mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
zkey: Require cryptsetup v2.8.2 or later
For supporting integrity protected volumes with dm-integrity, cryptsetup of version 2.8.2 or later is required. Make cryptsetup of version 2.8.2 a build requirement for zkey, not only for zkey-cryptsetup. Although zkey could be built with an older cryptsetup version, the commands that it generates might not work with older cryptsetup versions. This makes the compile switch HAVE_LUKS2_SUPPORT superfluous, since cryptsetup v2.8.2 always includes LUKS2 support. Remove the ifdefs from the code and update the man pages to not mention LUKS2 support. Also, starting with cryptsetup version 2.5.0 the luksFormat command accepts option '--volume-key-file' to specify the volume key file instead of --master-key-file'. Thus, use '--volume-key-file' in cryptsetup commands generated by zkey. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
committed by
Jan Höppner
Jan Höppner
parent
a2663ec8d3
commit
c3d8208a57
+36
-21
@@ -1,19 +1,24 @@
|
||||
include ../common.mak
|
||||
|
||||
ifneq (${HAVE_OPENSSL},0)
|
||||
BUILD_TARGETS += zkey
|
||||
INSTALL_TARGETS += install-zkey
|
||||
ifneq (${HAVE_JSONC},0)
|
||||
ifneq (${HAVE_LIBCURL},0)
|
||||
SUB_DIRS += ekmfweb
|
||||
ifneq (${HAVE_LIBXML2},0)
|
||||
SUB_DIRS += kmip
|
||||
ifneq (${HAVE_CRYPTSETUP2},0)
|
||||
BUILD_TARGETS += zkey
|
||||
INSTALL_TARGETS += install-zkey
|
||||
ifneq (${HAVE_JSONC},0)
|
||||
ifneq (${HAVE_LIBCURL},0)
|
||||
SUB_DIRS += ekmfweb
|
||||
ifneq (${HAVE_LIBXML2},0)
|
||||
SUB_DIRS += kmip
|
||||
endif
|
||||
endif
|
||||
endif
|
||||
else
|
||||
BUILD_TARGETS += zkey-skip-cryptsetup2
|
||||
INSTALL_TARGETS += zkey-skip-cryptsetup2
|
||||
endif
|
||||
else
|
||||
BUILD_TARGETS += zkey-skip
|
||||
INSTALL_TARGETS += zkey-skip
|
||||
BUILD_TARGETS += zkey-skip-openssl
|
||||
INSTALL_TARGETS += zkey-skip-openssl
|
||||
endif
|
||||
|
||||
ifneq (${HAVE_CRYPTSETUP2},0)
|
||||
@@ -21,7 +26,6 @@ ifneq (${HAVE_CRYPTSETUP2},0)
|
||||
ifneq (${HAVE_OPENSSL},0)
|
||||
BUILD_TARGETS += zkey-cryptsetup
|
||||
INSTALL_TARGETS += install-zkey-cryptsetup
|
||||
ALL_CPPFLAGS += -DHAVE_LUKS2_SUPPORT
|
||||
else
|
||||
BUILD_TARGETS += zkey-cryptsetup-skip-openssl
|
||||
INSTALL_TARGETS += zkey-cryptsetup-skip-openssl
|
||||
@@ -42,26 +46,33 @@ ALL_CFLAGS += -DKMS_PLUGIN_LOCATION=\"$(ZKEYKMSPLUGINDIR)\" \
|
||||
|
||||
detect-libcryptsetup.dep:
|
||||
echo "#include <libcryptsetup.h>" > detect-libcryptsetup.dep
|
||||
echo "#ifndef CRYPT_LUKS2" >> detect-libcryptsetup.dep
|
||||
echo " #error libcryptsetup version 2.0.3 is required" >> detect-libcryptsetup.dep
|
||||
echo "#ifndef CRYPT_REQUIREMENT_INLINE_HW_TAGS" >> detect-libcryptsetup.dep
|
||||
echo " #error libcryptsetup version 2.8.2 is required" >> detect-libcryptsetup.dep
|
||||
echo "#endif" >> detect-libcryptsetup.dep
|
||||
echo "int i = CRYPT_SLOT_UNBOUND;" >> detect-libcryptsetup.dep
|
||||
