
592
593 cipher_mode = crypt_get_cipher_mode(cd);
594 if (!cipher_mode)
595 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Cannot get cipher mode from LUKS device.");
596
597 e = strchr(cipher_mode, '-');
598 if (e)
599 cipher_mode = strndupa(cipher_mode, e - cipher_mode);
600
601 r = crypt_get_volume_key_size(cd);
602 if (r <= 0)
603 return log_error_errno(r < 0 ? r : SYNTHETIC_ERRNO(EINVAL), "Cannot get volume key size from LUKS device.");
604
605 key_size = r;
606 key_bits = key_size * 8;
607 if (streq(cipher_mode, "xts"))
608 key_bits /= 2;
609
610 if (asprintf(&cipher_name, "%s-%zu-%s", cipher, key_bits, cipher_mode) < 0)
611 return log_oom();
612
613 cc = EVP_get_cipherbyname(cipher_name);
614 if (!cc)
615 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "Selected cipher mode '%s' not supported, can't encrypt JSON record.", cipher_name);
616
617 /* Verify that our key length calculations match what OpenSSL thinks */
618 r = EVP_CIPHER_key_length(cc);
619 if (r < 0 || (uint64_t) r != key_size)
620 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Key size of selected cipher doesn't meet our expectations.");
621
622 *ret = cc;
623 return 0;
624 }
625
626 static int luks_validate_home_record(
627 struct crypt_device *cd,
628 UserRecord *h,
629 const void *volume_key,
630 char ***pkcs11_decrypted_passwords,
631 UserRecord **ret_luks_home_record) {
632
633 int r, token;
634
635 assert(cd);
636 assert(h);
637
638 for (token = 0;; token++) {
639 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL, *rr = NULL;
640 _cleanup_(EVP_CIPHER_CTX_freep) EVP_CIPHER_CTX *context = NULL;
641 _cleanup_(user_record_unrefp) UserRecord *lhr = NULL;
642 _cleanup_free_ void *encrypted = NULL, *iv = NULL;
643 size_t decrypted_size, encrypted_size, iv_size;
644 int decrypted_size_out1, decrypted_size_out2;
645 _cleanup_free_ char *decrypted = NULL;
646 const char *text, *type;
647 crypt_token_info state;
648 JsonVariant *jr, *jiv;
649 unsigned line, column;
650 const EVP_CIPHER *cc;
651
652 state = crypt_token_status(cd, token, &type);
653 if (state == CRYPT_TOKEN_INACTIVE) /* First unconfigured token, give up */
654 break;
655 if (IN_SET(state, CRYPT_TOKEN_INTERNAL, CRYPT_TOKEN_INTERNAL_UNKNOWN, CRYPT_TOKEN_EXTERNAL))
656 continue;
657 if (state != CRYPT_TOKEN_EXTERNAL_UNKNOWN)
658 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unexpected token state of token %i: %i", token, (int) state);
659
660 if (!streq(type, "systemd-homed"))
661 continue;
662
663 r = crypt_token_json_get(cd, token, &text);
664 if (r < 0)
665 return log_error_errno(r, "Failed to read LUKS token %i: %m", token);
666
667 r = json_parse(text, JSON_PARSE_SENSITIVE, &v, &line, &column);
668 if (r < 0)
669 return log_error_errno(r, "Failed to parse LUKS token JSON data %u:%u: %m", line, column);
670
671 jr = json_variant_by_key(v, "record");
672 if (!jr)
673 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "LUKS token lacks 'record' field.");
674 jiv = json_variant_by_key(v, "iv");
675 if (!jiv)
676 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "LUKS token lacks 'iv' field.");
677
678 r = json_variant_unbase64(jr, &encrypted, &encrypted_size);
679 if (r < 0)
680 return log_error_errno(r, "Failed to base64 decode record: %m");
681
682 r = json_variant_unbase64(jiv, &iv, &iv_size);
683 if (r < 0)
684 return log_error_errno(r, "Failed to base64 decode IV: %m");
685
686 r = crypt_device_to_evp_cipher(cd, &cc);
687 if (r < 0)
688 return r;
689 if (iv_size > INT_MAX || EVP_CIPHER_iv_length(cc) != (int) iv_size)
690 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "IV size doesn't match.");
691
692 context = EVP_CIPHER_CTX_new();
693 if (!context)
694 return log_oom();
695
696 if (EVP_DecryptInit_ex(context, cc, NULL, volume_key, iv) != 1)
697 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initialize decryption context.");
698
699 decrypted_size = encrypted_size + EVP_CIPHER_key_length(cc) * 2;
700 decrypted = new(char, decrypted_size);
701 if (!decrypted)
702 return log_oom();
703
704 if (EVP_DecryptUpdate(context, (uint8_t*) decrypted, &decrypted_size_out1, encrypted, encrypted_size) != 1)
705 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to decrypt JSON record.");
706
707 assert((size_t) decrypted_size_out1 <= decrypted_size);
708
709 if (EVP_DecryptFinal_ex(context, (uint8_t*) decrypted + decrypted_size_out1, &decrypted_size_out2) != 1)
710 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to finish decryption of JSON record.");
711
712 assert((size_t) decrypted_size_out1 + (size_t) decrypted_size_out2 < decrypted_size);
713 decrypted_size = (size_t) decrypted_size_out1 + (size_t) decrypted_size_out2;
714
715 if (memchr(decrypted, 0, decrypted_size))
716 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Inner NUL byte in JSON record, refusing.");
717
718 decrypted[decrypted_size] = 0;
719
720 r = json_parse(decrypted, JSON_PARSE_SENSITIVE, &rr, NULL, NULL);
721 if (r < 0)
722 return log_error_errno(r, "Failed to parse decrypted JSON record, refusing.");
723
724 lhr = user_record_new();
725 if (!lhr)
726 return log_oom();
727
728 r = user_record_load(lhr, rr, USER_RECORD_LOAD_EMBEDDED);
729 if (r < 0)
730 return log_error_errno(r, "Failed to parse user record: %m");
731
732 if (!user_record_compatible(h, lhr))
733 return log_error_errno(SYNTHETIC_ERRNO(EREMCHG), "LUKS home record not compatible with host record, refusing.");
734
735 r = user_record_authenticate(lhr, h, pkcs11_decrypted_passwords);
736 if (r < 0)
737 return r;
738
739 *ret_luks_home_record = TAKE_PTR(lhr);
740 return 0;
741 }
742
743 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Couldn't find home record in LUKS2 header, refusing.");
744 }
745
746 static int format_luks_token_text(
747 struct crypt_device *cd,
748 UserRecord *hr,
749 const void *volume_key,
750 char **ret) {
751
752 int r, encrypted_size_out1 = 0, encrypted_size_out2 = 0, iv_size, key_size;
753 _cleanup_(EVP_CIPHER_CTX_freep) EVP_CIPHER_CTX *context = NULL;
754 _cleanup_(json_variant_unrefp) JsonVariant *v = NULL;
755 _cleanup_free_ void *iv = NULL, *encrypted = NULL;
756 size_t text_length, encrypted_size;
757 _cleanup_free_ char *text = NULL;
758 const EVP_CIPHER *cc;
759
760 assert(cd);
761 assert(hr);
762 assert(volume_key);
763 assert(ret);
764
765 r = crypt_device_to_evp_cipher(cd, &cc);
766 if (r < 0)
767 return r;
768
769 key_size = EVP_CIPHER_key_length(cc);
770 iv_size = EVP_CIPHER_iv_length(cc);
771
772 if (iv_size > 0) {
773 iv = malloc(iv_size);
774 if (!iv)
775 return log_oom();
776
777 r = genuine_random_bytes(iv, iv_size, RANDOM_BLOCK);
778 if (r < 0)
779 return log_error_errno(r, "Failed to generate IV: %m");
780 }
781
782 context = EVP_CIPHER_CTX_new();
783 if (!context)
784 return log_oom();
785
786 if (EVP_EncryptInit_ex(context, cc, NULL, volume_key, iv) != 1)
787 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initialize encryption context.");
788
789 r = json_variant_format(hr->json, 0, &text);
790 if (r < 0)
791 return log_error_errno(r, "Failed to format user record for LUKS: %m");
792
793 text_length = strlen(text);
794 encrypted_size = text_length + 2*key_size - 1;
795
796 encrypted = malloc(encrypted_size);
797 if (!encrypted)
798 return log_oom();
799
800 if (EVP_EncryptUpdate(context, encrypted, &encrypted_size_out1, (uint8_t*) text, text_length) != 1)
801 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to encrypt JSON record.");
802
803 assert((size_t) encrypted_size_out1 <= encrypted_size);
804
805 if (EVP_EncryptFinal_ex(context, (uint8_t*) encrypted + encrypted_size_out1, &encrypted_size_out2) != 1)
806 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to finish encryption of JSON record. ");
807
808 assert((size_t) encrypted_size_out1 + (size_t) encrypted_size_out2 <= encrypted_size);
809
810 r = json_build(&v,
811 JSON_BUILD_OBJECT(
812 JSON_BUILD_PAIR("type", JSON_BUILD_STRING("systemd-homed")),
813 JSON_BUILD_PAIR("keyslots", JSON_BUILD_EMPTY_ARRAY),
814 JSON_BUILD_PAIR("record", JSON_BUILD_BASE64(encrypted, encrypted_size_out1 + encrypted_size_out2)),
815 JSON_BUILD_PAIR("iv", JSON_BUILD_BASE64(iv, iv_size))));
816 if (r < 0)
817 return log_error_errno(r, "Failed to prepare LUKS JSON token object: %m");
818
819 r = json_variant_format(v, 0, ret);
820 if (r < 0)
821 return log_error_errno(r, "Failed to format encrypted user record for LUKS: %m");
822
823 return 0;
824 }
825
826 int home_store_header_identity_luks(
827 UserRecord *h,
828 HomeSetup *setup,
829 UserRecord *old_home) {
830
831 _cleanup_(user_record_unrefp) UserRecord *header_home = NULL;
832 _cleanup_free_ char *text = NULL;
833 int token = 0, r;
834
835 assert(h);
836
837 if (!setup->crypt_device)
838 return 0;
839
840 assert(setup->volume_key);
841
842 /* Let's store the user's identity record in the LUKS2 "token" header data fields, in an encrypted
843 * fashion. Why that? If we'd rely on the record being embedded in the payload file system itself we
844 * would have to mount the file system before we can validate the JSON record, its signatures and
845 * whether it matches what we are looking for. However, kernel file system implementations are
846 * generally not ready to be used on untrusted media. Hence let's store the record independently of
847 * the file system, so that we can validate it first, and only then mount the file system. To keep
848 * things simple we use the same encryption settings for this record as for the file system itself. */
849
850 r = user_record_clone(h, USER_RECORD_EXTRACT_EMBEDDED, &header_home);
851 if (r < 0)
852 return log_error_errno(r, "Failed to determine new header record: %m");
853
854 if (old_home && user_record_equal(old_home, header_home)) {
855 log_debug("Not updating header home record.");
856 return 0;
857 }
858
859 r = format_luks_token_text(setup->crypt_device, header_home, setup->volume_key, &text);
860 if (r < 0)
861 return r;
862
863 for (;; token++) {
864 crypt_token_info state;
865 const char *type;
866
867 state = crypt_token_status(setup->crypt_device, token, &type);
868 if (state == CRYPT_TOKEN_INACTIVE) /* First unconfigured token, we are done */
869 break;
870 if (IN_SET(state, CRYPT_TOKEN_INTERNAL, CRYPT_TOKEN_INTERNAL_UNKNOWN, CRYPT_TOKEN_EXTERNAL))
871 continue; /* Not ours */
872 if (state != CRYPT_TOKEN_EXTERNAL_UNKNOWN)
