diff --git a/src/luks/systemd/dracut/clevis-pin-null/meson.build b/src/luks/dracut/clevis-pin-null/meson.build similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-null/meson.build rename to src/luks/dracut/clevis-pin-null/meson.build diff --git a/src/luks/systemd/dracut/clevis-pin-null/module-setup.sh.in b/src/luks/dracut/clevis-pin-null/module-setup.sh.in similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-null/module-setup.sh.in rename to src/luks/dracut/clevis-pin-null/module-setup.sh.in diff --git a/src/luks/systemd/dracut/clevis-pin-sss/meson.build b/src/luks/dracut/clevis-pin-sss/meson.build similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-sss/meson.build rename to src/luks/dracut/clevis-pin-sss/meson.build diff --git a/src/luks/systemd/dracut/clevis-pin-sss/module-setup.sh.in b/src/luks/dracut/clevis-pin-sss/module-setup.sh.in similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-sss/module-setup.sh.in rename to src/luks/dracut/clevis-pin-sss/module-setup.sh.in diff --git a/src/luks/systemd/dracut/clevis-pin-tang/meson.build b/src/luks/dracut/clevis-pin-tang/meson.build similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-tang/meson.build rename to src/luks/dracut/clevis-pin-tang/meson.build diff --git a/src/luks/systemd/dracut/clevis-pin-tang/module-setup.sh.in b/src/luks/dracut/clevis-pin-tang/module-setup.sh.in similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-tang/module-setup.sh.in rename to src/luks/dracut/clevis-pin-tang/module-setup.sh.in diff --git a/src/luks/systemd/dracut/clevis-pin-tpm2/meson.build b/src/luks/dracut/clevis-pin-tpm2/meson.build similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-tpm2/meson.build rename to src/luks/dracut/clevis-pin-tpm2/meson.build diff --git a/src/luks/systemd/dracut/clevis-pin-tpm2/module-setup.sh.in b/src/luks/dracut/clevis-pin-tpm2/module-setup.sh.in similarity index 100% rename from src/luks/systemd/dracut/clevis-pin-tpm2/module-setup.sh.in rename to src/luks/dracut/clevis-pin-tpm2/module-setup.sh.in diff --git a/src/luks/dracut/clevis/clevis-hook.sh.in b/src/luks/dracut/clevis/clevis-hook.sh.in new file mode 100755 index 00000000..78921a5d --- /dev/null +++ b/src/luks/dracut/clevis/clevis-hook.sh.in @@ -0,0 +1,22 @@ +#!/bin/sh +set -eu +# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: +# +# Copyright (c) 2020-2024 Red Hat, Inc. +# Author: Sergio Correia +# +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +@libexecdir@/clevis-luks-unlocker -l diff --git a/src/luks/dracut/clevis/clevis-luks-unlocker b/src/luks/dracut/clevis/clevis-luks-unlocker new file mode 100755 index 00000000..83063206 --- /dev/null +++ b/src/luks/dracut/clevis/clevis-luks-unlocker @@ -0,0 +1,72 @@ +#!/bin/sh +set -eu +# vim: set ts=8 shiftwidth=4 softtabstop=4 expandtab smarttab colorcolumn=80: +# +# Copyright (c) 2020-2024 Red Hat, Inc. +# Author: Sergio Correia +# +# Non-systemd clevis unlocker +# Modifications sponsored by PMGA Tech LLP +# +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# + +. clevis-luks-common-functions + +# Make sure to exit cleanly if SIGTERM is received. +trap 'echo "Exiting due to SIGTERM" && exit 0' TERM + +loop= +while getopts ":l" o; do + case "${o}" in + l) loop=true;; + *) ;; + esac +done + +to_unlock() { + _devices='' + for _d in $(blkid -t TYPE=crypto_LUKS -o device); do + if ! bindings="$(clevis luks list -d "${_d}" 2>/dev/null)" \ + || [ -z "${bindings}" ]; then + continue + fi + _uuid="$(cryptsetup luksUUID "${_d}")" + if clevis_is_luks_device_by_uuid_open "${_uuid}"; then + continue + fi + _devices="$(printf '%s\n%s' "${_devices}" "${_d}")" + done + echo "${_devices}" | sed -e 