cryptsetup-generator: block boot when querying passphrase.

[elogind.git] / src / cryptsetup-generator.c

diff --git a/src/cryptsetup-generator.c b/src/cryptsetup-generator.c
index 73c367935f57763cc0355f19b893e42576a3d45a..6f3aa786bc5eaee634c1da1ee89f15ea76939cfe 100644 (file)
--- a/src/cryptsetup-generator.c
+++ b/src/cryptsetup-generator.c
@@ -33,6 +33,11 @@ static bool has_option(const char *haystack, const char *needle) {
         const char *f = haystack;
         size_t l;
 
+        assert(needle);
+
+        if (!haystack)
+                return false;
+
         l = strlen(needle);
 
         while ((f = strstr(f, needle))) {
@@ -42,7 +47,7 @@ static bool has_option(const char *haystack, const char *needle) {
                         continue;
                 }
 
-                if (f[l] != 0 && f[l] == ',') {
+                if (f[l] != 0 && f[l] != ',') {
                         f++;
                         continue;
                 }
@@ -59,13 +64,17 @@ static int create_disk(
                 const char *password,
                 const char *options) {
 
-        char *p = NULL, *n = NULL, *d = NULL, *u = NULL, *from = NULL, *to = NULL;
+        char *p = NULL, *n = NULL, *d = NULL, *u = NULL, *from = NULL, *to = NULL, *e = NULL;
         int r;
         FILE *f = NULL;
+        bool noauto, nofail;
 
         assert(name);
         assert(device);
 
+        noauto = has_option(options, "noauto");
+        nofail = has_option(options, "nofail");
+
         if (!(n = unit_name_build_escape("cryptsetup", name, ".service"))) {
                 r = -ENOMEM;
                 log_error("Failed to allocate unit name.");
@@ -98,13 +107,19 @@ static int create_disk(
 
         fprintf(f,
                 "[Unit]\n"
-                "Description=Cryptography Setup for %%f\n"
+                "Description=Cryptography Setup for %%I\n"
+                "Conflicts=umount.target\n"
                 "DefaultDependencies=no\n"
-                "BindTo=%s\n"
+                "BindTo=%s dev-mapper-%%i.device\n"
                 "After=systemd-readahead-collect.service systemd-readahead-replay.service %s\n"
-                "Before=dev-mapper-%%i.device shutdown.target\n",
+                "Before=umount.target\n"
+                "Before=local-fs.target\n",
                 d, d);
 
+        if (!nofail)
+                fprintf(f,
+                        "Before=cryptsetup.target\n");
+
         if (password && (streq(password, "/dev/urandom") ||
                          streq(password, "/dev/random") ||
                          streq(password, "/dev/hw_random")))
@@ -115,21 +130,21 @@ static int create_disk(
                 "\n[Service]\n"
                 "Type=oneshot\n"
                 "RemainAfterExit=yes\n"
-                "ExecStart=" SYSTEMD_CRYPTSETUP_PATH " %s '%s' '%s' '%s' '%s'\n"
+                "TimeoutSec=0\n" /* the binary handles timeouts anyway */
+                "ExecStart=" SYSTEMD_CRYPTSETUP_PATH " attach '%s' '%s' '%s' '%s'\n"
                 "ExecStop=" SYSTEMD_CRYPTSETUP_PATH " detach '%s'\n",
-                options && has_option(options, "swap") ? "format-and-attach" : "attach",
                 name, u, strempty(password), strempty(options),
                 name);
 
-        if (options && has_option(options, "tmp"))
+        if (has_option(options, "tmp"))
                 fprintf(f,
-                        "ExecStartPost=/sbin/mke2fs '%s'",
-                        u);
+                        "ExecStartPost=/sbin/mke2fs '/dev/mapper/%s'\n",
+                        name);
 
-        if (options && has_option(options, "swap"))
+        if (has_option(options, "swap"))
                 fprintf(f,
-                        "ExecStartPost=/sbin/mkswap '%s'",
-                        u);
+                        "ExecStartPost=/sbin/mkswap '/dev/mapper/%s'\n",
+                        name);
 
         fflush(f);
 
@@ -139,14 +154,35 @@ static int create_disk(
                 goto fail;
         }
 
-        if (!options || !has_option(options, "noauto")) {
+        if (asprintf(&from, "../%s", n) < 0) {
+                r = -ENOMEM;
+                goto fail;
+        }
+
+        if (!noauto) {
 
                 if (asprintf(&to, "%s/%s.wants/%s", arg_dest, d, n) < 0) {
                         r = -ENOMEM;
                         goto fail;
                 }
 
-                if (asprintf(&from, "../%s", n) < 0) {
+                mkdir_parents(to, 0755);
+
+                if (symlink(from, to) < 0) {
+                        log_error("Failed to create symlink '%s' to '%s': %m", from, to);
+                        r = -errno;
+                        goto fail;
+                }
+
+                free(to);
+                to = NULL;
+
+                if (!nofail)
+                        asprintf(&to, "%s/cryptsetup.target.requires/%s", arg_dest, n);
+                else
+                        asprintf(&to, "%s/cryptsetup.target.wants/%s", arg_dest, n);
+
+                if (!to) {
                         r = -ENOMEM;
                         goto fail;
                 }
@@ -160,12 +196,30 @@ static int create_disk(
                 }
         }
 
+        free(to);
+        to = NULL;
+
+        e = unit_name_escape(name);
+        if (asprintf(&to, "%s/dev-mapper-%s.device.requires/%s", arg_dest, e, n) < 0) {
+                r = -ENOMEM;
+                goto fail;
+        }
+
+        mkdir_parents(to, 0755);
+
+        if (symlink(from, to) < 0) {
+                log_error("Failed to create symlink '%s' to '%s': %m", from, to);
+                r = -errno;
+                goto fail;
+        }
+
         r = 0;
 
 fail:
         free(p);
         free(n);
         free(d);
+        free(e);
 
         free(from);
         free(to);
@@ -186,12 +240,15 @@ int main(int argc, char *argv[]) {
                 return EXIT_FAILURE;
         }
 
-        arg_dest = argv[1];
+        if (argc > 1)
+                arg_dest = argv[1];
 
         log_set_target(LOG_TARGET_SYSLOG_OR_KMSG);
         log_parse_environment();
         log_open();
 
+        umask(0022);
+
         if (!(f = fopen("/etc/crypttab", "re"))) {
 
                 if (errno == ENOENT)