1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
4 This file is part of systemd.
6 Copyright 2010 Lennart Poettering
8 systemd is free software; you can redistribute it and/or modify it
9 under the terms of the GNU Lesser General Public License as published by
10 the Free Software Foundation; either version 2.1 of the License, or
11 (at your option) any later version.
13 systemd is distributed in the hope that it will be useful, but
14 WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 Lesser General Public License for more details.
18 You should have received a copy of the GNU Lesser General Public License
19 along with systemd; If not, see <http://www.gnu.org/licenses/>.
28 #include "unit-name.h"
32 #include "path-util.h"
34 #include "generator.h"
36 static const char *arg_dest = "/tmp";
37 static bool arg_enabled = true;
38 static bool arg_read_crypttab = true;
39 static char **arg_disks = NULL;
40 static char **arg_options = NULL;
41 static char *arg_keyfile = NULL;
43 static bool has_option(const char *haystack, const char *needle) {
44 const char *f = haystack;
54 while ((f = strstr(f, needle))) {
56 if (f > haystack && f[-1] != ',') {
61 if (f[l] != 0 && f[l] != ',') {
72 static int create_disk(
76 const char *options) {
78 _cleanup_free_ char *p = NULL, *n = NULL, *d = NULL, *u = NULL, *to = NULL, *e = NULL,
80 _cleanup_fclose_ FILE *f = NULL;
81 bool noauto, nofail, tmp, swap;
88 noauto = has_option(options, "noauto");
89 nofail = has_option(options, "nofail");
90 tmp = has_option(options, "tmp");
91 swap = has_option(options, "swap");
94 log_error("Device '%s' cannot be both 'tmp' and 'swap'. Ignoring.", name);
98 e = unit_name_escape(name);
102 n = unit_name_build("systemd-cryptsetup", e, ".service");
106 p = strjoin(arg_dest, "/", n, NULL);
110 u = fstab_node_to_udev_node(device);
114 d = unit_name_from_path(u, ".device");
120 log_error("Failed to create unit file %s: %m", p);
125 "# Automatically generated by systemd-cryptsetup-generator\n\n"
127 "Description=Cryptography Setup for %I\n"
128 "Documentation=man:crypttab(5) man:systemd-cryptsetup-generator(8) man:systemd-cryptsetup@.service(8)\n"
129 "SourcePath=/etc/crypttab\n"
130 "DefaultDependencies=no\n"
131 "Conflicts=umount.target\n"
132 "BindsTo=dev-mapper-%i.device\n"
133 "IgnoreOnIsolate=true\n"
134 "After=cryptsetup-pre.target\n",
139 "Before=cryptsetup.target\n");
142 if (STR_IN_SET(password, "/dev/urandom", "/dev/random", "/dev/hw_random"))
143 fputs("After=systemd-random-seed.service\n", f);
144 else if (!streq(password, "-") && !streq(password, "none")) {
145 _cleanup_free_ char *uu;
147 uu = fstab_node_to_udev_node(password);
151 if (!path_equal(uu, "/dev/null")) {
153 if (is_device_path(uu)) {
154 _cleanup_free_ char *dd;
156 dd = unit_name_from_path(uu, ".device");
160 fprintf(f, "After=%1$s\nRequires=%1$s\n", dd);
162 fprintf(f, "RequiresMountsFor=%s\n", password);
167 if (is_device_path(u))
171 "Before=umount.target\n",
175 "RequiresMountsFor=%s\n",
178 r = generator_write_timeouts(arg_dest, device, name, options, &filtered);
185 "RemainAfterExit=yes\n"
186 "TimeoutSec=0\n" /* the binary handles timeouts anyway */
187 "ExecStart=" SYSTEMD_CRYPTSETUP_PATH " attach '%s' '%s' '%s' '%s'\n"
188 "ExecStop=" SYSTEMD_CRYPTSETUP_PATH " detach '%s'\n",
189 name, u, strempty(password), strempty(filtered),
194 "ExecStartPost=/sbin/mke2fs '/dev/mapper/%s'\n",
199 "ExecStartPost=/sbin/mkswap '/dev/mapper/%s'\n",
204 log_error("Failed to write file %s: %m", p);
208 from = strappenda("../", n);
212 to = strjoin(arg_dest, "/", d, ".wants/", n, NULL);
216 mkdir_parents_label(to, 0755);
217 if (symlink(from, to) < 0) {
218 log_error("Failed to create symlink %s: %m", to);
224 to = strjoin(arg_dest, "/cryptsetup.target.requires/", n, NULL);
226 to = strjoin(arg_dest, "/cryptsetup.target.wants/", n, NULL);
230 mkdir_parents_label(to, 0755);
231 if (symlink(from, to) < 0) {
232 log_error("Failed to create symlink %s: %m", to);
238 to = strjoin(arg_dest, "/dev-mapper-", e, ".device.requires/", n, NULL);
242 mkdir_parents_label(to, 0755);
243 if (symlink(from, to) < 0) {
244 log_error("Failed to create symlink %s: %m", to);
248 if (!noauto && !nofail) {
249 _cleanup_free_ char *dmname;
250 dmname = strjoin("dev-mapper-", e, ".device", NULL);
