crypt_reboot 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ee0a1d8c466f902cc47c84b3310c899046ae2d2cacc952f184baa76463add807
-  data.tar.gz: 6fc17834b241d0822848b84e36fa2277b47a998c77659740a82d0e49d83a16e6
+  metadata.gz: 6ec1b79f3b99fddc49e170693df471d0eebc44af064787cb29b2694985a91418
+  data.tar.gz: e3fa5ac025fc7ea7544a6e4c6d9db1f5894a0da44b6c39d07689a7594c0fc714
 SHA512:
-  metadata.gz: 030a74f06349d21c91b05a7ac297ffb927309faad863689a8cd632521587e47059c38995b377e199e5337819f447999796f65aa6dfa17345f7aaca0821458a23
-  data.tar.gz: 2f16596ee0b871ecec49b9687da65d3086c66daa41b48e3090d43317452755752443996f5ef5887ac4a73f50f31bd4307ab08254b2869e3219970117ddfcbeee
+  metadata.gz: 8aebba8307469fc4cba898f0c3427b4c6242e7f90dea985b33a72e89e13ee7e0854b232870b1afaea518c92eee03dca8c32d4c1f956a6da2e6cd55adae67f07e
+  data.tar.gz: 56d86831971b547b4d1856b426dafac2a77bffa23fd8ced861908902ce969186be52710e92dd50ec01242c77133d77439a088a651626dd9e8ce2977ce136483a

data/CHANGELOG.md

@@ -1,3 +1,12 @@
+## [0.2.1] - 2023-11-12
+
+- use new MemoryLocker without a need for FFI compilation step
+
+## [0.2.0] - 2023-07-29
+
+- Make memory locking optional with `--insecure-memory` command line option
+- Remove FFI gem dependency
+
 ## [0.1.2] - 2023-07-22
 
 - Lock memory to prevent secrets leaking to swap

data/README.md

@@ -7,7 +7,8 @@ Convenient reboot for Linux systems with encrypted root partition.
 > Just type `cryptreboot` instead of `reboot`.
 
 It asks for a passphrase and reboots the system afterward, automatically
-unlocking the drive on startup using in-memory initramfs patching and kexec.
+unlocking the drive on startup using
+[in-memory initramfs patching and kexec](https://blog.pawelpokrywka.com/p/rebooting-linux-with-encrypted-disk).
 Without explicit consent, no secrets are stored on disk, even temporarily.
 
 Useful when unlocking the drive at startup is difficult, such as on headless
@@ -36,7 +37,8 @@ Following distributions were tested by the author on the AMD64 machine:
 - Ubuntu 22.04 LTS
 - Ubuntu 20.04 LTS needs tiny adjustments to system settings,
   specifically [changing compression](#lz4-initramfs-compression) and
-  [fixing systemd kexec support](#staged-kernel-not-being-executed-by-systemd)
+  [fixing systemd kexec support](#staged-kernel-not-being-executed-by-systemd), but still
+  [sometimes](#unable-to-kexec-on-reboot-using-old-systemd) reboot experience may be suboptimal
 - ~~Ubuntu 18.04 LTS~~ is not supported (initramfs uses *pre-crypttab* format)
 
 If you have successfully run cryptreboot on another distribution,
@@ -65,14 +67,6 @@ If you use Debian-based distribution, use this command to install required packa
 When asked if kexec should handle reboots, answer `yes` (however the answer probably
 doesn't matter for cryptreboot to work).
 
-## Recommendations
-
-To protects against saving sensitive data (passphrase, encryption keys) to swap space on a disk, it is recommended to use `memory_locker` ([Rubygems](https://rubygems.org/gems/memory_locker), [Github](https://github.com/phantom-node/memory_locker)).
-
-    $ sudo gem install memory_locker
-
-If you don't want to install it, you will have to specify `--insecure-memory` flag when running cryptreboot.
-
 ## Installation
 
 Make sure the required software is installed, then install the gem system-wide by executing:
@@ -180,12 +174,34 @@ If you get:
 
 it means there was an error while locking memory to prevent a risk of sensitive data ending in a swap space.
 
