summaryrefslogtreecommitdiff
path: root/src/cryptsetup
Commit message (Collapse)AuthorAge
* cryptsetup: allow x-systemd.device-timeoutZbigniew Jędrzejewski-Szmek2014-06-30
| | | | https://bugs.freedesktop.org/show_bug.cgi?id=54210
* cryptsetup: don't add unit dependency on /dev/null devices when it is listed ↵Lennart Poettering2014-06-23
| | | | | | | | | | | as password file As special magic, don't create device dependencies for /dev/null. Of course, there might be similar devices we might want to include, but given that none of them really make sense to specify as password source there's really no point in checking for anything else here. https://bugs.freedesktop.org/show_bug.cgi?id=75816
* stop complaining about unknown kernel cmdline optionsLennart Poettering2014-06-19
| | | | | Also stop warning about unknown kernel cmdline options in the various tools, not just in PID 1
* cryptsetup: introduce new cryptsetup-pre.traget unit so that services can ↵Lennart Poettering2014-06-18
| | | | | | make sure they are started before and stopped after any LUKS setup https://bugzilla.redhat.com/show_bug.cgi?id=1097938
* cryptsetup: check that password is not nullThomas Hindoe Paaboel Andersen2014-06-13
| | | | | | Beef up the assert to protect against passing null to strlen. Found with scan-build.
* Fix keysize handling in cryptsetup (bits vs. bytes)David Härdeman2014-04-24
| | | | | | | | | The command line key-size is in bits but the libcryptsetup API expects bytes. Note that the modulo 8 check is in the original cryptsetup binary as well, so it's no new limitation. (v2: changed the point at which the /= 8 is performed, rebased, removed tabs)
* Add more password agent informationDavid Härdeman2014-04-24
| | | | | | | | | | Add an (optional) "Id" key in the password agent .ask files. The Id is supposed to be a simple string in "<subsystem>:<target>" form which is used to provide more information on what the requested passphrase is to be used for (which e.g. allows an agent to only react to cryptsetup requests). (v2: rebased, fixed indentation, escape name, use strappenda)
* cryptsetup: copy value, not key for (rd.)luks.keyMatthew Monaco2014-04-19
|
* cryptsetup: minor typo fixLennart Poettering2014-03-24
|
* cryptsetup: call static variables parsed from command line arg_XYZ like in ↵Lennart Poettering2014-03-13
| | | | all other tools
* generators: add Documentation= fields that point to the generator man pagesLennart Poettering2014-03-06
|
* util: move more intellegince into parse_proc_cmdline()Lennart Poettering2014-03-06
| | | | | Already split variable assignments before invoking the callback. And drop "rd." settings if we are not in an initrd.
* cryptsetup: some fixesLennart Poettering2014-03-06
|
* Extract looping over /proc/cmdline into a shared functionZbigniew Jędrzejewski-Szmek2014-02-17
| | | | | | | In cryptsetup-generator automatic cleanup had to be replaced with manual cleanup, and the code gets a bit longer. But existing code had the issue that it returned negative values from main(), which was wrong, so should be reworked anyway.
* cryptsetup-generator: auto add deps for device as passwordDave Reisner2014-02-08
| | | | | If the password is a device file, we can add Requires/After dependencies on the device rather than requiring the user to do so.
* cryptsetup: Support key-slot optionChristian Seiler2014-01-26
| | | | | | | | | | | | | | Debian recently introduced the option key-slot to /etc/crypttab to specify the LUKS key slot to be used for decrypting the device. On systems where a keyfile is used and the key is not in the first slot, this can speed up the boot process quite a bit, since cryptsetup does not need to try all of the slots sequentially. (Unsuccessfully testing a key slot typically takes up to about 1 second.) This patch makes systemd aware of this option. Debian bug that introduced the feature: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=704470
* util: unify reading of /proc/cmdlineLennart Poettering2013-11-06
| | | | | | Instead of individually checking for containers in each user do this once in a new call proc_cmdline() that read the file only if we are not in a container.