echo "int test(void) { return crypt_reencrypt_init_by_keyslot_context(NULL, NULL, NULL, NULL, 0, 0, NULL, NULL, NULL); }" >> detect-libcryptsetup.dep
|
||||
|
||||
check-dep-zkey:
|
||||
check-dep-zkey: detect-libcryptsetup.dep
|
||||
$(call check_dep, \
|
||||
"zkey", \
|
||||
"openssl/evp.h", \
|
||||
"openssl-devel", \
|
||||
"HAVE_OPENSSL=0")
|
||||
$(call check_dep, \
|
||||
"zkey", \
|
||||
"detect-libcryptsetup.dep", \
|
||||
"cryptsetup-devel version 2.8.2", \
|
||||
"HAVE_CRYPTSETUP2=0", \
|
||||
-I. -lcryptsetup)
|
||||
touch check-dep-zkey
|
||||
|
||||
check-dep-zkey-cryptsetup: detect-libcryptsetup.dep
|
||||
$(call check_dep, \
|
||||
"zkey-cryptsetup", \
|
||||
"detect-libcryptsetup.dep", \
|
||||
"cryptsetup-devel version 2.0.3", \
|
||||
"cryptsetup-devel version 2.8.2", \
|
||||
"HAVE_CRYPTSETUP2=0", \
|
||||
"-I.")
|
||||
-I. -lcryptsetup)
|
||||
$(call check_dep, \
|
||||
"zkey-cryptsetup", \
|
||||
"json-c/json.h", \
|
||||
@@ -69,9 +80,12 @@ check-dep-zkey-cryptsetup: detect-libcryptsetup.dep
|
||||
"HAVE_JSONC=0")
|
||||
touch check-dep-zkey-cryptsetup
|
||||
|
||||
zkey-skip:
|
||||
zkey-skip-openssl:
|
||||
echo " SKIP zkey due to HAVE_OPENSSL=0"
|
||||
|
||||
zkey-skip-cryptsetup2:
|
||||
echo " SKIP zkey due to HAVE_CRYPTSETUP2=0"
|
||||
|
||||
zkey-cryptsetup-skip-cryptsetup2:
|
||||
echo " SKIP zkey-cryptsetup due to HAVE_CRYPTSETUP2=0"
|
||||
|
||||
@@ -83,13 +97,14 @@ zkey-cryptsetup-skip-openssl:
|
||||
|
||||
all: $(BUILD_TARGETS) $(SUB_DIRS)
|
||||
|
||||
zkey.o: zkey.c pkey.h cca.h ep11.h misc.h
|
||||
zkey.o: check-dep-zkey zkey.c pkey.h cca.h ep11.h misc.h
|
||||
pkey.o: pkey.c pkey.h cca.h ep11.h utils.h
|
||||
cca.o: cca.c cca.h pkey.h ep11.h utils.h
|
||||
ep11.o: ep11.c ep11.h pkey.h cca.h utils.h
|
||||
utils.o: utils.h pkey.h cca.h ep11.h
|
||||
properties.o: check-dep-zkey properties.c properties.h
|
||||
keystore.o: keystore.c keystore.h properties.h pkey.h cca.h ep11.h utils.h
|
||||
keystore.o: check-dep-zkey keystore.c keystore.h properties.h pkey.h cca.h \
|
||||
ep11.h utils.h
|
||||
zkey-cryptsetup.o: check-dep-zkey-cryptsetup zkey-cryptsetup.c pkey.h cca.h \
|
||||
ep11.h misc.h utils.h
|
||||
kms.o: kms.c kms.h kms-plugin.h utils.h pkey.h
|
||||
@@ -139,6 +154,6 @@ $(SUB_DIRS):
|
||||
$(MAKE) -C $@ TOPDIR=$(TOPDIR) HOST_ARCH=$(HOST_ARCH) $(goal) ;)
|
||||
.PHONY: $(SUB_DIRS)
|
||||
|
||||
.PHONY: all install clean zkey-skip zkey-cryptsetup-skip-cryptsetup2 \
|
||||
zkey-cryptsetup-skip-jsonc install-common install-zkey \
|
||||
install-zkey-cryptsetup
|
||||
.PHONY: all install clean zkey-skip-cryptsetup2 zkey-skip-openssl \
|
||||
zkey-cryptsetup-skip-cryptsetup2 zkey-cryptsetup-skip-jsonc \
|
||||
install-common install-zkey install-zkey-cryptsetup
|
||||
|
||||
+4
-10
@@ -57,11 +57,7 @@ struct key_filenames {
|
||||
|
||||
#define VOLUME_TYPE_PLAIN "plain"
|
||||
#define VOLUME_TYPE_LUKS2 "luks2"
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
#define DEFAULT_VOLUME_TYPE VOLUME_TYPE_LUKS2
|
||||
#else
|
||||
