[patch] Luks version, without keys. Extra boot option for added security

genkernel_luks_cd.patch (text/plain), 5.44 KB, created by Nelson on 2007-06-26 16:40:48 UTC

Index: genkernel/trunk/generic/initrd.scripts
===================================================================
--- genkernel/trunk/generic/initrd.scripts	(revision 518)
+++ genkernel/trunk/generic/initrd.scripts	(working copy)
@@ -109,18 +109,18 @@
                         if [ -b "${x}" ]
                         then
                                 good_msg "Attempting to mount key media:- ${x}"
-                                mount -r -t auto ${x} ${NEW_ROOT}/mnt/key \
+                                mount -r -t auto ${x} ${NEW_ROOT}/mnt/keydev \
                                                 > /dev/null 2>&1
-                                fi
                                 if [ "$?" = '0' ]
                                 then
                                         # Check for the key
-                                        if [ -e ${NEW_ROOT}/mnt/key/${SUBDIR}/${KEYNAME} ]
+                                        if [ -e ${NEW_ROOT}/mnt/keydev/${SUBDIR}/${KEYNAME} ]
                                         then
-                                                KEY_ROOT="${x}"
+                                                LUKS_ROOT_KEYDEV="${x}"
+						umount ${NEW_ROOT}/mnt/keydev
                                                 break
                                         else
-                                                umount ${NEW_ROOT}/mnt/key
+                                                umount ${NEW_ROOT}/mnt/keydev
                                         fi
                                 fi
                         fi
@@ -658,6 +658,14 @@
 		do
 			if [ "${LUKS_DEVICE}" = '' ]
 			then
+				if [ ${LUKS_SILENT} ]
+				then
+					echo 'System booted'
+					run_shell
+				fi
+
+			elif [ 1 ]
+			then
 				# LUKS device could not be opened. Prompt user for device.
 				bad_msg "The LUKS ${LUKS_NAME} block device is not detected."
 				echo "   Please specify a ${LUKS_NAME} LUKS device to open, "q" to skip, or "shell" for a shell..."
@@ -677,12 +685,18 @@
 				setup_md_device ${LUKS_DEVICE}
 				if cryptsetup isLuks ${LUKS_DEVICE}
 				then
-					good_msg "Opening LUKS device ${LUKS_DEVICE}"
+					if [ "${LUKS_SILENT}" = '' ]
+					then
+						good_msg "Opening LUKS device ${LUKS_DEVICE}"
+					fi
 					
 					cryptsetup luksOpen ${LUKS_DEVICE} ${LUKS_NAME}
 					if [ ! "$?" -eq '0' ]
 					then
 						bad_msg "Failed open LUKS device ${LUKS_DEVICE}"
+					elif [ "${LUKS_SILENT}" ]
+					then
+						run_shell
 					else
 						break
 					fi
Index: genkernel/trunk/generic/linuxrc
===================================================================
--- genkernel/trunk/generic/linuxrc	(revision 518)
+++ genkernel/trunk/generic/linuxrc	(working copy)
@@ -72,16 +72,13 @@
 			CDROOT=1
 			CDROOT_DEV=`parse_opt "${x}"`
 		;;
-		# Start livecd loop, looptype options and encryption
+		# Start livecd loop, looptype options
 		loop\=*)
 			LOOP=`parse_opt "${x}"`
 		;;
 		looptype\=*)
 			LOOPTYPE=`parse_opt "${x}"`
 		;;
-		loop_crypt\=*)
-			LOOP_CRYPT=`parse_opt "${x}"`
-		;;
 		# Start Device Manager options 
 		devfs)
 			USE_DEVFS_NORMAL=1
@@ -182,6 +179,9 @@
 		crypt_swap\=*)
 			LUKS_SWAP=`parse_opt "${x}"`
 		;;
+		crypt_silent\=*)
+			LUKS_SILENT=`parse_opt "${x}"`
+		;;
 		real_rootflags\=*)
 			REAL_ROOTFLAGS=`parse_opt "${x}"`
 		;;
@@ -236,8 +236,11 @@
 # Scan volumes
 startVolumes
 
-# Initialize LUKS root device
-startLUKS
+# Initialize LUKS root device except for livecd's
+if [ "${CDROOT}" -ne '1' ]
+then
+	startLUKS
+fi
 
 # Set up unionfs
 mkdir -p ${NEW_ROOT}
@@ -264,7 +267,7 @@
 		mount -t tmpfs tmpfs ${NEW_ROOT}
 	fi
 	
-	for i in dev mnt mnt/cdrom mnt/livecd mnt/key tmp tmp/.initrd mnt/gentoo sys
+	for i in dev mnt mnt/cdrom mnt/livecd mnt/keydev tmp tmp/.initrd mnt/gentoo sys
 	do
 		mkdir -p ${NEW_ROOT}/$i
 		chmod 755 ${NEW_ROOT}/$i
@@ -496,37 +499,41 @@
 	
 
         # If encrypted, find key and mount, otherwise mount as usual
-	if [ "${LOOP_CRYPT}" != '' ] 
+	if [ "${LUKS_ROOT}" != '' ] 
 	then
-		good_msg 'You booted an encrypted livecd'
-		KEYNAME=$(head -n 1 ${NEW_ROOT}/mnt/cdrom/livecd)
+		if [ "${LUKS_SILENT}" = '' ]
+		then
+			good_msg 'You booted an encrypted livecd'
+		fi
 
-		if [ "${KEYNAME}" = '' ]
-		then 
-			good_msg 'It's not locked with a gpg key, attempting to decrypt manually'
-			losetup -e ${LOOP_CRYPT} /dev/loop1 ${NEW_ROOT}/mnt/cdrom/${LOOPEXT}${LOOP}
-			
+		LUKS_ROOT_KEY=$(head -n 1 ${NEW_ROOT}/mnt/cdrom/livecd)
 
-		else 
-			good_msg 'Livecd locked with gpg key'
+		if [ "${LUKS_ROOT_KEY}" ]
+		then
 			bootstrapKey
-			good_msg 'Attempting to decrypt with key'
-			losetup -K ${NEW_ROOT}/mnt/key/${SUBDIR}/${KEYNAME} -e ${LOOP_CRYPT} /dev/loop1 \
-				${NEW_ROOT}/mnt/cdrom/${LOOPEXT}${LOOP}
 		fi
-
-		test_success 'Unencrypting loop'
 		
+		losetup /dev/loop1 ${NEW_ROOT}/mnt/cdrom/${LOOPEXT}${LOOP}
+		
+		test_success 'Preparing loop filesystem'
+		
+		LUKS_ROOT='/dev/loop1'
+		
+		startLUKS
+		
 		case ${LOOPTYPE} in
-			squashfs)
-				MOUNTTYPE="squashfs"
 			normal)
 				MOUNTTYPE="ext2"
-		esac
+				;;
+			*)
+				MOUNTTYPE="${LOOPTYPE}"
+				;;
+		esac		
 
-		mount -t ${MOUNTTYPE} -o ro /dev/loop1 ${NEW_ROOT}/mnt/livecd 
-				
-		test_success 'Mount filesystem, checking key'	
+
+		mount -t ${MOUNTTYPE} -o ro /dev/mapper/root ${NEW_ROOT}/mnt/livecd 
+		
+		test_success 'Mount filesystem'	
 		FS_LOCATION='mnt/livecd'
 
 
@@ -590,7 +597,7 @@
 			test_success 'mount /dev/loop0 /'
 			FS_LOCATION='mnt/livecd'
 		fi
-	
+	fi
 #
 # End cdrom looptype determination and mounting if necessary
 #