July 2012 - Arch-projects - lists.archlinux.org

[arch-projects] [initscripts][RFC] cryptsetup: deprecate old syntax and default to the systemd one
by teg＠jklm.no 03 Aug '12

03 Aug '12

From: Tom Gundersen <teg(a)jklm.no> We detect if the old syntax is used, and if so print a warning and use the old parsing code. Otherwise, we pass everything on to systemd-cryptsetup. Similarly to what was done with the network syntax, we intend to keep the legacy stuff working for a long time. See crypttab(5) for the new syntax[0]. The main reason for this change, is to be closer to what other distros do. The systemd syntax is based on Debian's format, and is essentially what is being used by at least Debian, Ubuntu, Fedora and Suse. Such widespread use means that it will be better documented in non-Arch-specific documentation, and is more likely to see integration with third-party tools. It is also surely appreciated by admins who use more than one distro, that they don't have to know more than one config format for these sorts of basic things. Furthermore, by actually sharing the code with systemd we get to rely on their much more widespread testing and review compared to what we are able to do ourselves. This is particularly important for the encryption code, as it is the most obscure code in initscripts and any bugs in it would have potentially very severe consequences. Lastly, there are a few (albeit minor) issues I see with our current format: /etc/crypttab is not a plaintext file, but needs to be parsed through bash. The (deprecated) embedded passwords have been a source of problems in the past. And, there is no level of abstraction between the crypttab options and cryptsetup, we just pass them on blindly. The new format and the old one cover roughly the same usecases. To the best of my knowledge, the only use-case not (yet) supported by systemd-cryptsetup, is mounting a removable device and reading the key from a file on that device. For this, stick with the old syntax (though be careful, it is inherently racy). [0]: <http://0pointer.de/public/systemd-man/systemd.unit.html> (note that keyfile-offset support is coming in the next systemd version). --- functions | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 58 insertions(+), 4 deletions(-) diff --git a/functions b/functions index 16f8d8f..7fd5258 100644 --- a/functions +++ b/functions @@ -381,12 +381,13 @@ activate_vgs() { (( $? == 0 )) && stat_done || stat_fail } -do_unlock() { +do_unlock_legacy() { # $1 = requested name # $2 = source device # $3 = password # $4 = options stat_append "${1}.." + printf "${C_FAIL}Using legacy crypttab format. This will stop working in the future. See crypttab(5).${C_OTHER}\n" local open=create a=$1 b=$2 failed=0 # Ordering of options is different if you are using LUKS vs. not. # Use ugly swizzling to deal with it. @@ -448,7 +449,6 @@ do_unlock() { /*) cryptsetup -d "$3" $4 $open "$a" "$b" >/dev/null;; *) - printf "${C_FAIL}crypttab contains a literal encryption key. This will stop working in the future.${C_OTHER}\n" echo "$3" | cryptsetup $4 $open "$a" "$b" >/dev/null;; esac if (( $? )); then @@ -460,10 +460,64 @@ do_unlock() { return $failed } +do_unlock_systemd() { + stat_append "${1}.." + local failed=0 + if ! /usr/lib/systemd/systemd-cryptsetup attach "$1" "$2" "$3" $4; then + failed=1 + else + IFS=, + if in_array swap ${options[@]}; then + if ! mkswap /dev/mapper/$name >/dev/null; then + failed=1 + fi + elif in_array tmp ${options[@]}; then + if ! mke2fs /dev/mapper/$name >/dev/null; then + failed=1 + fi + fi + fi + if (( $failed )); then + stat_append "failed " + else + stat_append "ok " + fi + return $failed +} + +do_unlock() { + local name=$1 device=$2 password=$3 options=$4 + + if [[ ${options:0:2} =~ -. ]]; then + do_unlock_legacy "$name" "$device" "$password" "$options" + return $? + fi + + case $password in + ASK|SWAP) + do_unlock_legacy "$name" "$device" "$password" "$options" + ;; + /dev/*) + if [[ ${password##*:} == $password ]]; then + do_unlock_systemd "$name" "$device" "$password" "$options" + else + do_unlock_legacy "$name" "$device" "$password" "$options" + fi + ;; + /*|none|-) + do_unlock_systemd "$name" "$device" "$password" "$options" + ;; + *) + do_unlock_legacy "$name" "$device" "$password" "$options" + ;; + esac + return $? +} + read_crypttab() { # $1 = function to call with the split out line from the crypttab local line nspo failed=0 - while read line; do + while read line <&3; do [[ $line && $line != '#'* ]] || continue eval nspo=("${line%#*}") if $1 "${nspo[0]}" "${nspo[1]}" "${nspo[2]}" "${nspo[*]:3}"; then @@ -471,7 +525,7 @@ read_crypttab() { else failed=1 fi - done < /etc/crypttab + done 3< /etc/crypttab return $failed } -- 1.7.11.1

