diff --git a/src/luks/systemd/dracut/clevis-pin-null/meson.build b/src/dracut/clevis-pin-null/meson.build similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-null/meson.build rename to src/dracut/clevis-pin-null/meson.build diff --git a/src/luks/systemd/dracut/clevis-pin-null/module-setup.sh.in b/src/dracut/clevis-pin-null/module-setup.sh.in similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-null/module-setup.sh.in rename to src/dracut/clevis-pin-null/module-setup.sh.in diff --git a/src/luks/systemd/dracut/clevis-pin-sss/meson.build b/src/dracut/clevis-pin-sss/meson.build similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-sss/meson.build rename to src/dracut/clevis-pin-sss/meson.build diff --git a/src/luks/systemd/dracut/clevis-pin-sss/module-setup.sh.in b/src/dracut/clevis-pin-sss/module-setup.sh.in similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-sss/module-setup.sh.in rename to src/dracut/clevis-pin-sss/module-setup.sh.in diff --git a/src/luks/systemd/dracut/clevis-pin-tang/meson.build b/src/dracut/clevis-pin-tang/meson.build similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-tang/meson.build rename to src/dracut/clevis-pin-tang/meson.build diff --git a/src/luks/systemd/dracut/clevis-pin-tang/module-setup.sh.in b/src/dracut/clevis-pin-tang/module-setup.sh.in similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-tang/module-setup.sh.in rename to src/dracut/clevis-pin-tang/module-setup.sh.in diff --git a/src/luks/systemd/dracut/clevis-pin-tpm2/meson.build b/src/dracut/clevis-pin-tpm2/meson.build similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-tpm2/meson.build rename to src/dracut/clevis-pin-tpm2/meson.build diff --git a/src/luks/systemd/dracut/clevis-pin-tpm2/module-setup.sh.in b/src/dracut/clevis-pin-tpm2/module-setup.sh.in similarity index 96% rename from src/luks/systemd/dracut/clevis-pin-tpm2/module-setup.sh.in rename to src/dracut/clevis-pin-tpm2/module-setup.sh.in index 5ff06404..2fce4e3e 100755 --- a/src/luks/systemd/dracut/clevis-pin-tpm2/module-setup.sh.in +++ b/src/dracut/clevis-pin-tpm2/module-setup.sh.in @@ -36,5 +36,5 @@ install() { } installkernel() { - hostonly='' instmods =drivers/char/tpm + hostonly='' instmods=drivers/char/tpm } diff --git a/src/dracut/clevis/clevis-hook.sh.in b/src/dracut/clevis/clevis-hook.sh.in new file mode 100755 index 00000000..c5f20c59 --- /dev/null +++ b/src/dracut/clevis/clevis-hook.sh.in @@ -0,0 +1,23 @@ +#!/bin/bash +set -eu +# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: +# +# Copyright (c) 2020-2023 Red Hat, Inc. +# Author: Sergio Correia +# Modifications sponsored by PMGA Tech LLP +# +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# +@libexecdir@/clevis-luks-generic-unlocker -l \ No newline at end of file diff --git a/src/dracut/clevis/clevis-luks-generic-unlocker b/src/dracut/clevis/clevis-luks-generic-unlocker new file mode 100755 index 00000000..8baec3b9 --- /dev/null +++ b/src/dracut/clevis/clevis-luks-generic-unlocker @@ -0,0 +1,71 @@ +#!/bin/bash +set -eu +# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: +# +# Copyright (c) 2020-2023 Red Hat, Inc. +# Author: Sergio Correia +# Modifications sponsored by PMGA Tech LLP +# +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +. clevis-luks-common-functions + +# Make sure to exit cleanly if SIGTERM is received. +trap 'echo "Exiting due to SIGTERM" && exit 0' TERM + +loop= +while getopts ":l" o; do + case "${o}" in + l) loop=true;; + *) ;; + esac +done + +to_unlock() { + local _devices='' _d _uuid + for _d in $(blkid -t TYPE=crypto_LUKS -o device); + do + if ! bindings="$(clevis luks list -d "${_d}" 2>/dev/null)" \ + || [ -z "${bindings}" ]; then + continue + fi + _uuid="$(cryptsetup