#define DEFAULT_VOLUME_TYPE VOLUME_TYPE_PLAIN
|
||||
#endif
|
||||
#define DEFAULT_VOLUME_TYPE VOLUME_TYPE_LUKS2
|
||||
|
||||
#define REC_KEY "Key"
|
||||
#define REC_DESCRIPTION "Description"
|
||||
@@ -304,10 +300,8 @@ static int _keystore_valid_volume_type(const char *volume_type)
|
||||
{
|
||||
if (strcasecmp(volume_type, VOLUME_TYPE_PLAIN) == 0)
|
||||
return 1;
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
if (strcasecmp(volume_type, VOLUME_TYPE_LUKS2) == 0)
|
||||
return 1;
|
||||
#endif
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -4438,7 +4432,7 @@ static int _keystore_process_cryptsetup(struct keystore *keystore,
|
||||
*/
|
||||
util_asprintf(&cmd,
|
||||
"cryptsetup luksFormat %s%s--type luks2 "
|
||||
"--master-key-file '%s' --key-size %lu "
|
||||
"--volume-key-file '%s' --key-size %lu "
|
||||
"--cipher %s --pbkdf %s %s%s%s",
|
||||
info->batch_mode ? "-q " : "",
|
||||
keystore->verbose ? "-v " : "",
|
||||
@@ -5005,7 +4999,7 @@ int keystore_convert_key(struct keystore *keystore, const char *name,
|
||||
"the secure AES volume key of type CCA-AESDATA. To "
|
||||
"change the secure AES volume key in the LUKS2 header, "
|
||||
"run command 'zkey-cryptsetup setkey <device> "
|
||||
"--master-key-file %s':", name,
|
||||
"--volume-key-file %s':", name,
|
||||
file_names.skey_filename);
|
||||
_keystore_msg_for_volumes(temp, properties, VOLUME_TYPE_LUKS2);
|
||||
free(temp);
|
||||
@@ -5824,7 +5818,7 @@ out:
|
||||
"encrypted with key '%s'. To update the secure "
|
||||
"AES volume key in the LUKS2 header, run command "
|
||||
"'zkey-cryptsetup setkey <device> "
|
||||
"--master-key-file %s':", name,
|
||||
"--volume-key-file %s':", name,
|
||||
file_names->skey_filename);
|
||||
_keystore_msg_for_volumes(msg, properties, VOLUME_TYPE_LUKS2);
|
||||
free(msg);
|
||||
|
||||
+15
-77
@@ -729,10 +729,7 @@ options
|
||||
.B \-\-keyfile\-offset
|
||||
and
|
||||
.B \-\-keyfile\-size
|
||||
to control which part of the key file is used as passphrase. These options are
|
||||
passed to the generated crypttab entries and are only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
to control which part of the key file is used as passphrase.
|
||||
.
|
||||
.SS "Generate cryptsetup commands for volumes associated with secure AES keys"
|
||||
.
|
||||
@@ -804,11 +801,8 @@ options
|
||||
.B \-\-keyfile\-offset
|
||||
and
|
||||
.B \-\-keyfile\-size
|
||||
to control which part of the key file is used as passphrase. These options are
|
||||
only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled. To avoid cryptsetup confirmation
|
||||
questions, you can specify the
|
||||
to control which part of the key file is used as passphrase.
|
||||
To avoid cryptsetup confirmation questions, you can specify the
|
||||
.B \-\-batch\-mode
|
||||
option. These options are passed to the generated command(s) and behave in the
|
||||
same way as with \fBcryptsetup\fP.
|
||||
@@ -871,7 +865,7 @@ to re-generate the crypttab entries.