7 23

[arch-projects] [mkinitcpio][RFC] a better fallback image?
by Tom Gundersen 29 Jul '12

29 Jul '12

Dave, Tobias, Thomas, I just managed to hose one of my machines. It was mainly due to an unfortunate series of events, but I have a suggestion which would have avoided this situation and might beneficial in general. The way things are now, I think the fallback image mkinitcpio generates by default is not very useful. In my experience the fallback image is broken exactly when the regular image is broken. I expect the reason for this is that the autodetection of modules is very good these days, so _that_ is never the problem. When there is a problem, which happens every once in a while, it is either due to user error (i.e. configuration errors), or mkinitcpio not being ran at all (and hence having the modules of the previous kernel (which is what happened to me today). It seems to me that a more useful fallback image, would be one that is generated at compile-time, rather than at install-time, and shipped as a part of the kernel package. This would avoid user errors, and mkinitcpio run-time problems. This fallback image should contain the widest sets of hooks and modules so that it should work on any hardware and any setup (at least to the extent possible with our current hooks). Any thoughts? Cheers, Tom

4 7

[arch-projects] [RFC][PATCH][initscripts] cryptsetup: add keyfile-size= support
by Tom Gundersen 29 Jul '12

29 Jul '12

This is useful e.g. if the keyfile is a raw device, where only parts of it should be read. It is typically used whenever the keyfile-offset= option is specified. --- This patch is compile-tested only, and just meant for gathering feedback. Do you guys agree that this is necessary and sufficient to cover the use-case brought up by Heiko? Cheers, Tom man/crypttab.xml | 11 +++++++++++ src/cryptsetup/cryptsetup.c | 22 +++++++++++++++------- 2 files changed, 26 insertions(+), 7 deletions(-) diff --git a/man/crypttab.xml b/man/crypttab.xml index 2fa8e89..ba3f750 100644 --- a/man/crypttab.xml +++ b/man/crypttab.xml @@ -131,6 +131,17 @@ <varlistentry> + <term><varname>keyfile-size=</varname></term> + + <listitem><para>Specifies the maximum number + of bytes to read from the keyfile; see + <citerefentry><refentrytitle>cryptsetup</refentrytitle><manvolnum>8</manvolnum></citerefentry> + for possible values and the default + value of this option.</para></listitem> + </varlistentry> + + + <varlistentry> <term><varname>keyfile-offset=</varname></term> <listitem><para>Specifies the number diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c index cc30e50..1035ac4 100644 --- a/src/cryptsetup/cryptsetup.c +++ b/src/cryptsetup/cryptsetup.c @@ -37,6 +37,7 @@ static const char *opt_type = NULL; /* LUKS1 or PLAIN */ static char *opt_cipher = NULL; static unsigned opt_key_size = 0; +static unsigned opt_keyfile_size = 0; static unsigned opt_keyfile_offset = 0; static char *opt_hash = NULL; static unsigned opt_tries = 0; @@ -80,6 +81,13 @@ static int parse_one_option(const char *option) { return 0; } + } else if (startswith(option, "keyfile-size=")) { + + if (safe_atou(option+13, &opt_keyfile_offset) < 0) { + log_error("keyfile-size= parse failure, ignoring."); + return 0; + } + } else if (startswith(option, "keyfile-offset=")) { if (safe_atou(option+15, &opt_keyfile_offset) < 0) { @@ -238,7 +246,6 @@ int main(int argc, char *argv[]) { char **passwords = NULL, *truncated_cipher = NULL; const char *cipher = NULL, *cipher_mode = NULL, *hash = NULL, *name = NULL; char *description = NULL, *name_buffer = NULL, *mount_point = NULL; - unsigned keyfile_size = 0; if (argc <= 1) { help(); @@ -437,6 +444,11 @@ int main(int argc, char *argv[]) { zero(params); params.hash = hash; + /* for CRYPT_PLAIN limit reads + * from keyfile to key length, and + * ignore keyfile-size */ + opt_keyfile_size = opt_key_size / 8; + /* In contrast to what the name * crypt_setup() might suggest this * doesn't actually format anything, @@ -448,14 +460,10 @@ int main(int argc, char *argv[]) { cipher_mode, NULL, NULL, - opt_key_size / 8, + opt_keyfile_size, &params); pass_volume_key = streq(hash, "plain"); - - /* for CRYPT_PLAIN limit reads - * from keyfile to key length */ - keyfile_size = opt_key_size / 8; } if (k < 0) { @@ -470,7 +478,7 @@ int main(int argc, char *argv[]) { argv[3]); if (key_file) - k = crypt_activate_by_keyfile_offset(cd, argv[2], CRYPT_ANY_SLOT, key_file, keyfile_size, + k = crypt_activate_by_keyfile_offset(cd, argv[2], CRYPT_ANY_SLOT, key_file, opt_keyfile_size, opt_keyfile_offset, flags); else { char **p; -- 1.7.11.3

