napcok/calamares
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[dracutlukscfg] Don't include keyfile in initramfs on unencrypted /boot.

Browse Source 
This matches the fix in initcpiocfg and initramfscfg.
This commit is contained in:
Kevin Kofler 2016-11-19 02:30:34 +01:00 committed by Philip
parent 423c7b57e3
commit 041db6e3d7
2 changed files with 32 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
src/modules/dracutlukscfg/DracutLuksCfgJob.cpp
View File

@ -33,14 +33,22 @@
const QString DracutLuksCfgJob::CONFIG_FILE = QStringLiteral( "/etc/dracut.conf.d/calamares-luks.conf" ); const QString DracutLuksCfgJob::CONFIG_FILE = QStringLiteral( "/etc/dracut.conf.d/calamares-luks.conf" );
// static // static
const char *DracutLuksCfgJob::CONFIG_FILE_CONTENTS = const char *DracutLuksCfgJob::CONFIG_FILE_HEADER =
"# Configuration file automatically written by the Calamares system installer\n" "# Configuration file automatically written by the Calamares system installer\n"
"# (This file is written once at install time and should be safe to edit.)\n" "# (This file is written once at install time and should be safe to edit.)\n"
"# Enables support for LUKS full disk encryption with single sign on from GRUB.\n" "# Enables support for LUKS full disk encryption with single sign on from GRUB.\n"
"\n" "\n";
// static
const char *DracutLuksCfgJob::CONFIG_FILE_CRYPTTAB_KEYFILE_LINE =
"# force installing /etc/crypttab even if hostonly=\"no\", install the keyfile\n" "# force installing /etc/crypttab even if hostonly=\"no\", install the keyfile\n"
"install_items+=\" /etc/crypttab /crypto_keyfile.bin \"\n"; "install_items+=\" /etc/crypttab /crypto_keyfile.bin \"\n";
// static
const char *DracutLuksCfgJob::CONFIG_FILE_CRYPTTAB_LINE =
"# force installing /etc/crypttab even if hostonly=\"no\"\n"
"install_items+=\" /etc/crypttab \"\n";
// static // static
const QString DracutLuksCfgJob::CONFIG_FILE_SWAPLINE = QStringLiteral( "# enable automatic resume from swap\nadd_device+=\" /dev/disk/by-uuid/%1 \"\n" ); const QString DracutLuksCfgJob::CONFIG_FILE_SWAPLINE = QStringLiteral( "# enable automatic resume from swap\nadd_device+=\" /dev/disk/by-uuid/%1 \"\n" );
@ -75,6 +83,21 @@ DracutLuksCfgJob::isRootEncrypted()
return false; return false;
} }
// static
bool
DracutLuksCfgJob::hasUnencryptedSeparateBoot()
{
const QVariantList partitions = DracutLuksCfgJob::partitions();
for ( const QVariant &partition : partitions )
{
QVariantMap partitionMap = partition.toMap();
QString mountPoint = partitionMap.value( QStringLiteral( "mountPoint" ) ).toString();
if ( mountPoint == QStringLiteral( "/boot" ) )
return !partitionMap.contains( QStringLiteral( "luksMapperName" ) );
}
return false;
}
// static // static
QString QString
DracutLuksCfgJob::swapOuterUuid() DracutLuksCfgJob::swapOuterUuid()
@ -126,7 +149,9 @@ DracutLuksCfgJob::exec()
return Calamares::JobResult::error( tr( "Failed to open %1" ).arg( realConfigFilePath ) ); return Calamares::JobResult::error( tr( "Failed to open %1" ).arg( realConfigFilePath ) );
} }
QTextStream outStream( &configFile ); QTextStream outStream( &configFile );
outStream << CONFIG_FILE_CONTENTS; outStream << CONFIG_FILE_HEADER
<< ( hasUnencryptedSeparateBoot() ? CONFIG_FILE_CRYPTTAB_LINE
: CONFIG_FILE_CRYPTTAB_KEYFILE_LINE );
const QString swapOuterUuid = DracutLuksCfgJob::swapOuterUuid(); const QString swapOuterUuid = DracutLuksCfgJob::swapOuterUuid();
if ( ! swapOuterUuid.isEmpty() ) if ( ! swapOuterUuid.isEmpty() )
{ {

5
src/modules/dracutlukscfg/DracutLuksCfgJob.h
View File

@ -42,12 +42,15 @@ public:
private: private:
static const QString CONFIG_FILE; static const QString CONFIG_FILE;
static const char *CONFIG_FILE_CONTENTS; static const char *CONFIG_FILE_HEADER;
static const char *CONFIG_FILE_CRYPTTAB_KEYFILE_LINE;
static const char *CONFIG_FILE_CRYPTTAB_LINE;
static const QString CONFIG_FILE_SWAPLINE; static const QString CONFIG_FILE_SWAPLINE;
static QString rootMountPoint(); static QString rootMountPoint();
static QVariantList partitions(); static QVariantList partitions();
static bool isRootEncrypted(); static bool isRootEncrypted();
static bool hasUnencryptedSeparateBoot();
static QString swapOuterUuid(); static QString swapOuterUuid();
}; };