crypt_reboot 0.2.1 → 0.3.0.beta.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ec1b79f3b99fddc49e170693df471d0eebc44af064787cb29b2694985a91418
-  data.tar.gz: e3fa5ac025fc7ea7544a6e4c6d9db1f5894a0da44b6c39d07689a7594c0fc714
+  metadata.gz: 01bc4b369ba12b4f4197e8935a0b89a2e6f4a95af950e3e1eb048a389ef7672e
+  data.tar.gz: 98e360717e15344ae14d41dd9557101c833efa75bcfcd01426096015a7faa2b4
 SHA512:
-  metadata.gz: 8aebba8307469fc4cba898f0c3427b4c6242e7f90dea985b33a72e89e13ee7e0854b232870b1afaea518c92eee03dca8c32d4c1f956a6da2e6cd55adae67f07e
-  data.tar.gz: 56d86831971b547b4d1856b426dafac2a77bffa23fd8ced861908902ce969186be52710e92dd50ec01242c77133d77439a088a651626dd9e8ce2977ce136483a
+  metadata.gz: 19d4fe5d9a715a8cc8e6f55bea983f3a676b2af1f17fe4705cb68122e90b17ac378da756bb3f1dadcd02df75f578c89105c84b654d6dc5e6837a0eedc6efba9c
+  data.tar.gz: 9d9010da9c9177229345ce804491593aaa4336bdeda5e92becc268035b539f4387b6b89f0e2b13d769d4a8b6e932981fa9e2b4e1085da65b5c177166e15bf437

data/CHANGELOG.md

@@ -1,6 +1,10 @@
+## [0.3.0.beta.1] - 2024-09-26
+
+- Add preliminary support for LUKS-keystore-based ZFS encryption implemented by Ubuntu
+
 ## [0.2.1] - 2023-11-12
 
-- use new MemoryLocker without a need for FFI compilation step
+- Use new MemoryLocker without a need for FFI compilation step
 
 ## [0.2.0] - 2023-07-29
 

data/README.md

@@ -44,6 +44,12 @@ Following distributions were tested by the author on the AMD64 machine:
 If you have successfully run cryptreboot on another distribution,
 please contact me and I will update the list.
 
+## Disk encryption method
+
+Currently, only LUKS-based disk-encryption is supported.
+If you use ZFS native encryption, cryptreboot will [downgrade](https://github.com/phantom-node/cryptreboot/issues/2)
+to standard reboot (using kexec).
+
 ## Requirements
 
 You need to ensure those are installed:

data/lib/basic_loader.rb

@@ -31,6 +31,7 @@ require 'crypt_reboot/crypt_tab/entry_serializer'
 require 'crypt_reboot/crypt_tab/keyfile_locator'
 require 'crypt_reboot/crypt_tab/luks_to_plain_converter'
 require 'crypt_reboot/crypt_tab/serializer'
+require 'crypt_reboot/crypt_tab/zfs_keystore_entries_generator'
 require 'crypt_reboot/initramfs/archiver'
 require 'crypt_reboot/initramfs/decompressor'
 require 'crypt_reboot/initramfs/extractor'

data/lib/crypt_reboot/crypt_tab/deserializer.rb

@@ -4,7 +4,7 @@ module CryptReboot
   module CryptTab
     # Load crypttab file and return array with deserialized entries
     class Deserializer
-      def call(filename = nil, content: File.read(filename))
+      def call(filename = nil, content: read_tolerate_missing(filename))
         split_to_important_lines(content).map do |line|
           entry_deserializer.call line
         end
@@ -12,6 +12,12 @@ module CryptReboot
 
       private
 
+      def read_tolerate_missing(filename)
+        File.read(filename)
+      rescue Errno::ENOENT
+        ''
+      end
+
       def split_to_important_lines(content)
         content.split(/\n+|\r+/)
                .reject(&:empty?)

data/lib/crypt_reboot/crypt_tab/zfs_keystore_entries_generator.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module CryptReboot
+  module CryptTab
+    # Get a list of keystore zvols from a running system and return entries array
+    class ZfsKeystoreEntriesGenerator
+      def call
+        glob = File.join(zvol_dir, '**/*')
+        Dir.glob(glob)
+           .select { |path| path =~ %r{/keystore$} && exist?(path) }
+           .map { |path| generate_entry(path) }
+      end
+
+      private
+
+      def exist?(path)
+        File.exist? File.realpath(path)
+      end
+
+      def generate_entry(path)
+        pool = File.basename File.dirname(path)
+        target = "keystore-#{pool}"
+        entry_class.new target: target, source: path, key_file: 'none', options: {}, flags: %i[luks discard]
+      end
+
+      attr_reader :zvol_dir, :entry_class
+
+      def initialize(zvol_dir: '/dev/zvol', entry_class: Entry)
+        @zvol_dir = zvol_dir
+        @entry_class = entry_class
+      end
+    end
+  end
+end

data/lib/crypt_reboot/files_generator.rb

@@ -3,7 +3,7 @@
 module CryptReboot
   # Generate a hash with file names as keys and file contents as values
   class FilesGenerator
-    def call(entries, base_dir)
+    def call(entries, base_dir:, crypttab_path:)
       files = {}
       modified_entries = entries.map do |entry|
         next entry unless luks?(entry, base_dir)
@@ -13,14 +13,11 @@ module CryptReboot
         files[keyfile] = data.key
         entry_converter.call(entry, data, keyfile)
       end
-      files.merge(CRYPTAB_PATH => serializer.call(modified_entries))
+      files.merge(crypttab_path => serializer.call(modified_entries))
     end
 
     private
 
-    CRYPTAB_PATH = '/cryptroot/crypttab'
-    private_constant :CRYPTAB_PATH
-
     def luks?(entry, base_dir)
       headevice = entry.headevice(header_prefix: base_dir)
       luks_checker.call(headevice)

data/lib/crypt_reboot/initramfs/extractor.rb

@@ -10,7 +10,7 @@ module CryptReboot
         tmp_maker.call do |dir|
           logger.call message
           decompressor.call(filename, dir)
-          yield dir
+          yield File.join(dir, subdir)
         end
       end
 
