diff options
| -rw-r--r-- | sys-fs/cryptsetup/ChangeLog | 12 | ||||
| -rw-r--r-- | sys-fs/cryptsetup/cryptsetup-1.0.5.ebuild | 100 | ||||
| -rw-r--r-- | sys-fs/cryptsetup/files/1.0.5-dm-crypt-start.sh | 243 | ||||
| -rw-r--r-- | sys-fs/cryptsetup/files/1.0.5-dm-crypt-stop.sh | 40 | ||||
| -rw-r--r-- | sys-fs/cryptsetup/files/1.0.5-dmcrypt.confd | 88 | ||||
| -rw-r--r-- | sys-fs/cryptsetup/files/1.0.5-dmcrypt.rc | 27 | ||||
| -rw-r--r-- | sys-fs/cryptsetup/files/digest-cryptsetup-1.0.5 | 3 |
7 files changed, 511 insertions, 2 deletions
diff --git a/sys-fs/cryptsetup/ChangeLog b/sys-fs/cryptsetup/ChangeLog index ca2fc2ea0051..62c3f176a9ed 100644 --- a/sys-fs/cryptsetup/ChangeLog +++ b/sys-fs/cryptsetup/ChangeLog @@ -1,6 +1,14 @@ # ChangeLog for sys-fs/cryptsetup -# Copyright 1999-2006 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/sys-fs/cryptsetup/ChangeLog,v 1.39 2006/07/07 23:46:29 tcort Exp $ +# Copyright 1999-2007 Gentoo Foundation; Distributed under the GPL v2 +# $Header: /var/cvsroot/gentoo-x86/sys-fs/cryptsetup/ChangeLog,v 1.40 2007/08/14 16:05:16 strerror Exp $ + +*cryptsetup-1.0.5 (14 Aug 2007) + + 14 Aug 2007; Benjamin Smee <strerror@gentoo.org> + +files/1.0.5-dm-crypt-start.sh, +files/1.0.5-dm-crypt-stop.sh, + +files/1.0.5-dmcrypt.confd, +files/1.0.5-dmcrypt.rc, + +cryptsetup-1.0.5.ebuild: + Major changes for bug #177100 and others. Thanks to ikelos 07 Jul 2006; Thomas Cort <tcort@gentoo.org> cryptsetup-0.1-r3.ebuild: Stable on alpha wrt Bug #124928. diff --git a/sys-fs/cryptsetup/cryptsetup-1.0.5.ebuild b/sys-fs/cryptsetup/cryptsetup-1.0.5.ebuild new file mode 100644 index 000000000000..6ecc35e1fbc6 --- /dev/null +++ b/sys-fs/cryptsetup/cryptsetup-1.0.5.ebuild @@ -0,0 +1,100 @@ +# Copyright 1999-2007 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sys-fs/cryptsetup/cryptsetup-1.0.5.ebuild,v 1.1 2007/08/14 16:05:16 strerror Exp $ + +inherit linux-info eutils flag-o-matic multilib + +DESCRIPTION="Tool to setup encrypted devices with dm-crypt" +HOMEPAGE="http://luks.endorphin.org/" +SRC_URI="http://luks.endorphin.org/source/${P}.tar.bz2" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86" +IUSE="build dynamic nls selinux" + +DEPEND=">=sys-fs/device-mapper-1.00.07-r1 + >=dev-libs/libgcrypt-1.1.42 + >=dev-libs/libgpg-error-1.0-r1 + >=dev-libs/popt-1.7 + selinux? ( sys-libs/libselinux ) + !sys-fs/cryptsetup" + +dm-crypt_check() { + local CONFIG_CHECK="~DM_CRYPT" + local WARNING_DM_CRYPT="CONFIG_DM_CRYPT:\tis not set (required for cryptsetup-luks)" + check_extra_config + echo +} + +crypto_check() { + local CONFIG_CHECK="~CRYPTO" + local WARNING_CRYPTO="CONFIG_CRYPTO:\tis not set (required for cryptsetup-luks)" + check_extra_config + echo +} + +cbc_check() { + local CONFIG_CHECK="~CRYPTO_CBC" + local WARNING_CRYPTO_CBC="CONFIG_CRYPTO_CBC:\tis not set (required for Kernel 2.6.19)" + check_extra_config + echo +} + +src_unpack() { + unpack ${A} + cd "${S}" +} + +pkg_setup() { + # Bug 148390 + if ! use build ; then + linux-info_pkg_setup + dm-crypt_check + crypto_check + cbc_check + fi +} + +src_compile() { + if use dynamic ; then + ewarn "If you need cryptsetup for an initrd or initramfs then you" + ewarn "should NOT use the dynamic USE flag" + epause 5 + fi + + econf \ + --sbindir=/sbin \ + $(use_enable !dynamic static) \ + --libdir=/usr/$(get_libdir) \ + $(use_enable nls) \ + $(use_enable selinux) \ + || die + + emake || die +} + +src_install() { + emake DESTDIR="${D}" install || die "install failed" + rmdir "${D}"/usr/$(get_libdir)/cryptsetup + insinto /lib/rcscripts/addons + #dosym /sbin/cryptsetup /bin/cryptsetup + newins "${FILESDIR}"/1.0.5-dm-crypt-start.sh dm-crypt-start.sh || die + newins "${FILESDIR}"/1.0.5-dm-crypt-stop.sh dm-crypt-stop.sh || die + newconfd "${FILESDIR}"/1.0.5-dmcrypt.confd dmcrypt || die + newinitd "${FILESDIR}"/1.0.5-dmcrypt.rc dmcrypt || die +} + +pkg_postinst() { + ewarn "This ebuild introduces a new set of scripts and configuration" + ewarn "then the last version. If you are currently using /etc/conf.d/cryptfs" + ewarn "then you *MUST* copy your old file to:" + ewarn "/etc/conf.d/dmcrypt" + ewarn "Or your encrypted partitions will *NOT* work." + einfo + einfo "Please see the example for configuring a LUKS mountpoint" + einfo "in /etc/conf.d/dmcrypt" + einfo + einfo "If you are using baselayout-2 then please do:" + einfo "rc-update add dmcrypt boot" +} diff --git a/sys-fs/cryptsetup/files/1.0.5-dm-crypt-start.sh b/sys-fs/cryptsetup/files/1.0.5-dm-crypt-start.sh new file mode 100644 index 000000000000..f47a52301be3 --- /dev/null +++ b/sys-fs/cryptsetup/files/1.0.5-dm-crypt-start.sh @@ -0,0 +1,243 @@ +# /lib/rcscripts/addons/dm-crypt-start.sh + +# For backwards compatability with baselayout < 1.13.0 +dm_crypt_execute_checkfs() { + dm_crypt_execute_dmcrypt +} + +dm_crypt_execute_volumes() { + dm_crypt_execute_dmcrypt +} + +# Setup mappings for an individual target/swap +# Note: This relies on variables localized in the main body below. +dm_crypt_execute_dmcrypt() { + local dev ret mode + # some colors + local red='\x1b[31;01m' green='\x1b[32;01m' off='\x1b[0;0m' + + if [ -n "$target" ]; then + # let user set options, otherwise leave empty + : ${options:=' '} + elif [ -n "$swap" ]; then + target=${swap} + # swap contents do not need to be preserved between boots, luks not required. + # suspend2 users should have initramfs's init handling their swap partition either way. + : ${options:='-c aes -h sha1 -d /dev/urandom'} + : ${pre_mount:='mkswap ${dev}'} + else + return + fi + if [ -z "$source" ] && [ ! -e "$source" ]; then + ewarn "source \"${source}\" for ${target} missing, skipping..." + return + fi + + if [[ -n ${loop_file} ]] ; then + dev="/dev/mapper/${target}" + ebegin " Setting up loop device ${source}" + /sbin/losetup ${source} ${loop_file} + fi + + # cryptsetup: + # luksOpen <device> <name> # <device> is $source + # create <name> <device> # <name> is $target + local arg1="create" arg2="$target" arg3="$source" luks=0 + + cryptsetup isLuks ${source} 2>/dev/null && { arg1="luksOpen"; arg2="$source"; arg3="$target"; luks=1; } + + if /bin/cryptsetup status ${target} | egrep -q '\<active:' ; then + einfo "dm-crypt mapping ${target} is already configured" + return + fi + # Handle keys + if [ -n "$key" ]; then + # Notes: sed not used to avoid case where /usr partition is encrypted. + mode=${key/*:/} && ( [ "$mode" == "$key" ] || [ -z "$mode" ] ) && mode=reg + key=${key/:*/} + case "$mode" in + gpg|reg) + # handle key on removable device + if [ -n "$remdev" ]; then + # temp directory to mount removable device + local mntrem=/mnt/remdev + local c=0 ans + for (( i = 0 ; i < 10 ; i++ )) + do + [ ! -d "$mntrem" ] && mkdir -p ${mntrem} 2>/dev/null >/dev/null + if mount -n -o ro ${remdev} ${mntrem} 2>/dev/null >/dev/null ; then + sleep 2 + # keyfile exists? + if [ ! -e "${mntrem}${key}" ]; then + umount -n ${mntrem} 2>/dev/null >/dev/null + rmdir ${mntrem} 2>/dev/null >/dev/null + einfo "Cannot find ${key} on removable media." + echo -n -e " ${green}*${off} Abort?