mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
c3d8208a57
For supporting integrity protected volumes with dm-integrity, cryptsetup of version 2.8.2 or later is required. Make cryptsetup of version 2.8.2 a build requirement for zkey, not only for zkey-cryptsetup. Although zkey could be built with an older cryptsetup version, the commands that it generates might not work with older cryptsetup versions. This makes the compile switch HAVE_LUKS2_SUPPORT superfluous, since cryptsetup v2.8.2 always includes LUKS2 support. Remove the ifdefs from the code and update the man pages to not mention LUKS2 support. Also, starting with cryptsetup version 2.5.0 the luksFormat command accepts option '--volume-key-file' to specify the volume key file instead of --master-key-file'. Thus, use '--volume-key-file' in cryptsetup commands generated by zkey. Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com> Reviewed-by: Finn Callies <fcallies@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
160 lines
4.8 KiB
Makefile
160 lines
4.8 KiB
Makefile
include ../common.mak
|
|
|
|
ifneq (${HAVE_OPENSSL},0)
|
|
ifneq (${HAVE_CRYPTSETUP2},0)
|
|
BUILD_TARGETS += zkey
|
|
INSTALL_TARGETS += install-zkey
|
|
ifneq (${HAVE_JSONC},0)
|
|
ifneq (${HAVE_LIBCURL},0)
|
|
SUB_DIRS += ekmfweb
|
|
ifneq (${HAVE_LIBXML2},0)
|
|
SUB_DIRS += kmip
|
|
endif
|
|
endif
|
|
endif
|
|
else
|
|
BUILD_TARGETS += zkey-skip-cryptsetup2
|
|
INSTALL_TARGETS += zkey-skip-cryptsetup2
|
|
endif
|
|
else
|
|
BUILD_TARGETS += zkey-skip-openssl
|
|
INSTALL_TARGETS += zkey-skip-openssl
|
|
endif
|
|
|
|
ifneq (${HAVE_CRYPTSETUP2},0)
|
|
ifneq (${HAVE_JSONC},0)
|
|
ifneq (${HAVE_OPENSSL},0)
|
|
BUILD_TARGETS += zkey-cryptsetup
|
|
INSTALL_TARGETS += install-zkey-cryptsetup
|
|
else
|
|
BUILD_TARGETS += zkey-cryptsetup-skip-openssl
|
|
INSTALL_TARGETS += zkey-cryptsetup-skip-openssl
|
|
endif
|
|
else
|
|
BUILD_TARGETS += zkey-cryptsetup-skip-jsonc
|
|
INSTALL_TARGETS += zkey-cryptsetup-skip-jsonc
|
|
endif
|
|
else
|
|
BUILD_TARGETS += zkey-cryptsetup-skip-cryptsetup2
|
|
INSTALL_TARGETS += zkey-cryptsetup-skip-cryptsetup2
|
|
endif
|
|
|
|
libs = $(rootdir)/libutil/libutil.a
|
|
|
|
ALL_CFLAGS += -DKMS_PLUGIN_LOCATION=\"$(ZKEYKMSPLUGINDIR)\" \
|
|
-D_FILE_OFFSET_BITS=64
|
|
|
|
detect-libcryptsetup.dep:
|
|
echo "#include <libcryptsetup.h>" > detect-libcryptsetup.dep
|
|
echo "#ifndef CRYPT_REQUIREMENT_INLINE_HW_TAGS" >> detect-libcryptsetup.dep
|
|
echo " #error libcryptsetup version 2.8.2 is required" >> detect-libcryptsetup.dep
|
|
echo "#endif" >> detect-libcryptsetup.dep
|
|
echo "int i = CRYPT_SLOT_UNBOUND;" >> detect-libcryptsetup.dep
|
|
echo "int test(void) { return crypt_reencrypt_init_by_keyslot_context(NULL, NULL, NULL, NULL, 0, 0, NULL, NULL, NULL); }" >> detect-libcryptsetup.dep
|
|
|
|
check-dep-zkey: detect-libcryptsetup.dep
|
|
$(call check_dep, \
|
|
"zkey", \
|
|
"openssl/evp.h", \
|
|
"openssl-devel", \
|
|
"HAVE_OPENSSL=0")
|
|
$(call check_dep, \
|
|
"zkey", \
|
|
"detect-libcryptsetup.dep", \
|
|
"cryptsetup-devel version 2.8.2", \
|
|
"HAVE_CRYPTSETUP2=0", \
|
|
-I. -lcryptsetup)
|
|
touch check-dep-zkey
|
|
|
|
check-dep-zkey-cryptsetup: detect-libcryptsetup.dep
|
|