|
||||
.P
|
||||
Associated volumes of type \fBLUKS2\fP still contain the secure AES volume key
|
||||
of the original type. To change the secure AES volume key in the LUKS2 header,
|
||||
run command \fBzkey\-cryptsetup setkey <device> \-\-master\-key\-file
|
||||
run command \fBzkey\-cryptsetup setkey <device> \-\-volume\-key\-file
|
||||
<converted\-key>\fP for each associated volume.
|
||||
.
|
||||
.P
|
||||
@@ -1392,10 +1386,6 @@ This option is only used for secure keys contained in the secure key repository.
|
||||
Specifies the volume type of the associated volumes used with \fBdm\-crypt\fP.
|
||||
Possible values are \fBplain\fP and \fBluks2\fP. If omitted, \fBluks2\fP is
|
||||
used.
|
||||
This option is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled. If LUKS2 support is not enabled,
|
||||
the default volume type is \fBplain\fP.
|
||||
This option is only used for secure keys contained in the secure key repository.
|
||||
.TP
|
||||
.BR \-K ", " \-\-key\-type\~\fItype\fP
|
||||
@@ -1566,10 +1556,6 @@ This option is only used for secure keys contained in the secure key repository.
|
||||
Specifies the volume type of the associated volumes used with \fBdm\-crypt\fP.
|
||||
Possible values are \fBplain\fP and \fBluks2\fP. If omitted, \fBluks2\fP is
|
||||
used.
|
||||
This option is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled. If LUKS2 support is not enabled,
|
||||
the default volume type is \fBplain\fP.
|
||||
This option is only used for secure keys contained in the secure key repository.
|
||||
.TP
|
||||
.BR \-\-gen\-dummy\-passphrase
|
||||
@@ -1637,9 +1623,6 @@ This option is only used for secure keys contained in the secure key repository.
|
||||
Specifies the volume type of the associated volumes used with \fBdm\-crypt\fP.
|
||||
Possible values are \fBplain\fP and \fBluks2\fP. Only keys with the specified
|
||||
volume type are listed.
|
||||
This option is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
This option is only used for secure keys contained in the secure key repository.
|
||||
.TP
|
||||
.BR \-K ", " \-\-key\-type\~\fItype\fP
|
||||
@@ -1739,9 +1722,6 @@ This option is only used for secure keys contained in the secure key repository.
|
||||
.BR \-t ", " \-\-volume\-type\~\fItype\fP
|
||||
Specifies the volume type of the associated volumes used with \fBdm\-crypt\fP.
|
||||
Possible values are \fBplain\fP and \fBluks2\fP.
|
||||
This option is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
This option is only used for secure keys contained in the secure key repository.
|
||||
.TP
|
||||
.BR \-\-gen\-dummy\-passphrase
|
||||
@@ -1845,28 +1825,20 @@ This option is only used for secure keys contained in the secure key repository.
|
||||
Specifies the volume type of the associated volumes used with \fBdm\-crypt\fP.
|
||||
Possible values are \fBplain\fP and \fBluks2\fP. Only keys with the specified
|
||||
volume type are selected to generate crypttab entries for.
|
||||
This option is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
This option is only used for secure keys contained in the secure key repository.
|
||||
.TP
|
||||
.BR \-\-key\-file\~\fIfile\-name\fP
|
||||
Reads the passphrase from the specified file. If this option is omitted, and
|
||||
no dummy passphrase is associated with the secure key, then you are prompted to
|
||||
enter the passphrase interactively during system startup.
|
||||
This option is passed to the generated crypttab entries for LUKS2 volumes, and
|
||||
is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
This option is passed to the generated crypttab entries for LUKS2 volumes.
|
||||
.TP
|
||||
.BR \-\-keyfile\-offset\~\fIbytes\fP
|
||||
Specifies the number of bytes to skip before starting to read in the file
|
||||
specified with option \fB\-\-key\-file\fP. If omitted, the file is read
|
||||
from the beginning. When option \fB\-\-key\-file\fP is not specified, this
|
||||
option is ignored. This option is passed to the generated crypttab entries
|
||||
for LUKS2 volumes, and is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled. Not all distributions support the
|
||||
for LUKS2 volumes. Not all distributions support the
|
||||
.B keyfile\-offset
|
||||
option in crypttab entries.
