/mandos/trunk

#!/bin/sh -e

# 

# This script will run in the initrd environment at boot and edit

# /conf/conf.d/cryptroot to set /lib/mandos/plugin-runner as keyscript

# when no other keyscript is set, before cryptsetup.

# 

# This script should be installed as

# "/usr/share/initramfs-tools/scripts/init-premount/mandos" which will

# eventually be "/scripts/init-premount/mandos" in the initrd.img

# file.

PREREQ="udev"

prereqs()

{

    echo "$PREREQ"

}

case $1 in

prereqs)

	prereqs

	exit 0

	;;

esac

. /scripts/functions

for param in `cat /proc/cmdline`; do

    case "$param" in

        ip=*) IPOPTS="${param#ip=}" ;;

        mandos=*)

            # Split option line on commas

            old_ifs="$IFS"

            IFS="$IFS,"

            for mpar in ${param#mandos=}; do

                IFS="$old_ifs"

                case "$mpar" in

                    off) exit 0 ;;

		    connect) connect="" ;;

                    connect:*) connect="${mpar#connect:}" ;;

                    *) log_warning_msg "$0: Bad option ${mpar}" ;;

                esac

            done

	    unset mpar

            IFS="$old_ifs"

            unset old_ifs

            ;;

    esac

done

unset param

chmod a=rwxt /tmp

test -r /conf/conf.d/cryptroot

test -w /conf/conf.d

# Get DEVICE from /conf/initramfs.conf and other files

. /conf/initramfs.conf

for conf in /conf/conf.d/*; do

    [ -f "${conf}" ] && . "${conf}"

done

if [ -e /conf/param.conf ]; then

    . /conf/param.conf

fi

# Override DEVICE from sixth field of ip= kernel option, if passed

case "$IPOPTS" in

    *:*:*:*:*:*)		# At least six fields

        # Remove the first five fields

	device="${IPOPTS#*:*:*:*:*:}"

        # Remove all fields except the first one

	DEVICE="${device%%:*}"

	;;

esac

# Add device setting (if any) to plugin-runner.conf

if [ "${DEVICE+set}" = set ]; then

    # Did we get the device from an ip= option?

    if [ "${device+set}" = set ]; then

	# Let ip= option override local config; append:

	cat <<-EOF >>/conf/conf.d/mandos/plugin-runner.conf

	--options-for=mandos-client:--interface=${DEVICE}

EOF

    else

        # Prepend device setting so any later options would override:

	sed -i -e \

	    '1i--options-for=mandos-client:--interface='"${DEVICE}" \

	    /conf/conf.d/mandos/plugin-runner.conf

    fi

fi

unset device

# If we are connecting directly, run "configure_networking" (from

# /scripts/functions); it needs IPOPTS and DEVICE

if [ "${connect+set}" = set ]; then

    set +e			# Required by library functions

    configure_networking

    set -e

    if [ -n "$connect" ]; then

	cat <<-EOF >>/conf/conf.d/mandos/plugin-runner.conf

	--options-for=mandos-client:--connect=${connect}

EOF

    fi

fi

# Do not replace cryptroot file unless we need to.

replace_cryptroot=no

# Our keyscript

mandos=/lib/mandos/plugin-runner

test -x "$mandos"

# parse /conf/conf.d/cryptroot.  Format:

# target=sda2_crypt,source=/dev/sda2,rootdev,key=none,keyscript=/foo/bar/baz

# Is the root device specially marked?

changeall=yes

while read -r options; do

    case "$options" in

	rootdev,*|*,rootdev,*|*,rootdev)

	    # If the root device is specially marked, don't change all

	    # lines in crypttab by default.

	    changeall=no

	    ;;

    esac

done < /conf/conf.d/cryptroot

exec 3>/conf/conf.d/cryptroot.mandos

while read -r options; do

    newopts=""

    keyscript=""

    changethis="$changeall"

    # Split option line on commas

    old_ifs="$IFS"

    IFS="$IFS,"

    for opt in $options; do

	# Find the keyscript option, if any

	case "$opt" in

	    keyscript=*)

		keyscript="${opt#keyscript=}"

		newopts="$newopts,$opt"

		;;

	    "") : ;;

	    # Always use Mandos on the root device, if marked

	    rootdev)

		changethis=yes

		newopts="$newopts,$opt"

		;;

	    # Don't use Mandos on resume device, if marked

	    resumedev)

		changethis=no

		newopts="$newopts,$opt"

		;;

	    *)

		newopts="$newopts,$opt"

		;;

	esac

    done

    IFS="$old_ifs"

    unset old_ifs

    # If there was no keyscript option, add one.

    if [ "$changethis" = yes ] && [ -z "$keyscript" ]; then

	replace_cryptroot=yes

	newopts="$newopts,keyscript=$mandos"

    fi

    newopts="${newopts#,}"

    echo "$newopts" >&3

done < /conf/conf.d/cryptroot

exec 3>&-

# If we need to, replace the old cryptroot file with the new file.

if [ "$replace_cryptroot" = yes ]; then

    mv /conf/conf.d/cryptroot /conf/conf.d/cryptroot.mandos-old

    mv /conf/conf.d/cryptroot.mandos /conf/conf.d/cryptroot

else

    rm /conf/conf.d/cryptroot.mandos

fi