summarylogtreecommitdiffstats
path: root/multiencrypt_hook
blob: fa401636356b79d61cbc1d05531f2c97ea6cae73 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
#!/usr/bin/ash

run_hook() {
    local pw
    modprobe -a -q dm-crypt >/dev/null 2>&1
    [ "${quiet}" = "y" ] && CSQUIET=">/dev/null"

    if [ -z "${cryptdevices}" ]; then
        return 1
    fi

    for devspec in $(echo "${cryptdevices}" | tr ';' '\n'); do
        [ -z "${devspec}" ] && continue
        
        IFS=: read cryptdev cryptname cryptoptions <<EOF
${devspec}
EOF

        # parse options
        cryptargs=""
        for cryptopt in ${cryptoptions//,/ }; do
            case ${cryptopt} in
                allow-discards)
                    cryptargs="${cryptargs} --allow-discards"
                    ;;
                *)
                    echo "Encryption option '${cryptopt}' not known, ignoring" >&2
                    ;;
            esac
        done

        # try to decrypt
        if ! resolved=$(resolve_device "${cryptdev}" ${rootdelay}); then
            err "Device ${cryptdev} could not be resolved. Skipping..."
            continue
        fi

        if ! eval cryptsetup isLuks ${resolved} >/dev/null 2>&1; then
            err "Failed to open device ${cryptdev}: Not a LUKS volume!"
            continue
        fi

        while ! [ -e "/dev/mapper/${cryptname}" ]; do
            eval cryptsetup open --type luks --test-passphrase ${resolved} ${cryptname} ${cryptargs} >/dev/null 2>/dev/null <<EOF
${pw}
EOF
            if [ $? -eq 0 ]; then
                break
            else
                echo -n "Enter password for ${cryptname}: "
                read -r -s pw
		echo ""
            fi
        done

        eval cryptsetup open --type luks ${resolved} ${cryptname} ${cryptargs} ${CSQUIET} <<EOF
${pw}
EOF
        if ! [ -e "/dev/mapper/${cryptname}" ]; then
            err "Password succeeded, but ${cryptname} creation failed, aborting..."
            exit 1
        fi
    done
}

# vim: set ft=sh ts=4 sw=4 et: