From: Quirin Gylstorff <Quirin.Gylstorff@siemens.com>
To: cip-dev@lists.cip-project.org, jan.kiszka@siemens.com, johnxw@amazon.com
Subject: [cip-dev][isar-cip-core][RFC 3/8] initramfs-crypt-hook: move the mounting of encrypted disks in a seperate function
Date: Tue, 19 Mar 2024 19:18:27 +0100 [thread overview]
Message-ID: <20240319182026.1571362-4-Quirin.Gylstorff@siemens.com> (raw)
In-Reply-To: <20240319182026.1571362-1-Quirin.Gylstorff@siemens.com>
From: Quirin Gylstorff <quirin.gylstorff@siemens.com>
This increase the maintainability and avoids missing checks.
Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
---
.../files/encrypt_partition.clevis.script | 20 +++++++++++--------
.../files/encrypt_partition.systemd.script | 20 +++++++++++--------
2 files changed, 24 insertions(+), 16 deletions(-)
diff --git a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script
index 4e76c44..0f82c1a 100644
--- a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script
+++ b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script
@@ -92,6 +92,16 @@ reencrypt_existing_partition() {
fi
}
+mount_partition() {
+ partition_dev_path=$1
+ partition_mountpoint=$2
+ echo "mount device: '$partition' to '$partition_mountpoint'"
+ if ! mount -t "$(get_fstype "${partition_dev_path}")" "${partition_dev_path}" \
+ "${partition_mountpoint}"; then
+ panic "Can't mount encrypted partition '${partition_dev_path}'!"
+ fi
+}
+
if [ ! -e "$tpm_device" ]; then
panic "tpm device '$tpm_device' does not exists - cannot create a encrypted device!"
fi
@@ -114,10 +124,7 @@ for partition_set in $partition_sets; do
if /usr/sbin/cryptsetup luksDump --batch-mode "$partition" \
| grep -q "clevis"; then
open_tpm2_partition "$part_device"
- if ! mount -t "$(get_fstype "${decrypted_part}")" "${decrypted_part}" \
- "${rootmnt}${partition_mountpoint}"; then
- panic "Can't mount encrypted partition '${decrypted_part}'!"
- fi
+ mount_partition "$decrypted_part" "${rootmnt}""$partition_mountpoint"
continue
fi
@@ -150,10 +157,7 @@ for partition_set in $partition_sets; do
;;
esac
- if ! mount -t "$(get_fstype "${decrypted_part}")" "${decrypted_part}" \
- "${rootmnt}${partition_mountpoint}"; then
- panic "Can't mount encrypted partition '${decrypted_part}'!"
- fi
+ mount_partition "$decrypted_part" "${rootmnt}""$partition_mountpoint"
# delete initial key
# afterwards no new keys can be enrolled
diff --git a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
index f97a461..6c6d22e 100644
--- a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
+++ b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
@@ -102,6 +102,16 @@ reencrypt_existing_partition() {
fi
}
+mount_partition() {
+ partition_dev_path=$1
+ partition_mountpoint=$2
+ echo "mount device: '$partition' to '$partition_mountpoint'"
+ if ! mount -t "$(get_fstype "${partition_dev_path}")" "${partition_dev_path}" \
+ "${partition_mountpoint}"; then
+ panic "Can't mount encrypted partition '${partition_dev_path}'!"
+ fi
+}
+
if [ ! -e "$tpm_device" ]; then
panic "tpm device '$tpm_device' does not exists - cannot create a encrypted device!"
fi
@@ -118,11 +128,8 @@ for partition_set in $partition_sets; do
# check if partition is already encrypted with systemd-tpm2
if /usr/sbin/cryptsetup luksDump --batch-mode "$partition" \
| grep -q "systemd-tpm2"; then
- if ! mount -t "$(get_fstype "${decrypted_part}")" "${decrypted_part}" \
- "${rootmnt}${partition_mountpoint}"; then
- panic "Can't mount encrypted partition '${decrypted_part}'!"
- fi
open_tpm2_partition "$part_device"
+ mount_partition "$decrypted_part" "${rootmnt}""$partition_mountpoint"
continue
fi
@@ -155,10 +162,7 @@ for partition_set in $partition_sets; do
;;
esac
- if ! mount -t "$(get_fstype "${decrypted_part}")" "${decrypted_part}" \
- "${rootmnt}${partition_mountpoint}"; then
- panic "Can't mount encrypted partition '${decrypted_part}'!"
- fi
+ mount_partition "$decrypted_part" "${rootmnt}""$partition_mountpoint"
# delete initial key
# afterwards no new keys can be enrolled
--
2.43.0
next prev parent reply other threads:[~2024-03-19 18:20 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-19 18:18 [cip-dev][isar-cip-core][RFC 0/8] Rework disk encryption Quirin Gylstorff
2024-03-19 18:18 ` [cip-dev][isar-cip-core][RFC 1/8] initramfs-crypt-hook: Allow switching between clevis and systemd Quirin Gylstorff
2024-03-19 18:33 ` Jan Kiszka
2024-03-20 11:27 ` Gylstorff Quirin
2024-03-19 18:18 ` [cip-dev][isar-cip-core][RFC 2/8] initramfs-crypt-hook: Align systemd encryption and clevis encryption Quirin Gylstorff
2024-03-19 18:18 ` Quirin Gylstorff [this message]
2024-03-19 18:18 ` [cip-dev][isar-cip-core][RFC 4/8] initramfs-crypt-hook: Check if the TPM device fulfills the given requirements Quirin Gylstorff
2024-03-19 18:35 ` Jan Kiszka
2024-03-19 18:18 ` [cip-dev][isar-cip-core][RFC 5/8] initramfs-crypt-hook: add flag to make encryption optional Quirin Gylstorff
2024-03-19 18:36 ` Jan Kiszka
2024-03-19 18:18 ` [cip-dev][isar-cip-core][RFC 6/8] initramfs-crypt-hook: add e2fsck to avoid resize error Quirin Gylstorff
2024-03-19 18:37 ` Jan Kiszka
2024-03-20 11:42 ` Gylstorff Quirin
2024-03-19 18:18 ` [cip-dev][isar-cip-core][PATCH 7/8] initramfs-crypt-hook: split encryption and mounting Quirin Gylstorff
2024-03-19 18:18 ` [cip-dev][isar-cip-core][RFC 8/8] Add example to encrypt the rootfs Quirin Gylstorff
2024-03-19 18:42 ` Jan Kiszka
2024-03-20 11:41 ` Gylstorff Quirin
2024-03-20 11:49 ` Jan Kiszka
2024-03-22 0:24 ` [isar-cip-core][RFC " JohnW
2024-03-25 8:34 ` [cip-dev] " Gylstorff Quirin
2024-03-25 17:48 ` JohnW
2024-03-28 10:14 ` [cip-dev] " Gylstorff Quirin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240319182026.1571362-4-Quirin.Gylstorff@siemens.com \
--to=quirin.gylstorff@siemens.com \
--cc=cip-dev@lists.cip-project.org \
--cc=jan.kiszka@siemens.com \
--cc=johnxw@amazon.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.