|
||||
.TP
|
||||
@@ -1876,9 +1848,7 @@ specified with option \fB\-\-key\-file\fP. If omitted, the file is read
|
||||
until the end. When \fB\-\-keyfile\-offset\fP is also specified, reading starts
|
||||
at the offset. When option \fB\-\-key\-file\fP is not specified, this option is
|
||||
ignored. This option is passed to the generated crypttab entries for LUKS2
|
||||
volumes, and is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled. Not all distributions support the
|
||||
volumes. Not all distributions support the
|
||||
.B keyfile\-size
|
||||
option in crypttab entries.
|
||||
.TP
|
||||
@@ -1887,9 +1857,7 @@ Specifies how often the interactive input of the passphrase can be re-entered
|
||||
during system startup. The default is 3 times. When option \fB\-\-key\-file\fP
|
||||
is specified, this option is ignored, and the passphrase is read only once from
|
||||
the file. This option is passed to the generated crypttab entries for LUKS2
|
||||
volumes, and is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
volumes.
|
||||
.
|
||||
.
|
||||
.
|
||||
@@ -1910,9 +1878,6 @@ This option is only used for secure keys contained in the secure key repository.
|
||||
Specifies the volume type of the associated volumes used with \fBdm\-crypt\fP.
|
||||
Possible values are \fBplain\fP and \fBluks2\fP. Only keys with the specified
|
||||
volume type are selected to generate cryptsetup commands for.
|
||||
This option is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
This option is only used for secure keys contained in the secure key repository.
|
||||
.TP
|
||||
.BR \-r ", " \-\-run
|
||||
@@ -1925,55 +1890,40 @@ Generates \fBcryptsetup luksOpen\fP or \fBcryptsetup plainOpen\fP commands.
|
||||
For a plain volume type, this is the default. This option can not be specified
|
||||
together with the
|
||||
.BR \-\-format
|
||||
option, and is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
option.
|
||||
.TP
|
||||
.BR \-\-format
|
||||
Generates \fBcryptsetup luksFormat\fP commands. For a LUKS2 volume type, this
|
||||
is the default. If specified for a plain volume type, then no command is
|
||||
generated. This option can not be specified together with the
|
||||
.BR \-\-open
|
||||
option, and is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
option.
|
||||
.TP
|
||||
.BR \-\-key\-file\~\fIfile\-name\fP
|
||||
Reads the passphrase from the specified file. If this option is omitted, and
|
||||
no dummy passphrase is associated with the secure key, or if the file\-name is
|
||||
\fI\-\fP (a dash), then you are prompted to enter the passphrase interactively.
|
||||
This option is passed to the generated command(s) for LUKS2 volumes, and is
|
||||
only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
This option is passed to the generated command(s) for LUKS2 volumes.
|
||||
.TP
|
||||
.BR \-\-keyfile\-offset\~\fIbytes\fP
|
||||
Specifies the number of bytes to skip before starting to read in the file
|
||||
specified with option \fB\-\-key\-file\fP. If omitted, the file is read
|
||||
from the beginning. When option \fB\-\-key\-file\fP is not specified, this
|
||||
option is ignored. This option is passed to the generated command(s)
|
||||
for LUKS2 volumes, and is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
for LUKS2 volumes.
|
||||
.TP
|
||||
.BR \-\-keyfile\-size\~\fIbytes\fP
|
||||
Specifies the number of bytes to be read from the beginning of the file
|
||||
specified with option \fB\-\-key\-file\fP. If omitted, the file is read
|
||||
until the end. When \fB\-\-keyfile\-offset\fP is also specified, reading starts
|
||||
at the offset. When option \fB\-\-key\-file\fP is not specified, this option is
|
||||
ignored. This option is passed to the generated command(s) for LUKS2 volumes,
|
||||
and is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
ignored. This option is passed to the generated command(s) for LUKS2 volumes.
|
||||
.TP
|
||||
.BR \-\-tries\~\fInumber\fP
|
||||
Specifies how often the interactive input of the passphrase can be re-entered.
|
||||
The default is 3 times. When option \fB\-\-key\-file\fP is specified, this
|
||||
option is ignored, and the passphrase is read only once from the file.
