Attachment 154948 Details for Bug 124789 – Patch to add encrypted swap and root fs support to mkinitrd w/modular CBC on F7

[patch] Patch to add encrypted swap and root fs support to mkinitrd w/modular CBC on F7

mkinitrd-6.0.9-enc-sup.patch (text/plain), 15.86 KB, created by Tim Niemueller on 2007-05-17 18:42:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tim Niemueller

Created: 2007-05-17 18:42:28 UTC

Size: 15.86 KB

patch

obsolete

>diff -urN mkinitrd-6.0.9.orig/grubby/grubby.c mkinitrd-6.0.9/grubby/grubby.c
>--- mkinitrd-6.0.9.orig/grubby/grubby.c	2007-04-17 00:09:48.000000000 +0200
>+++ mkinitrd-6.0.9/grubby/grubby.c	2007-05-17 14:05:10.000000000 +0200
>@@ -29,6 +29,7 @@
> #include <sys/stat.h>
> #include <unistd.h>
> #include <libgen.h>
>+#include <libdevmapper.h>
> 
> #include "version.h"
> 
>@@ -47,6 +48,8 @@
> 
> #define CODE_SEG_SIZE	  128	/* code segment checked by --bootloader-probe */
> 
>+#define CRYPT_TARGET "crypt"
>+
> /* comments get lumped in with indention */
> struct lineElement {
>     char * item;
>@@ -1039,6 +1042,32 @@
>     return i;
> }
> 
>+/* returns true if dev seems to be encrypted using dmcrypt -- if this is
>+   true then dev (ie: /dev/hdaX) will not be the same as sb2's dev
>+   (ie: /dev/mapper/Y) */
>+static int isRootEnc(const dev_t statdev, const char *configdev) {
>+    void *next = NULL;
>+    struct dm_task *dmt;
>+    struct dm_info dmi;
>+    uint64_t start, length;
>+    char *target_type, *params;
>+    // Check if current root device is dm device.
>+    if (statdev >> 8 != 253)
>+        return 0;
>+    if (!(dmt = dm_task_create(DM_DEVICE_STATUS)))
>+        return 0;
>+    if (!dm_task_set_name(dmt, "root"))
>+        return 0;
>+    if (!dm_task_run(dmt))
>+        return 0;
>+    if (!dm_task_get_info(dmt, &dmi))
>+        return 0;
>+    next = dm_get_next_target(dmt, next, &start, &length, &target_type, &params);
>+    if (!target_type || strcmp(target_type, CRYPT_TARGET) != 0 || start != 0 || next)
>+        return 0;
>+    return 1;
>+}
>+
> int suitableImage(struct singleEntry * entry, const char * bootPrefix,
> 		  int skipRemoved, int flags) {
>     struct singleLine * line;
>@@ -1102,7 +1131,7 @@
> 
>     stat("/", &sb2);
> 
>-    if (sb.st_rdev != sb2.st_dev)
>+    if (! isRootEnc(sb2.st_dev, dev) && sb.st_rdev != sb2.st_dev)
>         return 0;
> 
>     return 1;
>diff -urN mkinitrd-6.0.9.orig/grubby/new-kernel-pkg mkinitrd-6.0.9/grubby/new-kernel-pkg
>--- mkinitrd-6.0.9.orig/grubby/new-kernel-pkg	2006-06-30 05:54:45.000000000 +0200
>+++ mkinitrd-6.0.9/grubby/new-kernel-pkg	2007-05-17 14:05:10.000000000 +0200
>@@ -11,6 +11,8 @@
> 
> PATH=/sbin:/bin:$PATH
> 
>+. /etc/rc.d/init.d/functions
>+
> lilo=/sbin/lilo
> 
> # some defaults that are sane for most arches
>@@ -87,6 +89,32 @@
>     exit 1
> }
> 
>+get_traditional_devnod() {
>+    majmin=$(get_numeric_dev dec $1)
>+    find /sys/block -name dev | while read device ; do \
>+        echo "$majmin" | cmp -s $device && echo $device ; done \
>+        | sed -e 's,.*/$[^/]\+$/dev,\1,'
>+}
>+
>+# Given /dev/dm-?:
>+# 1.  Find the devnod in /dev/mapper that has the same major and minor number.
>+# 2.  Find the link in /dev/VolGroup?? that points to this /dev/mapper device.
>+# 3.  Print /dev/VolGroup??/LogVol??
>+get_logvol_devnod() {
>+    majmin=$(get_numeric_dev dec $1)
>+    
>+    # 1:
>+    for device in /dev/mapper/*; do
>+        [ "$majmin" = "$(get_numeric_dev dec $device)" ] && mapperdev=$device
>+    done 
>+    # 2:
