From: Quirin Gylstorff <Quirin.Gylstorff@siemens.com>
To: jan.kiszka@siemens.com, cip-dev@lists.cip-project.org, johnxw@amazon.com
Subject: [cip-dev][isar-cip-core][PATCH v2 02/13] initramfs-crypt-hook: Align systemd encryption and clevis encryption
Date: Fri, 22 Mar 2024 11:05:12 +0100 [thread overview]
Message-ID: <20240322100605.4129226-3-Quirin.Gylstorff@siemens.com> (raw)
In-Reply-To: <20240322100605.4129226-1-Quirin.Gylstorff@siemens.com>
From: Quirin Gylstorff <quirin.gylstorff@siemens.com>
The following changes were copied from systemd to clevis:
- check return of resize command
The following changes were copied form clevis to systemd:
- check if create_filesystem command is empty
- use part_device(/dev/*) instead of disk
label(/dev/disk/by-partlabel/*)
Signed-off-by: Quirin Gylstorff <quirin.gylstorff@siemens.com>
---
.../files/encrypt_partition.clevis.script | 6 ++++--
.../files/encrypt_partition.systemd.script | 21 +++++++++++--------
2 files changed, 16 insertions(+), 11 deletions(-)
diff --git a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script
index 0318966..4e76c44 100644
--- a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script
+++ b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.clevis.script
@@ -2,7 +2,7 @@
#
# CIP Core, generic profile
#
-# Copyright (c) Siemens AG, 2023
+# Copyright (c) Siemens AG, 2023-2024
#
# Authors:
# Quirin Gylstorff <quirin.gylstorff@siemens.com>
@@ -82,7 +82,9 @@ reencrypt_existing_partition() {
reduced_size="$(expr "$part_size_blocks" - 65536 )"
reduced_size_in_byte="$(expr "$reduced_size" \* 512)"
reduced_size_in_kb="$(expr "$reduced_size_in_byte" / 1024)K"
- resize2fs "$1" "${reduced_size_in_kb}"
+ if ! resize2fs "$1" "${reduced_size_in_kb}"; then
+ panic "reencryption of filesystem $1 cannot continue!"
+ fi
if [ -x /usr/sbin/cryptsetup-reencrypt ]; then
/usr/sbin/cryptsetup-reencrypt --new --reduce-device-size "$reduce_device_size"k "$1" < "$2"
else
diff --git a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
index eeeb55a..f97a461 100644
--- a/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
+++ b/recipes-initramfs/initramfs-crypt-hook/files/encrypt_partition.systemd.script
@@ -2,7 +2,7 @@
#
# CIP Core, generic profile
#
-# Copyright (c) Siemens AG, 2023
+# Copyright (c) Siemens AG, 2023-2024
#
# Authors:
# Quirin Gylstorff <quirin.gylstorff@siemens.com>
@@ -47,6 +47,9 @@ modprobe loop
tpm_device=/dev/tpmrm0
partition_sets="$PARTITIONS"
create_file_system_cmd="$CREATE_FILE_SYSTEM_CMD"
+if [ -z "${create_file_system_cmd}" ]; then
+ create_file_system_cmd="mke2fs -t ext4"
+fi
service_watchdog() {
for n in $(seq $(($SETUP_TIMEOUT / 10)) ); do
@@ -83,8 +86,7 @@ enroll_tpm2_token() {
}
reencrypt_existing_partition() {
- part_device="$(readlink -f "$partition")"
- part_size_blocks="$(cat /sys/class/block/"$(awk -v dev="$part_device" 'BEGIN{split(dev,a,"/"); print a[3]}' )"/size)"
+ part_size_blocks="$(cat /sys/class/block/"$(awk -v dev="$1" 'BEGIN{split(dev,a,"/"); print a[3]}' )"/size)"
# reduce the filesystem and partition by 32M to fit the LUKS header
reduce_device_size=32768
reduced_size="$(expr "$part_size_blocks" - 65536 )"
@@ -111,15 +113,16 @@ for partition_set in $partition_sets; do
partition=/dev/disk/by-partlabel/"$partition_label"
crypt_mount_name="encrypted_$partition_label"
decrypted_part=/dev/mapper/"$crypt_mount_name"
+ part_device=$(readlink -f "$partition")
# check if partition is already encrypted with systemd-tpm2
if /usr/sbin/cryptsetup luksDump --batch-mode "$partition" \
| grep -q "systemd-tpm2"; then
- open_tpm2_partition "$partition"
if ! mount -t "$(get_fstype "${decrypted_part}")" "${decrypted_part}" \
"${rootmnt}${partition_mountpoint}"; then
panic "Can't mount encrypted partition '${decrypted_part}'!"
fi
+ open_tpm2_partition "$part_device"
continue
fi
@@ -136,15 +139,15 @@ for partition_set in $partition_sets; do
case "${partition_format}" in
"reencrypt")
- reencrypt_existing_partition "$partition" "$tmp_key"
- enroll_tpm2_token "$partition" "$tmp_key"
- open_tpm2_partition "$partition"
+ reencrypt_existing_partition "$part_device" "$tmp_key"
+ enroll_tpm2_token "$part_device" "$tmp_key"
+ open_tpm2_partition "$part_device"
;;
"format")
/usr/sbin/cryptsetup luksFormat --batch-mode \
--type luks2 "$partition" < "$tmp_key"
- enroll_tpm2_token "$partition" "$tmp_key"
- open_tpm2_partition "$partition"
+ enroll_tpm2_token "$part_device" "$tmp_key"
+ open_tpm2_partition "$part_device"
eval "${create_file_system_cmd} ${decrypted_part}"
;;
*)
--
2.43.0
next prev parent reply other threads:[~2024-03-22 10:06 UTC|newest]
Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-22 10:05 [cip-dev][isar-cip-core][PATCH v2 00/13] Rework disk encryption Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 01/13] initramfs-crypt-hook: Allow switching between clevis and systemd Quirin Gylstorff
2024-03-22 10:05 ` Quirin Gylstorff [this message]
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 03/13] initramfs-crypt-hook: move the mounting of encrypted disks in a seperate function Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 04/13] initramfs-crypt-hook: Check if the TPM device fulfills the given requirements Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 05/13] initramfs-crypt-hook: add flag to make encryption optional Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 06/13] initramfs-crypt-hook: add e2fsck to avoid resize error Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 07/13] initramfs-crypt-hook: split encryption and mounting Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 08/13] initramfs-crypt-hook: Add check if root is part of the mountpoints Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 09/13] initramfs-crypt-hook: split hook in multiple files Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 10/13] initramfs-crypt-hook: Consolidate clevis and systemd scripts Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 11/13] initramfs-crypt-hook: Increase version Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 12/13] README.tpm2.encryption: Add section to switch from clevis to systemd Quirin Gylstorff
2024-03-22 10:05 ` [cip-dev][isar-cip-core][PATCH v2 13/13] Add example to encrypt the rootfs Quirin Gylstorff
2024-04-08 17:50 ` Jan Kiszka
2024-04-08 17:40 ` [cip-dev][isar-cip-core][PATCH v2 00/13] Rework disk encryption Jan Kiszka
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240322100605.4129226-3-Quirin.Gylstorff@siemens.com \
--to=quirin.gylstorff@siemens.com \
--cc=cip-dev@lists.cip-project.org \
--cc=jan.kiszka@siemens.com \
--cc=johnxw@amazon.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.