$(call check_dep, \
|
|
"zkey-cryptsetup", \
|
|
"detect-libcryptsetup.dep", \
|
|
"cryptsetup-devel version 2.8.2", \
|
|
"HAVE_CRYPTSETUP2=0", \
|
|
-I. -lcryptsetup)
|
|
$(call check_dep, \
|
|
"zkey-cryptsetup", \
|
|
"json-c/json.h", \
|
|
"json-c-devel", \
|
|
"HAVE_JSONC=0")
|
|
touch check-dep-zkey-cryptsetup
|
|
|
|
zkey-skip-openssl:
|
|
echo " SKIP zkey due to HAVE_OPENSSL=0"
|
|
|
|
zkey-skip-cryptsetup2:
|
|
echo " SKIP zkey due to HAVE_CRYPTSETUP2=0"
|
|
|
|
zkey-cryptsetup-skip-cryptsetup2:
|
|
echo " SKIP zkey-cryptsetup due to HAVE_CRYPTSETUP2=0"
|
|
|
|
zkey-cryptsetup-skip-jsonc:
|
|
echo " SKIP zkey-cryptsetup due to HAVE_JSONC=0"
|
|
|
|
zkey-cryptsetup-skip-openssl:
|
|
echo " SKIP zkey-cryptsetup due to HAVE_OPENSSL=0"
|
|
|
|
all: $(BUILD_TARGETS) $(SUB_DIRS)
|
|
|
|
zkey.o: check-dep-zkey zkey.c pkey.h cca.h ep11.h misc.h
|
|
pkey.o: pkey.c pkey.h cca.h ep11.h utils.h
|
|
cca.o: cca.c cca.h pkey.h ep11.h utils.h
|
|
ep11.o: ep11.c ep11.h pkey.h cca.h utils.h
|
|
utils.o: utils.h pkey.h cca.h ep11.h
|
|
properties.o: check-dep-zkey properties.c properties.h
|
|
keystore.o: check-dep-zkey keystore.c keystore.h properties.h pkey.h cca.h \
|
|
ep11.h utils.h
|
|
zkey-cryptsetup.o: check-dep-zkey-cryptsetup zkey-cryptsetup.c pkey.h cca.h \
|
|
ep11.h misc.h utils.h
|
|
kms.o: kms.c kms.h kms-plugin.h utils.h pkey.h
|
|
pvsecrets.o: pvsecrets.h
|
|
|
|
zkey: LDLIBS = -ldl -lcrypto
|
|
zkey: zkey.o pkey.o cca.o ep11.o properties.o keystore.o utils.o kms.o \
|
|
pvsecrets.o $(libs)
|
|
$(LINK) $(ALL_LDFLAGS) $^ $(LDLIBS) -o $@
|
|
|
|
zkey-cryptsetup: LDLIBS = -ldl -lcryptsetup -ljson-c -lcrypto
|
|
zkey-cryptsetup: zkey-cryptsetup.o pkey.o cca.o ep11.o utils.o $(libs)
|
|
$(LINK) $(ALL_LDFLAGS) $^ $(LDLIBS) -o $@
|
|
|
|
install-common:
|
|
$(INSTALL) -d -m 755 $(DESTDIR)$(USRBINDIR)
|
|
$(INSTALL) -d -m 755 $(DESTDIR)$(MANDIR)/man1
|
|
$(MAKE) -C initramfs install
|
|
$(MAKE) -C dracut install
|
|
|
|
install-zkey: zkey
|
|
$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 zkey $(DESTDIR)$(USRBINDIR)
|
|
$(INSTALL) -m 644 -c zkey.1 $(DESTDIR)$(MANDIR)/man1
|
|
$(INSTALL) -d -m 770 $(DESTDIR)$(SYSCONFDIR)/zkey
|
|
$(INSTALL) -d -m 770 $(DESTDIR)$(SYSCONFDIR)/zkey/repository
|
|
$(INSTALL) -m 644 -c kms-plugins.conf $(DESTDIR)$(SYSCONFDIR)/zkey
|
|
|
|
install-zkey-cryptsetup: zkey-cryptsetup
|
|
$(INSTALL) -g $(GROUP) -o $(OWNER) -m 755 zkey-cryptsetup $(DESTDIR)$(USRBINDIR)
|
|
$(INSTALL) -m 644 -c zkey-cryptsetup.1 $(DESTDIR)$(MANDIR)/man1
|
|
|
|
install: install-common $(INSTALL_TARGETS) $(SUB_DIRS)
|
|
|
|
clean: $(SUB_DIRS)
|
|
rm -f *.o zkey zkey-cryptsetup detect-libcryptsetup.dep \
|
|
check-dep-zkey check-dep-zkey-cryptsetup
|
|
|
|
#
|
|
# For simple "make" we explicitly set the MAKECMDGOALS to "all".
|
|
#
|
|
ifeq ($(MAKECMDGOALS),)
|
|
MAKECMDGOALS = all
|
|
endif
|
|
|
|
$(SUB_DIRS):
|
|
$(foreach goal,$(MAKECMDGOALS), \
|
|
$(MAKE) -C $@ TOPDIR=$(TOPDIR) HOST_ARCH=$(HOST_ARCH) $(goal) ;)
|
|
.PHONY: $(SUB_DIRS)
|
|
|
|
.PHONY: all install clean zkey-skip-cryptsetup2 zkey-skip-openssl \
|
|
zkey-cryptsetup-skip-cryptsetup2 zkey-cryptsetup-skip-jsonc \
|
|
install-common install-zkey install-zkey-cryptsetup
|