873 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unexpected token state of token %i: %i", token, (int) state);
874
875 if (!streq(type, "systemd-homed"))
876 continue;
877
878 r = crypt_token_json_set(setup->crypt_device, token, text);
879 if (r < 0)
880 return log_error_errno(r, "Failed to set JSON token for slot %i: %m", token);
881
882 /* Now, let's free the text so that for all further matching tokens we all crypt_json_token_set()
883 * with a NULL text in order to invalidate the tokens. */
884 text = mfree(text);
885 token++;
886 }
887
888 if (text)
889 return log_error_errno(SYNTHETIC_ERRNO(EBADMSG), "Didn't find any record token to update.");
890
891 log_info("Wrote LUKS header user record.");
892
893 return 1;
894 }
895
896 int run_fitrim(int root_fd) {
897 char buf[FORMAT_BYTES_MAX];
898 struct fstrim_range range = {
899 .len = UINT64_MAX,
900 };
901
902 /* If discarding is on, discard everything right after mounting, so that the discard setting takes
903 * effect on activation. (Also, optionally, trim on logout) */
904
905 assert(root_fd >= 0);
906
907 if (ioctl(root_fd, FITRIM, &range) < 0) {
908 if (ERRNO_IS_NOT_SUPPORTED(errno) || errno == EBADF) {
909 log_debug_errno(errno, "File system does not support FITRIM, not trimming.");
910 return 0;
911 }
912
913 return log_warning_errno(errno, "Failed to invoke FITRIM, ignoring: %m");
914 }
915
916 log_info("Discarded unused %s.",
917 format_bytes(buf, sizeof(buf), range.len));
918 return 1;
919 }
920
921 int run_fitrim_by_path(const char *root_path) {
922 _cleanup_close_ int root_fd = -1;
923
924 root_fd = open(root_path, O_RDONLY|O_DIRECTORY|O_CLOEXEC);
925 if (root_fd < 0)
926 return log_error_errno(errno, "Failed to open file system '%s' for trimming: %m", root_path);
927
928 return run_fitrim(root_fd);
929 }
930
931 int run_fallocate(int backing_fd, const struct stat *st) {
932 char buf[FORMAT_BYTES_MAX];
933 struct stat stbuf;
934
935 assert(backing_fd >= 0);
936
937 /* If discarding is off, let's allocate the whole image before mounting, so that the setting takes
938 * effect on activation */
939
940 if (!st) {
941 if (fstat(backing_fd, &stbuf) < 0)
942 return log_error_errno(errno, "Failed to fstat(): %m");
943
944 st = &stbuf;
945 }
946
947 if (!S_ISREG(st->st_mode))
948 return 0;
949
950 if (st->st_blocks >= DIV_ROUND_UP(st->st_size, 512)) {
951 log_info("Backing file is fully allocated already.");
952 return 0;
953 }
954
955 if (fallocate(backing_fd, FALLOC_FL_KEEP_SIZE, 0, st->st_size) < 0) {
956
957 if (ERRNO_IS_NOT_SUPPORTED(errno)) {
958 log_debug_errno(errno, "fallocate() not supported on file system, ignoring.");
959 return 0;
960 }
961
962 if (ERRNO_IS_DISK_SPACE(errno)) {
963 log_debug_errno(errno, "Not enough disk space to fully allocate home.");
964 return -ENOSPC; /* make recognizable */
965 }
966
967 return log_error_errno(errno, "Failed to allocate backing file blocks: %m");
968 }
969
970 log_info("Allocated additional %s.",
971 format_bytes(buf, sizeof(buf), (DIV_ROUND_UP(st->st_size, 512) - st->st_blocks) * 512));
972 return 1;
973 }
974
975 int run_fallocate_by_path(const char *backing_path) {
976 _cleanup_close_ int backing_fd = -1;
977
978 backing_fd = open(backing_path, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
979 if (backing_fd < 0)
980 return log_error_errno(errno, "Failed to open '%s' for fallocate(): %m", backing_path);
981
982 return run_fallocate(backing_fd, NULL);
983 }
984
985 int home_prepare_luks(
986 UserRecord *h,
987 bool already_activated,
988 const char *force_image_path,
989 char ***pkcs11_decrypted_passwords,
990 HomeSetup *setup,
991 UserRecord **ret_luks_home) {
992
993 sd_id128_t found_partition_uuid, found_luks_uuid, found_fs_uuid;
994 _cleanup_(user_record_unrefp) UserRecord *luks_home = NULL;
995 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
996 _cleanup_(crypt_freep) struct crypt_device *cd = NULL;
997 _cleanup_(erase_and_freep) void *volume_key = NULL;
998 bool dm_activated = false, mounted = false;
999 _cleanup_close_ int root_fd = -1;
1000 size_t volume_key_size = 0;
1001 uint64_t offset, size;
1002 int r;
1003
1004 assert(h);
1005 assert(setup);
1006 assert(setup->dm_name);
1007 assert(setup->dm_node);
1008
1009 assert(user_record_storage(h) == USER_LUKS);
1010
1011 if (already_activated) {
1012 struct loop_info64 info;
1013 const char *n;
1014
1015 r = luks_open(setup->dm_name,
1016 h->password,
1017 pkcs11_decrypted_passwords ? *pkcs11_decrypted_passwords : NULL,
1018 &cd,
1019 &found_luks_uuid,
1020 &volume_key,
1021 &volume_key_size);
1022 if (r < 0)
1023 return r;
1024
1025 r = luks_validate_home_record(cd, h, volume_key, pkcs11_decrypted_passwords, &luks_home);
1026 if (r < 0)
1027 return r;
1028
1029 n = crypt_get_device_name(cd);
1030 if (!n)
1031 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine backing device for DM %s.", setup->dm_name);
1032
1033 r = loop_device_open(n, O_RDWR, &loop);
1034 if (r < 0)
1035 return log_error_errno(r, "Failed to open loopback device %s: %m", n);
1036
1037 if (ioctl(loop->fd, LOOP_GET_STATUS64, &info) < 0) {
1038 _cleanup_free_ char *sysfs = NULL;
1039 struct stat st;
1040
1041 if (!IN_SET(errno, ENOTTY, EINVAL))
1042 return log_error_errno(errno, "Failed to get block device metrics of %s: %m", n);
1043
1044 if (ioctl(loop->fd, BLKGETSIZE64, &size) < 0)
1045 return log_error_errno(r, "Failed to read block device size of %s: %m", n);
1046
1047 if (fstat(loop->fd, &st) < 0)
1048 return log_error_errno(r, "Failed to stat block device %s: %m", n);
1049 assert(S_ISBLK(st.st_mode));
1050
1051 if (asprintf(&sysfs, "/sys/dev/block/%u:%u/partition", major(st.st_rdev), minor(st.st_rdev)) < 0)
1052 return log_oom();
1053
1054 if (access(sysfs, F_OK) < 0) {
1055 if (errno != ENOENT)
1056 return log_error_errno(errno, "Failed to determine whether %s exists: %m", sysfs);
1057
1058 offset = 0;
1059 } else {
1060 _cleanup_free_ char *buffer = NULL;
1061
1062 if (asprintf(&sysfs, "/sys/dev/block/%u:%u/start", major(st.st_rdev), minor(st.st_rdev)) < 0)
1063 return log_oom();
1064
1065 r = read_one_line_file(sysfs, &buffer);
1066 if (r < 0)
1067 return log_error_errno(r, "Failed to read partition start offset: %m");
1068
1069 r = safe_atou64(buffer, &offset);
1070 if (r < 0)
1071 return log_error_errno(r, "Failed to parse partition start offset: %m");
1072
1073 if (offset > UINT64_MAX / 512U)
1074 return log_error_errno(SYNTHETIC_ERRNO(E2BIG), "Offset too large for 64 byte range, refusing.");
1075
1076 offset *= 512U;
1077 }
1078 } else {
1079 offset = info.lo_offset;
1080 size = info.lo_sizelimit;
1081 }
1082
1083 found_partition_uuid = found_fs_uuid = SD_ID128_NULL;
1084
1085 log_info("Discovered used loopback device %s.", loop->node);
1086
1087 root_fd = open(user_record_home_directory(h), O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
1088 if (root_fd < 0) {
1089 r = log_error_errno(r, "Failed to open home directory: %m");
1090 goto fail;
1091 }
1092 } else {
1093 _cleanup_free_ char *fstype = NULL, *subdir = NULL;
1094 _cleanup_close_ int fd = -1;
1095 const char *ip;
1096 struct stat st;
1097
1098 ip = force_image_path ?: user_record_image_path(h);
1099
1100 subdir = path_join("/run/systemd/user-home-mount/", user_record_user_name_and_realm(h));
1101 if (!subdir)
1102 return log_oom();
1103
1104 fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
1105 if (fd < 0)
1106 return log_error_errno(errno, "Failed to open image file %s: %m", ip);
1107
1108 if (fstat(fd, &st) < 0)
1109 return log_error_errno(errno, "Failed to fstat() image file: %m");
1110 if (!S_ISREG(st.st_mode) && !S_ISBLK(st.st_mode))
1111 return log_error_errno(errno, "Image file %s is not a regular file or block device: %m", ip);
1112
1113 r = luks_validate(fd, user_record_user_name_and_realm(h), h->partition_uuid, &found_partition_uuid, &offset, &size);
1114 if (r < 0)
1115 return log_error_errno(r, "Failed to validate disk label: %m");
1116
1117 if (!user_record_luks_discard(h)) {
1118 r = run_fallocate(fd, &st);
1119 if (r < 0)
1120 return r;
1121 }
1122
1123 r = loop_device_make(fd, O_RDWR, offset, size, 0, &loop);
1124 if (r == -ENOENT) {
1125 log_error_errno(r, "Loopback block device support is not available on this system.");
1126 return -ENOLINK; /* make recognizable */
1127 }
1128 if (r < 0)
1129 return log_error_errno(r, "Failed to allocate loopback context: %m");
1130
1131 log_info("Setting up loopback device %s completed.", loop->node ?: ip);
1132
1133 r = luks_setup(loop->node ?: ip,
1134 setup->dm_name,
1135 h->luks_uuid,
1136 h->luks_cipher,
1137 h->luks_cipher_mode,
1138 h->luks_volume_key_size,
1139 h->password,
1140 pkcs11_decrypted_passwords ? *pkcs11_decrypted_passwords : NULL,
1141 user_record_luks_discard(h) || user_record_luks_offline_discard(h),
1142 &cd,
1143 &found_luks_uuid,
1144 &volume_key,
1145 &volume_key_size);
1146 if (r < 0)
1147 return r;
1148
1149 dm_activated = true;
1150
1151 r = luks_validate_home_record(cd, h, volume_key, pkcs11_decrypted_passwords, &luks_home);
1152 if (r < 0)
1153 goto fail;
1154
1155 r = fs_validate(setup->dm_node, h->file_system_uuid, &fstype, &found_fs_uuid);
1156 if (r < 0)
1157 goto fail;
1158
1159 r = run_fsck(setup->dm_node, fstype);
1160 if (r < 0)
1161 goto fail;
1162
1163 r = home_unshare_and_mount(setup->dm_node, fstype, user_record_luks_discard(h));
1164 if (r < 0)
1165 goto fail;
1166
1167 mounted = true;
1168
1169 root_fd = open(subdir, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
1170 if (root_fd < 0) {
1171 r = log_error_errno(r, "Failed to open home directory: %m");
1172 goto fail;
1173 }
1174
1175 if (user_record_luks_discard(h))
1176 (void) run_fitrim(root_fd);
1177
1178 setup->image_fd = TAKE_FD(fd);
1179 setup->do_offline_fallocate = !(setup->do_offline_fitrim = user_record_luks_offline_discard(h));
1180 }
1181
1182 setup->loop = TAKE_PTR(loop);
1183 setup->crypt_device = TAKE_PTR(cd);
1184 setup->root_fd = TAKE_FD(root_fd);
1185 setup->found_partition_uuid = found_partition_uuid;
1186 setup->found_luks_uuid = found_luks_uuid;
1187 setup->found_fs_uuid = found_fs_uuid;
1188 setup->partition_offset = offset;
1189 setup->partition_size = size;
1190 setup->volume_key = TAKE_PTR(volume_key);
1191 setup->volume_key_size = volume_key_size;
1192
1193 setup->undo_mount = mounted;