's/^\n$//' +} + +while true; do + for d in $(to_unlock); do + uuid="$(cryptsetup luksUUID "${d}")" + if ! clevis luks unlock -d "${d}"; then + echo "Unable to unlock ${d} (UUID=${uuid})" >&2 + continue + fi + echo "Unlocked ${d} (UUID=${uuid}) successfully" >&2 + done + + [ "${loop}" != true ] && break + # Checking for pending devices to be unlocked. + if remaining=$(to_unlock) && [ -z "${remaining}" ]; then + break; + fi + + sleep 0.5 +done diff --git a/src/luks/systemd/dracut/clevis/meson.build b/src/luks/dracut/clevis/meson.build similarity index 88% rename from src/luks/systemd/dracut/clevis/meson.build rename to src/luks/dracut/clevis/meson.build index 167e708a..b05bc101 100644 --- a/src/luks/systemd/dracut/clevis/meson.build +++ b/src/luks/dracut/clevis/meson.build @@ -16,6 +16,8 @@ if dracut.found() install_dir: dracutdir, configuration: data, ) + + install_data('clevis-luks-unlocker', install_dir: libexecdir) else warning('Will not install dracut module due to missing dependencies!') endif diff --git a/src/luks/systemd/dracut/clevis/module-setup.sh.in b/src/luks/dracut/clevis/module-setup.sh.in similarity index 78% rename from src/luks/systemd/dracut/clevis/module-setup.sh.in rename to src/luks/dracut/clevis/module-setup.sh.in index bfe657c1..50547a52 100755 --- a/src/luks/systemd/dracut/clevis/module-setup.sh.in +++ b/src/luks/dracut/clevis/module-setup.sh.in @@ -19,7 +19,11 @@ # depends() { - echo crypt systemd + local __depends=crypt + if dracut_module_included "systemd"; then + __depends=$(printf '%s systemd' "${__depends}") + fi + echo "${__depends}" return 255 } @@ -27,17 +31,22 @@ install() { if dracut_module_included "systemd"; then inst_multiple \ $systemdsystemunitdir/clevis-luks-askpass.service \ - $systemdsystemunitdir/clevis-luks-askpass.path + $systemdsystemunitdir/clevis-luks-askpass.path \ + @SYSTEMD_REPLY_PASS@ \ + @libexecdir@/clevis-luks-askpass + systemctl -q --root "$initdir" add-wants cryptsetup.target clevis-luks-askpass.path else inst_hook initqueue/online 60 "$moddir/clevis-hook.sh" inst_hook initqueue/settled 60 "$moddir/clevis-hook.sh" + inst_multiple \ + @libexecdir@/clevis-luks-unlocker \ + clevis-luks-unlock \ + blkid fi inst_multiple \ /etc/services \ - @SYSTEMD_REPLY_PASS@ \ - @libexecdir@/clevis-luks-askpass \ clevis-luks-common-functions \ grep sed cut \ clevis-decrypt \ diff --git a/src/luks/systemd/dracut/meson.build b/src/luks/dracut/meson.build similarity index 100% rename from src/luks/systemd/dracut/meson.build rename to src/luks/dracut/meson.build diff --git a/src/luks/meson.build b/src/luks/meson.build index e06fa125..8a8394e0 100644 --- a/src/luks/meson.build +++ b/src/luks/meson.build @@ -34,6 +34,9 @@ clevis_luks_unbind = configure_file(input: 'clevis-luks-unbind.in', if libcryptsetup.found() and luksmeta.found() subdir('systemd') + # systemd should come before dracut in order to set up + # variables like SYSTEMD_REPLY_PASS. + subdir('dracut') subdir('udisks2') bins += clevis_luks_unbind diff --git a/src/luks/systemd/dracut/clevis/clevis-hook.sh.in b/src/luks/systemd/dracut/clevis/clevis-hook.sh.in deleted file mode 100755 index cb257c99..00000000 --- a/src/luks/systemd/dracut/clevis/clevis-hook.sh.in +++ /dev/null @@ -1,2 +0,0 @@ -#!/bin/bash -@libexecdir@/clevis-luks-askpass diff --git a/src/luks/systemd/meson.build b/src/luks/systemd/meson.build index e3b3d918..b10494e3 100644 --- a/src/luks/systemd/meson.build +++ b/src/luks/systemd/meson.build @@ -10,7 +10,6 @@ sd_reply_pass = find_program( if systemd.found() and sd_reply_pass.found() data.set('SYSTEMD_REPLY_PASS', sd_reply_pass.path()) - subdir('dracut') unitdir = systemd.get_pkgconfig_variable('systemdsystemunitdir')