/mandos/trunk

#!/bin/sh -e

# 

# This script will run in the initrd environment at boot and edit

# /conf/conf.d/cryptroot to set /lib/mandos/plugin-runner as keyscript

# when no other keyscript is set, before cryptsetup.

# 

# This script should be installed as

# "/usr/share/initramfs-tools/scripts/init-premount/mandos" which will

# eventually be "/scripts/init-premount/mandos" in the initrd.img

# file.

PREREQ="udev"

prereqs()

{

    echo "$PREREQ"

}

case $1 in

prereqs)

	prereqs

	exit 0

	;;

esac

. /scripts/functions

for param in `cat /proc/cmdline`; do

    case "$param" in

        ip=*) IPOPTS="${param#ip=}" ;;

        mandos=*)

            # Split option line on commas

            old_ifs="$IFS"

            IFS="$IFS,"

            for mpar in ${param#mandos=}; do

                IFS="$old_ifs"

                case "$mpar" in

                    off) exit 0 ;;

		    connect) connect="" ;;

                    connect:*) connect="${mpar#connect:}" ;;

                    *) log_warning_msg "$0: Bad option ${mpar}" ;;

                esac

            done

	    unset mpar

            IFS="$old_ifs"

            unset old_ifs

            ;;

    esac

done

unset param

chmod a=rwxt /tmp

# Get DEVICE from /conf/initramfs.conf and other files

. /conf/initramfs.conf

for conf in /conf/conf.d/*; do

    [ -f "${conf}" ] && . "${conf}"

done

if [ -e /conf/param.conf ]; then

    . /conf/param.conf

fi

# Override DEVICE from sixth field of ip= kernel option, if passed

case "$IPOPTS" in

    *:*:*:*:*:*)		# At least six fields

        # Remove the first five fields

	device="${IPOPTS#*:*:*:*:*:}"

        # Remove all fields except the first one

	DEVICE="${device%%:*}"

	;;

esac

# Add device setting (if any) to plugin-runner.conf

if [ "${DEVICE+set}" = set ]; then

    # Did we get the device from an ip= option?

    if [ "${device+set}" = set ]; then

	# Let ip= option override local config; append:

	cat <<-EOF >>/conf/conf.d/mandos/plugin-runner.conf

	--options-for=mandos-client:--interface=${DEVICE}

EOF

    else

        # Prepend device setting so any later options would override:

	sed -i -e \

	    '1i--options-for=mandos-client:--interface='"${DEVICE}" \

	    /conf/conf.d/mandos/plugin-runner.conf

    fi

fi

unset device

# If we are connecting directly, run "configure_networking" (from

# /scripts/functions); it needs IPOPTS and DEVICE

if [ "${connect+set}" = set ]; then

    set +e			# Required by library functions

    configure_networking

    set -e

    if [ -n "$connect" ]; then

	cat <<-EOF >>/conf/conf.d/mandos/plugin-runner.conf

	--options-for=mandos-client:--connect=${connect}

EOF

    fi

fi

if [ -r /conf/conf.d/cryptroot ]; then

    test -w /conf/conf.d

    # Do not replace cryptroot file unless we need to.

    replace_cryptroot=no

    # Our keyscript

    mandos=/lib/mandos/plugin-runner

    test -x "$mandos"

    # parse /conf/conf.d/cryptroot.  Format:

    # target=sda2_crypt,source=/dev/sda2,rootdev,key=none,keyscript=/foo/bar/baz

    # Is the root device specially marked?

    changeall=yes

    while read -r options; do

	case "$options" in

	    rootdev,*|*,rootdev,*|*,rootdev)

		# If the root device is specially marked, don't change all

		# lines in crypttab by default.

		changeall=no

		;;

	esac

    done < /conf/conf.d/cryptroot

    exec 3>/conf/conf.d/cryptroot.mandos

    while read -r options; do

	newopts=""

	keyscript=""

	changethis="$changeall"

	# Split option line on commas

	old_ifs="$IFS"

	IFS="$IFS,"

	for opt in $options; do

	    # Find the keyscript option, if any

	    case "$opt" in

		keyscript=*)

		    keyscript="${opt#keyscript=}"

		    newopts="$newopts,$opt"

		    ;;

		"") : ;;

		# Always use Mandos on the root device, if marked

		rootdev)

		    changethis=yes

		    newopts="$newopts,$opt"

		    ;;

		# Don't use Mandos on resume device, if marked

		resumedev)

		    changethis=no

		    newopts="$newopts,$opt"

		    ;;

		*)

		    newopts="$newopts,$opt"

		    ;;

	    esac

	done

	IFS="$old_ifs"

	unset old_ifs

	# If there was no keyscript option, add one.

	if [ "$changethis" = yes ] && [ -z "$keyscript" ]; then

	    replace_cryptroot=yes

	    newopts="$newopts,keyscript=$mandos"

	fi

	newopts="${newopts#,}"

	echo "$newopts" >&3

    done < /conf/conf.d/cryptroot

    exec 3>&-

    # If we need to, replace the old cryptroot file with the new file.

    if [ "$replace_cryptroot" = yes ]; then

	mv /conf/conf.d/cryptroot /conf/conf.d/cryptroot.mandos-old

	mv /conf/conf.d/cryptroot.mandos /conf/conf.d/cryptroot

    else

	rm -f /conf/conf.d/cryptroot.mandos

    fi

elif [ -x /usr/bin/cryptroot-unlock ]; then

    # Use setsid if available

    if command -v setsid >/dev/null 2>&1; then

	setsid /lib/mandos/mandos-to-cryptroot-unlock &

    else

	/lib/mandos/mandos-to-cryptroot-unlock &

    fi

fi