crypt_reboot 0.3.0.beta.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 01bc4b369ba12b4f4197e8935a0b89a2e6f4a95af950e3e1eb048a389ef7672e
-  data.tar.gz: 98e360717e15344ae14d41dd9557101c833efa75bcfcd01426096015a7faa2b4
+  metadata.gz: c87fe69139eb41dd5bf41ec7e790cef1934e4c0c1d9bac7d46990d0a190a4f7f
+  data.tar.gz: d9aa729f6fabb43042a260b53a622a1ad33d1d011301719b7e2f1d141f46dcba
 SHA512:
-  metadata.gz: 19d4fe5d9a715a8cc8e6f55bea983f3a676b2af1f17fe4705cb68122e90b17ac378da756bb3f1dadcd02df75f578c89105c84b654d6dc5e6837a0eedc6efba9c
-  data.tar.gz: 9d9010da9c9177229345ce804491593aaa4336bdeda5e92becc268035b539f4387b6b89f0e2b13d769d4a8b6e932981fa9e2b4e1085da65b5c177166e15bf437
+  metadata.gz: 24ebddd15821359a61c6eaab3915b0a6bc70b5d3acae7cfd1dee2a0dcaafe749d52abf22d5e8ead46b10b43bcfeaba7ef78bfed325ef360f740b0c40c6a5e192
+  data.tar.gz: 4b4a0ddb6a508f3e590ac2c8df6e78730c244fd1860a14fd4035953d4b066b448d56312dfa908151a1a5ff85db0b984142ec3ad8d611020458264ac1358f2cad

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## [0.3.0] - 2024-09-27
+
+- Refactor ZFS keystore encryption support
+
 ## [0.3.0.beta.1] - 2024-09-26
 
 - Add preliminary support for LUKS-keystore-based ZFS encryption implemented by Ubuntu

data/README.md

@@ -20,6 +20,14 @@ and `/boot/initrd.img` as initramfs.
 Will work properly when using standard passphrase-based disk unlocking.
 Fancy methods such as using an external USB with a passphrase file will fail.
 
+## Supported disk encryption methods
+
+### LUKS crypttab
+LUKS-based disk-encryption configured with `/etc/crypttab` file.
+
+### ZFS keystore
+Native ZFS encryption with LUKS-encrypted keystore volume.
+
 ## Compatible Linux distributions
 
 Currently, cryptreboot depends on `initramfs-tools` package which is available in
@@ -30,26 +38,27 @@ On the other hand, do not expect it to work on other distributions now.
 But support for them may come in upcoming versions.
 
 Following distributions were tested by the author on the AMD64 machine:
-- DappNode 0.2.75 is based on Debian 12, see below
-- Debian 12 needs [symlinks for kernel and initramfs](#no-symlinks-to-most-recent-kernel-and-initramfs)
-- Pop!_OS 22.04 LTS
-- Ubuntu 23.04
-- Ubuntu 22.04 LTS
-- Ubuntu 20.04 LTS needs tiny adjustments to system settings,
-  specifically [changing compression](#lz4-initramfs-compression) and
-  [fixing systemd kexec support](#staged-kernel-not-being-executed-by-systemd), but still
-  [sometimes](#unable-to-kexec-on-reboot-using-old-systemd) reboot experience may be suboptimal
-- ~~Ubuntu 18.04 LTS~~ is not supported (initramfs uses *pre-crypttab* format)
+
+- LUKS crypttab disk encryption method
+  - DappNode 0.2.75 is based on Debian 12, see below
+  - Debian 12 needs [symlinks for kernel and initramfs](#no-symlinks-to-most-recent-kernel-and-initramfs)
+  - Pop!_OS 22.04 LTS
+  - Ubuntu 24.04 LTS
+  - Ubuntu 23.04
+  - Ubuntu 22.04 LTS
+  - Ubuntu 20.04 LTS needs tiny adjustments to system settings,
+    specifically [changing compression](#lz4-initramfs-compression) and
+    [fixing systemd kexec support](#staged-kernel-not-being-executed-by-systemd), but still
+    [sometimes](#unable-to-kexec-on-reboot-using-old-systemd) reboot experience may be suboptimal
+  - ~~Ubuntu 18.04 LTS~~ is not supported (initramfs uses *pre-crypttab* format)
+
+- ZFS keystore disk encryption method
+  - Ubuntu 24.04 LTS
+  - Ubuntu 22.04 LTS
 
 If you have successfully run cryptreboot on another distribution,
 please contact me and I will update the list.
 