|
||||
This option is passed to the generated command(s) for LUKS2 volumes, and is
|
||||
only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
This option is passed to the generated command(s) for LUKS2 volumes.
|
||||
.TP
|
||||
.BR \-q ", " \-\-batch\-mode
|
||||
Suppress cryptsetup confirmation questions. This option is passed to the
|
||||
@@ -2096,9 +2046,6 @@ When wildcards are used you must quote the value.
|
||||
Specifies the volume type of the associated volumes used with \fBdm\-crypt\fP.
|
||||
Possible values are \fBplain\fP and \fBluks2\fP. Only keys with the specified
|
||||
volume type are listed.
|
||||
This option is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
.
|
||||
.
|
||||
.
|
||||
@@ -2131,9 +2078,6 @@ When wildcards are used you must quote the value.
|
||||
Specifies the volume type of the associated volumes used with \fBdm\-crypt\fP.
|
||||
Possible values are \fBplain\fP and \fBluks2\fP. Only keys with the specified
|
||||
volume type are imported.
|
||||
This option is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
.TP
|
||||
.BR \-q ", " \-\-batch\-mode
|
||||
Suppress prompts to skip or to enter an alternate name, if a secure key with the
|
||||
@@ -2170,9 +2114,6 @@ When wildcards are used you must quote the value.
|
||||
Specifies the volume type of the associated volumes used with \fBdm\-crypt\fP.
|
||||
Possible values are \fBplain\fP and \fBluks2\fP. Only keys with the specified
|
||||
volume type are refreshed.
|
||||
This option is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled.
|
||||
.TP
|
||||
.BR \-K ", " \-\-key\-type\~\fItype\fP
|
||||
Specifies the key type of the secure key. Possible values are
|
||||
@@ -2281,10 +2222,7 @@ sector size is used.
|
||||
.BR \-t ", " \-\-volume\-type\~\fItype\fP
|
||||
Specifies the volume type of the associated volumes used with \fBdm\-crypt\fP.
|
||||
Possible values are \fBplain\fP and \fBluks2\fP. If omitted, \fBluks2\fP is
|
||||
used. This option is only available if
|
||||
.B zkey
|
||||
has been compiled with LUKS2 support enabled. If LUKS2 support is not enabled,
|
||||
the default volume type is \fBplain\fP.
|
||||
used.
|
||||
.TP
|
||||
.BR \-\-gen\-dummy\-passphrase
|
||||
Generate a dummy passphrase randomly and associate it with the protected
|
||||
|
||||
-30
@@ -265,7 +265,6 @@ static struct util_opt opt_vec[] = {
|
||||
"used",
|
||||
.command = COMMAND_GENERATE,
|
||||
},
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
{
|
||||
.option = { "volume-type", required_argument, NULL, 't'},
|
||||
.argument = "type",
|
||||
@@ -274,7 +273,6 @@ static struct util_opt opt_vec[] = {
|
||||
"the default is 'luks2'",
|
||||
.command = COMMAND_GENERATE,
|
||||
},
|
||||
#endif
|
||||
{
|
||||
.option = { "key-type", required_argument, NULL, 'K'},
|
||||
.argument = "type",
|
||||
@@ -487,7 +485,6 @@ static struct util_opt opt_vec[] = {
|
||||
"used",
|
||||
.command = COMMAND_IMPORT,
|
||||
},
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
{
|
||||
.option = { "volume-type", required_argument, NULL, 't'},
|
||||
.argument = "type",
|
||||
@@ -496,7 +493,6 @@ static struct util_opt opt_vec[] = {
|
||||
"the default is 'luks2'",
|
||||
.command = COMMAND_IMPORT,
|
||||
},
|
||||
#endif
|
||||
{
|
||||
.option = { "gen-dummy-passphrase", 0, NULL,
|
||||
OPT_GEN_DUMMY_PASSPHRASE},
|
||||
@@ -583,7 +579,6 @@ static struct util_opt opt_vec[] = {
|
||||
"associated with specific crypto cards",
|
||||
.command = COMMAND_LIST,
|
||||
},
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
{
|
||||
.option = { "volume-type", required_argument, NULL, 't'},
|
||||
.argument = "type",
|
||||
@@ -592,7 +587,6 @@ static struct util_opt opt_vec[] = {
|
||||
"keys with the specified volumes type.",
|
||||
.command = COMMAND_LIST,
|
||||
},
|
||||
#endif
|
||||
{
|
||||
.option = { "key-type", required_argument, NULL, 'K'},
|
||||
.argument = "type",
|
||||
@@ -691,7 +685,6 @@ static struct util_opt opt_vec[] = {
|
||||
"use the system default sector size (512)",
|
||||
.command = COMMAND_CHANGE,
|
||||
},
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
{
|
||||
.option = { "volume-type", required_argument, NULL, 't'},
|
||||
.argument = "type",
|
||||
@@ -699,7 +692,6 @@ static struct util_opt opt_vec[] = {
|
||||
"are 'plain' and 'luks2'",
|
||||
.command = COMMAND_CHANGE,
|
||||
},
|
||||
#endif
|
||||
{
|
||||
.option = { "gen-dummy-passphrase", 0, NULL,
|
||||
OPT_GEN_DUMMY_PASSPHRASE},
|
||||
@@ -815,7 +807,6 @@ static struct util_opt opt_vec[] = {
|
||||
"volume and the device-mapper name matches",
|
||||
.command = COMMAND_CRYPTTAB,
|
||||
},
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
{
|
||||
.option = { "volume-type", required_argument, NULL, 't'},
|
||||
.argument = "type",
|
||||
@@ -872,7 +863,6 @@ static struct util_opt opt_vec[] = {
|
||||
.command = COMMAND_CRYPTTAB,
|
||||
.flags = UTIL_OPT_FLAG_NOSHORT,
|
||||
},
|
||||
#endif
|
||||
/***********************************************************/
|
||||
{
|
||||
.flags = UTIL_OPT_FLAG_SECTION,
|
||||
@@ -891,7 +881,6 @@ static struct util_opt opt_vec[] = {
|
||||
"both, the volume and the device-mapper name matches",
|
||||
.command = COMMAND_CRYPTSETUP,
|
||||
},
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
{
|
||||
.option = { "volume-type", required_argument, NULL, 't'},
|
||||
.argument = "type",
|
||||
@@ -901,13 +890,11 @@ static struct util_opt opt_vec[] = {
|
||||
"entry is to be generated",
|
||||
.command = COMMAND_CRYPTSETUP,
|
||||
},
|
||||
#endif
|
||||
{
|
||||
.option = {"run", 0, NULL, 'r'},
|
||||
.desc = "Runs the generated cryptsetup command",
|
||||
.command = COMMAND_CRYPTSETUP,
|
||||
},
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
{
|
||||
.option = {"key-file", required_argument, NULL,
|
||||
OPT_CRYPTSETUP_KEYFILE},
|
||||
@@ -951,7 +938,6 @@ static struct util_opt opt_vec[] = {
|
||||
.command = COMMAND_CRYPTSETUP,
|
||||
.flags = UTIL_OPT_FLAG_NOSHORT,
|
||||
},
|
||||
#endif
|
||||
{
|
||||
.option = {"batch-mode", 0, NULL, 'q'},
|
||||
.desc = "Suppresses cryptsetup confirmation questions. "
|
||||
@@ -959,7 +945,6 @@ static struct util_opt opt_vec[] = {
|
||||
"command(s)",
|
||||
.command = COMMAND_CRYPTSETUP,
|
||||
},
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
{
|
||||
.option = {"open", 0, NULL, OPT_CRYPTSETUP_OPEN},
|
||||
.desc = "Generates luksOpen or plainOpen commands. For the "
|
||||
@@ -975,7 +960,6 @@ static struct util_opt opt_vec[] = {
|
||||
.command = COMMAND_CRYPTSETUP,
|
||||
.flags = UTIL_OPT_FLAG_NOSHORT,
|
||||
},
|
||||
#endif
|
||||
/***********************************************************/
|
||||
{
|
||||
.flags = UTIL_OPT_FLAG_SECTION,
|
||||
@@ -1111,7 +1095,6 @@ static struct util_opt opt_vec[] = {