>+    for device in /dev/VolGroup??/*; do
>+        [ "$mapperdev" = "$(ls -l $device | awk '{ print $11 }')" ] && logvol=$device
>+    done 
>+    # 3:
>+    echo $logvol
>+} 
>+
> install() {
>     # XXX kernel should be able to be specified also (or work right on ia64)
>     if [ ! -f $bootPrefix/$kernelName-$version ] ; then
>@@ -130,6 +158,42 @@
> 	cfgLilo=""
>     fi
> 
>+    # check if root is encrypted and convert /dev/mapper/root to real
>+    # block device if it is (inverse of code in mkinitrd)
>+    if [ ${rootdevice%/*} = /dev/mapper ] \
>+         && cryptsetup status $rootdevice | grep cipher >/dev/null; then
>+        # cryptsetup prints the first device node it finds that matches the device type,
>+        # major number and minor number; this may be /dev/root and not, e.x., /dev/hda1.
>+        cryptsetupdevice=$(cryptsetup status $rootdevice | grep device | awk '{ print $2 }')
>+        traditionaldevice=$(get_traditional_devnod $cryptsetupdevice)
>+
>+        # If the backing device is not a valid block device, then check if the
>+        # cryptdevice is a valid block device and use it instead.
>+        # This helps cover the case where newer rules have disabled the
>+        # dm-# devices but the LVM mappings point to a valid block device.
>+        if [ ! -b "/dev/$traditionaldevice" ] && [ -b "$cryptsetupdevice" ] ; then 
>+           traditionaldevice=$cryptsetupdevice 
>+        fi
>+
>+        if [ -n "$traditionaldevice" ]; then
>+            if [ "dm-" = ${traditionaldevice%[^-]} ]; then
>+                logvoldevice=$(get_logvol_devnod /dev/$traditionaldevice)
>+                echo "Found backing device $logvoldevice ($traditionaldevice) for $rootdevice"
>+                rootdevice=$logvoldevice
>+            elif [[ "$traditionaldevice" =~ "^/dev/" ]] ; then
>+                logvoldevice=$(get_logvol_devnod $traditionaldevice)
>+                echo "Found backing device $logvoldevice ($traditionaldevice) for $rootdevice"
>+                rootdevice=$logvoldevice
>+            else
>+                echo "Found backing device $traditionaldevice for $rootdevice"
>+                rootdevice=/dev/$traditionaldevice
>+            fi
>+        else
>+	    echo "Could not determine traditional device for $cryptsetupdevice"
>+	    exit 1
>+        fi
>+    fi
>+
>     if [ -n "$cfgGrub" ]; then
> 	[ -n "$verbose" ] && echo "adding $version to $grubConfig"
> 
>diff -urN mkinitrd-6.0.9.orig/mkinitrd mkinitrd-6.0.9/mkinitrd
>--- mkinitrd-6.0.9.orig/mkinitrd	2007-04-16 23:55:39.000000000 +0200
>+++ mkinitrd-6.0.9/mkinitrd	2007-05-17 14:05:42.000000000 +0200
>@@ -160,6 +160,32 @@
>     echo nash-resolveDevice "$1" | /sbin/nash --forcequiet
> }
> 
>+get_traditional_devnod() {
>+    majmin=$(get_numeric_dev dec $1)
>+    findall /sys/block -name dev | while read device ; do \
>+        echo "$majmin" | cmp -s $device && echo $device ; done \
>+        | sed -e 's,.*/$[^/]\+$/dev,\1,'
>+}
>+
>+# Given /dev/dm-?:
>+# 1.  Find the devnod in /dev/mapper that has the same major and minor number.
>+# 2.  Find the link in /dev/VolGroup?? that points to this /dev/mapper device.
>+# 3.  Print /dev/VolGroup??/LogVol??
>+get_logvol_devnod() {
>+    majmin=$(get_numeric_dev dec $1)
>+
>+    # 1:
>+    for device in /dev/mapper/*; do
>+        [ "$majmin" = "$(get_numeric_dev dec $device)" ] && mapperdev=$device
>+    done
>+    # 2:
>+    for device in /dev/VolGroup??/*; do
>+        [ "$mapperdev" = "$(ls -l $device | awk '{ print $11 }')" ] && logvol=$device