-The best solution is to install `memory_locker` (see [requirements](#requirements) section).
-If it still doesn't help, make sure you have permission to lock memory. Root users do.
-If the problem persists, then please report a bug describing your setup.
+Make sure you have permission to lock memory. Root users have.
+If permissions are ok, then please report a bug describing your setup.
 
 The solution of last resort is to use `--insecure-memory` flag, which disables memory locking completely.
 
+### Unable to kexec on reboot using old systemd
+
+Ubuntu 20.04 ships with `systemd` which may fall back to standard reboot instead of using `kexec`, because this utility
+is located on a filesystem being unmounted during the shutdown sequence.
+
+As a result, using cryptreboot would feel like using normal reboot.
+
+To tell if your system is affected, you have to check messages printed to the console after you run cryptreboot.
+This message happens just before reboot, so you will have just a few milliseconds to notice it on screen:
+
+> shutdown[1]: (sd-kexec) failed with exit status 1
+
+[There is a fix](https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1969365) waiting to be included in
+a stable release update to `systemd` since 2023-07-21.
+
+In the meantime, as a workaround, you can use `kexec` directly. **Warning: it will skip the standard shutdown procedure. Filesystems won't be unmounted, services won't be stopped, etc. It is like hitting `reset` button**.
+However, when you use a decent filesystem with journalling the risk of things going bad should not be high.
+
+Given the above warning, to reboot skipping the shutdown procedure, run:
+
+    $ sudo cryptreboot -p
+    $ sudo kexec -e # will skip proper shutdown sequence
+
 ## Development
 
 After checking out the repo, run `bundle install` to install

data/lib/crypt_reboot/elastic_memory_locker.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'memory_locker' unless defined? MemoryLocker # MemoryLocker is mocked in tests
+
 module CryptReboot
   # Try to lock memory if configuration allows it
   class ElasticMemoryLocker
@@ -8,10 +10,9 @@ module CryptReboot
     def call
       return if skip_locking?
 
-      loader.call
       locker.call
       nil
-    rescue load_error, locking_error => e
+    rescue locking_error => e
       raise LockingError, 'Failed to lock memory', cause: e
     end
 
@@ -21,22 +22,14 @@ module CryptReboot
       insecure_memory_checker.call
     end
 
-    def locking_error
-      lazy_locking_error.call
-    end
-
-    attr_reader :insecure_memory_checker, :loader, :load_error, :locker, :lazy_locking_error
+    attr_reader :insecure_memory_checker, :locker, :locking_error
 
     def initialize(insecure_memory_checker: LazyConfig.insecure_memory,
-                   loader: -> { require 'memory_locker' },
-                   load_error: LoadError,
-                   locker: -> { MemoryLocker.call },
-                   lazy_locking_error: -> { MemoryLocker::Error })
+                   locker: MemoryLocker,
+                   locking_error: MemoryLocker::Error)
       @insecure_memory_checker = insecure_memory_checker
-      @loader = loader
-      @load_error = load_error
       @locker = locker
-      @lazy_locking_error = lazy_locking_error
+      @locking_error = locking_error
     end
   end
 end

data/lib/crypt_reboot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CryptReboot
-  VERSION = '0.2.0'
+  VERSION = '0.2.1'
 end

data/lib/crypt_reboot.rb

@@ -7,7 +7,6 @@ rescue LoadError => e
 
   require 'zeitwerk'
   loader = Zeitwerk::Loader.for_gem
-  loader.ignore("#{__dir__}/memory_locker.rb") # stub has to be loaded manually
   loader.setup
 end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: crypt_reboot
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Paweł Pokrywka
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-07-29 00:00:00.000000000 Z
+date: 2023-11-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tty-command
@@ -38,7 +38,21 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.3'
-description: 
+- !ruby/object:Gem::Dependency
+  name: memory_locker
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.0.3
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.0.3
+description:
 email:
 - pepawel@users.noreply.github.com
 executables:
@@ -117,7 +131,7 @@ metadata:
   source_code_uri: https://github.com/phantom-node/cryptreboot
   changelog_uri: https://github.com/phantom-node/cryptreboot/blob/master/CHANGELOG.md
   rubygems_mfa_required: 'true'
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -132,8 +146,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
-signing_key: 
+rubygems_version: 3.2.22
+signing_key:
 specification_version: 4
 summary: Linux utility for automatic and secure unlocking of encrypted disks on reboot
 test_files: []