luksUUID "${_d}")" + if clevis_is_luks_device_by_uuid_open "${_uuid}"; then + continue + fi + _devices="$(printf '%s\n%s' "${_devices}" "${_d}")" + done + echo "${_devices}" | sed -e 's/^\n$//' +} + +while true; do + for d in $(to_unlock); do + uuid="$(cryptsetup luksUUID "${d}")" + if ! clevis luks unlock -d "${d}"; then + echo "Unable to unlock ${d} (UUID=${uuid})" >&2 + continue + fi + echo "Unlocked ${d} (UUID=${uuid}) successfully" >&2 + done + + [ "${loop}" != true ] && break + # Checking for pending devices to be unlocked. + if remaining=$(to_unlock) && [ -z "${remaining}" ]; then + break; + fi + + sleep 0.5 +done \ No newline at end of file diff --git a/src/luks/systemd/dracut/clevis/meson.build b/src/dracut/clevis/meson.build similarity index 88% rename from src/luks/systemd/dracut/clevis/meson.build rename to src/dracut/clevis/meson.build index 167e708a..db5ef2f2 100644 --- a/src/luks/systemd/dracut/clevis/meson.build +++ b/src/dracut/clevis/meson.build @@ -16,6 +16,7 @@ if dracut.found() install_dir: dracutdir, configuration: data, ) +install_data('clevis-luks-generic-unlocker', install_dir: libexecdir) else warning('Will not install dracut module due to missing dependencies!') endif diff --git a/src/luks/systemd/dracut/clevis/module-setup.sh.in b/src/dracut/clevis/module-setup.sh.in similarity index 77% rename from src/luks/systemd/dracut/clevis/module-setup.sh.in rename to src/dracut/clevis/module-setup.sh.in index bfe657c1..af3eff49 100755 --- a/src/luks/systemd/dracut/clevis/module-setup.sh.in +++ b/src/dracut/clevis/module-setup.sh.in @@ -19,7 +19,11 @@ # depends() { - echo crypt systemd + local __depends=crypt + if dracut_module_included "systemd"; then + __depends=$(printf '%s systemd' "${__depends}") + fi + echo "${__depends}" return 255 } @@ -27,17 +31,21 @@ install() { if dracut_module_included "systemd"; then inst_multiple \ $systemdsystemunitdir/clevis-luks-askpass.service \ - $systemdsystemunitdir/clevis-luks-askpass.path + $systemdsystemunitdir/clevis-luks-askpass.path \ + @SYSTEMD_REPLY_PASS@ \ + @libexecdir@/clevis-luks-askpass systemctl -q --root "$initdir" add-wants cryptsetup.target clevis-luks-askpass.path else inst_hook initqueue/online 60 "$moddir/clevis-hook.sh" inst_hook initqueue/settled 60 "$moddir/clevis-hook.sh" + inst_multiple \ + @libexecdir@/clevis-luks-generic-unlocker \ + clevis-luks-unlock \ + blkid fi inst_multiple \ /etc/services \ - @SYSTEMD_REPLY_PASS@ \ - @libexecdir@/clevis-luks-askpass \ clevis-luks-common-functions \ grep sed cut \ clevis-decrypt \ diff --git a/src/luks/systemd/dracut/meson.build b/src/dracut/meson.build similarity index 100% rename from src/luks/systemd/dracut/meson.build rename to src/dracut/meson.build diff --git a/src/luks/systemd/dracut/clevis/clevis-hook.sh.in b/src/luks/systemd/dracut/clevis/clevis-hook.sh.in deleted file mode 100755 index cb257c99..00000000 --- a/src/luks/systemd/dracut/clevis/clevis-hook.sh.in +++ /dev/null @@ -1,2 +0,0 @@ -#!/bin/bash -@libexecdir@/clevis-luks-askpass diff --git a/src/luks/systemd/meson.build b/src/luks/systemd/meson.build index e3b3d918..019e1a69 100644 --- a/src/luks/systemd/meson.build +++ b/src/luks/systemd/meson.build @@ -10,7 +10,7 @@ sd_reply_pass = find_program( if systemd.found() and sd_reply_pass.found() data.set('SYSTEMD_REPLY_PASS', sd_reply_pass.path()) - subdir('dracut') + unitdir = systemd.get_pkgconfig_variable('systemdsystemunitdir') diff --git a/src/meson.build b/src/meson.build index c4e696f6..a0dff5b7 100644 --- a/src/meson.build +++ b/src/meson.build @@ -1,6 +1,7 @@ subdir('bash') subdir('luks') subdir('pins') +subdir('dracut') subdir('initramfs-tools') bins += join_paths(meson.current_source_dir(), 'clevis-decrypt')