From 0f7a4f49a7ce95e87061afe03ac40662a1eb0e2d Mon Sep 17 00:00:00 2001

From: shinygold <10763595+shinygold@users.noreply.github.com>

Date: Tue, 16 Jul 2019 13:06:16 +0200

Subject: [PATCH] cryptsetup: add keyfile-timeout to allow a keydev timeout and

 allow to fallback to a password if it fails.

(cherry picked from commit 50d2eba27b9bfc77ef6b40e5721713846815418b)

Resolves: #1763155

---

 src/cryptsetup/cryptsetup-generator.c | 119 ++++++++++++++++++--------

 src/cryptsetup/cryptsetup.c           |   5 +-

 2 files changed, 89 insertions(+), 35 deletions(-)

diff --git a/src/cryptsetup/cryptsetup-generator.c b/src/cryptsetup/cryptsetup-generator.c

index 52c1262728..1e8e3ba00d 100644

--- a/src/cryptsetup/cryptsetup-generator.c

+++ b/src/cryptsetup/cryptsetup-generator.c

@@ -40,10 +40,39 @@ static Hashmap *arg_disks = NULL;

 static char *arg_default_options = NULL;

 static char *arg_default_keyfile = NULL;

-static int generate_keydev_mount(const char *name, const char *keydev, char **unit, char **mount) {

-        _cleanup_free_ char *u = NULL, *what = NULL, *where = NULL, *name_escaped = NULL;

+static int split_keyspec(const char *keyspec, char **keyfile, char **keydev) {

+        _cleanup_free_ char *kfile = NULL, *kdev = NULL;

+        char *c;

+

+        assert(keyspec);

+        assert(keyfile);

+        assert(keydev);

+

+        c = strrchr(keyspec, ':');

+        if (c) {

+                kfile = strndup(keyspec, c-keyspec);

+                kdev = strdup(c + 1);

+                if (!*kfile || !*kdev)

+                        return log_oom();

+        } else {

+                /* No keydev specified */

+                kfile = strdup(keyspec);

+                kdev = NULL;

+                if (!*kfile)

+                        return log_oom();

+        }

+

+        *keyfile = TAKE_PTR(kfile);

+        *keydev = TAKE_PTR(kdev);

+

+        return 0;

+}

+

+static int generate_keydev_mount(const char *name, const char *keydev, const char *keydev_timeout, bool canfail, char **unit, char **mount) {

+        _cleanup_free_ char *u = NULL, *what = NULL, *where = NULL, *name_escaped = NULL, *device_unit = NULL;

         _cleanup_fclose_ FILE *f = NULL;

         int r;

+        usec_t timeout_us;

         assert(name);

         assert(keydev);

@@ -88,7 +117,25 @@ static int generate_keydev_mount(const char *name, const char *keydev, char **un

                 "[Mount]\n"

                 "What=%s\n"

                 "Where=%s\n"

-                "Options=ro\n", what, where);

+                "Options=ro%s\n", what, where, canfail ? ",nofail" : "");

+

+        if (keydev_timeout) {

+                r = parse_sec_fix_0(keydev_timeout, &timeout_us);

+                if (r >= 0) {

+                        r = unit_name_from_path(what, ".device", &device_unit);

+                        if (r < 0)

+                                return log_error_errno(r, "Failed to generate unit name: %m");

+

+                        r = write_drop_in_format(arg_dest, device_unit, 90, "device-timeout",

+                                "# Automatically generated by systemd-cryptsetup-generator \n\n"

+                                "[Unit]\nJobRunningTimeoutSec=%s", keydev_timeout);

+                        if (r < 0)

+                                return log_error_errno(r, "Failed to write device drop-in: %m");

+

+                } else

+                        log_warning_errno(r, "Failed to parse %s, ignoring: %m", keydev_timeout);

+

+        }

         r = fflush_and_check(f);

         if (r < 0)

