/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to initramfs-tools-script

  • Committer: Teddy Hogeborn
  • Date: 2017-08-20 14:14:14 UTC
  • mto: (237.7.594 trunk)
  • mto: This revision was merged to the branch mainline in revision 360.
  • Revision ID: teddy@recompile.se-20170820141414-m034xuebg7ccaeui
Add some more restrictions to the systemd service file.

* mandos.service ([Service]/ProtectKernelTunables): New; set to "yes".
  ([Service]/ProtectControlGroups): - '' -

Show diffs side-by-side

added added

removed removed

Lines of Context:
initramfs-tools-script
10
10
# eventually be "/scripts/init-premount/mandos" in the initrd.img
11
11
# file.
12
12
 
13
 
# No initramfs pre-requirements.
14
13
PREREQ="udev"
15
14
prereqs()
16
15
{
58
57
# Get DEVICE from /conf/initramfs.conf and other files
59
58
. /conf/initramfs.conf
60
59
for conf in /conf/conf.d/*; do
61
 
    [ -f ${conf} ] && . ${conf}
 
60
    [ -f "${conf}" ] && . "${conf}"
62
61
done
63
62
if [ -e /conf/param.conf ]; then
64
63
    . /conf/param.conf
95
94
# If we are connecting directly, run "configure_networking" (from
96
95
# /scripts/functions); it needs IPOPTS and DEVICE
97
96
if [ "${connect+set}" = set ]; then
 
97
    set +e                      # Required by library functions
98
98
    configure_networking
 
99
    set -e
99
100
    if [ -n "$connect" ]; then
100
101
        cat <<-EOF >>/conf/conf.d/mandos/plugin-runner.conf
101
102
        
109
110
 
110
111
# Our keyscript
111
112
mandos=/lib/mandos/plugin-runner
 
113
test -x "$mandos"
112
114
 
113
115
# parse /conf/conf.d/cryptroot.  Format:
114
116
# target=sda2_crypt,source=/dev/sda2,key=none,keyscript=/foo/bar/baz
115
117
exec 3>/conf/conf.d/cryptroot.mandos
116
 
while read options; do
 
118
while read -r options; do
117
119
    newopts=""
118
120
    # Split option line on commas
119
121
    old_ifs="$IFS"