-## Disk encryption method
-
-Currently, only LUKS-based disk-encryption is supported.
-If you use ZFS native encryption, cryptreboot will [downgrade](https://github.com/phantom-node/cryptreboot/issues/2)
-to standard reboot (using kexec).
-
 ## Requirements
 
 You need to ensure those are installed:

data/lib/basic_loader.rb

@@ -15,11 +15,13 @@ require 'crypt_reboot/gziper'
 require 'crypt_reboot/initramfs_patch_squeezer'
 require 'crypt_reboot/kexec_patching_loader'
 require 'crypt_reboot/lazy_config'
+require 'crypt_reboot/luks_crypt_tab_patcher'
 require 'crypt_reboot/passphrase_asker'
 require 'crypt_reboot/patched_initramfs_generator'
 require 'crypt_reboot/rebooter'
 require 'crypt_reboot/runner'
 require 'crypt_reboot/single_assign_restricted_map'
+require 'crypt_reboot/zfs_keystore_patcher'
 require 'crypt_reboot/cli/exiter'
 require 'crypt_reboot/cli/happy_exiter'
 require 'crypt_reboot/cli/params_parsing_executor'

data/lib/crypt_reboot/crypt_tab/deserializer.rb

@@ -4,7 +4,7 @@ module CryptReboot
   module CryptTab
     # Load crypttab file and return array with deserialized entries
     class Deserializer
-      def call(filename = nil, content: read_tolerate_missing(filename))
+      def call(filename = nil, content: File.read(filename))
         split_to_important_lines(content).map do |line|
           entry_deserializer.call line
         end
@@ -12,12 +12,6 @@ module CryptReboot
 
       private
 
-      def read_tolerate_missing(filename)
-        File.read(filename)
-      rescue Errno::ENOENT
-        ''
-      end
-
       def split_to_important_lines(content)
         content.split(/\n+|\r+/)
                .reject(&:empty?)

data/lib/crypt_reboot/crypt_tab/zfs_keystore_entries_generator.rb

@@ -19,15 +19,23 @@ module CryptReboot
 
       def generate_entry(path)
         pool = File.basename File.dirname(path)
-        target = "keystore-#{pool}"
-        entry_class.new target: target, source: path, key_file: 'none', options: {}, flags: %i[luks discard]
+        # Target name is the same as produced by /scripts/zfs script within initramfs
+        entry_builder.call target: "keystore-#{pool}", source: path
       end
 
-      attr_reader :zvol_dir, :entry_class
+      attr_reader :zvol_dir, :entry_builder
 
-      def initialize(zvol_dir: '/dev/zvol', entry_class: Entry)
+      def initialize(zvol_dir: '/dev/zvol',
+                     entry_builder: lambda { |target:, source:|
+                       # Flags and options are the same as produced by /scripts/zfs script within initramfs
+                       Entry.new target: target,
+                                 source: source,
+                                 key_file: 'none',
+                                 options: {},
+                                 flags: %i[luks discard]
+                     })
         @zvol_dir = zvol_dir
-        @entry_class = entry_class
+        @entry_builder = entry_builder
       end
     end
   end

data/lib/crypt_reboot/initramfs_patch_squeezer.rb

@@ -5,51 +5,23 @@ module CryptReboot
   class InitramfsPatchSqueezer
     def call(initramfs_path)
       extractor.call(initramfs_path) do |tmp_dir|
-        main_files(tmp_dir).merge zfs_files(tmp_dir)
+        patchers.inject({}) do |files, patcher|
+          files.merge patcher.call(tmp_dir)
+        end
       end
     end
 
     private
 
-    def main_files(tmp_dir)
-      full_crypttab_path = File.join(tmp_dir, crypttab_path)
-      crypttab_entries = crypttab_deserializer.call(full_crypttab_path)
-      files_generator.call(crypttab_entries, base_dir: tmp_dir, crypttab_path: crypttab_path)
-    end
-
-    def zfs_files(tmp_dir)
-      crypttab_entries = zfs_keystore_entries_generator.call
-      return {} if crypttab_entries.empty?
-      files = files_generator.call(crypttab_entries, base_dir: tmp_dir, crypttab_path: zfs_crypttab_path)
-      script_path = File.join(tmp_dir, zfs_script_path)
-      script = File.read(script_path)
-      files.merge(zfs_script_path => patch_zfs_script(script))
-    end
-
-    def patch_zfs_script(script)
-      patch = "cp #{zfs_crypttab_path} #{crypttab_path}; ${CRYPTROOT}"
-      script.sub(/^\s*\${CRYPTROOT}\s*$/, patch)
-    end
-
-    attr_reader :crypttab_path, :zfs_crypttab_path, :zfs_script_path, :extractor,
-                :crypttab_deserializer, :zfs_keystore_entries_generator, :files_generator
+    attr_reader :extractor, :patchers
 
-    # rubocop:disable Metrics/ParameterLists
-    def initialize(crypttab_path = '/cryptroot/crypttab',
-                   zfs_crypttab_path = '/cryptreboot/zfs_crypttab',
-                   zfs_script_path = '/scripts/zfs',
-                   extractor: Initramfs::Extractor.new,
-                   crypttab_deserializer: CryptTab::Deserializer.new,
-                   zfs_keystore_entries_generator: CryptTab::ZfsKeystoreEntriesGenerator.new,
-                   files_generator: FilesGenerator.new)
-      @crypttab_path = crypttab_path
-      @zfs_crypttab_path = zfs_crypttab_path
-      @zfs_script_path = zfs_script_path
+    def initialize(extractor: Initramfs::Extractor.new,
+                   patchers: [
+                     LuksCryptTabPatcher.new,
+                     ZfsKeystorePatcher.new
+                   ])
       @extractor = extractor
-      @crypttab_deserializer = crypttab_deserializer
-      @zfs_keystore_entries_generator = zfs_keystore_entries_generator
-      @files_generator = files_generator
+      @patchers = patchers
     end
-    # rubocop:enable Metrics/ParameterLists
   end
 end

data/lib/crypt_reboot/luks_crypt_tab_patcher.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module CryptReboot
+  # Generate patch (files hash) from files in a directory containing uncompressed initramfs
+  class LuksCryptTabPatcher
+    def call(dir)
+      full_crypttab_path = File.join(dir, crypttab_path)
+      return {} unless File.exist?(full_crypttab_path)
+
+      crypttab_entries = crypttab_deserializer.call(full_crypttab_path)
+      files_generator.call(crypttab_entries, base_dir: dir, crypttab_path: crypttab_path)
+    end
+
+    private
+
+    attr_reader :crypttab_path, :crypttab_deserializer, :files_generator
+
+    def initialize(crypttab_path: '/cryptroot/crypttab',
+                   crypttab_deserializer: CryptTab::Deserializer.new,
+                   files_generator: FilesGenerator.new)
+      @crypttab_path = crypttab_path
+      @crypttab_deserializer = crypttab_deserializer
+      @files_generator = files_generator
+    end
+  end
+end

data/lib/crypt_reboot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CryptReboot
-  VERSION = '0.3.0.beta.1'
+  VERSION = '0.3.0'
 end

data/lib/crypt_reboot/zfs_keystore_patcher.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module CryptReboot
+  # Generate patch (files hash) from files in a directory containing uncompressed initramfs
+  class ZfsKeystorePatcher
+    def call(dir)
+      crypttab_entries = entries_generator.call
+      return {} if crypttab_entries.empty?
+
+      files_generator
+        .call(crypttab_entries, base_dir: dir, crypttab_path: tmp_crypttab_path)
+        .merge(script_patch_files(dir))
+    end
+
+    private
+
+    def script_patch_files(dir)
+      path = File.join(dir, script_path)
+      content = File.read(path)
+      { script_path => patch_script(content) }
+    rescue Errno::ENOENT
+      {}
+    end
+
+    def patch_script(script)
+      comment = '# Following line has been added by cryptreboot'
+      patch = "cp #{tmp_crypttab_path} #{crypttab_path}"
+      script.sub(/^(\s*)(\${CRYPTROOT})\s*$/, "\n\\1#{comment}\n\\1#{patch}\n\n\\1\\2")
+    end
+
+    attr_reader :crypttab_path, :tmp_crypttab_path, :script_path,
+                :entries_generator, :files_generator
+
+    def initialize(crypttab_path: '/cryptroot/crypttab',
+                   tmp_crypttab_path: '/cryptreboot/zfs_crypttab',
+                   script_path: '/scripts/zfs',
+                   entries_generator: CryptTab::ZfsKeystoreEntriesGenerator.new,
+                   files_generator: FilesGenerator.new)
+      @crypttab_path = crypttab_path
+      @tmp_crypttab_path = tmp_crypttab_path
+      @script_path = script_path
+      @entries_generator = entries_generator
+      @files_generator = files_generator
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: crypt_reboot
 version: !ruby/object:Gem::Version
-  version: 0.3.0.beta.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Paweł Pokrywka
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-09-26 00:00:00.000000000 Z
+date: 2024-09-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tty-command
@@ -109,6 +109,7 @@ files:
 - lib/crypt_reboot/luks/dumper/luks_v2_parser.rb
 - lib/crypt_reboot/luks/key_fetcher.rb
 - lib/crypt_reboot/luks/version_detector.rb
+- lib/crypt_reboot/luks_crypt_tab_patcher.rb
 - lib/crypt_reboot/passphrase_asker.rb
 - lib/crypt_reboot/patched_initramfs_generator.rb
 - lib/crypt_reboot/rebooter.rb
@@ -124,6 +125,7 @@ files:
 - lib/crypt_reboot/safe_temp/mounter.rb
 - lib/crypt_reboot/single_assign_restricted_map.rb
 - lib/crypt_reboot/version.rb
+- lib/crypt_reboot/zfs_keystore_patcher.rb
 homepage: https://phantomno.de/cryptreboot
 licenses:
 - MIT