mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
zkey: Add common passphrase options for crypttab command
When generating crypttab entries for LUKS2 volumes, allow to specify common passphrase options like --key-file, --keyfile-offset, --keyfile-size and --tries and pass those to the generated crypttab entries. Note that not all distributions support the keyfile-offset and keyfile-size options in crypttab entries. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
committed by
Jan Höppner
Jan Höppner
parent
5a0c93443c
commit
3ed8ab4e2a
@@ -3405,7 +3405,7 @@ static int _keystore_process_crypttab(struct keystore *UNUSED(keystore),
|
||||
size_t key_file_size,
|
||||
size_t sector_size,
|
||||
const char *volume_type,
|
||||
struct crypt_info *UNUSED(info))
|
||||
struct crypt_info *info)
|
||||
{
|
||||
char temp[1000];
|
||||
|
||||
@@ -3428,7 +3428,18 @@ static int _keystore_process_crypttab(struct keystore *UNUSED(keystore),
|
||||
dmname, volume, key_file_name, cipher_spec,
|
||||
key_file_size * 8, sector_size > 0 ? temp : "");
|
||||
} else if (strcasecmp(volume_type, VOLUME_TYPE_LUKS2) == 0) {
|
||||
printf("%s\t%s\tnone\tluks\n", dmname, volume);
|
||||
printf("%s\t%s\t%s\tluks", dmname, volume,
|
||||
info->keyfile != NULL ? info->keyfile : "none");
|
||||
if (info->keyfile != NULL) {
|
||||
if (info->keyfile_offset > 0)
|
||||
printf(",keyfile-offset=%lu",
|
||||
info->keyfile_offset);
|
||||
if (info->keyfile_size > 0)
|
||||
printf(",keyfile-size=%lu", info->keyfile_size);
|
||||
}
|
||||
if (info->tries > 0)
|
||||
printf(",tries=%lu", info->tries);
|
||||
printf("\n");
|
||||
} else {
|
||||
return -EINVAL;
|
||||
}
|
||||
@@ -3677,11 +3688,17 @@ int keystore_cryptsetup(struct keystore *keystore, const char *volume_filter,
|
||||
* for the volume filter. If not specified, the filter
|
||||
* checks the volume part only.
|
||||
* @param[in] volume_type the type of volume to generate crypttab entries for
|
||||
* @param[in] keyfile If non-NULL, specifies the name of the file to
|
||||
* read the passphrase from.
|
||||
* @param[in] keyfile_offset the offset in bytes for reading from keyfile
|
||||
* @param[in] keyfile_size the size in bytes for reading from keyfile
|
||||
* @param[in] tries the number of tries for passphrase entry
|
||||
*
|
||||
* @returns 0 for success or a negative errno in case of an error
|
||||
*/
|
||||
int keystore_crypttab(struct keystore *keystore, const char *volume_filter,
|
||||
const char *volume_type)
|
||||
const char *volume_type, const char *keyfile,
|
||||
size_t keyfile_offset, size_t keyfile_size, size_t tries)
|
||||
{
|
||||
struct crypt_info info = { 0 };
|
||||
int rc;
|
||||
@@ -3697,6 +3714,10 @@ int keystore_crypttab(struct keystore *keystore, const char *volume_filter,
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
info.keyfile = keyfile;
|
||||
info.keyfile_offset = keyfile_offset;
|
||||
info.keyfile_size = keyfile_size;
|
||||
info.tries = tries;
|
||||
info.volume_filter = str_list_split(volume_filter);
|
||||
info.process_func = _keystore_process_crypttab;
|
||||
|
||||
|
||||
@@ -73,7 +73,8 @@ int keystore_cryptsetup(struct keystore *keystore, const char *volume_filter,
|
||||
size_t keyfile_size, size_t tries, bool batch_mode);
|
||||
|
||||
int keystore_crypttab(struct keystore *keystore, const char *volume_filter,
|
||||
const char *volume_type);
|
||||
const char *volume_type, const char *keyfile,
|
||||
size_t keyfile_offset, size_t keyfile_size, size_t tries);
|
||||
|
||||
void keystore_free(struct keystore *keystore);
|
||||
|
||||
|
||||
65
zkey/zkey.1
65
zkey/zkey.1
@@ -519,6 +519,14 @@ volumes afterwards.
|
||||
.IR volume1[:dmname1][,volume2[:dmname2][,...]] ]
|
||||
.RB [ \-\-volume-type | \-t
|
||||
.IR type ]
|
||||
.RB [ \-\-key\-file
|
||||
.IR file-name ]
|
||||
.RB [ \-\-keyfile\-offset
|
||||
.IR bytes ]
|
||||
.RB [ \-\-keyfile\-size
|
||||
.IR bytes ]
|
||||
.RB [ \-\-tries
|
||||
.IR number ]
|
||||
.RB [ \-\-verbose | \-V ]
|
||||
.
|
||||
.PP
|
||||
@@ -537,6 +545,23 @@ name are selected.
|
||||
Specify the
|
||||
.B \-\-volume-type
|
||||
option to generate crypttab entries for the specified volume type only.
|
||||
.P
|
||||
For LUKS2 volumes, a passphrase is required. You are prompted for the
|
||||
passphrase during system startup when crypttab is evaluated, unless option
|
||||
.B \-\-key\-file
|
||||
is specified. Option
|
||||
.B \-\-tries
|
||||
specifies how often a passphrase can be re-entered. When option
|
||||
.B \-\-key\-file
|
||||
is specified, the passphrase is read from the specified file. You can specify
|
||||
options
|
||||
.B \-\-keyfile\-offset
|
||||
and
|
||||
.B \-\-keyfile\-size
|
||||
to control which part of the key file is used as passphrase. These options are
|
||||
passed to the generated crypttab entries and are only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
.