1194 setup->undo_dm = dm_activated;
1195
1196 if (ret_luks_home)
1197 *ret_luks_home = TAKE_PTR(luks_home);
1198
1199 return 0;
1200
1201 fail:
1202 if (mounted)
1203 (void) umount_verbose("/run/systemd/user-home-mount");
1204
1205 if (dm_activated)
1206 (void) crypt_deactivate(cd, setup->dm_name);
1207
1208 return r;
1209 }
1210
1211 static void print_size_summary(uint64_t host_size, uint64_t encrypted_size, struct statfs *sfs) {
1212 char buffer1[FORMAT_BYTES_MAX], buffer2[FORMAT_BYTES_MAX], buffer3[FORMAT_BYTES_MAX], buffer4[FORMAT_BYTES_MAX];
1213
1214 assert(sfs);
1215
1216 log_info("Image size is %s, file system size is %s, file system payload size is %s, file system free is %s.",
1217 format_bytes(buffer1, sizeof(buffer1), host_size),
1218 format_bytes(buffer2, sizeof(buffer2), encrypted_size),
1219 format_bytes(buffer3, sizeof(buffer3), (uint64_t) sfs->f_blocks * (uint64_t) sfs->f_frsize),
1220 format_bytes(buffer4, sizeof(buffer4), (uint64_t) sfs->f_bfree * (uint64_t) sfs->f_frsize));
1221 }
1222
1223 int home_activate_luks(
1224 UserRecord *h,
1225 char ***pkcs11_decrypted_passwords,
1226 UserRecord **ret_home) {
1227
1228 _cleanup_(user_record_unrefp) UserRecord *new_home = NULL, *luks_home_record = NULL;
1229 _cleanup_(home_setup_undo) HomeSetup setup = HOME_SETUP_INIT;
1230 uint64_t host_size, encrypted_size;
1231 const char *hdo, *hd;
1232 struct statfs sfs;
1233 int r;
1234
1235 assert(h);
1236 assert(user_record_storage(h) == USER_LUKS);
1237 assert(ret_home);
1238
1239 assert_se(hdo = user_record_home_directory(h));
1240 hd = strdupa(hdo); /* copy the string out, since it might change later in the home record object */
1241
1242 r = make_dm_names(h->user_name, &setup.dm_name, &setup.dm_node);
1243 if (r < 0)
1244 return r;
1245
1246 r = access(setup.dm_node, F_OK);
1247 if (r < 0) {
1248 if (errno != ENOENT)
1249 return log_error_errno(errno, "Failed to determine whether %s exists: %m", setup.dm_node);
1250 } else
1251 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Device mapper device %s already exists, refusing.", setup.dm_node);
1252
1253 r = home_prepare_luks(
1254 h,
1255 false,
1256 NULL,
1257 pkcs11_decrypted_passwords,
1258 &setup,
1259 &luks_home_record);
1260 if (r < 0)
1261 return r;
1262
1263 r = block_get_size_by_fd(setup.loop->fd, &host_size);
1264 if (r < 0)
1265 return log_error_errno(r, "Failed to get loopback block device size: %m");
1266
1267 r = block_get_size_by_path(setup.dm_node, &encrypted_size);
1268 if (r < 0)
1269 return log_error_errno(r, "Failed to get LUKS block device size: %m");
1270
1271 r = home_refresh(
1272 h,
1273 &setup,
1274 luks_home_record,
1275 pkcs11_decrypted_passwords,
1276 &sfs,
1277 &new_home);
1278 if (r < 0)
1279 return r;
1280
1281 r = home_extend_embedded_identity(new_home, h, &setup);
1282 if (r < 0)
1283 return r;
1284
1285 setup.root_fd = safe_close(setup.root_fd);
1286
1287 r = home_move_mount(user_record_user_name_and_realm(h), hd);
1288 if (r < 0)
1289 return r;
1290
1291 setup.undo_mount = false;
1292 setup.do_offline_fitrim = false;
1293
1294 loop_device_relinquish(setup.loop);
1295
1296 r = dm_deferred_remove(setup.dm_name);
1297 if (r < 0)
1298 log_warning_errno(r, "Failed to relinquish DM device, ignoring: %m");
1299
1300 setup.undo_dm = false;
1301 setup.do_offline_fallocate = false;
1302
1303 log_info("Everything completed.");
1304
1305 print_size_summary(host_size, encrypted_size, &sfs);
1306
1307 *ret_home = TAKE_PTR(new_home);
1308 return 1;
1309 }
1310
1311 int home_deactivate_luks(UserRecord *h) {
1312 _cleanup_(crypt_freep) struct crypt_device *cd = NULL;
1313 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
1314 bool we_detached;
1315 int r;
1316
1317 /* Note that the DM device and loopback device are set to auto-detach, hence strictly speaking we
1318 * don't have to explicitly have to detach them. However, we do that nonetheless (in case of the DM
1319 * device), to avoid races: by explicitly detaching them we know when the detaching is complete. We
1320 * don't bother about the loopback device because unlike the DM device it doesn't have a fixed
1321 * name. */
1322
1323 r = make_dm_names(h->user_name, &dm_name, &dm_node);
1324 if (r < 0)
1325 return r;
1326
1327 r = crypt_init_by_name(&cd, dm_name);
1328 if (IN_SET(r, -ENODEV, -EINVAL, -ENOENT)) {
1329 log_debug_errno(r, "LUKS device %s has already been detached.", dm_name);
1330 we_detached = false;
1331 } else if (r < 0)
1332 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
1333 else {
1334 log_info("Discovered used LUKS device %s.", dm_node);
1335
1336 crypt_set_log_callback(cd, cryptsetup_log_glue, NULL);
1337
1338 r = crypt_deactivate(cd, dm_name);
1339 if (IN_SET(r, -ENODEV, -EINVAL, -ENOENT)) {
1340 log_debug_errno(r, "LUKS device %s is already detached.", dm_node);
1341 we_detached = false;
1342 } else if (r < 0)
1343 return log_info_errno(r, "LUKS device %s couldn't be deactivated: %m", dm_node);
1344 else {
1345 log_info("LUKS device detaching completed.");
1346 we_detached = true;
1347 }
1348 }
1349
1350 if (user_record_luks_offline_discard(h))
1351 log_debug("Not allocating on logout.");
1352 else
1353 (void) run_fallocate_by_path(user_record_image_path(h));
1354
1355 return we_detached;
1356 }
1357
1358 int home_trim_luks(UserRecord *h) {
1359 assert(h);
1360
1361 if (!user_record_luks_offline_discard(h)) {
1362 log_debug("Not trimming on logout.");
1363 return 0;
1364 }
1365
1366 (void) run_fitrim_by_path(user_record_home_directory(h));
1367 return 0;
1368 }
1369
1370 static int run_mkfs(
1371 const char *node,
1372 const char *fstype,
1373 const char *label,
1374 sd_id128_t uuid,
1375 bool discard) {
1376
1377 int r;
1378
1379 assert(node);
1380 assert(fstype);
1381 assert(label);
1382
1383 r = mkfs_exists(fstype);
1384 if (r < 0)
1385 return log_error_errno(r, "Failed to check if mkfs for file system %s exists: %m", fstype);
1386 if (r == 0)
1387 return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "No mkfs for file system %s installed.", fstype);
1388
1389 r = safe_fork("(mkfs)", FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_WAIT|FORK_STDOUT_TO_STDERR, NULL);
1390 if (r < 0)
1391 return r;
1392 if (r == 0) {
1393 const char *mkfs;
1394 char suuid[37];
1395
1396 /* Child */
1397
1398 mkfs = strjoina("mkfs.", fstype);
1399 id128_to_uuid_string(uuid, suuid);
1400
1401 if (streq(fstype, "ext4"))
1402 execlp(mkfs, mkfs,
1403 "-L", label,
1404 "-U", suuid,
1405 "-I", "256",
1406 "-O", "has_journal",
1407 "-m", "0",
1408 "-E", discard ? "lazy_itable_init=1,discard" : "lazy_itable_init=1,nodiscard",
1409 node, NULL);
1410 else if (streq(fstype, "btrfs")) {
1411 if (discard)
1412 execlp(mkfs, mkfs, "-L", label, "-U", suuid, node, NULL);
1413 else
1414 execlp(mkfs, mkfs, "-L", label, "-U", suuid, "--nodiscard", node, NULL);
1415 } else if (streq(fstype, "xfs")) {
1416 const char *j;
1417
1418 j = strjoina("uuid=", suuid);
1419 if (discard)
1420 execlp(mkfs, mkfs, "-L", label, "-m", j, "-m", "reflink=1", node, NULL);
1421 else
1422 execlp(mkfs, mkfs, "-L", label, "-m", j, "-m", "reflink=1", "-K", node, NULL);
1423 } else {
1424 log_error("Cannot make file system: %s", fstype);
1425 _exit(EXIT_FAILURE);
1426 }
1427
1428 log_error_errno(errno, "Failed to execute %s: %m", mkfs);
1429 _exit(EXIT_FAILURE);
1430 }
1431
1432 return 0;
1433 }
1434
1435 static struct crypt_pbkdf_type* build_good_pbkdf(struct crypt_pbkdf_type *buffer, UserRecord *hr) {
1436 assert(buffer);
1437 assert(hr);
1438
1439 *buffer = (struct crypt_pbkdf_type) {
1440 .hash = user_record_luks_pbkdf_hash_algorithm(hr),
1441 .type = user_record_luks_pbkdf_type(hr),
1442 .time_ms = user_record_luks_pbkdf_time_cost_usec(hr) / USEC_PER_MSEC,
1443 .max_memory_kb = user_record_luks_pbkdf_memory_cost(hr) / 1024,
1444 .parallel_threads = user_record_luks_pbkdf_parallel_threads(hr),
1445 };
1446
1447 return buffer;
1448 }
1449
1450 static struct crypt_pbkdf_type* build_minimal_pbkdf(struct crypt_pbkdf_type *buffer, UserRecord *hr) {
1451 assert(buffer);
1452 assert(hr);
1453
1454 /* For PKCS#11 derived keys (which are generated randomly and are of high quality already) we use a
1455 * minimal PBKDF */
1456 *buffer = (struct crypt_pbkdf_type) {
1457 .hash = user_record_luks_pbkdf_hash_algorithm(hr),
1458 .type = CRYPT_KDF_PBKDF2,
1459 .iterations = 1,
1460 .time_ms = 1,
1461 };
1462
1463 return buffer;
1464 }
1465
1466 static int luks_format(
1467 const char *node,
1468 const char *dm_name,
1469 sd_id128_t uuid,
1470 const char *label,
1471 char **pkcs11_decrypted_passwords,
1472 char **effective_passwords,
1473 bool discard,
1474 UserRecord *hr,
1475 struct crypt_device **ret) {
1476
1477 _cleanup_(user_record_unrefp) UserRecord *reduced = NULL;
1478 _cleanup_(crypt_freep) struct crypt_device *cd = NULL;
1479 _cleanup_(erase_and_freep) void *volume_key = NULL;
1480 struct crypt_pbkdf_type good_pbkdf, minimal_pbkdf;
1481 _cleanup_free_ char *text = NULL;
1482 size_t volume_key_size;
1483 char suuid[37], **pp;
1484 int slot = 0, r;
1485
1486 assert(node);
1487 assert(dm_name);
1488 assert(hr);
1489 assert(ret);
1490
1491 r = crypt_init(&cd, node);
1492 if (r < 0)
1493 return log_error_errno(r, "Failed to allocate libcryptsetup context: %m");
1494
1495 crypt_set_log_callback(cd, cryptsetup_log_glue, NULL);
1496
1497 /* Normally we'd, just leave volume key generation to libcryptsetup. However, we can't, since we
1498 * can't extract the volume key from the library again, but we need it in order to encrypt the JSON
1499 * record. Hence, let's generate it on our own, so that we can keep track of it. */
1500
1501 volume_key_size = user_record_luks_volume_key_size(hr);
1502 volume_key = malloc(volume_key_size);
1503 if (!volume_key)
1504 return log_oom();
1505
1506 r = genuine_random_bytes(volume_key, volume_key_size, RANDOM_BLOCK);
1507 if (r < 0)
1508 return log_error_errno(r, "Failed to generate volume key: %m");
1509
1510 #if HAVE_CRYPT_SET_METADATA_SIZE
1511 /* Increase the metadata space to 4M, the largest LUKS2 supports */
1512 r = crypt_set_metadata_size(cd, 4096U*1024U, 0);
1513 if (r < 0)
1514 return log_error_errno(r, "Failed to change LUKS2 metadata size: %m");
1515 #endif
1516
1517 build_good_pbkdf(&good_pbkdf, hr);
1518 build_minimal_pbkdf(&minimal_pbkdf, hr);
1519
1520 r = crypt_format(cd,
1521 CRYPT_LUKS2,