>+    done
>+    # 3:
>+    echo $logvol
>+}
>+
> DSO_DEPS=""
> get_dso_deps() {
>     bin="$1" ; shift
>@@ -986,6 +1012,7 @@
>     findmodule -${rootfs}
> 
>     [ -z "$rootdev" ] && rootdev=$(awk '/^[ \t]*[^#]/ { if ($2 == "/") { print $1; }}' $fstab)
>+
>     # check if it's nfsroot
>     if [ "$rootfs" == "nfs" -a "x$net_list" == "x" ]; then
>         handlenfs $rootdev
>@@ -994,26 +1021,107 @@
>             "$rootdev" != "${rootdev##UUID=}" ]; then
>         rootopts=$(echo $rootopts | sed -e 's/^r[ow],//' -e 's/,_netdev//' -e 's/_netdev//' -e 's/,r[ow],$//' -e 's/,r[ow],/,/' -e 's/^r[ow]$/defaults/' -e 's/$/,ro/')
>         devname=$(resolve_device_name $rootdev)
>-        majmin=$(get_numeric_dev dec $devname)
>-        if [ -n "$majmin" ]; then
>-            dev=$(findall /sys/block -name dev | while read device ; do \
>-                  echo "$majmin" | cmp -s $device && echo $device ; done \
>-                  | sed -e 's,.*/$[^/]\+$/dev,\1,' )
>-            if [ -n "$dev" ]; then
>-                vecho "Found root device $dev for $rootdev"
>-                rootdev=$dev
>-            fi
>+        dev=$(get_traditional_devnod $devname)
>+        if [ -n "$dev" ]; then
>+            vecho "Found root device $dev for $rootdev"
>+            rootdev=/dev/$dev
>         fi
>     else
>         rootopts=$(echo $rootopts | sed -e 's/^r[ow],//' -e 's/,_netdev//' -e 's/_netdev//' -e 's/,r[ow],$//' -e 's/,r[ow],/,/' -e 's/^r[ow]$/defaults/' -e 's/$/,ro/')
>     fi
>-    [ "$rootfs" != "nfs" ] && handlelvordev $rootdev
>+
>+    # Check if root is encrypted
>+    root_enc=""
>+    if [ ${rootdev%/*} = /dev/mapper ] \
>+         && cryptsetup status $rootdev | grep cipher >/dev/null; then
>+        # cryptsetup prints the first device node it finds that matches the device type,
>+        # major number and minor number; this may be /dev/root and not, e.x., /dev/hda1.
>+        cryptsetupdev=`cryptsetup status $rootdev | grep device | awk '{ print $2 }'`
>+        traditionaldev=$(get_traditional_devnod $cryptsetupdev)
>+
>+        # If the backing device is not a valid block device, then check if the
>+        # cryptdevice is a valid block device and use it instead.
>+        # This helps cover the case where newer rules have disabled the
>+        # dm-# devices but the LVM mappings point to a valid block device.
>+        if [ ! -b "/dev/$traditionaldev" ] && [ -b "$cryptsetupdev" ] ; then
>+           traditionaldev=$cryptsetupdev
>+        fi
>+
>+        if [ -n "$traditionaldev" ]; then
>+            if [ "dm-" = ${traditionaldev%[^-]} ]; then
>+                backingdev=$(get_logvol_devnod /dev/$traditionaldev)
>+            elif [[ "$traditionaldev" =~ "^/dev/" ]] ; then
>+                backingdev=$(get_logvol_devnod $traditionaldev)
>+            else
>+                backingdev=/dev/$traditionaldev
>+            fi
>+            vecho "Found backing device $backingdev for $rootdev"
>+        else
>+            echo "Could not determine backing device, aborting." >&2
>+            exit 1
>+        fi
>+        if ! cryptsetup isLuks ${backingdev}; then
>+            echo "Encryption on $rootdev (backing device ${backingdev} does not use LUKS, aborting." >&2
>+            exit 1
>+        fi
>+        root_enc="yes"
>+        findmodule -dm-crypt
>+        findmodule -blkcipher
>+        findmodule -cbc
>+        findmodule -aes
>+        findmodule -sha256
>+        handlelvordev $backingdev
>+    else