254 r = write_drop_in(arg_dest, dmname, 90, "device-timeout",
255 "# Automatically generated by systemd-cryptsetup-generator \n\n"
256 "[Unit]\nJobTimeoutSec=0");
258 log_error("Failed to write device drop-in: %s", strerror(-r));
266 static int parse_proc_cmdline_item(const char *key, const char *value) {
269 if (STR_IN_SET(key, "luks", "rd.luks") && value) {
271 r = parse_boolean(value);
273 log_warning("Failed to parse luks switch %s. Ignoring.", value);
277 } else if (STR_IN_SET(key, "luks.crypttab", "rd.luks.crypttab") && value) {
279 r = parse_boolean(value);
281 log_warning("Failed to parse luks crypttab switch %s. Ignoring.", value);
283 arg_read_crypttab = r;
285 } else if (STR_IN_SET(key, "luks.uuid", "rd.luks.uuid") && value) {
287 if (strv_extend(&arg_disks, value) < 0)
290 } else if (STR_IN_SET(key, "luks.options", "rd.luks.options") && value) {
292 if (strv_extend(&arg_options, value) < 0)
295 } else if (STR_IN_SET(key, "luks.key", "rd.luks.key") && value) {
298 arg_keyfile = strdup(value);
307 int main(int argc, char *argv[]) {
308 _cleanup_strv_free_ char **disks_done = NULL;
309 _cleanup_fclose_ FILE *f = NULL;
311 int r = EXIT_FAILURE, r2 = EXIT_FAILURE, z;
314 if (argc > 1 && argc != 4) {
315 log_error("This program takes three or no arguments.");
322 log_set_target(LOG_TARGET_SAFE);
323 log_parse_environment();
328 z = parse_proc_cmdline(parse_proc_cmdline_item);
330 log_warning("Failed to parse kernel command line, ignoring: %s", strerror(-z));
333 r = r2 = EXIT_SUCCESS;
337 strv_uniq(arg_disks);
339 if (arg_read_crypttab) {
342 f = fopen("/etc/crypttab", "re");
347 log_error("Failed to open /etc/crypttab: %m");
352 if (fstat(fileno(f), &st) < 0) {
353 log_error("Failed to stat /etc/crypttab: %m");
357 /* If we readd support for specifying passphrases
358 * directly in crypttabe we should upgrade the warning
359 * below, though possibly only if a passphrase is
360 * specified directly. */
361 if (st.st_mode & 0005)
362 log_debug("/etc/crypttab is world-readable. This is usually not a good idea.");
365 char line[LINE_MAX], *l;
366 _cleanup_free_ char *name = NULL, *device = NULL, *password = NULL, *options = NULL;
369 if (!fgets(line, sizeof(line), f))
375 if (*l == '#' || *l == 0)
378 k = sscanf(l, "%ms %ms %ms %ms", &name, &device, &password, &options);
379 if (k < 2 || k > 4) {
380 log_error("Failed to parse /etc/crypttab:%u, ignoring.", n);
385 If options are specified on the kernel command line, let them override
386 the ones from crypttab.
388 STRV_FOREACH(i, arg_options) {
389 _cleanup_free_ char *proc_uuid = NULL, *proc_options = NULL;
392 k = sscanf(p, "%m[0-9a-fA-F-]=%ms", &proc_uuid, &proc_options);
393 if (k == 2 && streq(proc_uuid, device + 5)) {
405 If luks UUIDs are specified on the kernel command line, use them as a filter
406 for /etc/crypttab and only generate units for those.
408 STRV_FOREACH(i, arg_disks) {
409 _cleanup_free_ char *proc_device = NULL, *proc_name = NULL;
412 if (startswith(p, "luks-"))
415 proc_name = strappend("luks-", p);
416 proc_device = strappend("UUID=", p);
418 if (!proc_name || !proc_device) {
423 if (streq(proc_device, device) || streq(proc_name, name)) {
424 if (create_disk(name, device, password, options) < 0)
427 if (strv_extend(&disks_done, p) < 0) {
433 } else if (create_disk(name, device, password, options) < 0)
442 STRV_FOREACH(i, arg_disks) {
444 Generate units for those UUIDs, which were specified
445 on the kernel command line and not yet written.
448 _cleanup_free_ char *name = NULL, *device = NULL, *options = NULL;
451 if (startswith(p, "luks-"))
454 if (strv_contains(disks_done, p))
457 name = strappend("luks-", p);
458 device = strappend("UUID=", p);
460 if (!name || !device) {
467 If options are specified on the kernel command line, use them.
471 STRV_FOREACH(j, arg_options) {
472 _cleanup_free_ char *proc_uuid = NULL, *proc_options = NULL;
476 k = sscanf(s, "%m[0-9a-fA-F-]=%ms", &proc_uuid, &proc_options);
478 if (streq(proc_uuid, device + 5)) {
480 options = proc_options;
483 } else if (!options) {
485 Fall back to options without a specified UUID
497 options = strdup("timeout=0");
504 if (create_disk(name, device, arg_keyfile, options) < 0)
511 strv_free(arg_disks);
512 strv_free(arg_options);
515 return r != EXIT_SUCCESS ? r : r2;