2 3

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository annotated tag 0.10 created. 0.10
by dreisner＠archlinux.org 29 Jul '12

29 Jul '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The annotated tag, 0.10 has been created at 7454cde3983060a2ec05b51b35eb58beb233265f (tag) tagging d7951e00f1959abd2a8cdd4c06cf3c44896c6b03 (commit) replaces 0.9.2 tagged by Dave Reisner on Sun Jul 29 11:54:36 2012 -0400 - Log ----------------------------------------------------------------- tag as 0.10 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (GNU/Linux) iQEcBAABAgAGBQJQFVy+AAoJEB6yY4/1bAxTVxcIAJepUYWS0c/I0CUbexB8qpQs c6+l7tSj1p9uuB+V2gCdCieFNoF33/Yufu5BvHwTiFfVsvGIov5rzX7tctHf1wr7 0Ky0ueYISc+gI9cvyS1+oPMbGf8X/7JIZNYPcor72yqfUZtHWV6SIfIFQ7DuS5G0 QLxz6bES7VfdUnTXvKmNyKX16+k9kwNA+e6wpJQXcqWs1VF9/bwHF62gCK6ueAPN VSmwToIZbI9CRvmOGgSeouNCl2KGAhD6xj/oj4jKUyidmdpBXGqKt0icZuWqhFS4 mSDJSW+ExsBExZwAusBRPbwIZbawneR4wfdVaaQ5FMhdClusp5tNvlII7Vcl2T4= =rDUH -----END PGP SIGNATURE----- Brian Parsons (1): Update module filter to be aware of hyphens in the MODULES array Dave Reisner (9): shutdown: don't alert udev on disable VGs add 'strip' install hook use last exit status as default arg for cleanup initalize buildroot later, and out outside of hooks lsinitcpio: comment on why bsdtar alone isn't good enough init_functions: use a consistent default rootdelay implement --moduleroot option mkinitcpio: rename longopt for --add to --addhooks autodetect: fix wrong flag passed to modprobe Tom Gundersen (1): baseroot: add flagfile to indicate we're in an initramfs ----------------------------------------------------------------------- hooks/post-receive -- The official mkinitcpio repository

1 0

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository branch master updated. 0.9.2-11-gd7951e0
by dreisner＠archlinux.org 29 Jul '12

29 Jul '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The branch, master has been updated via d7951e00f1959abd2a8cdd4c06cf3c44896c6b03 (commit) from 434c64cfaa91ae565c995691b1c71a4d007c6da8 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit d7951e00f1959abd2a8cdd4c06cf3c44896c6b03 Author: Dave Reisner <dreisner(a)archlinux.org> Date: Sun Jul 29 11:49:46 2012 -0400 autodetect: fix wrong flag passed to modprobe Signed-off-by: Dave Reisner <dreisner(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: install/autodetect | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) hooks/post-receive -- The official mkinitcpio repository

1 0

[arch-projects] [initscripts] [GIT] Arch Linux initscripts repository branch master updated. 2012.07.5-6-gad6100d
by tomegun＠archlinux.org 29 Jul '12

29 Jul '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "Arch Linux initscripts repository". The branch, master has been updated via ad6100d47b2d5337d1645e946de6f450dc990ff8 (commit) from ecdcf3795e88c8e6a2c39321d8164798ba652df6 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit ad6100d47b2d5337d1645e946de6f450dc990ff8 Author: Tom Gundersen <teg(a)jklm.no> Date: Sun Jul 29 03:32:56 2012 +0200 rc-local-shutdown.service: don't conflict with shutdown.target Reported-by: Oded Signed-off-by: Tom Gundersen <teg(a)jklm.no> ----------------------------------------------------------------------- Summary of changes: rc-local-shutdown.service | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) hooks/post-receive -- Arch Linux initscripts repository

1 0

[arch-projects] [initscripts][PATCH 2/2] archlinux man page: fix vconcole man page reference
by Eric Bélanger 28 Jul '12