(${red}yes${off}/${green}no${off})" >/dev/console + read ans </dev/console + echo >/dev/console + [ "$ans" != "yes" ] && { i=0; c=0; } || return + else + key="${mntrem}${key}" + break + fi + else + [ "$c" -eq 0 ] && einfo "Please insert removable device for ${target}" + c=1 + sleep 2 + # let user abort + if [ "$i" -eq 9 ]; then + rmdir ${mntrem} 2>/dev/null >/dev/null + einfo "Removable device for ${target} not present." + echo -n -e " ${green}*${off} Abort?(${red}yes${off}/${green}no${off})" >/dev/console + read ans </dev/console + echo >/dev/console + [ "$ans" != "yes" ] && { i=0; c=0; } || return + fi + fi + done + else # keyfile ! on removable device + if [ ! -e "$key" ]; then + ewarn "${source} will not be decrypted ..." + einfo "Reason: keyfile ${key} does not exist." + return + fi + fi + ;; + *) + ewarn "${source} will not be decrypted ..." + einfo "Reason: mode ${mode} is invalid." + return + ;; + esac + else + mode=none + fi + splash svc_input_begin ${SVCNAME} >/dev/null 2>&1 + ebegin "dm-crypt map ${target}" + einfo "cryptsetup will be called with : ${options} ${arg1} ${arg2} ${arg3}" + if [ "$mode" == "gpg" ]; then + : ${gpg_options:='-q -d'} + # gpg available ? + if type -p gpg >/dev/null ; then + for (( i = 0 ; i < 3 ; i++ )) + do + # paranoid, don't store key in a variable, pipe it so it stays very little in ram unprotected. + # save stdin stdout stderr "values" + exec 3>&0 4>&1 6>&2 # ABS says fd 5 is reserved + exec &>/dev/console </dev/console + gpg ${gpg_options} ${key} 2>/dev/null | cryptsetup ${options} ${arg1} ${arg2} ${arg3} + ret="$?" + # restore values and close file descriptors + exec 0>&3 1>&4 2>&6 + exec 3>&- 4>&- 6>&- + [ "$ret" -eq 0 ] && break + done + eend "${ret}" "failure running cryptsetup" + else + ewarn "${source} will not be decrypted ..." + einfo "Reason: cannot find gpg application." + einfo "You have to install app-crypt/gnupg first." + einfo "If you have /usr on its own partition, try copying gpg to /bin ." + fi + else + if [ "$mode" == "reg" ]; then + cryptsetup ${options} -d ${key} ${arg1} ${arg2} ${arg3} >/dev/console </dev/console + ret="$?" + eend "${ret}" "failure running cryptsetup" + else + cryptsetup ${options} ${arg1} ${arg2} ${arg3} >/dev/console </dev/console + ret="$?" + eend "${ret}" "failure running cryptsetup" + fi + fi + if [ -d "$mntrem" ]; then + umount -n ${mntrem} 2>/dev/null >/dev/null + rmdir ${mntrem} 2>/dev/null >/dev/null + fi + splash svc_input_end ${SVCNAME} >/dev/null 2>&1 + + if [[ ${ret} != 0 ]] ; then + cryptfs_status=1 + else + if [[ -n ${pre_mount} ]] ; then + dev="/dev/mapper/${target}" + ebegin " Running pre_mount commands for ${target}" + eval "${pre_mount}" > /dev/null + ewend $? || cryptfs_status=1 + fi + fi +} + +# Run any post_mount commands for an individual mount +# +# Note: This relies on variables localized in the main body below. +dm_crypt_execute_localmount() { + local mount_point + + [ -z "$target" ] && [ -z "$post_mount" ] && return + + if ! /bin/cryptsetup status ${target} | egrep -q '\<active:' ; then + ewarn "Skipping unmapped target ${target}" + cryptfs_status=1 + return + fi + + mount_point=$(grep "/dev/mapper/${target}" /proc/mounts | cut -d' ' -f2) + if [[ -z ${mount_point} ]] ; then + ewarn "Failed to find mount point for ${target}, skipping" + cryptfs_status=1 + fi + + if [[ -n ${post_mount} ]] ; then + ebegin "Running post_mount commands for target ${target}" + eval "${post_mount}" >/dev/null + eend $? || cryptfs_status=1 + fi +} + +local cryptfs_status=0 +local gpg_options key