1522 user_record_luks_cipher(hr),
1523 user_record_luks_cipher_mode(hr),
1524 id128_to_uuid_string(uuid, suuid),
1525 volume_key,
1526 volume_key_size,
1527 &(struct crypt_params_luks2) {
1528 .label = label,
1529 .subsystem = "systemd-home",
1530 .sector_size = 512U,
1531 .pbkdf = &good_pbkdf,
1532 });
1533 if (r < 0)
1534 return log_error_errno(r, "Failed to format LUKS image: %m");
1535
1536 log_info("LUKS formatting completed.");
1537
1538 STRV_FOREACH(pp, effective_passwords) {
1539
1540 if (strv_contains(pkcs11_decrypted_passwords, *pp)) {
1541 log_debug("Using minimal PBKDF for slot %i", slot);
1542 r = crypt_set_pbkdf_type(cd, &minimal_pbkdf);
1543 } else {
1544 log_debug("Using good PBKDF for slot %i", slot);
1545 r = crypt_set_pbkdf_type(cd, &good_pbkdf);
1546 }
1547 if (r < 0)
1548 return log_error_errno(r, "Failed to tweak PBKDF for slot %i: %m", slot);
1549
1550 r = crypt_keyslot_add_by_volume_key(
1551 cd,
1552 slot,
1553 volume_key,
1554 volume_key_size,
1555 *pp,
1556 strlen(*pp));
1557 if (r < 0)
1558 return log_error_errno(r, "Failed to set up LUKS password for slot %i: %m", slot);
1559
1560 log_info("Writing password to LUKS keyslot %i completed.", slot);
1561 slot++;
1562 }
1563
1564 r = crypt_activate_by_volume_key(
1565 cd,
1566 dm_name,
1567 volume_key,
1568 volume_key_size,
1569 discard ? CRYPT_ACTIVATE_ALLOW_DISCARDS : 0);
1570 if (r < 0)
1571 return log_error_errno(r, "Failed to activate LUKS superblock: %m");
1572
1573 log_info("LUKS activation by volume key succeeded.");
1574
1575 r = user_record_clone(hr, USER_RECORD_EXTRACT_EMBEDDED, &reduced);
1576 if (r < 0)
1577 return log_error_errno(r, "Failed to prepare home record for LUKS: %m");
1578
1579 r = format_luks_token_text(cd, reduced, volume_key, &text);
1580 if (r < 0)
1581 return r;
1582
1583 r = crypt_token_json_set(cd, CRYPT_ANY_TOKEN, text);
1584 if (r < 0)
1585 return log_error_errno(r, "Failed to set LUKS JSON token: %m");
1586
1587 log_info("Writing user record as LUKS token completed.");
1588
1589 if (ret)
1590 *ret = TAKE_PTR(cd);
1591
1592 return 0;
1593 }
1594
1595 DEFINE_TRIVIAL_CLEANUP_FUNC(struct fdisk_context*, fdisk_unref_context);
1596 DEFINE_TRIVIAL_CLEANUP_FUNC(struct fdisk_partition*, fdisk_unref_partition);
1597 DEFINE_TRIVIAL_CLEANUP_FUNC(struct fdisk_parttype*, fdisk_unref_parttype);
1598 DEFINE_TRIVIAL_CLEANUP_FUNC(struct fdisk_table*, fdisk_unref_table);
1599
1600 static int make_partition_table(
1601 int fd,
1602 const char *label,
1603 sd_id128_t uuid,
1604 uint64_t *ret_offset,
1605 uint64_t *ret_size,
1606 sd_id128_t *ret_disk_uuid) {
1607
1608 _cleanup_(fdisk_unref_partitionp) struct fdisk_partition *p = NULL, *q = NULL;
1609 _cleanup_(fdisk_unref_parttypep) struct fdisk_parttype *t = NULL;
1610 _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
1611 _cleanup_free_ char *path = NULL, *disk_uuid_as_string = NULL;
1612 uint64_t offset, size;
1613 sd_id128_t disk_uuid;
1614 char uuids[37];
1615 int r;
1616
1617 assert(fd >= 0);
1618 assert(label);
1619 assert(ret_offset);
1620 assert(ret_size);
1621
1622 t = fdisk_new_parttype();
1623 if (!t)
1624 return log_oom();
1625
1626 r = fdisk_parttype_set_typestr(t, "773f91ef-66d4-49b5-bd83-d683bf40ad16");
1627 if (r < 0)
1628 return log_error_errno(r, "Failed to initialize partition type: %m");
1629
1630 c = fdisk_new_context();
1631 if (!c)
1632 return log_oom();
1633
1634 if (asprintf(&path, "/proc/self/fd/%i", fd) < 0)
1635 return log_oom();
1636
1637 r = fdisk_assign_device(c, path, 0);
1638 if (r < 0)
1639 return log_error_errno(r, "Failed to open device: %m");
1640
1641 r = fdisk_create_disklabel(c, "gpt");
1642 if (r < 0)
1643 return log_error_errno(r, "Failed to create GPT disk label: %m");
1644
1645 p = fdisk_new_partition();
1646 if (!p)
1647 return log_oom();
1648
1649 r = fdisk_partition_set_type(p, t);
1650 if (r < 0)
1651 return log_error_errno(r, "Failed to set partition type: %m");
1652
1653 r = fdisk_partition_start_follow_default(p, 1);
1654 if (r < 0)
1655 return log_error_errno(r, "Failed to place partition at beginning of space: %m");
1656
1657 r = fdisk_partition_partno_follow_default(p, 1);
1658 if (r < 0)
1659 return log_error_errno(r, "Failed to place partition at first free partition index: %m");
1660
1661 r = fdisk_partition_end_follow_default(p, 1);
1662 if (r < 0)
1663 return log_error_errno(r, "Failed to make partition cover all free space: %m");
1664
1665 r = fdisk_partition_set_name(p, label);
1666 if (r < 0)
1667 return log_error_errno(r, "Failed to set partition name: %m");
1668
1669 r = fdisk_partition_set_uuid(p, id128_to_uuid_string(uuid, uuids));
1670 if (r < 0)
1671 return log_error_errno(r, "Failed to set partition UUID: %m");
1672
1673 r = fdisk_add_partition(c, p, NULL);
1674 if (r < 0)
1675 return log_error_errno(r, "Failed to add partition: %m");
1676
1677 r = fdisk_write_disklabel(c);
1678 if (r < 0)
1679 return log_error_errno(r, "Failed to write disk label: %m");
1680
1681 r = fdisk_get_disklabel_id(c, &disk_uuid_as_string);
1682 if (r < 0)
1683 return log_error_errno(r, "Failed to determine disk label UUID: %m");
1684
1685 r = sd_id128_from_string(disk_uuid_as_string, &disk_uuid);
1686 if (r < 0)
1687 return log_error_errno(r, "Failed to parse disk label UUID: %m");
1688
1689 r = fdisk_get_partition(c, 0, &q);
1690 if (r < 0)
1691 return log_error_errno(r, "Failed to read created partition metadata: %m");
1692
1693 assert(fdisk_partition_has_start(q));
1694 offset = fdisk_partition_get_start(q);
1695 if (offset > UINT64_MAX / 512U)
1696 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Partition offset too large.");
1697
1698 assert(fdisk_partition_has_size(q));
1699 size = fdisk_partition_get_size(q);
1700 if (size > UINT64_MAX / 512U)
1701 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Partition size too large.");
1702
1703 *ret_offset = offset * 512U;
1704 *ret_size = size * 512U;
1705 *ret_disk_uuid = disk_uuid;
1706
1707 return 0;
1708 }
1709
1710 static bool supported_fs_size(const char *fstype, uint64_t host_size) {
1711 uint64_t m;
1712
1713 m = minimal_size_by_fs_name(fstype);
1714 if (m == UINT64_MAX)
1715 return false;
1716
1717 return host_size >= m;
1718 }
1719
1720 static int wait_for_devlink(const char *path) {
1721 _cleanup_close_ int inotify_fd = -1;
1722 usec_t until;
1723 int r;
1724
1725 /* let's wait for a device link to show up in /dev, with a time-out. This is good to do since we
1726 * return a /dev/disk/by-uuid/… link to our callers and they likely want to access it right-away,
1727 * hence let's wait until udev has caught up with our changes, and wait for the symlink to be
1728 * created. */
1729
1730 until = usec_add(now(CLOCK_MONOTONIC), 45 * USEC_PER_SEC);
1731
1732 for (;;) {
1733 _cleanup_free_ char *dn = NULL;
1734 usec_t w;
1735
1736 if (laccess(path, F_OK) < 0) {
1737 if (errno != ENOENT)
1738 return log_error_errno(errno, "Failed to determine whether %s exists: %m", path);
1739 } else
1740 return 0; /* Found it */
1741
1742 if (inotify_fd < 0) {
1743 /* We need to wait for the device symlink to show up, let's create an inotify watch for it */
1744 inotify_fd = inotify_init1(IN_NONBLOCK|IN_CLOEXEC);
1745 if (inotify_fd < 0)
1746 return log_error_errno(errno, "Failed to allocate inotify fd: %m");
1747 }
1748
1749 dn = dirname_malloc(path);
1750 for (;;) {
1751 if (!dn)
1752 return log_oom();
1753
1754 log_info("Watching %s", dn);
1755
1756 if (inotify_add_watch(inotify_fd, dn, IN_CREATE|IN_MOVED_TO|IN_ONLYDIR|IN_DELETE_SELF|IN_MOVE_SELF) < 0) {
1757 if (errno != ENOENT)
1758 return log_error_errno(errno, "Failed to add watch on %s: %m", dn);
1759 } else
1760 break;
1761
1762 if (empty_or_root(dn))
1763 break;
1764
1765 dn = dirname_malloc(dn);
1766 }
1767
1768 w = now(CLOCK_MONOTONIC);
1769 if (w >= until)
1770 return log_error_errno(SYNTHETIC_ERRNO(ETIMEDOUT), "Device link %s still hasn't shown up, giving up.", path);
1771
1772 r = fd_wait_for_event(inotify_fd, POLLIN, usec_sub_unsigned(until, w));
1773 if (r < 0)
1774 return log_error_errno(r, "Failed to watch inotify: %m");
1775
1776 (void) flush_fd(inotify_fd);
1777 }
1778 }
1779
1780 static int calculate_disk_size(UserRecord *h, const char *parent_dir, uint64_t *ret) {
1781 char buf[FORMAT_BYTES_MAX];
1782 struct statfs sfs;
1783 uint64_t m;
1784
1785 assert(h);
1786 assert(parent_dir);
1787 assert(ret);
1788
1789 if (h->disk_size != UINT64_MAX) {
1790 *ret = DISK_SIZE_ROUND_DOWN(h->disk_size);
1791 return 0;
1792 }
1793
1794 if (statfs(parent_dir, &sfs) < 0)
1795 return log_error_errno(errno, "statfs() on %s failed: %m", parent_dir);
1796
1797 m = sfs.f_bsize * sfs.f_bavail;
1798
1799 if (h->disk_size_relative == UINT64_MAX) {
1800
1801 if (m > UINT64_MAX / USER_DISK_SIZE_DEFAULT_PERCENT)
1802 return log_error_errno(SYNTHETIC_ERRNO(EOVERFLOW), "Disk size too large.");
1803
1804 *ret = DISK_SIZE_ROUND_DOWN(m * USER_DISK_SIZE_DEFAULT_PERCENT / 100);
1805
1806 log_info("Sizing home to %u%% of available disk space, which is %s.",
1807 USER_DISK_SIZE_DEFAULT_PERCENT,
1808 format_bytes(buf, sizeof(buf), *ret));
1809 } else {
1810 *ret = DISK_SIZE_ROUND_DOWN((uint64_t) ((double) m * (double) h->disk_size_relative / (double) UINT32_MAX));
1811
1812 log_info("Sizing home to %" PRIu64 ".%01" PRIu64 "%% of available disk space, which is %s.",
1813 (h->disk_size_relative * 100) / UINT32_MAX,
1814 ((h->disk_size_relative * 1000) / UINT32_MAX) % 10,
1815 format_bytes(buf, sizeof(buf), *ret));
1816 }
1817
1818 if (*ret < USER_DISK_SIZE_MIN)
1819 *ret = USER_DISK_SIZE_MIN;
1820
1821 return 0;
1822 }
1823
1824 static int home_truncate(
1825 UserRecord *h,
1826 int fd,
1827 const char *path,
1828 uint64_t size) {
1829
1830 bool trunc;
1831 int r;
1832
1833 assert(h);
1834 assert(fd >= 0);
1835 assert(path);
1836
1837 trunc = user_record_luks_discard(h);
1838 if (!trunc) {
1839 r = fallocate(fd, 0, 0, size);
1840 if (r < 0 && ERRNO_IS_NOT_SUPPORTED(errno)) {
1841 /* Some file systems do not support fallocate(), let's gracefully degrade
1842 * (ZFS, reiserfs, …) and fall back to truncation */
1843 log_notice_errno(errno, "Backing file system does not support fallocate(), falling back to ftruncate(), i.e. implicitly using non-discard mode.");
1844 trunc = true;
1845 }
1846 }
1847
1848 if (trunc)
1849 r = ftruncate(fd, size);
1850
1851 if (r < 0) {