|
||||
"mapper name matches.",
|
||||
.command = COMMAND_KMS " " COMMAND_KMS_LIST,
|
||||
},
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
{
|
||||
.option = { "volume-type", required_argument, NULL, 't'},
|
||||
.argument = "type",
|
||||
@@ -1120,7 +1103,6 @@ static struct util_opt opt_vec[] = {
|
||||
"keys with the specified volumes type.",
|
||||
.command = COMMAND_KMS " " COMMAND_KMS_LIST,
|
||||
},
|
||||
#endif
|
||||
/***********************************************************/
|
||||
{
|
||||
.flags = UTIL_OPT_FLAG_SECTION,
|
||||
@@ -1155,7 +1137,6 @@ static struct util_opt opt_vec[] = {
|
||||
"mapper name matches.",
|
||||
.command = COMMAND_KMS " " COMMAND_KMS_IMPORT,
|
||||
},
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
{
|
||||
.option = { "volume-type", required_argument, NULL, 't'},
|
||||
.argument = "type",
|
||||
@@ -1164,7 +1145,6 @@ static struct util_opt opt_vec[] = {
|
||||
"all keys with the specified volumes type.",
|
||||
.command = COMMAND_KMS " " COMMAND_KMS_IMPORT,
|
||||
},
|
||||
#endif
|
||||
{
|
||||
.option = {"batch-mode", 0, NULL, 'q'},
|
||||
.desc = "Suppresses alternate name questions. When importing a "
|
||||
@@ -1207,7 +1187,6 @@ static struct util_opt opt_vec[] = {
|
||||
"device-mapper name matches",
|
||||
.command = COMMAND_KMS " " COMMAND_KMS_REFRESH,
|
||||
},
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
{
|
||||
.option = { "volume-type", required_argument, NULL, 't'},
|
||||
.argument = "type",
|
||||
@@ -1216,7 +1195,6 @@ static struct util_opt opt_vec[] = {
|
||||
"all keys with the specified volumes type.",
|
||||
.command = COMMAND_KMS " " COMMAND_KMS_REFRESH,
|
||||
},
|
||||
#endif
|
||||
{
|
||||
.option = { "key-type", required_argument, NULL, 'K'},
|
||||
.argument = "type",
|
||||
@@ -1342,7 +1320,6 @@ static struct util_opt opt_vec[] = {
|
||||
"used",
|
||||
.command = COMMAND_PVSECRETS " " COMMAND_PVSECRETS_IMPORT,
|
||||
},
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
{
|
||||
.option = { "volume-type", required_argument, NULL, 't'},
|
||||
.argument = "type",
|
||||
@@ -1351,7 +1328,6 @@ static struct util_opt opt_vec[] = {
|
||||
"the default is 'luks2'",
|
||||
.command = COMMAND_PVSECRETS " " COMMAND_PVSECRETS_IMPORT,
|
||||
},
|
||||
#endif
|
||||
{
|
||||
.option = { "gen-dummy-passphrase", 0, NULL,
|
||||
OPT_GEN_DUMMY_PASSPHRASE},
|
||||
@@ -3517,11 +3493,9 @@ int main(int argc, char *argv[])
|
||||
return EXIT_FAILURE;
|
||||
}
|
||||
break;
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
case 't':
|
||||
g.volume_type = optarg;
|
||||
break;
|
||||
#endif
|
||||
case 'w':
|
||||
g.newname = optarg;
|
||||
break;
|
||||
@@ -3537,7 +3511,6 @@ int main(int argc, char *argv[])
|
||||
case 'V':
|
||||
g.verbose = 1;
|
||||
break;
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
case OPT_CRYPTSETUP_KEYFILE:
|
||||
g.keyfile = optarg;
|
||||
break;
|
||||
@@ -3575,18 +3548,15 @@ int main(int argc, char *argv[])
|
||||
return EXIT_FAILURE;
|
||||
}
|
||||
break;
|
||||
#endif
|
||||
case 'q':
|
||||
g.batch_mode = 1;
|
||||
break;
|
||||
#ifdef HAVE_LUKS2_SUPPORT
|
||||
case OPT_CRYPTSETUP_OPEN:
|
||||
g.open = 1;
|
||||
break;
|
||||
case OPT_CRYPTSETUP_FORMAT:
|
||||
g.format = 1;
|
||||
break;
|
||||
#endif
|
||||
case 'L':
|
||||
g.local = 1;
|
||||
break;
|
||||
|
||||
Reference in New Issue
Block a user