From: Matthew Monaco
I worked with Dave and Tom this past weekend to clean up and enhance
encrypted volume handling. There are quite a few "patches" here, and
more to come against initscripts. All of this fixes a handful of bugs,
adds new features, does some refactoring.
In summary, I wrote a new package called 'cryptmount.' The intention is
for it to depend on cryptsetup and to provide the encrypt hooks for
mkinitcpio. Additionally initscripts will depend on cryptmount
(optdepends will work too).
The cryptmount code is here [1] and the initscripts changes are here
[2].
There are a few goals:
1) Use the same code for the mkinitcpio encrypt hook and initscripts.
2) Allow for interoperability with systemd's crypttab format.
This is accomplished without any forced changes on the user (with the
exception of plaintext passwords in crypttab).
3) Allow the random seed to be restored before doing things like setting
up a swap volume which uses /dev/urandom as a password.
4) If possible, allow for encrypted /usr from the initrd. This depends
on Dave's working branch of mkinitcpio which provides late hooks (and
cleanup hooks).
*5*) Do not drop support for current configurations. This is important.
The only thing that is dropped is storing a plain text password in
crypttab. Whether your options line in crypttab is literally for
cryptsetup (--size=100 --cipher=...) or a comma separated list
(size=100,cipher=...), your configuration will be supported.
That said, if you see any holes in this statement, please let me know
and I will address it.
This addresses the following bugs, there may be more, and you may
question that it does for some of these:
FS#17131 - Restore random seed before using decryption
FS#24700 - Allow UUID for cryptdevice
In addition we support UUID,PARTUUID,LABEL for both the
encrypted device AND the passphrase if it is on an external
device.
FS#27137 - I think a dup of the above.
FS#23182 - Multiple device support for the initrd
The encrypt hook included supports root, /usr, and an
arbitrary number of encrypted mappings.
FS#15738 - More or less similar to above
FS#21936 - Don't immediately revert to interactive pw if key device is
not available.
All devices are resolved and waited on IFF udevd is running.
This goes for the initrd and rc.sysinit.
FS#21198 - Mount key devices if needed.
This is done whenever the key is a file on another device and
that device is not already mounted.
FS#21513 - Provide a man page for crypttab.
I wrote one and for cryptmount.
I have been testing this for the past week, but I'm sure there are some
bugs. Please report any problems you see (or experience if you are able
to test). Also, if you see an opportunity for improvements in
efficiency, cleanup, or additional functionality, let me know.
[1] https://github.com/mmonaco/cryptmount/tree/master
[2] https://github.com/mmonaco/initscripts/tree/crypto
--
1.7.10.2