@@ -20,16 +20,18 @@ module CryptReboot
         decompressor_factory.call
       end
 
-      attr_reader :tmp_maker, :decompressor_factory, :message, :logger
+      attr_reader :tmp_maker, :decompressor_factory, :message, :logger, :subdir
 
       def initialize(tmp_maker: Dir.method(:mktmpdir),
                      decompressor_factory: Decompressor.new,
                      message: 'Extracting initramfs... To speed things up, future versions will employ cache.',
-                     logger: ->(msg) { warn msg })
+                     logger: ->(msg) { warn msg },
+                     subdir: 'main')
         @tmp_maker = tmp_maker
         @decompressor_factory = decompressor_factory
         @message = message
         @logger = logger
+        @subdir = subdir
       end
     end
   end

data/lib/crypt_reboot/initramfs_patch_squeezer.rb

@@ -5,24 +5,51 @@ module CryptReboot
   class InitramfsPatchSqueezer
     def call(initramfs_path)
       extractor.call(initramfs_path) do |tmp_dir|
-        crypttab_path = File.join(tmp_dir, crypttab_relative_path)
-        crypttab_entries = deserializer.call(crypttab_path)
-        files_generator.call(crypttab_entries, tmp_dir)
+        main_files(tmp_dir).merge zfs_files(tmp_dir)
       end
     end
 
     private
 
-    attr_reader :crypttab_relative_path, :extractor, :deserializer, :files_generator
+    def main_files(tmp_dir)
+      full_crypttab_path = File.join(tmp_dir, crypttab_path)
+      crypttab_entries = crypttab_deserializer.call(full_crypttab_path)
+      files_generator.call(crypttab_entries, base_dir: tmp_dir, crypttab_path: crypttab_path)
+    end
+
+    def zfs_files(tmp_dir)
+      crypttab_entries = zfs_keystore_entries_generator.call
+      return {} if crypttab_entries.empty?
+      files = files_generator.call(crypttab_entries, base_dir: tmp_dir, crypttab_path: zfs_crypttab_path)
+      script_path = File.join(tmp_dir, zfs_script_path)
+      script = File.read(script_path)
+      files.merge(zfs_script_path => patch_zfs_script(script))
+    end
+
+    def patch_zfs_script(script)
+      patch = "cp #{zfs_crypttab_path} #{crypttab_path}; ${CRYPTROOT}"
+      script.sub(/^\s*\${CRYPTROOT}\s*$/, patch)
+    end
+
+    attr_reader :crypttab_path, :zfs_crypttab_path, :zfs_script_path, :extractor,
+                :crypttab_deserializer, :zfs_keystore_entries_generator, :files_generator
 
-    def initialize(crypttab_relative_path = 'main/cryptroot/crypttab',
+    # rubocop:disable Metrics/ParameterLists
+    def initialize(crypttab_path = '/cryptroot/crypttab',
+                   zfs_crypttab_path = '/cryptreboot/zfs_crypttab',
+                   zfs_script_path = '/scripts/zfs',
                    extractor: Initramfs::Extractor.new,
-                   deserializer: CryptTab::Deserializer.new,
+                   crypttab_deserializer: CryptTab::Deserializer.new,
+                   zfs_keystore_entries_generator: CryptTab::ZfsKeystoreEntriesGenerator.new,
                    files_generator: FilesGenerator.new)
-      @crypttab_relative_path = crypttab_relative_path
+      @crypttab_path = crypttab_path
+      @zfs_crypttab_path = zfs_crypttab_path
+      @zfs_script_path = zfs_script_path
       @extractor = extractor
-      @deserializer = deserializer
+      @crypttab_deserializer = crypttab_deserializer
+      @zfs_keystore_entries_generator = zfs_keystore_entries_generator
       @files_generator = files_generator
     end
+    # rubocop:enable Metrics/ParameterLists
   end
 end

data/lib/crypt_reboot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module CryptReboot
-  VERSION = '0.2.1'
+  VERSION = '0.3.0.beta.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: crypt_reboot
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0.beta.1
 platform: ruby
 authors:
 - Paweł Pokrywka
-autorequire:
+autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-11-12 00:00:00.000000000 Z
+date: 2024-09-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tty-command
@@ -52,7 +52,7 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 1.0.3
-description:
+description: 
 email:
 - pepawel@users.noreply.github.com
 executables:
@@ -85,6 +85,7 @@ files:
 - lib/crypt_reboot/crypt_tab/keyfile_locator.rb
 - lib/crypt_reboot/crypt_tab/luks_to_plain_converter.rb
 - lib/crypt_reboot/crypt_tab/serializer.rb
+- lib/crypt_reboot/crypt_tab/zfs_keystore_entries_generator.rb
 - lib/crypt_reboot/elastic_memory_locker.rb
 - lib/crypt_reboot/files_generator.rb
 - lib/crypt_reboot/files_writer.rb
@@ -131,7 +132,7 @@ metadata:
   source_code_uri: https://github.com/phantom-node/cryptreboot
   changelog_uri: https://github.com/phantom-node/cryptreboot/blob/master/CHANGELOG.md
   rubygems_mfa_required: 'true'
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -146,8 +147,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.22
-signing_key:
+rubygems_version: 3.5.4
+signing_key: 
 specification_version: 4
 summary: Linux utility for automatic and secure unlocking of encrypted disks on reboot
 test_files: []