>+        [ "$rootfs" != "nfs" ] && handlelvordev $rootdev
>+    fi
> 
>     # find the first swap dev which would get used for swsusp
>     swsuspdev=$(awk '/^[ \t]*[^#]/ { if ($3 == "swap") { print $1; exit }}' $fstab)
>-    if [ "$swsuspdev" == "${swsuspdev##LABEL=}" -o \
>-         "$swsuspdev" == "${swsuspdev##UUID=}" ]; then
>-        handlelvordev $swsuspdev
>+    swsusp_enc=""
>+    if [ ${swsuspdev%/*} = /dev/mapper ] \
>+         && cryptsetup status $swsuspdev | grep cipher >/dev/null; then
>+        # cryptsetup prints the first device node it finds that matches the
>+        # device type, major number and minor number .
>+        cryptsetupdev=`cryptsetup status $swsuspdev | grep device | awk '{ print $2 }'`
>+        traditionaldev=$(get_traditional_devnod $cryptsetupdev)
>+
>+        # If the backing device is not a valid block device, then check if the
>+        # cryptdevice is a valid block device and use it instead.
>+        # This helps cover the case where newer rules have disabled the
>+        # dm-# devices but the LVM mappings point to a valid block device.
>+        if [ ! -b "/dev/$traditionaldev" ] && [ -b "$cryptsetupdev" ] ; then
>+           traditionaldev=$cryptsetupdev
>+        fi
>+
>+        if [ -n "$traditionaldev" ]; then
>+            if [ "dm-" = ${traditionaldev%[^-]} ]; then
>+                sbackingdev=$(get_logvol_devnod /dev/$traditionaldev)
>+            elif [[ "$traditionaldev" =~ "^/dev/" ]] ; then
>+                sbackingdev=$(get_logvol_devnod $traditionaldev)
>+            else
>+                sbackingdev=/dev/$traditionaldev
>+            fi
>+            vecho "Found backing device $sbackingdev for $swsuspdev"
>+        else
>+            echo "Could not determine backing device, aborting." >&2
>+            exit 1
>+        fi
>+        if ! cryptsetup isLuks ${sbackingdev}; then
>+            echo "Encryption on $swsuspdev (backing device ${sbackingdev} does not use LUKS, aborting." >&2
>+            exit 1
>+        fi
>+        swsusp_enc="yes"
>+        findmodule -dm-crypt
>+        findmodule -blkcipher
>+        findmodule -cbc
>+        findmodule -aes
>+        findmodule -sha256
>+        handlelvordev $sbackingdev
>+    else
>+        if [ "$swsuspdev" == "${swsuspdev##LABEL=}" -o \
>+             "$swsuspdev" == "${swsuspdev##UUID=}" ]; then
>+            handlelvordev $swsuspdev
>+        fi
>     fi
> fi
> 
>@@ -1401,7 +1509,7 @@
> done
> unset usb_mounted
> 
>-if [ -n "$vg_list" ]; then
>+if [ -n "$vg_list" -o -n "$root_enc" -o -n "$swsusp_enc" ]; then
>     emit "echo Making device-mapper control node"
>     emit "mkdmnod"
> fi
>@@ -1443,6 +1551,20 @@
> fi
> 
> if [ -z "$noresume" -a -n "$swsuspdev" ]; then
>+    if [ "$swsusp_enc" = "yes" ]; then
>+        inst /sbin/cryptsetup "$MNTIMAGE" /bin/cryptsetup
>+
>+        # unlock device, make accesible at /dev/mapper/whatever
>+        if [ -f /etc/swsusp-key ]; then
>+            vecho "Found swsusp key at /etc/swsusp-key, installing at $MNTIMAGE/swsusp-key"
>+            vecho "Initrd's volume MUST BE REMOVABLE AND PROTECTED"
>+            cp /etc/swsusp-key $MNTIMAGE/swsusp-key
>+            emit "cryptsetup -d /swsusp-key luksOpen ${sbackingdev} ${swsuspdev##/dev/mapper/}"
>+        else
>+            vecho "Assuming manual passphrase entry"
>+            emit "cryptsetup luksOpen ${sbackingdev} ${swsuspdev##/dev/mapper/} < /dev/console > /dev/console"
>+        fi
>+    fi
>     emit "resume $swsuspdev"
> fi