1852 if (ERRNO_IS_DISK_SPACE(errno)) {
1853 log_error_errno(errno, "Not enough disk space to allocate home.");
1854 return -ENOSPC; /* make recognizable */
1855 }
1856
1857 return log_error_errno(errno, "Failed to truncate home image %s: %m", path);
1858 }
1859
1860 return 0;
1861 }
1862
1863 int home_create_luks(
1864 UserRecord *h,
1865 char **pkcs11_decrypted_passwords,
1866 char **effective_passwords,
1867 UserRecord **ret_home) {
1868
1869 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL, *subdir = NULL, *disk_uuid_path = NULL, *temporary_image_path = NULL;
1870 uint64_t host_size, encrypted_size, partition_offset, partition_size;
1871 bool image_created = false, dm_activated = false, mounted = false;
1872 _cleanup_(user_record_unrefp) UserRecord *new_home = NULL;
1873 sd_id128_t partition_uuid, fs_uuid, luks_uuid, disk_uuid;
1874 _cleanup_(loop_device_unrefp) LoopDevice *loop = NULL;
1875 _cleanup_(crypt_freep) struct crypt_device *cd = NULL;
1876 _cleanup_close_ int image_fd = -1, root_fd = -1;
1877 const char *fstype, *ip;
1878 struct statfs sfs;
1879 int r;
1880
1881 assert(h);
1882 assert(h->storage < 0 || h->storage == USER_LUKS);
1883 assert(ret_home);
1884
1885 assert_se(ip = user_record_image_path(h));
1886
1887 fstype = user_record_file_system_type(h);
1888 if (!supported_fstype(fstype))
1889 return log_error_errno(SYNTHETIC_ERRNO(EPROTONOSUPPORT), "Unsupported file system type: %s", h->file_system_type);
1890
1891 if (sd_id128_is_null(h->partition_uuid)) {
1892 r = sd_id128_randomize(&partition_uuid);
1893 if (r < 0)
1894 return log_error_errno(r, "Failed to acquire partition UUID: %m");
1895 } else
1896 partition_uuid = h->partition_uuid;
1897
1898 if (sd_id128_is_null(h->luks_uuid)) {
1899 r = sd_id128_randomize(&luks_uuid);
1900 if (r < 0)
1901 return log_error_errno(r, "Failed to acquire LUKS UUID: %m");
1902 } else
1903 luks_uuid = h->luks_uuid;
1904
1905 if (sd_id128_is_null(h->file_system_uuid)) {
1906 r = sd_id128_randomize(&fs_uuid);
1907 if (r < 0)
1908 return log_error_errno(r, "Failed to acquire file system UUID: %m");
1909 } else
1910 fs_uuid = h->file_system_uuid;
1911
1912 r = make_dm_names(h->user_name, &dm_name, &dm_node);
1913 if (r < 0)
1914 return r;
1915
1916 r = access(dm_node, F_OK);
1917 if (r < 0) {
1918 if (errno != ENOENT)
1919 return log_error_errno(errno, "Failed to determine whether %s exists: %m", dm_node);
1920 } else
1921 return log_error_errno(SYNTHETIC_ERRNO(EEXIST), "Device mapper device %s already exists, refusing.", dm_node);
1922
1923 if (path_startswith(ip, "/dev/")) {
1924 _cleanup_free_ char *sysfs = NULL;
1925 uint64_t block_device_size;
1926 struct stat st;
1927
1928 /* Let's place the home directory on a real device, i.e. an USB stick or such */
1929
1930 image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
1931 if (image_fd < 0)
1932 return log_error_errno(errno, "Failed to open device %s: %m", ip);
1933
1934 if (fstat(image_fd, &st) < 0)
1935 return log_error_errno(errno, "Failed to stat device %s: %m", ip);
1936 if (!S_ISBLK(st.st_mode))
1937 return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Device is not a block device, refusing.");
1938
1939 if (asprintf(&sysfs, "/sys/dev/block/%u:%u/partition", major(st.st_rdev), minor(st.st_rdev)) < 0)
1940 return log_oom();
1941 if (access(sysfs, F_OK) < 0) {
1942 if (errno != ENOENT)
1943 return log_error_errno(errno, "Failed to check whether %s exists: %m", sysfs);
1944 } else
1945 return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Operating on partitions is currently not supported, sorry. Please specify a top-level block device.");
1946
1947 if (flock(image_fd, LOCK_EX) < 0) /* make sure udev doesn't read from it while we operate on the device */
1948 return log_error_errno(errno, "Failed to lock block device %s: %m", ip);
1949
1950 if (ioctl(image_fd, BLKGETSIZE64, &block_device_size) < 0)
1951 return log_error_errno(errno, "Failed to read block device size: %m");
1952
1953 if (h->disk_size == UINT64_MAX) {
1954
1955 /* If a relative disk size is requested, apply it relative to the block device size */
1956 if (h->disk_size_relative < UINT32_MAX)
1957 host_size = CLAMP(DISK_SIZE_ROUND_DOWN(block_device_size * h->disk_size_relative / UINT32_MAX),
1958 USER_DISK_SIZE_MIN, USER_DISK_SIZE_MAX);
1959 else
1960 host_size = block_device_size; /* Otherwise, take the full device */
1961
1962 } else if (h->disk_size > block_device_size)
1963 return log_error_errno(SYNTHETIC_ERRNO(EMSGSIZE), "Selected disk size larger than backing block device, refusing.");
1964 else
1965 host_size = DISK_SIZE_ROUND_DOWN(h->disk_size);
1966
1967 if (!supported_fs_size(fstype, host_size))
1968 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Selected file system size too small for %s.", h->file_system_type);
1969
1970 /* After creation we should reference this partition by its UUID instead of the block
1971 * device. That's preferable since the user might have specified a device node such as
1972 * /dev/sdb to us, which might look very different when replugged. */
1973 if (asprintf(&disk_uuid_path, "/dev/disk/by-uuid/" SD_ID128_UUID_FORMAT_STR, SD_ID128_FORMAT_VAL(luks_uuid)) < 0)
1974 return log_oom();
1975
1976 if (user_record_luks_discard(h) || user_record_luks_offline_discard(h)) {
1977 /* If we want online or offline discard, discard once before we start using things. */
1978
1979 if (ioctl(image_fd, BLKDISCARD, (uint64_t[]) { 0, block_device_size }) < 0)
1980 log_full_errno(errno == EOPNOTSUPP ? LOG_DEBUG : LOG_WARNING, errno,
1981 "Failed to issue full-device BLKDISCARD on device, ignoring: %m");
1982 else
1983 log_info("Full device discard completed.");
1984 }
1985 } else {
1986 _cleanup_free_ char *parent = NULL;
1987
1988 parent = dirname_malloc(ip);
1989 if (!parent)
1990 return log_oom();
1991
1992 r = mkdir_p(parent, 0755);
1993 if (r < 0)
1994 return log_error_errno(r, "Failed to create parent directory %s: %m", parent);
1995
1996 r = calculate_disk_size(h, parent, &host_size);
1997 if (r < 0)
1998 return r;
1999
2000 if (!supported_fs_size(fstype, host_size))
2001 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "Selected file system size too small for %s.", h->file_system_type);
2002
2003 r = tempfn_random(ip, "homework", &temporary_image_path);
2004 if (r < 0)
2005 return log_error_errno(r, "Failed to derive temporary file name for %s: %m", ip);
2006
2007 image_fd = open(temporary_image_path, O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW, 0600);
2008 if (image_fd < 0)
2009 return log_error_errno(errno, "Failed to create home image %s: %m", temporary_image_path);
2010
2011 image_created = true;
2012
2013 r = chattr_fd(image_fd, FS_NOCOW_FL, FS_NOCOW_FL, NULL);
2014 if (r < 0)
2015 log_warning_errno(r, "Failed to set file attributes on %s, ignoring: %m", temporary_image_path);
2016
2017 r = home_truncate(h, image_fd, temporary_image_path, host_size);
2018 if (r < 0)
2019 goto fail;
2020
2021 log_info("Allocating image file completed.");
2022 }
2023
2024 r = make_partition_table(
2025 image_fd,
2026 user_record_user_name_and_realm(h),
2027 partition_uuid,
2028 &partition_offset,
2029 &partition_size,
2030 &disk_uuid);
2031 if (r < 0)
2032 goto fail;
2033
2034 log_info("Writing of partition table completed.");
2035
2036 r = loop_device_make(image_fd, O_RDWR, partition_offset, partition_size, 0, &loop);
2037 if (r < 0) {
2038 if (r == -ENOENT) { /* this means /dev/loop-control doesn't exist, i.e. we are in a container
2039 * or similar and loopback bock devices are not available, return a
2040 * recognizable error in this case. */
2041 log_error_errno(r, "Loopback block device support is not available on this system.");
2042 r = -ENOLINK;
2043 goto fail;
2044 }
2045
2046 log_error_errno(r, "Failed to set up loopback device for %s: %m", temporary_image_path);
2047 goto fail;
2048 }
2049
2050 r = loop_device_flock(loop, LOCK_EX); /* make sure udev won't read before we are done */
2051 if (r < 0) {
2052 log_error_errno(r, "Failed to take lock on loop device: %m");
2053 goto fail;
2054 }
2055
2056 log_info("Setting up loopback device %s completed.", loop->node ?: ip);
2057
2058 r = luks_format(loop->node,
2059 dm_name,
2060 luks_uuid,
2061 user_record_user_name_and_realm(h),
2062 pkcs11_decrypted_passwords,
2063 effective_passwords,
2064 user_record_luks_discard(h) || user_record_luks_offline_discard(h),
2065 h,
2066 &cd);
2067 if (r < 0)
2068 goto fail;
2069
2070 dm_activated = true;
2071
2072 r = block_get_size_by_path(dm_node, &encrypted_size);
2073 if (r < 0) {
2074 log_error_errno(r, "Failed to get encrypted block device size: %m");
2075 goto fail;
2076 }
2077
2078 log_info("Setting up LUKS device %s completed.", dm_node);
2079
2080 r = run_mkfs(dm_node, fstype, user_record_user_name_and_realm(h), fs_uuid, user_record_luks_discard(h));
2081 if (r < 0)
2082 goto fail;
2083
2084 log_info("Formatting file system completed.");
2085
2086 r = home_unshare_and_mount(dm_node, fstype, user_record_luks_discard(h));
2087 if (r < 0)
2088 goto fail;
2089
2090 mounted = true;
2091
2092 subdir = path_join("/run/systemd/user-home-mount/", user_record_user_name_and_realm(h));
2093 if (!subdir) {
2094 r = log_oom();
2095 goto fail;
2096 }
2097
2098 /* Prefer using a btrfs subvolume if we can, fall back to directory otherwise */
2099 r = btrfs_subvol_make_fallback(subdir, 0700);
2100 if (r < 0) {
2101 log_error_errno(r, "Failed to create user directory in mounted image file: %m");
2102 goto fail;
2103 }
2104
2105 root_fd = open(subdir, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
2106 if (root_fd < 0) {
2107 r = log_error_errno(errno, "Failed to open user directory in mounted image file: %m");
2108 goto fail;
2109 }
2110
2111 r = home_populate(h, root_fd);
2112 if (r < 0)
2113 goto fail;
2114
2115 r = home_sync_and_statfs(root_fd, &sfs);
2116 if (r < 0)
2117 goto fail;
2118
2119 r = user_record_clone(h, USER_RECORD_LOAD_MASK_SECRET|USER_RECORD_LOG, &new_home);
2120 if (r < 0) {
2121 log_error_errno(r, "Failed to clone record: %m");
2122 goto fail;
2123 }
2124
2125 r = user_record_add_binding(
2126 new_home,
2127 USER_LUKS,
2128 disk_uuid_path ?: ip,
2129 partition_uuid,
2130 luks_uuid,
2131 fs_uuid,
2132 crypt_get_cipher(cd),
2133 crypt_get_cipher_mode(cd),
2134 luks_volume_key_size_convert(cd),
2135 fstype,