loop_file target targetline options pre_mount post_mount source swap remdev + +if [[ -f /etc/conf.d/dmcrypt ]] && [[ -x /bin/cryptsetup ]] ; then + ebegin "Setting up dm-crypt mappings" + + # Fix for baselayout-1.12.10 (bug 174256) + [ -z ${SVCNAME} ] && SVCNAME="${myservice}" + + while read targetline ; do + # skip comments and blank lines + [[ ${targetline}\# == \#* ]] && continue + + # check for the start of a new target/swap + case ${targetline} in + target=*|swap=*) + # If we have a target queued up, then execute it + dm_crypt_execute_${SVCNAME} + + # Prepare for the next target/swap by resetting variables + unset gpg_options key loop_file target options pre_mount post_mount source swap remdev + ;; + + gpg_options=*|remdev=*|key=*|loop_file=*|options=*|pre_mount=*|post_mount=*|source=*) + if [[ -z ${target} && -z ${swap} ]] ; then + ewarn "Ignoring setting outside target/swap section: ${targetline}" + continue + fi + ;; + + *) + ewarn "Skipping invalid line in /etc/conf.d/dmcrypt: ${targetline}" + ;; + esac + + # Queue this setting for the next call to dm_crypt_execute_${SVCNAME} + eval "${targetline}" + done < /etc/conf.d/dmcrypt + + # If we have a target queued up, then execute it + dm_crypt_execute_${SVCNAME} + + ewend ${cryptfs_status} "Failed to setup dm-crypt devices" +fi + +# vim:ts=4 diff --git a/sys-fs/cryptsetup/files/1.0.5-dm-crypt-stop.sh b/sys-fs/cryptsetup/files/1.0.5-dm-crypt-stop.sh new file mode 100644 index 000000000000..9aea8217cb8f --- /dev/null +++ b/sys-fs/cryptsetup/files/1.0.5-dm-crypt-stop.sh @@ -0,0 +1,40 @@ +# /lib/rcscripts/addons/dm-crypt-stop.sh + +# Try to remove any dm-crypt mappings +csetup=/bin/cryptsetup +if [ -f /etc/conf.d/cryptfs ] && [ -x "$csetup" ] +then + einfo "Removing dm-crypt mappings" + + /bin/egrep "^(target|swap)" /etc/conf.d/cryptfs | \ + while read targetline + do + target= + swap= + + eval ${targetline} + + [ -n "${swap}" ] && target=${swap} + [ -z "${target}" ] && ewarn "Invalid line in /etc/conf.d/cryptfs: ${targetline}" + + ebegin "Removing dm-crypt mapping for: ${target}" + ${csetup} remove ${target} + eend $? "Failed to remove dm-crypt mapping for: ${target}" + done + + if [[ -n $(/bin/egrep -e "^(source=)./dev/loop*" /etc/conf.d/cryptfs) ]] ; then + einfo "Taking down any dm-crypt loop devices" + /bin/egrep -e "^(source)" /etc/conf.d/cryptfs | while read sourceline + do + source= + eval ${sourceline} + if [[ -n $(echo ${source} | grep /dev/loop) ]] ; then + ebegin " Taking down ${source}" + /sbin/losetup -d ${source} + eend $? " Failed to remove loop" + fi + done + fi +fi + +# vim:ts=4 diff --git a/sys-fs/cryptsetup/files/1.0.5-dmcrypt.confd b/sys-fs/cryptsetup/files/1.0.5-dmcrypt.confd new file mode 100644 index 000000000000..faa61383ceb6 --- /dev/null +++ b/sys-fs/cryptsetup/files/1.0.5-dmcrypt.confd @@ -0,0 +1,88 @@ +# /etc/conf.d/cryptfs + +#-------------------- +# Instructions +#-------------------- + +# Note regarding the syntax of this file. This file is *almost* bash, +# but each line is evaluated separately. Separate swaps/targets can be +# specified. The init-script which reads this file assumes that a +# swap= or target= line starts a new section, similar to lilo or grub +# configuration. + +# Note when using gpg keys and /usr on a separate partition, you will +# have to copy /usr/bin/gpg to /bin/gpg so that it will work properly +# and ensure that gpg has been compiled statically. +# See http://bugs.gentoo.org/90482 for more information. + +# Note that the init-script which reads this file