[PATCH] rc.S: interactive password prompt for LUKS devices with options in /etc/crypttab

.Lightning · 04-29-2016, 06:14 AM

damn, I haven't been here for a looong time ...

first in my life I am dealing with dmcrypt/cryptsetup/LUKS and while reading how rc.S handles /etc/crypttab I noticed that it's not possible to pass luksOpen-options to a volume while being interactively asked for a decryption password during boot.

according to https://www.freedesktop.org/software.../crypttab.html a "-" should be in place (field 3) to achieve this behaviour but Slackware's rc.S (-current 2016-04-25) doesn't honor this (yet). [see patch attached]

additionally all options but "ro" and "swap" are ignored entirely; is this intentional? (if not, I'll write a patch for this too

)

and one more thing:

Code:

cat /etc/crypttab | grep -v "^#" | grep -v "^$" | while read line; do

is found in rc.S and rc.6; is there a reason why this isn't the imho better code:

Code:

grep -v -e "^#" -e"^$" /etc/crypttab | while read line; do

conraid · 04-29-2016, 07:45 AM

Quote:

Originally Posted by .Lightning

damn, I haven't been here for a looong time ...

first in my life I am dealing with dmcrypt/cryptsetup/LUKS and while reading how rc.S handles /etc/crypttab I noticed that it's not possible to pass luksOpen-options to a volume while being interactively asked for a decryption password during boot.

according to https://www.freedesktop.org/software.../crypttab.html a "-" should be in place (field 3) to achieve this behaviour but Slackware's rc.S (-current 2016-04-25) doesn't honor this (yet). [see patch attached]

additionally all options but "ro" and "swap" are ignored entirely; is this intentional? (if not, I'll write a patch for this too

)

and one more thing:

Code:

cat /etc/crypttab | grep -v "^#" | grep -v "^$" | while read line; do

is found in rc.S and rc.6; is there a reason why this isn't the imho better code:

Code:

grep -v -e "^#" -e"^$" /etc/crypttab | while read line; do

I sent this patch to Pat time ago, maybe it doesn't arrived. I don't know.
https://github.com/conraid/personal/...hes/rc.S.patch
but it's only for discard option.

Alien Bob · 04-29-2016, 08:12 AM

Do not assume that there is any similarity between the crypttab file format used by systemd and/or other distros, and the file with the same name in Slackware. Its format is not standardized.

conraid · 04-29-2016, 08:22 AM

Quote:

Originally Posted by Alien Bob

Do not assume that there is any similarity between the crypttab file format used by systemd and/or other distros, and the file with the same name in Slackware. Its format is not standardized.

Yes, I know, but a way for add options imho it would be good.
Although Slackware users should know how to do it yourself

.Lightning · 04-29-2016, 08:25 AM

Quote:

Originally Posted by Alien Bob

Do not assume that there is any similarity between the crypttab file format used by systemd and/or other distros, and the file with the same name in Slackware. Its format is not standardized.

well, that's right, but I think that doesn't really matter (in my case).

slackware64-current/README_CRYPT.TXT states the file format as:

Quote:

The file '/etc/crypttab' contains lines of the format: "mappedname devicename password options".

I felt free to take the dash as symbol for "ask for password", of course something like "nopasswd", "ask", "stdin" could be used as well (but this would prevent these words from being taken as a literal password for your crypto volume). I don't really care about WHICH method makes this possible as long as there is one

.

additionally I think that the possibility of passing options to cryptsetup is important and/or necessary (especially for things like "--allow-discards", "--keyfile-offset" or "--keyfile-size").

GazL · 04-29-2016, 08:50 AM

Quote:

Originally Posted by .Lightning

...
I felt free to take the dash as symbol for "ask for password", of course something like "nopasswd", "ask", "stdin" could be used as well (but this would prevent these words from being taken as a literal password for your crypto volume). I don't really care about WHICH method makes this possible as long as there is one

.

additionally I think that the possibility of passing options to cryptsetup is important and/or necessary (especially for things like "--allow-discards", "--keyfile-offset" or "--keyfile-size").

I wrote a rc.cryptsetup sometime last year which does much of what you describe above. I posted it on the forum and Eric made some positive comments at the time, but nothing more came of it.

In my version, a passphrase specified as either "none" or "-" will solicit the user to provide it. Passphrases can optionally be single or double quoted and contain spaces or other punctuations, and swap is identified by the option 'swap' and ignores the passphrase field. It also supports some of the newer cryptsetup options you mentioned.

The biggest change of course was that I separated it out into its own rc file that rc.S should call.

Anyway, attached below (NO WARRANTY PROVIDED), once again, for anyone who may be interested...

.Lightning · 04-29-2016, 09:00 AM

Quote:

Originally Posted by GazL

I wrote a rc.cryptsetup sometime last year which does much of what you describe above. I posted it on the forum and Eric made some positive comments at the time, but nothing more came of it.

In my version, a passphrase specified as either "none" or "-" will solicit the user to provide it. Passphrases can optionally be single or double quoted and contain spaces or other punctuations, and swap is identified by the option 'swap' and ignores the passphrase field. It also supports some of the newer cryptsetup options you mentioned.

The biggest change of course was that I separated it out into its own rc file that rc.S should call.

Anyway, attached below (NO WARRANTY PROVIDED), once again, for anyone who may be interested...

hehe, I had the same idea about half an hour ago and started writing one myself

I'll have a look at yours and might come back with some ideas, maybe we'll get Eric to integrate it with united powers

GazL · 04-29-2016, 09:42 AM

Quote:

Originally Posted by .Lightning

hehe, I had the same idea about half an hour ago and started writing one myself

I'll have a look at yours and might come back with some ideas, maybe we'll get Eric to integrate it with united powers

That's a decision for Pat, not Eric, but unlikely to happen during the 'Release Candidate' stage of development now. As it stands I believe the script is pretty much complete but I lost enthusiasm for the project when it seemed to fall on deaf ears. Feel free to take it and do with it what you will however.