2136 NULL,
2137 h->uid,
2138 (gid_t) h->uid);
2139 if (r < 0) {
2140 log_error_errno(r, "Failed to add binding to record: %m");
2141 goto fail;
2142 }
2143
2144 if (user_record_luks_offline_discard(h)) {
2145 r = run_fitrim(root_fd);
2146 if (r < 0)
2147 goto fail;
2148 }
2149
2150 root_fd = safe_close(root_fd);
2151
2152 r = umount_verbose("/run/systemd/user-home-mount");
2153 if (r < 0)
2154 goto fail;
2155
2156 mounted = false;
2157
2158 r = crypt_deactivate(cd, dm_name);
2159 if (r < 0) {
2160 log_error_errno(r, "Failed to deactivate LUKS device: %m");
2161 goto fail;
2162 }
2163
2164 dm_activated = false;
2165
2166 loop = loop_device_unref(loop);
2167
2168 if (!user_record_luks_offline_discard(h)) {
2169 r = run_fallocate(image_fd, NULL /* refresh stat() data */);
2170 if (r < 0)
2171 goto fail;
2172 }
2173
2174 if (disk_uuid_path)
2175 (void) ioctl(image_fd, BLKRRPART, 0);
2176
2177 /* Let's close the image fd now. If we are operating on a real block device this will release the BSD
2178 * lock that ensures udev doesn't interfere with what we are doing */
2179 image_fd = safe_close(image_fd);
2180
2181 if (temporary_image_path) {
2182 if (rename(temporary_image_path, ip) < 0) {
2183 log_error_errno(errno, "Failed to rename image file: %m");
2184 goto fail;
2185 }
2186
2187 log_info("Moved image file into place.");
2188 }
2189
2190 if (disk_uuid_path)
2191 (void) wait_for_devlink(disk_uuid_path);
2192
2193 log_info("Everything completed.");
2194
2195 print_size_summary(host_size, encrypted_size, &sfs);
2196
2197 *ret_home = TAKE_PTR(new_home);
2198 return 0;
2199
2200 fail:
2201 /* Let's close all files before we unmount the file system, to avoid EBUSY */
2202 root_fd = safe_close(root_fd);
2203
2204 if (mounted)
2205 (void) umount_verbose("/run/systemd/user-home-mount");
2206
2207 if (dm_activated)
2208 (void) crypt_deactivate(cd, dm_name);
2209
2210 loop = loop_device_unref(loop);
2211
2212 if (image_created)
2213 (void) unlink(temporary_image_path);
2214
2215 return r;
2216 }
2217
2218 int home_validate_update_luks(UserRecord *h, HomeSetup *setup) {
2219 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
2220 int r;
2221
2222 assert(h);
2223 assert(setup);
2224
2225 r = make_dm_names(h->user_name, &dm_name, &dm_node);
2226 if (r < 0)
2227 return r;
2228
2229 r = access(dm_node, F_OK);
2230 if (r < 0 && errno != ENOENT)
2231 return log_error_errno(errno, "Failed to determine whether %s exists: %m", dm_node);
2232
2233 free_and_replace(setup->dm_name, dm_name);
2234 free_and_replace(setup->dm_node, dm_node);
2235
2236 return r >= 0;
2237 }
2238
2239 enum {
2240 CAN_RESIZE_ONLINE,
2241 CAN_RESIZE_OFFLINE,
2242 };
2243
2244 static int can_resize_fs(int fd, uint64_t old_size, uint64_t new_size) {
2245 struct statfs sfs;
2246
2247 assert(fd >= 0);
2248
2249 /* Filter out bogus requests early */
2250 if (old_size == 0 || old_size == UINT64_MAX ||
2251 new_size == 0 || new_size == UINT64_MAX)
2252 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Invalid resize parameters.");
2253
2254 if ((old_size & 511) != 0 || (new_size & 511) != 0)
2255 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Resize parameters not multiple of 512.");
2256
2257 if (fstatfs(fd, &sfs) < 0)
2258 return log_error_errno(errno, "Failed to fstatfs() file system: %m");
2259
2260 if (is_fs_type(&sfs, BTRFS_SUPER_MAGIC)) {
2261
2262 if (new_size < BTRFS_MINIMAL_SIZE)
2263 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for btrfs (needs to be 256M at least.");
2264
2265 /* btrfs can grow and shrink online */
2266
2267 } else if (is_fs_type(&sfs, XFS_SB_MAGIC)) {
2268
2269 if (new_size < XFS_MINIMAL_SIZE)
2270 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for xfs (needs to be 14M at least).");
2271
2272 /* XFS can grow, but not shrink */
2273 if (new_size < old_size)
2274 return log_error_errno(SYNTHETIC_ERRNO(EMSGSIZE), "Shrinking this type of file system is not supported.");
2275
2276 } else if (is_fs_type(&sfs, EXT4_SUPER_MAGIC)) {
2277
2278 if (new_size < EXT4_MINIMAL_SIZE)
2279 return log_error_errno(SYNTHETIC_ERRNO(ERANGE), "New file system size too small for ext4 (needs to be 1M at least).");
2280
2281 /* ext4 can grow online, and shrink offline */
2282 if (new_size < old_size)
2283 return CAN_RESIZE_OFFLINE;
2284
2285 } else
2286 return log_error_errno(SYNTHETIC_ERRNO(ESOCKTNOSUPPORT), "Resizing this type of file system is not supported.");
2287
2288 return CAN_RESIZE_ONLINE;
2289 }
2290
2291 static int ext4_offline_resize_fs(HomeSetup *setup, uint64_t new_size, bool discard) {
2292 _cleanup_free_ char *size_str = NULL;
2293 bool re_open = false, re_mount = false;
2294 pid_t resize_pid, fsck_pid;
2295 int r, exit_status;
2296
2297 assert(setup);
2298 assert(setup->dm_node);
2299
2300 /* First, unmount the file system */
2301 if (setup->root_fd >= 0) {
2302 setup->root_fd = safe_close(setup->root_fd);
2303 re_open = true;
2304 }
2305
2306 if (setup->undo_mount) {
2307 r = umount_verbose("/run/systemd/user-home-mount");
2308 if (r < 0)
2309 return r;
2310
2311 setup->undo_mount = false;
2312 re_mount = true;
2313 }
2314
2315 log_info("Temporary unmounting of file system completed.");
2316
2317 /* resize2fs requires that the file system is force checked first, do so. */
2318 r = safe_fork("(e2fsck)", FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_STDOUT_TO_STDERR, &fsck_pid);
2319 if (r < 0)
2320 return r;
2321 if (r == 0) {
2322 /* Child */
2323 execlp("e2fsck" ,"e2fsck", "-fp", setup->dm_node, NULL);
2324 log_error_errno(errno, "Failed to execute e2fsck: %m");
2325 _exit(EXIT_FAILURE);
2326 }
2327
2328 exit_status = wait_for_terminate_and_check("e2fsck", fsck_pid, WAIT_LOG_ABNORMAL);
2329 if (exit_status < 0)
2330 return exit_status;
2331 if ((exit_status & ~FSCK_ERROR_CORRECTED) != 0) {
2332 log_warning("e2fsck failed with exit status %i.", exit_status);
2333
2334 if ((exit_status & (FSCK_SYSTEM_SHOULD_REBOOT|FSCK_ERRORS_LEFT_UNCORRECTED)) != 0)
2335 return log_error_errno(SYNTHETIC_ERRNO(EIO), "File system is corrupted, refusing.");
2336
2337 log_warning("Ignoring fsck error.");
2338 }
2339
2340 log_info("Forced file system check completed.");
2341
2342 /* We use 512 sectors here, because resize2fs doesn't do byte sizes */
2343 if (asprintf(&size_str, "%" PRIu64 "s", new_size / 512) < 0)
2344 return log_oom();
2345
2346 /* Resize the thing */
2347 r = safe_fork("(e2resize)", FORK_RESET_SIGNALS|FORK_RLIMIT_NOFILE_SAFE|FORK_DEATHSIG|FORK_LOG|FORK_WAIT|FORK_STDOUT_TO_STDERR, &resize_pid);
2348 if (r < 0)
2349 return r;
2350 if (r == 0) {
2351 /* Child */
2352 execlp("resize2fs" ,"resize2fs", setup->dm_node, size_str, NULL);
2353 log_error_errno(errno, "Failed to execute resize2fs: %m");
2354 _exit(EXIT_FAILURE);
2355 }
2356
2357 log_info("Offline file system resize completed.");
2358
2359 /* Re-establish mounts and reopen the directory */
2360 if (re_mount) {
2361 r = home_mount_node(setup->dm_node, "ext4", discard);
2362 if (r < 0)
2363 return r;
2364
2365 setup->undo_mount = true;
2366 }
2367
2368 if (re_open) {
2369 setup->root_fd = open("/run/systemd/user-home-mount", O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
2370 if (setup->root_fd < 0)
2371 return log_error_errno(errno, "Failed to reopen file system: %m");
2372 }
2373
2374 log_info("File system mounted again.");
2375
2376 return 0;
2377 }
2378
2379 static int prepare_resize_partition(
2380 int fd,
2381 uint64_t partition_offset,
2382 uint64_t old_partition_size,
2383 uint64_t new_partition_size,
2384 sd_id128_t *ret_disk_uuid,
2385 struct fdisk_table **ret_table) {
2386
2387 _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
2388 _cleanup_(fdisk_unref_tablep) struct fdisk_table *t = NULL;
2389 _cleanup_free_ char *path = NULL, *disk_uuid_as_string = NULL;
2390 size_t n_partitions, i;
2391 sd_id128_t disk_uuid;
2392 bool found = false;
2393 int r;
2394
2395 assert(fd >= 0);
2396 assert(ret_disk_uuid);
2397 assert(ret_table);
2398
2399 assert((partition_offset & 511) == 0);
2400 assert((old_partition_size & 511) == 0);
2401 assert((new_partition_size & 511) == 0);
2402 assert(UINT64_MAX - old_partition_size >= partition_offset);
2403 assert(UINT64_MAX - new_partition_size >= partition_offset);
2404
2405 if (partition_offset == 0) {
2406 /* If the offset is at the beginning we assume no partition table, let's exit early. */
2407 log_debug("Not rewriting partition table, operating on naked device.");
2408 *ret_disk_uuid = SD_ID128_NULL;
2409 *ret_table = NULL;
2410 return 0;
2411 }
2412
2413 c = fdisk_new_context();
2414 if (!c)
2415 return log_oom();
2416
2417 if (asprintf(&path, "/proc/self/fd/%i", fd) < 0)
2418 return log_oom();
2419
2420 r = fdisk_assign_device(c, path, 0);
2421 if (r < 0)
2422 return log_error_errno(r, "Failed to open device: %m");
2423
2424 if (!fdisk_is_labeltype(c, FDISK_DISKLABEL_GPT))
2425 return log_error_errno(SYNTHETIC_ERRNO(ENOMEDIUM), "Disk has no GPT partition table.");
2426
2427 r = fdisk_get_disklabel_id(c, &disk_uuid_as_string);
2428 if (r < 0)
2429 return log_error_errno(r, "Failed to acquire disk UUID: %m");
2430
2431 r = sd_id128_from_string(disk_uuid_as_string, &disk_uuid);
2432 if (r < 0)
2433 return log_error_errno(r, "Failed parse disk UUID: %m");
2434
2435 r = fdisk_get_partitions(c, &t);
2436 if (r < 0)
2437 return log_error_errno(r, "Failed to acquire partition table: %m");
2438
2439 n_partitions = fdisk_table_get_nents(t);
2440 for (i = 0; i < n_partitions; i++) {
2441 struct fdisk_partition *p;
2442
2443 p = fdisk_table_get_partition(t, i);
2444 if (!p)
2445 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Failed to read partition metadata: %m");
2446
2447 if (fdisk_partition_is_used(p) <= 0)
2448 continue;
2449 if (fdisk_partition_has_start(p) <= 0 || fdisk_partition_has_size(p) <= 0 || fdisk_partition_has_end(p) <= 0)
2450 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Found partition without a size.");
2451
2452 if (fdisk_partition_get_start(p) == partition_offset / 512U &&
2453 fdisk_partition_get_size(p) == old_partition_size / 512U) {
2454
2455 if (found)
2456 return log_error_errno(SYNTHETIC_ERRNO(ENOTUNIQ), "Partition found twice, refusing.");
2457
2458 /* Found our partition, now patch it */
2459 r = fdisk_partition_size_explicit(p, 1);
2460 if (r < 0)