28 Jul '12

Fixes FS#30891 Signed-off-by: Eric Bélanger <snowmaniscool(a)gmail.com> --- archlinux.7.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/archlinux.7.txt b/archlinux.7.txt index 0c6dd8e..b24bd83 100644 --- a/archlinux.7.txt +++ b/archlinux.7.txt @@ -72,7 +72,7 @@ and modules to be blacklisted from auto-loading can be configured in /etc/modpro SEE ALSO -------- -rc.conf(5), hostname(5), hosts(5), nsswitch.conf(5), locale.conf(5), vconsole(5), timezone(3), hwclock(8), fstab(5), crypttab(5), +rc.conf(5), hostname(5), hosts(5), nsswitch.conf(5), locale.conf(5), vconsole.conf(5), timezone(3), hwclock(8), fstab(5), crypttab(5), mkinitcpio(8), pacman(8), pacman.conf(5), grub-mkconfig(8), syslinux(1), modules-load.d(5), modprobe.d(5) AUTHORS -- 1.7.11.3

2 1

[arch-projects] [initscripts] typo in archlinux man page
by Eric Fernandez 28 Jul '12

28 Jul '12

Hi, There is a typo in the locale section of the archlinux man page: LOCALIZATION[[L]] ----------------- Various locales may be enabled in /etc/locale-gen, Should be: LOCALIZATION[[L]] ----------------- Various locales may be enabled in /etc/locale.gen, Cheers, Zeb

2 1

[arch-projects] [initscripts] [GIT] Arch Linux initscripts repository branch master updated. 2012.07.5-5-gecdcf37
by tomegun＠archlinux.org 28 Jul '12

28 Jul '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "Arch Linux initscripts repository". The branch, master has been updated via ecdcf3795e88c8e6a2c39321d8164798ba652df6 (commit) via 7bd46175a82a4eb87ea8b1b9bfe706435c5d232f (commit) from f670511763a05ac5ef688d335187ac1ccabf0487 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit ecdcf3795e88c8e6a2c39321d8164798ba652df6 Author: Tom Gundersen <teg(a)jklm.no> Date: Sat Jul 28 23:26:03 2012 +0200 man: archlinux typo Reported-by: Eric Fernandez <zebcom(a)zebulon.org.uk> Signed-off-by: Tom Gundersen <teg(a)jklm.no> commit 7bd46175a82a4eb87ea8b1b9bfe706435c5d232f Author: Eric Bélanger <snowmaniscool(a)gmail.com> Date: Sat Jul 28 17:23:02 2012 -0400 archlinux man page: fix vconcole man page reference Fixes FS#30891 Signed-off-by: Eric Bélanger <snowmaniscool(a)gmail.com> ----------------------------------------------------------------------- Summary of changes: archlinux.7.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) hooks/post-receive -- Arch Linux initscripts repository

1 0

[arch-projects] [mkinitcpio] [GIT] The official mkinitcpio repository branch master updated. 0.9.2-10-g434c64c
by dreisner＠archlinux.org 28 Jul '12

28 Jul '12

This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "The official mkinitcpio repository". The branch, master has been updated via 434c64cfaa91ae565c995691b1c71a4d007c6da8 (commit) via 6a585950c5a014c35e449861b6b2040dca2d2516 (commit) from b8459a2ac067b05925d660fdf2b62855eae544da (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 434c64cfaa91ae565c995691b1c71a4d007c6da8 Author: Dave Reisner <dreisner(a)archlinux.org> Date: Sat Jul 28 12:40:58 2012 -0400 mkinitcpio: rename longopt for --add to --addhooks Rename this option so that it mirrors the longopt name for -S, --skiphooks. The original --add option remains behind in the option parser for backwards compatability, but no other references remain. Signed-off-by: Dave Reisner <dreisner(a)archlinux.org> commit 6a585950c5a014c35e449861b6b2040dca2d2516 Author: Dave Reisner <dreisner(a)archlinux.org> Date: Fri Jul 27 23:52:02 2012 -0400 implement --moduleroot option This might be useful for creating an initramfs image as part of a kernel package. Signed-off-by: Dave Reisner <dreisner(a)archlinux.org> ----------------------------------------------------------------------- Summary of changes: bash-completion | 8 ++++---- functions | 4 ++-- install/autodetect | 2 +- mkinitcpio | 22 +++++++++++++--------- mkinitcpio.8.txt | 5 ++++- 5 files changed, 24 insertions(+), 17 deletions(-) hooks/post-receive -- The official mkinitcpio repository

1 0