@@ -103,16 +150,17 @@ static int generate_keydev_mount(const char *name, const char *keydev, char **un

 static int create_disk(

                 const char *name,

                 const char *device,

-                const char *keydev,

                 const char *password,

+                const char *keydev,

                 const char *options) {

         _cleanup_free_ char *n = NULL, *d = NULL, *u = NULL, *e = NULL,

-                *filtered = NULL, *u_escaped = NULL, *password_escaped = NULL, *filtered_escaped = NULL, *name_escaped = NULL, *keydev_mount = NULL;

+                *keydev_mount = NULL, *keyfile_timeout_value = NULL, *password_escaped = NULL,

+                *filtered = NULL, *u_escaped = NULL, *filtered_escaped = NULL, *name_escaped = NULL;

         _cleanup_fclose_ FILE *f = NULL;

         const char *dmname;

         bool noauto, nofail, tmp, swap, netdev;

-        int r;

+        int r, keyfile_can_timeout;

         assert(name);

         assert(device);

@@ -123,6 +171,10 @@ static int create_disk(

         swap = fstab_test_option(options, "swap\0");

         netdev = fstab_test_option(options, "_netdev\0");

+        keyfile_can_timeout = fstab_filter_options(options, "keyfile-timeout\0", NULL, &keyfile_timeout_value, NULL);

+        if (keyfile_can_timeout < 0)

+                return log_error_errno(keyfile_can_timeout, "Failed to parse keyfile-timeout= option value: %m");

+

         if (tmp && swap) {

                 log_error("Device '%s' cannot be both 'tmp' and 'swap'. Ignoring.", name);

                 return -EINVAL;

@@ -152,12 +204,6 @@ static int create_disk(

         if (r < 0)

                 return log_error_errno(r, "Failed to generate unit name: %m");

-        if (password) {

-                password_escaped = specifier_escape(password);

-                if (!password_escaped)

-                        return log_oom();

-        }

-

         if (keydev && !password) {

                 log_error("Key device is specified, but path to the password file is missing.");

                 return -EINVAL;

@@ -178,10 +224,16 @@ static int create_disk(

                 "After=%s\n",

                 netdev ? "remote-fs-pre.target" : "cryptsetup-pre.target");

+        if (password) {

+                password_escaped = specifier_escape(password);

+                if (!password_escaped)

+                        return log_oom();

+        }

+

         if (keydev) {

                 _cleanup_free_ char *unit = NULL, *p = NULL;

-                r = generate_keydev_mount(name, keydev, &unit, &keydev_mount);

+                r = generate_keydev_mount(name, keydev, keyfile_timeout_value, keyfile_can_timeout > 0, &unit, &keydev_mount);

                 if (r < 0)

                         return log_error_errno(r, "Failed to generate keydev mount unit: %m");

@@ -190,6 +242,12 @@ static int create_disk(

                         return log_oom();

                 free_and_replace(password_escaped, p);

+

+                fprintf(f, "After=%s\n", unit);

+                if (keyfile_can_timeout > 0)

+                        fprintf(f, "Wants=%s\n", unit);

+                else

+                        fprintf(f, "Requires=%s\n", unit);

         }

         if (!nofail)

@@ -197,7 +255,7 @@ static int create_disk(

                         "Before=%s\n",

                         netdev ? "remote-cryptsetup.target" : "cryptsetup.target");

-        if (password) {

+        if (password && !keydev) {

                 if (STR_IN_SET(password, "/dev/urandom", "/dev/random", "/dev/hw_random"))

                         fputs("After=systemd-random-seed.service\n", f);

                 else if (!STR_IN_SET(password, "-", "none")) {

@@ -271,7 +329,7 @@ static int create_disk(

         if (keydev)

                 fprintf(f,

-                        "ExecStartPost=" UMOUNT_PATH " %s\n\n",

+                        "ExecStartPost=-" UMOUNT_PATH " %s\n\n",

                         keydev_mount);

         r = fflush_and_check(f);