2461 return log_error_errno(r, "Failed to enable explicit partition size: %m");
2462
2463 r = fdisk_partition_set_size(p, new_partition_size / 512U);
2464 if (r < 0)
2465 return log_error_errno(r, "Failed to change partition size: %m");
2466
2467 found = true;
2468 continue;
2469
2470 } else {
2471 if (fdisk_partition_get_start(p) < partition_offset + new_partition_size / 512U &&
2472 fdisk_partition_get_end(p) >= partition_offset / 512)
2473 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Can't extend, conflicting partition found.");
2474 }
2475 }
2476
2477 if (!found)
2478 return log_error_errno(SYNTHETIC_ERRNO(ENOPKG), "Failed to find matching partition to resize.");
2479
2480 *ret_table = TAKE_PTR(t);
2481 *ret_disk_uuid = disk_uuid;
2482
2483 return 1;
2484 }
2485
2486 static int ask_cb(struct fdisk_context *c, struct fdisk_ask *ask, void *userdata) {
2487 char *result;
2488
2489 assert(c);
2490
2491 switch (fdisk_ask_get_type(ask)) {
2492
2493 case FDISK_ASKTYPE_STRING:
2494 result = new(char, 37);
2495 if (!result)
2496 return log_oom();
2497
2498 fdisk_ask_string_set_result(ask, id128_to_uuid_string(*(sd_id128_t*) userdata, result));
2499 break;
2500
2501 default:
2502 log_debug("Unexpected question from libfdisk, ignoring.");
2503 }
2504
2505 return 0;
2506 }
2507
2508 static int apply_resize_partition(int fd, sd_id128_t disk_uuids, struct fdisk_table *t) {
2509 _cleanup_(fdisk_unref_contextp) struct fdisk_context *c = NULL;
2510 _cleanup_free_ void *two_zero_lbas = NULL;
2511 _cleanup_free_ char *path = NULL;
2512 ssize_t n;
2513 int r;
2514
2515 assert(fd >= 0);
2516
2517 if (!t) /* no partition table to apply, exit early */
2518 return 0;
2519
2520 two_zero_lbas = malloc0(1024U);
2521 if (!two_zero_lbas)
2522 return log_oom();
2523
2524 /* libfdisk appears to get confused by the existing PMBR. Let's explicitly flush it out. */
2525 n = pwrite(fd, two_zero_lbas, 1024U, 0);
2526 if (n < 0)
2527 return log_error_errno(errno, "Failed to wipe partition table: %m");
2528 if (n != 1024)
2529 return log_error_errno(SYNTHETIC_ERRNO(EIO), "Short write while wiping partition table.");
2530
2531 c = fdisk_new_context();
2532 if (!c)
2533 return log_oom();
2534
2535 if (asprintf(&path, "/proc/self/fd/%i", fd) < 0)
2536 return log_oom();
2537
2538 r = fdisk_assign_device(c, path, 0);
2539 if (r < 0)
2540 return log_error_errno(r, "Failed to open device: %m");
2541
2542 r = fdisk_create_disklabel(c, "gpt");
2543 if (r < 0)
2544 return log_error_errno(r, "Failed to create GPT disk label: %m");
2545
2546 r = fdisk_apply_table(c, t);
2547 if (r < 0)
2548 return log_error_errno(r, "Failed to apply partition table: %m");
2549
2550 r = fdisk_set_ask(c, ask_cb, &disk_uuids);
2551 if (r < 0)
2552 return log_error_errno(r, "Failed to set libfdisk query function: %m");
2553
2554 r = fdisk_set_disklabel_id(c);
2555 if (r < 0)
2556 return log_error_errno(r, "Failed to change disklabel ID: %m");
2557
2558 r = fdisk_write_disklabel(c);
2559 if (r < 0)
2560 return log_error_errno(r, "Failed to write disk label: %m");
2561
2562 return 1;
2563 }
2564
2565 int home_resize_luks(
2566 UserRecord *h,
2567 bool already_activated,
2568 char ***pkcs11_decrypted_passwords,
2569 HomeSetup *setup,
2570 UserRecord **ret_home) {
2571
2572 char buffer1[FORMAT_BYTES_MAX], buffer2[FORMAT_BYTES_MAX], buffer3[FORMAT_BYTES_MAX],
2573 buffer4[FORMAT_BYTES_MAX], buffer5[FORMAT_BYTES_MAX], buffer6[FORMAT_BYTES_MAX];
2574 uint64_t old_image_size, new_image_size, old_fs_size, new_fs_size, crypto_offset, new_partition_size;
2575 _cleanup_(user_record_unrefp) UserRecord *header_home = NULL, *embedded_home = NULL, *new_home = NULL;
2576 _cleanup_(fdisk_unref_tablep) struct fdisk_table *table = NULL;
2577 _cleanup_free_ char *whole_disk = NULL;
2578 _cleanup_close_ int image_fd = -1;
2579 sd_id128_t disk_uuid;
2580 const char *ip, *ipo;
2581 struct statfs sfs;
2582 struct stat st;
2583 int r, resize_type;
2584
2585 assert(h);
2586 assert(user_record_storage(h) == USER_LUKS);
2587 assert(setup);
2588 assert(ret_home);
2589
2590 assert_se(ipo = user_record_image_path(h));
2591 ip = strdupa(ipo); /* copy out since original might change later in home record object */
2592
2593 image_fd = open(ip, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2594 if (image_fd < 0)
2595 return log_error_errno(errno, "Failed to open image file %s: %m", ip);
2596
2597 if (fstat(image_fd, &st) < 0)
2598 return log_error_errno(errno, "Failed to stat image file %s: %m", ip);
2599 if (S_ISBLK(st.st_mode)) {
2600 dev_t parent;
2601
2602 r = block_get_whole_disk(st.st_rdev, &parent);
2603 if (r < 0)
2604 return log_error_errno(r, "Failed to acquire whole block device for %s: %m", ip);
2605 if (r > 0) {
2606 /* If we shall resize a file system on a partition device, then let's figure out the
2607 * whole disk device and operate on that instead, since we need to rewrite the
2608 * partition table to resize the partition. */
2609
2610 log_info("Operating on partition device %s, using parent device.", ip);
2611
2612 r = device_path_make_major_minor(st.st_mode, parent, &whole_disk);
2613 if (r < 0)
2614 return log_error_errno(r, "Failed to derive whole disk path for %s: %m", ip);
2615
2616 safe_close(image_fd);
2617
2618 image_fd = open(whole_disk, O_RDWR|O_CLOEXEC|O_NOCTTY|O_NONBLOCK);
2619 if (image_fd < 0)
2620 return log_error_errno(errno, "Failed to open whole block device %s: %m", whole_disk);
2621
2622 if (fstat(image_fd, &st) < 0)
2623 return log_error_errno(errno, "Failed to stat whole block device %s: %m", whole_disk);
2624 if (!S_ISBLK(st.st_mode))
2625 return log_error_errno(SYNTHETIC_ERRNO(ENOTBLK), "Whole block device %s is not actually a block device, refusing.", whole_disk);
2626 } else
2627 log_info("Operating on whole block device %s.", ip);
2628
2629 if (ioctl(image_fd, BLKGETSIZE64, &old_image_size) < 0)
2630 return log_error_errno(errno, "Failed to determine size of original block device: %m");
2631
2632 if (flock(image_fd, LOCK_EX) < 0) /* make sure udev doesn't read from it while we operate on the device */
2633 return log_error_errno(errno, "Failed to lock block device %s: %m", ip);
2634
2635 new_image_size = old_image_size; /* we can't resize physical block devices */
2636 } else {
2637 r = stat_verify_regular(&st);
2638 if (r < 0)
2639 return log_error_errno(r, "Image %s is not a block device nor regular file: %m", ip);
2640
2641 old_image_size = st.st_size;
2642
2643 /* Note an asymetry here: when we operate on loopback files the specified disk size we get we
2644 * apply onto the loopback file as a whole. When we operate on block devices we instead apply
2645 * to the partition itself only. */
2646
2647 new_image_size = DISK_SIZE_ROUND_DOWN(h->disk_size);
2648 if (new_image_size == old_image_size) {
2649 log_info("Image size already matching, skipping operation.");
2650 return 0;
2651 }
2652 }
2653
2654 r = home_prepare_luks(h, already_activated, whole_disk, pkcs11_decrypted_passwords, setup, &header_home);
2655 if (r < 0)
2656 return r;
2657
2658 r = home_load_embedded_identity(h, setup->root_fd, header_home, USER_RECONCILE_REQUIRE_NEWER_OR_EQUAL, pkcs11_decrypted_passwords, &embedded_home, &new_home);
2659 if (r < 0)
2660 return r;
2661
2662 log_info("offset = %" PRIu64 ", size = %" PRIu64 ", image = %" PRIu64, setup->partition_offset, setup->partition_size, old_image_size);
2663
2664 if ((UINT64_MAX - setup->partition_offset) < setup->partition_size ||
2665 setup->partition_offset + setup->partition_size > old_image_size)
2666 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Old partition doesn't fit in backing storage, refusing.");
2667
2668 if (S_ISREG(st.st_mode)) {
2669 uint64_t partition_table_extra;
2670
2671 partition_table_extra = old_image_size - setup->partition_size;
2672 if (new_image_size <= partition_table_extra)
2673 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "New size smaller than partition table metadata.");
2674
2675 new_partition_size = new_image_size - partition_table_extra;
2676 } else {
2677 assert(S_ISBLK(st.st_mode));
2678
2679 new_partition_size = DISK_SIZE_ROUND_DOWN(h->disk_size);
2680 if (new_partition_size == setup->partition_size) {
2681 log_info("Partition size already matching, skipping operation.");
2682 return 0;
2683 }
2684 }
2685
2686 if ((UINT64_MAX - setup->partition_offset) < new_partition_size ||
2687 setup->partition_offset + new_partition_size > new_image_size)
2688 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "New partition doesn't fit into backing storage, refusing.");
2689
2690 crypto_offset = crypt_get_data_offset(setup->crypt_device);
2691 if (setup->partition_size / 512U <= crypto_offset)
2692 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Weird, old crypto payload offset doesn't actually fit in partition size?");
2693 if (new_partition_size / 512U <= crypto_offset)
2694 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "New size smaller than crypto payload offset?");
2695
2696 old_fs_size = (setup->partition_size / 512U - crypto_offset) * 512U;
2697 new_fs_size = (new_partition_size / 512U - crypto_offset) * 512U;
2698
2699 /* Before we start doing anything, let's figure out if we actually can */
2700 resize_type = can_resize_fs(setup->root_fd, old_fs_size, new_fs_size);
2701 if (resize_type < 0)
2702 return resize_type;
2703 if (resize_type == CAN_RESIZE_OFFLINE && already_activated)
2704 return log_error_errno(SYNTHETIC_ERRNO(ETXTBSY), "File systems of this type can only be resized offline, but is currently online.");
2705
2706 log_info("Ready to resize image size %s → %s, partition size %s → %s, file system size %s → %s.",
2707 format_bytes(buffer1, sizeof(buffer1), old_image_size),
2708 format_bytes(buffer2, sizeof(buffer2), new_image_size),
2709 format_bytes(buffer3, sizeof(buffer3), setup->partition_size),
2710 format_bytes(buffer4, sizeof(buffer4), new_partition_size),
2711 format_bytes(buffer5, sizeof(buffer5), old_fs_size),
2712 format_bytes(buffer6, sizeof(buffer6), new_fs_size));
2713
2714 r = prepare_resize_partition(
2715 image_fd,
2716 setup->partition_offset,
2717 setup->partition_size,
2718 new_partition_size,
2719 &disk_uuid,
2720 &table);
2721 if (r < 0)
2722 return r;
2723
2724 if (new_fs_size > old_fs_size) {
2725
2726 if (S_ISREG(st.st_mode)) {
2727 /* Grow file size */
2728 r = home_truncate(h, image_fd, ip, new_image_size);