* Introduce udev object cleanup functionsZbigniew Jędrzejewski-Szmek2013-10-13
|
* Introduce _cleanup_endmntent_Zbigniew Jędrzejewski-Szmek2013-10-03
|
* cryptsetup: fix OOM handling when parsing mount optionsLennart Poettering2013-10-02
|
* set IgnoreOnIsolate=true for systemd-cryptsetup@.serviceAndrey Borzenkov2013-09-29
| | | | | | | | | When crypttab contains noauto, cryptsetup service does not have any explicit dependencies. If service is started later manually (directly or via mount dependency) it will be stopped on isolate. mount units already have IgnoreOnIsolate set by default. Set it by default for cryptsetup units as well.
* Fix obsolete references to systemd-random-seed-load.serviceEelco Dolstra2013-09-23
| | | | | This service was merged with systemd-random-seed-save.service in c35b956d34bbb8bb208e49e45de2c103ca11911c.
* cryptsetup-generator: allow specifying options in /proc/cmdlineTom Gundersen2013-09-13
| | | | | | | The main usecase for this is to make it possible to use cryptsetup in the initrd without it having to include a host-specific /etc/crypttab. Tested-by: Thomas Bächler <thomas@archlinux.org>
* cryptsetup-generator: don't create tmp+swap unitsTom Gundersen2013-09-13
|
* cryptsetup: Retry indefinitely if tries=0 option has been set.Thomas Bächler2013-09-11
| | | | | When running from initrd, entering a wrong passphrase usually means that you cannot boot. Therefore, we allow trying indefinitely.
* systemd-cryptsetup: makes “discard” a synonym for “allow-discards”Ondrej Balaz2013-08-14
| | | | | | | | | systemd-cryptsetup recognizes option 'allow-discards' in /etc/crypttab to enable TRIM passthrough to underlying encrypted device. In Debian this option was changed to 'discard' to avoid hyphen in option name. (see: #648868 and `man crypttab`). [zj: update crypttab(5) too, making "discard" the default.]
* cryptsetup: Add tcrypt supportJan Janssen2013-07-16
| | | | | | | | | | | | | | Tcrypt uses a different approach to passphrases/key files. The passphrase and all key files are incorporated into the "password" to open the volume. So, the idea of slots that provide a way to open the volume with different passphrases/key files that are independent from each other like with LUKS does not apply. Therefore, we use the key file from /etc/crypttab as the source for the passphrase. The actual key files that are combined with the passphrase into a password are provided as a new option in /etc/crypttab and can be given multiple times if more than one key file is used by a volume.
* cryptsetup: Move attaching of the device out of mainJan Janssen2013-07-16
|
* cryptsetup: Move password query out of mainJan Janssen2013-07-16
| | | | Also use _cleanup_free_ where possible.
* cryptsetup: downgrade world-writable warning againLennart Poettering2013-05-03
| | | | This semi-reverts 8973790ee6f62132b1b57de15c4edaef2c097004.
* cryptsetup: warn if keyfiles are world-readableLennart Poettering2013-04-30
|
* cryptsetup: warn if /etc/crypttab is world-readableLennart Poettering2013-04-30
|
* Standarize on one spelling of symlink error messageZbigniew Jędrzejewski-Szmek2013-04-24
| | | | | It's polite to print the name of the link that wasn't created, and it makes little sense to print the target.
* crypt-setup-generator: correctly check return of strdupLukas Nykryn2013-04-19
|
* cryptsetup: ask for password, if key file cannot be accessedHarald Hoyer2013-04-18
| | | | | If the key file cannot be accessed, we can at least ask for the password.