|
||||
.SS "Generate cryptsetup commands for volumes associated with secure AES keys"
|
||||
.
|
||||
@@ -956,6 +981,46 @@ This option is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
This option is only used for secure keys contained in the secure key repository.
|
||||
.TP
|
||||
.BR \-\-key\-file\~\fIfile\-name\fP
|
||||
Reads the passphrase from the specified file. If this option is omitted, then
|
||||
you are prompted to enter the passphrase interactively during system startup.
|
||||
This option is passed to the generated crypttab entries for LUKS2 volumes, and
|
||||
is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
.TP
|
||||
.BR \-\-keyfile\-offset\~\fIbytes\fP
|
||||
Specifies the number of bytes to skip before starting to read in the file
|
||||
specified with option \fB\-\-key\-file\fP. If omitted, the file is read
|
||||
from the beginning. When option \fB\-\-key\-file\fP is not specified, this
|
||||
option is ignored. This option is passed to the generated crypttab entries
|
||||
for LUKS2 volumes, and is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled. Not all distributions support the
|
||||
.B keyfile-offset
|
||||
option in crypttab entries.
|
||||
.TP
|
||||
.BR \-\-keyfile\-size\~\fIbytes\fP
|
||||
Specifies the number of bytes to be read from the beginning of the file
|
||||
specified with option \fB\-\-key\-file\fP. If omitted, the file is read
|
||||
until the end. When \fB\-\-keyfile\-offset\fP is also specified, reading starts
|
||||
at the offset. When option \fB\-\-key\-file\fP is not specified, this option is
|
||||
ignored. This option is passed to the generated crypttab entries for LUKS2
|
||||
volumes, and is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled. Not all distributions support the
|
||||
.B keyfile-size
|
||||
option in crypttab entries.
|
||||
.TP
|
||||
.BR \-\-tries\~\fInumber\fP
|
||||
Specifies how often the interactive input of the passphrase can be re-entered
|
||||
during system startup. The default is 3 times. When option \fB\-\-key\-file\fP
|
||||
is specified, this option is ignored, and the passphrase is read only once from
|
||||
the file. This option is passed to the generated crypttab entries for LUKS2
|
||||
volumes, and is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
.
|
||||
.
|
||||
.
|
||||
|
||||
50
zkey/zkey.c
50
zkey/zkey.c
@@ -557,6 +557,53 @@ static struct util_opt opt_vec[] = {
|
||||
"entry is to be generated",
|
||||
.command = COMMAND_CRYPTTAB,
|
||||
},
|
||||
{
|
||||
.option = {"key-file", required_argument, NULL,
|
||||
OPT_CRYPTSETUP_KEYFILE},
|
||||
.argument = "FILE-NAME",
|
||||
.desc = "Read the passphrase from the specified file. "
|
||||
"The specified file is passed to the generated "
|
||||
"crypttab entry for LUKS2 volumes",
|
||||
.command = COMMAND_CRYPTTAB,
|
||||
.flags = UTIL_OPT_FLAG_NOSHORT,
|
||||
},
|
||||
{
|
||||
.option = {"keyfile-offset", required_argument, NULL,
|
||||
OPT_CRYPTSETUP_KEYFILE_OFFSET},
|
||||
.argument = "BYTES",
|
||||
.desc = "Specifies the number of bytes to skip in the file "
|
||||
"specified with option '--key-file'. "
|
||||
"The specified offset is passed to the generated "
|
||||
"crypttab entry for LUKS2 volumes. Not all "
|
||||
"distributions support the 'keyfile-offset' option in "
|
||||
"crypttab entries",
|
||||
.command = COMMAND_CRYPTTAB,
|
||||
.flags = UTIL_OPT_FLAG_NOSHORT,
|
||||
},
|
||||
{
|
||||
.option = {"keyfile-size", required_argument, NULL,
|
||||
OPT_CRYPTSETUP_KEYFILE_SIZE},
|
||||
.argument = "BYTES",
|
||||
.desc = "Specifies the number of bytes to read from the file "
|
||||
"specified with option '--key-file'. "
|
||||
"The specified size is passed to the generated "
|
||||
"crypttab entry for LUKS2 volumes. Not all "
|
||||
"distributions support the 'keyfile-size' option in "
|
||||
"crypttab entries",
|
||||
.command = COMMAND_CRYPTTAB,
|
||||
.flags = UTIL_OPT_FLAG_NOSHORT,
|
||||
},
|
||||
{
|
||||
.option = {"tries", required_argument, NULL,
|
||||
OPT_CRYPTSETUP_TRIES},
|
||||
.argument = "NUMBER",
|
||||
.desc = "Specifies how often the interactive input of the "
|
||||
"passphrase can be retried. "
|
||||
"The specified number is passed to the generated "
|
||||
"crypttab entry for LUKS2 volumes",
|
||||
.command = COMMAND_CRYPTTAB,
|
||||
.flags = UTIL_OPT_FLAG_NOSHORT,
|
||||
},
|
||||
#endif
|
||||
/***********************************************************/
|
||||
{
|
||||
@@ -1428,7 +1475,8 @@ static int command_crypttab(void)
|
||||
{
|
||||
int rc;
|
||||
|
||||
rc = keystore_crypttab(g.keystore, g.volumes, g.volume_type);
|
||||
rc = keystore_crypttab(g.keystore, g.volumes, g.volume_type, g.keyfile,
|
||||
g.keyfile_offset, g.keyfile_size, g.tries);
|
||||
|
||||
return rc != 0 ? EXIT_FAILURE : EXIT_SUCCESS;
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user