2729 if (r < 0)
2730 return r;
2731
2732 log_info("Growing of image file completed.");
2733 }
2734
2735 /* Make sure loopback device sees the new bigger size */
2736 r = loop_device_refresh_size(setup->loop, UINT64_MAX, new_partition_size);
2737 if (r == -ENOTTY)
2738 log_debug_errno(r, "Device is not a loopback device, not refreshing size.");
2739 else if (r < 0)
2740 return log_error_errno(r, "Failed to refresh loopback device size: %m");
2741 else
2742 log_info("Refreshing loop device size completed.");
2743
2744 r = apply_resize_partition(image_fd, disk_uuid, table);
2745 if (r < 0)
2746 return r;
2747 if (r > 0)
2748 log_info("Growing of partition completed.");
2749
2750 if (ioctl(image_fd, BLKRRPART, 0) < 0)
2751 log_debug_errno(errno, "BLKRRPART failed on block device, ignoring: %m");
2752
2753 /* Tell LUKS about the new bigger size too */
2754 r = crypt_resize(setup->crypt_device, setup->dm_name, new_fs_size / 512U);
2755 if (r < 0)
2756 return log_error_errno(r, "Failed to grow LUKS device: %m");
2757
2758 log_info("LUKS device growing completed.");
2759 } else {
2760 r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
2761 if (r < 0)
2762 return r;
2763
2764 if (S_ISREG(st.st_mode)) {
2765 if (user_record_luks_discard(h))
2766 /* Before we shrink, let's trim the file system, so that we need less space on disk during the shrinking */
2767 (void) run_fitrim(setup->root_fd);
2768 else {
2769 /* If discard is off, let's ensure all backing blocks are allocated, so that our resize operation doesn't fail half-way */
2770 r = run_fallocate(image_fd, &st);
2771 if (r < 0)
2772 return r;
2773 }
2774 }
2775 }
2776
2777 /* Now resize the file system */
2778 if (resize_type == CAN_RESIZE_ONLINE)
2779 r = resize_fs(setup->root_fd, new_fs_size, NULL);
2780 else
2781 r = ext4_offline_resize_fs(setup, new_fs_size, user_record_luks_discard(h));
2782 if (r < 0)
2783 return log_error_errno(r, "Failed to resize file system: %m");
2784
2785 log_info("File system resizing completed.");
2786
2787 /* Immediately sync afterwards */
2788 r = home_sync_and_statfs(setup->root_fd, NULL);
2789 if (r < 0)
2790 return r;
2791
2792 if (new_fs_size < old_fs_size) {
2793
2794 /* Shrink the LUKS device now, matching the new file system size */
2795 r = crypt_resize(setup->crypt_device, setup->dm_name, new_fs_size / 512);
2796 if (r < 0)
2797 return log_error_errno(r, "Failed to shrink LUKS device: %m");
2798
2799 log_info("LUKS device shrinking completed.");
2800
2801 if (S_ISREG(st.st_mode)) {
2802 /* Shrink the image file */
2803 if (ftruncate(image_fd, new_image_size) < 0)
2804 return log_error_errno(errno, "Failed to shrink image file %s: %m", ip);
2805
2806 log_info("Shrinking of image file completed.");
2807 }
2808
2809 /* Refresh the loop devices size */
2810 r = loop_device_refresh_size(setup->loop, UINT64_MAX, new_partition_size);
2811 if (r == -ENOTTY)
2812 log_debug_errno(r, "Device is not a loopback device, not refreshing size.");
2813 else if (r < 0)
2814 return log_error_errno(r, "Failed to refresh loopback device size: %m");
2815 else
2816 log_info("Refreshing loop device size completed.");
2817
2818 r = apply_resize_partition(image_fd, disk_uuid, table);
2819 if (r < 0)
2820 return r;
2821 if (r > 0)
2822 log_info("Shrinking of partition completed.");
2823
2824 if (ioctl(image_fd, BLKRRPART, 0) < 0)
2825 log_debug_errno(errno, "BLKRRPART failed on block device, ignoring: %m");
2826 } else {
2827 r = home_store_embedded_identity(new_home, setup->root_fd, h->uid, embedded_home);
2828 if (r < 0)
2829 return r;
2830 }
2831
2832 r = home_store_header_identity_luks(new_home, setup, header_home);
2833 if (r < 0)
2834 return r;
2835
2836 r = home_extend_embedded_identity(new_home, h, setup);
2837 if (r < 0)
2838 return r;
2839
2840 if (user_record_luks_discard(h))
2841 (void) run_fitrim(setup->root_fd);
2842
2843 r = home_sync_and_statfs(setup->root_fd, &sfs);
2844 if (r < 0)
2845 return r;
2846
2847 r = home_setup_undo(setup);
2848 if (r < 0)
2849 return r;
2850
2851 log_info("Everything completed.");
2852
2853 print_size_summary(new_image_size, new_fs_size, &sfs);
2854
2855 *ret_home = TAKE_PTR(new_home);
2856 return 0;
2857 }
2858
2859 int home_passwd_luks(
2860 UserRecord *h,
2861 HomeSetup *setup,
2862 char **pkcs11_decrypted_passwords, /* the passwords acquired via PKCS#11 security tokens */
2863 char **effective_passwords /* new passwords */) {
2864
2865 size_t volume_key_size, i, max_key_slots, n_effective;
2866 _cleanup_(erase_and_freep) void *volume_key = NULL;
2867 struct crypt_pbkdf_type good_pbkdf, minimal_pbkdf;
2868 const char *type;
2869 int r;
2870
2871 assert(h);
2872 assert(user_record_storage(h) == USER_LUKS);
2873 assert(setup);
2874
2875 type = crypt_get_type(setup->crypt_device);
2876 if (!type)
2877 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine crypto device type.");
2878
2879 r = crypt_keyslot_max(type);
2880 if (r <= 0)
2881 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine number of key slots.");
2882 max_key_slots = r;
2883
2884 r = crypt_get_volume_key_size(setup->crypt_device);
2885 if (r <= 0)
2886 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to determine volume key size.");
2887 volume_key_size = (size_t) r;
2888
2889 volume_key = malloc(volume_key_size);
2890 if (!volume_key)
2891 return log_oom();
2892
2893 r = luks_try_passwords(setup->crypt_device, pkcs11_decrypted_passwords, volume_key, &volume_key_size);
2894 if (r == -ENOKEY) {
2895 r = luks_try_passwords(setup->crypt_device, h->password, volume_key, &volume_key_size);
2896 if (r == -ENOKEY)
2897 return log_error_errno(SYNTHETIC_ERRNO(ENOKEY), "Failed to unlock LUKS superblock with supplied passwords.");
2898 }
2899 if (r < 0)
2900 return log_error_errno(r, "Failed to unlocks LUKS superblock: %m");
2901
2902 n_effective = strv_length(effective_passwords);
2903
2904 build_good_pbkdf(&good_pbkdf, h);
2905 build_minimal_pbkdf(&minimal_pbkdf, h);
2906
2907 for (i = 0; i < max_key_slots; i++) {
2908 r = crypt_keyslot_destroy(setup->crypt_device, i);
2909 if (r < 0 && !IN_SET(r, -ENOENT, -EINVAL)) /* Returns EINVAL or ENOENT if there's no key in this slot already */
2910 return log_error_errno(r, "Failed to destroy LUKS password: %m");
2911
2912 if (i >= n_effective) {
2913 if (r >= 0)
2914 log_info("Destroyed LUKS key slot %zu.", i);
2915 continue;
2916 }
2917
2918 if (strv_find(pkcs11_decrypted_passwords, effective_passwords[i])) {
2919 log_debug("Using minimal PBKDF for slot %zu", i);
2920 r = crypt_set_pbkdf_type(setup->crypt_device, &minimal_pbkdf);
2921 } else {
2922 log_debug("Using good PBKDF for slot %zu", i);
2923 r = crypt_set_pbkdf_type(setup->crypt_device, &good_pbkdf);
2924 }
2925 if (r < 0)
2926 return log_error_errno(r, "Failed to tweak PBKDF for slot %zu: %m", i);
2927
2928 r = crypt_keyslot_add_by_volume_key(
2929 setup->crypt_device,
2930 i,
2931 volume_key,
2932 volume_key_size,
2933 effective_passwords[i],
2934 strlen(effective_passwords[i]));
2935 if (r < 0)
2936 return log_error_errno(r, "Failed to set up LUKS password: %m");
2937
2938 log_info("Updated LUKS key slot %zu.", i);
2939 }
2940
2941 return 1;
2942 }
2943
2944 int home_lock_luks(UserRecord *h) {
2945 _cleanup_(crypt_freep) struct crypt_device *cd = NULL;
2946 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
2947 _cleanup_close_ int root_fd = -1;
2948 const char *p;
2949 int r;
2950
2951 assert(h);
2952
2953 assert_se(p = user_record_home_directory(h));
2954 root_fd = open(p, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
2955 if (root_fd < 0)
2956 return log_error_errno(errno, "Failed to open home directory: %m");
2957
2958 r = make_dm_names(h->user_name, &dm_name, &dm_node);
2959 if (r < 0)
2960 return r;
2961
2962 r = crypt_init_by_name(&cd, dm_name);
2963 if (r < 0)
2964 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
2965
2966 log_info("Discovered used LUKS device %s.", dm_node);
2967 crypt_set_log_callback(cd, cryptsetup_log_glue, NULL);
2968
2969 if (syncfs(root_fd) < 0) /* Snake oil, but let's better be safe than sorry */
2970 return log_error_errno(errno, "Failed to synchronize file system %s: %m", p);
2971
2972 root_fd = safe_close(root_fd);
2973
2974 log_info("File system synchronized.");
2975
2976 /* Note that we don't invoke FIFREEZE here, it appears libcryptsetup/device-mapper already does that on its own for us */
2977
2978 r = crypt_suspend(cd, dm_name);
2979 if (r < 0)
2980 return log_error_errno(r, "Failed to suspend cryptsetup device: %s: %m", dm_node);
2981
2982 log_info("LUKS device suspended.");
2983 return 0;
2984 }
2985
2986 static int luks_try_resume(
2987 struct crypt_device *cd,
2988 const char *dm_name,
2989 char **password) {
2990
2991 char **pp;
2992 int r;
2993
2994 assert(cd);
2995 assert(dm_name);
2996
2997 STRV_FOREACH(pp, password) {
2998 r = crypt_resume_by_passphrase(
2999 cd,
3000 dm_name,
3001 CRYPT_ANY_SLOT,
3002 *pp,
3003 strlen(*pp));
3004 if (r >= 0) {
3005 log_info("Resumed LUKS device %s.", dm_name);
3006 return 0;
3007 }
3008
3009 log_debug_errno(r, "Password %zu didn't work for resuming device: %m", (size_t) (pp - password));
3010 }
3011
3012 return -ENOKEY;
3013 }
3014
3015 int home_unlock_luks(UserRecord *h, char ***pkcs11_decrypted_passwords) {
3016 _cleanup_free_ char *dm_name = NULL, *dm_node = NULL;
3017 _cleanup_(crypt_freep) struct crypt_device *cd = NULL;
3018 int r;
3019
3020 assert(h);
3021
3022 r = make_dm_names(h->user_name, &dm_name, &dm_node);
3023 if (r < 0)
3024 return r;
3025
3026 r = crypt_init_by_name(&cd, dm_name);
3027 if (r < 0)
3028 return log_error_errno(r, "Failed to initialize cryptsetup context for %s: %m", dm_name);
3029
3030 log_info("Discovered used LUKS device %s.", dm_node);
3031 crypt_set_log_callback(cd, cryptsetup_log_glue, NULL);
3032
3033 r = luks_try_resume(cd, dm_name, pkcs11_decrypted_passwords ? *pkcs11_decrypted_passwords : NULL);
3034 if (r == -ENOKEY) {
3035 r = luks_try_resume(cd, dm_name, h->password);
3036 if (r == -ENOKEY)
3037 return log_error_errno(r, "No valid password for LUKS superblock.");
3038 }
3039 if (r < 0)
3040 return log_error_errno(r, "Failed to resume LUKS superblock: %m");
3041
3042 log_info("LUKS device resumed.");
3043 return 0;
3044 }
Unnamed repository; edit this file 'description' to name the repository.