detects whether your +# partition is LUKS or not. No mkfs is run unless you specify a makefs +# option. + +# Arguments: +#----------- +# target=<name> == Mapping name for partition. +# swap=<name> == Mapping name for swap partition. +# source='<dev>' == Real device for partition. +# key='</path/to/keyfile>[:<mode>]' == Fullpath from / or from inside removable media. +# remdev='<dev>' == Device that will be assigned to removable media. +# gpg_options='<opts>' == Default are --quiet --decrypt +# options='<opts>' == cryptsetup, for LUKS you can only use --readonly +# loop_file='<file>' == Loopback file. +# pre_mount='cmds' == commands to execute before mounting partition. +# post_mount='cmds' == commands to execute after mounting partition. +#----------- +# Supported Modes +# gpg == decrypt and pipe key into cryptsetup. +# Note: new-line character must not be part of key. +# Command to erase \n char: 'cat key | tr -d '\n' > cleanKey' + +#-------------------- +# dm-crypt examples +#-------------------- + +## swap +# Swap partitions. These should come first so that no keys make their +# way into unencrypted swap. +# If no options are given, they will default to: -c aes -h sha1 -d /dev/urandom +# If no makefs is given then mkswap will be assumed +#swap=crypt-swap +#source='/dev/hda2' + +## /home with passphrase +#target=crypt-home +#source='/dev/hda5' + +## /home with regular keyfile +#target=crypt-home +#source='/dev/hda5' +#key='/full/path/to/homekey' + +## /home with gpg protected key +#target=crypt-home +#source='/dev/hda5' +#key='/full/path/to/homekey:gpg' + +## /home with regular keyfile on removable media(such as usb-stick) +#target=crypt-home +#source='/dev/hda5' +#key='/full/path/to/homekey' +#remdev='/dev/sda1' + +##/home with gpg protected key on removable media(such as usb-stick) +#target=crypt-home +#source='/dev/hda5' +#key='/full/path/to/homekey:gpg' +#remdev='/dev/sda1' + +##/tmp with regular keyfile +#target=crypt-tmp +#source='/dev/hda6' +#key='/full/path/to/tmpkey' +#pre_mount='/sbin/mkreiserfs -f -f ${dev}' +#post_mount='chown root:root ${mount_point}; chmod 1777 ${mount_point}' + +## Loopback file example +#mount='crypt-loop-home' +#source='/dev/loop0' +#loop_file='/mnt/crypt/home' diff --git a/sys-fs/cryptsetup/files/1.0.5-dmcrypt.rc b/sys-fs/cryptsetup/files/1.0.5-dmcrypt.rc new file mode 100644 index 000000000000..a861a4f80d2d --- /dev/null +++ b/sys-fs/cryptsetup/files/1.0.5-dmcrypt.rc @@ -0,0 +1,27 @@ +#!/sbin/runscript +# Copyright 1999-2007 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/sys-fs/cryptsetup/files/1.0.5-dmcrypt.rc,v 1.1 2007/08/14 16:05:16 strerror Exp $ + +depend() { + before checkfs +} + +start() { + if [ ! -e /lib/librc.so ]; then + eerror "The ${myservice} init script is written for baselayout-2" + eerror "Please do not use it with baselayout-1" + return 1 + fi + + . /lib/rcscripts/addons/dm-crypt-start.sh +} + +stop() { + if [ ! -e /lib/librc.so ]; then + return 0 + fi + + . /lib/rcscripts/addons/dm-crypt-stop.sh +} + diff --git a/sys-fs/cryptsetup/files/digest-cryptsetup-1.0.5 b/sys-fs/cryptsetup/files/digest-cryptsetup-1.0.5 new file mode 100644 index 000000000000..6f628fcf5e9f --- /dev/null +++ b/sys-fs/cryptsetup/files/digest-cryptsetup-1.0.5 @@ -0,0 +1,3 @@ +MD5 0aa2f94c39123f1a0352983e5366179c cryptsetup-1.0.5.tar.bz2 322394 +RMD160 99d9b0090b297b1bc2c72c064f091c8b2f322f70 cryptsetup-1.0.5.tar.bz2 322394 +SHA256 4bab529afa00cafde3bc5df2769578c88438f80c5152d4257cd0e86986f95bc4 cryptsetup-1.0.5.tar.bz2 322394 |