@@ -394,7 +452,6 @@ static int parse_proc_cmdline_item(const char *key, const char *value, void *dat

         } else if (streq(key, "luks.key")) {

                 size_t n;

                 _cleanup_free_ char *keyfile = NULL, *keydev = NULL;

-                char *c;

                 const char *keyspec;

                 if (proc_cmdline_value_missing(key, value))

@@ -421,23 +478,13 @@ static int parse_proc_cmdline_item(const char *key, const char *value, void *dat

                         return log_oom();

                 keyspec = value + n + 1;

-                c = strrchr(keyspec, ':');

-                if (c) {

-                         *c = '\0';

-                        keyfile = strdup(keyspec);

-                        keydev = strdup(c + 1);

-

-                        if (!keyfile || !keydev)

-                                return log_oom();

-                } else {

-                        /* No keydev specified */

-                        keyfile = strdup(keyspec);

-                        if (!keyfile)

-                                return log_oom();

-                }

+                r = split_keyspec(keyspec, &keyfile, &keydev);

+                if (r < 0)

+                        return r;

                 free_and_replace(d->keyfile, keyfile);

                 free_and_replace(d->keydev, keydev);

+

         } else if (streq(key, "luks.name")) {

                 if (proc_cmdline_value_missing(key, value))

@@ -485,7 +532,7 @@ static int add_crypttab_devices(void) {

                 int r, k;

                 char line[LINE_MAX], *l, *uuid;

                 crypto_device *d = NULL;

-                _cleanup_free_ char *name = NULL, *device = NULL, *keyfile = NULL, *options = NULL;

+                _cleanup_free_ char *name = NULL, *device = NULL, *keydev = NULL, *keyfile = NULL, *keyspec = NULL, *options = NULL;

                 if (!fgets(line, sizeof(line), f))

                         break;

@@ -496,7 +543,7 @@ static int add_crypttab_devices(void) {

                 if (IN_SET(*l, 0, '#'))

                         continue;

-                k = sscanf(l, "%ms %ms %ms %ms", &name, &device, &keyfile, &options);

+                k = sscanf(l, "%ms %ms %ms %ms", &name, &device, &keyspec, &options);

                 if (k < 2 || k > 4) {

                         log_error("Failed to parse /etc/crypttab:%u, ignoring.", crypttab_line);

                         continue;

@@ -515,7 +562,11 @@ static int add_crypttab_devices(void) {

                         continue;

                 }

-                r = create_disk(name, device, NULL, keyfile, (d && d->options) ? d->options : options);

+                r = split_keyspec(keyspec, &keyfile, &keydev);

+                if (r < 0)

+                        return r;

+

+                r = create_disk(name, device, keyfile, keydev, (d && d->options) ? d->options : options);

                 if (r < 0)

                         return r;

@@ -555,7 +606,7 @@ static int add_proc_cmdline_devices(void) {

                 else

                         options = "timeout=0";

-                r = create_disk(d->name, device, d->keydev, d->keyfile ?: arg_default_keyfile, options);

+                r = create_disk(d->name, device, d->keyfile ?: arg_default_keyfile, d->keydev, options);

                 if (r < 0)

                         return r;

         }

diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c

index 9071126c2e..0881aea915 100644

--- a/src/cryptsetup/cryptsetup.c

+++ b/src/cryptsetup/cryptsetup.c

@@ -69,7 +69,10 @@ static int parse_one_option(const char *option) {

         assert(option);

         /* Handled outside of this tool */

-        if (STR_IN_SET(option, "noauto", "auto", "nofail", "fail", "_netdev"))

+        if (STR_IN_SET(option, "noauto", "auto", "nofail", "fail", "_netdev", "keyfile-timeout"))

+                return 0;

+

+        if (startswith(option, "keyfile-timeout="))

                 return 0;

         if ((val = startswith(option, "cipher="))) {