* move _cleanup_ attribute in front of the typeHarald Hoyer2013-04-18
| | | | http://lists.freedesktop.org/archives/systemd-devel/2013-April/010510.html
* cryptsetup-generator: add support for rd.luks.key=Harald Hoyer2013-04-18
| | | | | | Also clarify rd.luks.uuid and luks.uuid in the manual. https://bugzilla.redhat.com/show_bug.cgi?id=905683
* cryptsetup: set the timeout to 0 by defaultHarald Hoyer2013-04-18
| | | | | | | cryptsetup itself has no timeout as default from the beginning. So the default timeout has been "0" from the beginning. https://bugzilla.redhat.com/show_bug.cgi?id=949702
* Use initalization instead of explicit zeroingZbigniew Jędrzejewski-Szmek2013-04-05
| | | | | | | | | | | | | | | | | | | | | | | Before, we would initialize many fields twice: first by filling the structure with zeros, and then a second time with the real values. We can let the compiler do the job for us, avoiding one copy. A downside of this patch is that text gets slightly bigger. This is because all zero() calls are effectively inlined: $ size build/.libs/systemd text data bss dec hex filename before 897737 107300 2560 1007597 f5fed build/.libs/systemd after 897873 107300 2560 1007733 f6075 build/.libs/systemd … actually less than 1‰. A few asserts that the parameter is not null had to be removed. I don't think this changes much, because first, it is quite unlikely for the assert to fail, and second, an immediate SEGV is almost as good as an assert.
* cryptsetup-generator: add JobTimeoutSec=0 for the decrypted crypt devicesHarald Hoyer2013-04-04
| | | | | | | | | | | | | | | | The password query for a crypto device currently times out after 90s, which is too short to grab a cup of coffee when a machine boots up. The resulting decrypted device /dev/mapper/luks-<uuid> might not be a mountpoint (but part of a LVM PV or raid array) and therefore the timeout cannot be controlled by the settings in /etc/fstab. For this reason this device should not carry its own timeout. Also the encrypted device /dev/disk/by-*/* already has a timeout and additionally the timeout for the password query is set in /etc/crypttab. This patch disables the timeout of the resulting decrypted devices by creating <device-unit>.d/50-job-timeout-sec-0.conf files with "JobTimeoutSec=0".
* util: rename parse_usec() to parse_sec() sinds the default unit is secondsLennart Poettering2013-04-03
| | | | | | | | Internally we store all time values in usec_t, however parse_usec() actually was used mostly to parse values in seconds (unless explicit units were specified to define a different unit). Hence, be clear about this and name the function about what we pass into it, not what we get out of it.
* cryptsetup: add RequiresMountsFor for keyfileThomas Weißschuh2013-04-01
| | | | | | | | This ensures that the keyfile is available during the opening of the encrypted device. Also dropped the explicit ordering Before=local-fs.target, as the containers are ordered implicitly by their content.
* cryptsetup: RequiresMountsFor if source is a fileThomas Weißschuh2013-04-01
| | | | | Fixes: https://bugzilla.novell.com/show_bug.cgi?id=730496 https://bugs.freedesktop.org/show_bug.cgi?id=60821
* cryptsetup: when prompting for password use GPT partition labelLennart Poettering2013-03-26
| | | | | If there's a GPT partition label set for a LUKS partition, then it's nicer to show that than the model number, when asking for a passphrase.
* cryptsetup-generator: let's be a bit more efficient with strv_extend()Lennart Poettering2013-03-25
|
* cryptsetup-generator: add a missing OOM checkLennart Poettering2013-03-25
|
* cryptsetup-generator: use _cleanup_ where possibleHarald Hoyer2013-03-13
|
* cryptsetup-generator: fix the kernel command line strategy for luks.uuidHarald Hoyer2013-03-01
| | | | | | If rd.luks.uuid or luks.uuid is specified on the kernel command, only generate units for these UUIDs. Additionally use the information in /etc/crypttab unless rd.luks.crypttab=0 or luks.crypttab=0 is specified.
* added some missing include for a5c32cff1f56afe6f0c6c70d91a88a7a8238b2d7Harald Hoyer2013-02-14
|
* cryptsetup: accept both "read-only" and "readonly" spellingsMichal Schmidt2013-01-31
| | | | | | | | | | | Mukund Sivaraman pointed out that cryptsetup(5) mentions the "read-only" option, while the code understands "readonly". We could just fix the manpage, but for consistency in naming of multi-word options it would be prettier to have "read-only". So let's accept both spellings. BZ: https://bugzilla.redhat.com/show_bug.cgi?id=903463
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-27 23:49:48 +0000