> 
>@@ -1454,10 +1576,37 @@
>     emit "losetup /dev/loop0 /tmpmount/$looppath"
> fi
> 
>-emit "echo Creating root device."
>-# mkrootdev does "echo /dev/root /sysroot ext3 defaults,ro 0 0 >/etc/fstab"
>-emit "mkrootdev -t $rootfs -o $rootopts $rootdev"
>-rootdev=/dev/root
>+if [ -n "$root_enc" ]; then
>+    inst /sbin/cryptsetup "$MNTIMAGE/bin/cryptsetup"
>+    emit "echo Creating root device"
>+
>+    # FIXME: I need some advice here.  In the case of encrypted filesystems,
>+    # the "backing" root device is something like /dev/hda6 ($backingdev) and 
>+    # the "used" root device is something like /dev/mapper/root ($rootdev).
>+    # mkrootdev should create the "backing" root device but should write 
>+    # the "used" root device to /etc/fstab.  I modified mkrootdev to allow 
>+    # this but the result is ugly:
>+    emit "mkrootdev -n $rootdev -t $rootfs -o $rootopts $backingdev"
>+
>+    # unlock /dev/root, make accesible at /dev/mapper/root
>+    if [ -f /etc/root-key ]; then
>+        vecho "Found root key at /etc/root-key, installing at $MNTIMAGE/root-key"
>+        vecho "Initrd's volume MUST BE REMOVABLE AND PROTECTED"
>+        cp /etc/root-key $MNTIMAGE/root-key
>+        emit "cryptsetup -d /root-key luksOpen /dev/root root"
>+    else
>+        vecho "Assuming manual passphrase entry"
>+        emit "cryptsetup luksOpen /dev/root root < /dev/console > /dev/console"
>+    fi
>+
>+    # /dev/root is encrypted, /dev/mapper/root is plaintext
>+    rootdev=/dev/mapper/root
>+else
>+    emit "echo Creating root device."
>+    # mkrootdev does "echo /dev/root /sysroot ext3 defaults,ro 0 0 >/etc/fstab"
>+    emit "mkrootdev -n $rootdev -t $rootfs -o $rootopts $rootdev"
>+    rootdev=/dev/root
>+fi
> 
> emit "echo Mounting root filesystem."
> emit "mount /sysroot"
>diff -urN mkinitrd-6.0.9.orig/nash/nash.c mkinitrd-6.0.9/nash/nash.c
>--- mkinitrd-6.0.9.orig/nash/nash.c	2007-03-29 19:27:49.000000000 +0200
>+++ mkinitrd-6.0.9/nash/nash.c	2007-05-17 14:05:10.000000000 +0200
>@@ -1450,7 +1450,7 @@
>     int i;
>     FILE *fstab;
>     struct mntent mnt = {
>-        .mnt_fsname = "/dev/root",
>+        .mnt_fsname = NULL,
>         .mnt_dir = "/sysroot",
>         .mnt_type = NULL,
>         .mnt_opts = NULL,
>@@ -1473,7 +1473,13 @@
> 
>     i = 0;
>     while ((cmd = getArg(cmd, end, &chptr))) {
>-        if (!strcmp(chptr, "-t")) {
>+        if (!strcmp(chptr, "-n")) {
>+            cmd = getArg(cmd, end, &mnt.mnt_fsname);
>+            if (!cmd) {
>+                eprintf("mkrootdev: expected real mount device name\n");
>+                return 1;
>+            }
>+        } else if (!strcmp(chptr, "-t")) {
>             cmd = getArg(cmd, end, &mnt.mnt_type);
>             if (!cmd) {
>                 eprintf("mkrootdev: expected fs type\n");
>@@ -1506,6 +1512,10 @@
>         return 1;
>     }
> 
>+    if (!mnt.mnt_fsname) {
>+        eprintf("mkrootdev: expected real mount device name\n");
>+        return 1;
>+    }
>     if (!mnt.mnt_type) {
>         eprintf("mkrootdev: expected fs type\n");
>         return 1;

Actions: View | Diff

Attachments on bug 124789: 100700 | 101270 | 101644 | 102779 | 103215 | 103216 | 103419 | 105456 | 107752 | 107778 | 108173 | 113508 | 115668 | 117763 | 133932 | 134108 | 134534 | 134535 | 134536 | 134537 | 134538 | 135006 | 135462 | 135894 | 136049 | 141591 | 143860 | 144351 | 147835 | 148297 | 154948 | 155547 | 155901 | 159957 | 161831 | 161832 | 161909 | 161910 | 161912 | 255221 | 269101 | 289833