/mandos/release

#!/bin/sh -e

# 

# This script will run in the initrd environment at boot and edit

# /conf/conf.d/cryptroot to set /lib/mandos/plugin-runner as keyscript

# when no other keyscript is set, before cryptsetup.

# 

# This script should be installed as

# "/usr/share/initramfs-tools/scripts/init-premount/mandos" which will

# eventually be "/scripts/init-premount/mandos" in the initrd.img

# file.

PREREQ="udev"

prereqs()

{

    echo "$PREREQ"

}

case $1 in

prereqs)

	prereqs

	exit 0

	;;

esac

. /scripts/functions

for param in `cat /proc/cmdline`; do

    case "$param" in

        ip=*) IPOPTS="${param#ip=}" ;;

        mandos=*)

            # Split option line on commas

            old_ifs="$IFS"

            IFS="$IFS,"

            for mpar in ${param#mandos=}; do

                IFS="$old_ifs"

                case "$mpar" in

                    off) exit 0 ;;

		    connect) connect="" ;;

                    connect:*) connect="${mpar#connect:}" ;;

                    *) log_warning_msg "$0: Bad option ${mpar}" ;;

                esac

            done

	    unset mpar

            IFS="$old_ifs"

            unset old_ifs

            ;;

    esac

done

unset param

chmod a=rwxt /tmp

test -r /conf/conf.d/cryptroot

test -w /conf/conf.d

# Get DEVICE from /conf/initramfs.conf and other files

. /conf/initramfs.conf

for conf in /conf/conf.d/*; do

    [ -f ${conf} ] && . ${conf}

done

if [ -e /conf/param.conf ]; then

    . /conf/param.conf

fi

# Override DEVICE from sixth field of ip= kernel option, if passed

case "$IPOPTS" in

    *:*:*:*:*:*)		# At least six fields

        # Remove the first five fields

	device="${IPOPTS#*:*:*:*:*:}"

        # Remove all fields except the first one

	DEVICE="${device%%:*}"

	;;

esac

# Add device setting (if any) to plugin-runner.conf

if [ "${DEVICE+set}" = set ]; then

    # Did we get the device from an ip= option?

    if [ "${device+set}" = set ]; then

	# Let ip= option override local config; append:

	cat <<-EOF >>/conf/conf.d/mandos/plugin-runner.conf

	--options-for=mandos-client:--interface=${DEVICE}

EOF

    else

        # Prepend device setting so any later options would override:

	sed -i -e \

	    '1i--options-for=mandos-client:--interface='"${DEVICE}" \

	    /conf/conf.d/mandos/plugin-runner.conf

    fi

fi

unset device

# If we are connecting directly, run "configure_networking" (from

# /scripts/functions); it needs IPOPTS and DEVICE

if [ "${connect+set}" = set ]; then

    configure_networking

    if [ -n "$connect" ]; then

	cat <<-EOF >>/conf/conf.d/mandos/plugin-runner.conf

	--options-for=mandos-client:--connect=${connect}

EOF

    fi

fi

# Do not replace cryptroot file unless we need to.

replace_cryptroot=no

# Our keyscript

mandos=/lib/mandos/plugin-runner

# parse /conf/conf.d/cryptroot.  Format:

# target=sda2_crypt,source=/dev/sda2,key=none,keyscript=/foo/bar/baz

exec 3>/conf/conf.d/cryptroot.mandos

while read options; do

    newopts=""

    # Split option line on commas

    old_ifs="$IFS"

    IFS="$IFS,"

    for opt in $options; do

	# Find the keyscript option, if any

	case "$opt" in

	    keyscript=*)

		keyscript="${opt#keyscript=}"

		newopts="$newopts,$opt"

		;;

	    "") : ;;

	    *)

		newopts="$newopts,$opt"

		;;

	esac

    done

    IFS="$old_ifs"

    unset old_ifs

    # If there was no keyscript option, add one.

    if [ -z "$keyscript" ]; then

	replace_cryptroot=yes

	newopts="$newopts,keyscript=$mandos"

    fi

    newopts="${newopts#,}"

    echo "$newopts" >&3

done < /conf/conf.d/cryptroot

exec 3>&-

# If we need to, replace the old cryptroot file with the new file.

if [ "$replace_cryptroot" = yes ]; then

    mv /conf/conf.d/cryptroot /conf/conf.d/cryptroot.mandos-old

    mv /conf/conf.d/cryptroot.mandos /conf/conf.d/cryptroot

else

    rm /conf/conf.d/cryptroot.mandos

fi

## Work around Debian bug #633582: <http://bugs.debian.org/633582>

# First determine the mandos user and group ID

mandos_user="65534"

mandos_group="65534"

while read line; do

    line="${line%%#*}"

    TEMP=`getopt --quiet --longoptions userid:,groupid: -- $line`

    eval set -- "$TEMP"

    while true; do

	case "$1" in

	    --userid) mandos_user="$2"; shift 2;;

	    --groupid) mandos_group="$2"; shift 2;;

	    --) shift; break;;

	esac

    done

done < /conf/conf.d/mandos/plugin-runner.conf

chown "${mandos_user}:${mandos_group}" \

    /lib/mandos/plugins.d \

    /conf/conf.d/mandos/pubkey.txt \

    /conf/conf.d/mandos/seckey.txt