From: Tomas Volf <wolf@wolfsden.cz>
To: 65002@debbugs.gnu.org
Cc: Tomas Volf <wolf@wolfsden.cz>
Subject: [bug#65002] [PATCH 1/2] mapped-devices: Allow unlocking by a key file
Date: Tue, 1 Aug 2023 23:09:20 +0200 [thread overview]
Message-ID: <f868b4ab8b6ffdee7cfa0f2fc0c4ee3d7100f081.1690922760.git.wolf@wolfsden.cz> (raw)
In-Reply-To: <cover.1690922760.git.wolf@wolfsden.cz>
Requiring the user to input their password in order to unlock a device is not
always reasonable, so having an option to unlock the device using a key file
is a nice quality of life change.
* gnu/system/mapped-devices.scm (luks-device-mapping): New keyword argument
* gnu/system/mapped-devices.scm (luks-device-mapping-with-options): New
procedure
---
doc/guix.texi | 12 +++++++
gnu/system/mapped-devices.scm | 67 ++++++++++++++++++++++-------------
2 files changed, 54 insertions(+), 25 deletions(-)
diff --git a/doc/guix.texi b/doc/guix.texi
index 58cc3d7aad..a857654191 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -17622,6 +17622,18 @@ Mapped Devices
@code{dm-crypt} Linux kernel module.
@end defvar
+@deffn {Procedure} luks-device-mapping-with-options [#:key-file]
+Return a @code{luks-device-mapping} object, which defines LUKS block
+device encryption using the @command{cryptsetup} command from the
+package with the same name. It relies on the @code{dm-crypt} Linux
+kernel module.
+
+If @code{key-file} is provided, unlocking is first attempted using that
+key file. If it fails, password unlock is attempted as well. Key file
+is not stored in the store and needs to be available at the specified
+path at the time of the unlock attempt.
+@end deffn
+
@defvar raid-device-mapping
This defines a RAID device, which is assembled using the @code{mdadm}
command from the package with the same name. It requires a Linux kernel
diff --git a/gnu/system/mapped-devices.scm b/gnu/system/mapped-devices.scm
index e6b8970c12..79b776e81e 100644
--- a/gnu/system/mapped-devices.scm
+++ b/gnu/system/mapped-devices.scm
@@ -2,6 +2,7 @@
;;; Copyright © 2014-2022 Ludovic Courtès <ludo@gnu.org>
;;; Copyright © 2016 Andreas Enge <andreas@enge.fr>
;;; Copyright © 2017, 2018 Mark H Weaver <mhw@netris.org>
+;;; Copyright © 2023 Tomas Volf <wolf@wolfsden.cz>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -64,6 +65,7 @@ (define-module (gnu system mapped-devices)
check-device-initrd-modules ;XXX: needs a better place
luks-device-mapping
+ luks-device-mapping-with-options
raid-device-mapping
lvm-device-mapping))
@@ -188,7 +190,7 @@ (define (check-device-initrd-modules device linux-modules location)
;;; Common device mappings.
;;;
-(define (open-luks-device source targets)
+(define* (open-luks-device source targets #:key key-file)
"Return a gexp that maps SOURCE to TARGET as a LUKS device, using
'cryptsetup'."
(with-imported-modules (source-module-closure
@@ -198,7 +200,8 @@ (define (open-luks-device source targets)
((target)
#~(let ((source #$(if (uuid? source)
(uuid-bytevector source)
- source)))
+ source))
+ (keyfile #$key-file))
;; XXX: 'use-modules' should be at the top level.
(use-modules (rnrs bytevectors) ;bytevector?
((gnu build file-systems)
@@ -215,29 +218,35 @@ (define (open-luks-device source targets)
;; 'cryptsetup open' requires standard input to be a tty to allow
;; for interaction but shepherd sets standard input to /dev/null;
;; thus, explicitly request a tty.
- (zero? (system*/tty
- #$(file-append cryptsetup-static "/sbin/cryptsetup")
- "open" "--type" "luks"
-
- ;; Note: We cannot use the "UUID=source" syntax here
- ;; because 'cryptsetup' implements it by searching the
- ;; udev-populated /dev/disk/by-id directory but udev may
- ;; be unavailable at the time we run this.
- (if (bytevector? source)
- (or (let loop ((tries-left 10))
- (and (positive? tries-left)
- (or (find-partition-by-luks-uuid source)
- ;; If the underlying partition is
- ;; not found, try again after
- ;; waiting a second, up to ten
- ;; times. FIXME: This should be
- ;; dealt with in a more robust way.
- (begin (sleep 1)
- (loop (- tries-left 1))))))
- (error "LUKS partition not found" source))
- source)
-
- #$target)))))))
+ (let ((partition
+ ;; Note: We cannot use the "UUID=source" syntax here
+ ;; because 'cryptsetup' implements it by searching the
+ ;; udev-populated /dev/disk/by-id directory but udev may
+ ;; be unavailable at the time we run this.
+ (if (bytevector? source)
+ (or (let loop ((tries-left 10))
+ (and (positive? tries-left)
+ (or (find-partition-by-luks-uuid source)
+ ;; If the underlying partition is
+ ;; not found, try again after
+ ;; waiting a second, up to ten
+ ;; times. FIXME: This should be
+ ;; dealt with in a more robust way.
+ (begin (sleep 1)
+ (loop (- tries-left 1))))))
+ (error "LUKS partition not found" source))
+ source)))
+ ;; We want to fallback to the password unlock if the keyfile fails.
+ (or (and keyfile
+ (zero? (system*/tty
+ #$(file-append cryptsetup-static "/sbin/cryptsetup")
+ "open" "--type" "luks"
+ "--key-file" keyfile
+ partition #$target)))
+ (zero? (system*/tty
+ #$(file-append cryptsetup-static "/sbin/cryptsetup")
+ "open" "--type" "luks"
+ partition #$target)))))))))
(define (close-luks-device source targets)
"Return a gexp that closes TARGET, a LUKS device."
@@ -276,6 +285,14 @@ (define luks-device-mapping
(close close-luks-device)
(check check-luks-device)))
+(define* (luks-device-mapping-with-options #:key key-file)
+ "Return a luks-device-mapping object with open modified to pass the arguments
+into the open-luks-device procedure."
+ (mapped-device-kind
+ (inherit luks-device-mapping)
+ (open (λ (source targets) (open-luks-device source targets
+ #:key-file key-file)))))
+
(define (open-raid-device sources targets)
"Return a gexp that assembles SOURCES (a list of devices) to the RAID device
TARGET (e.g., \"/dev/md0\"), using 'mdadm'."
--
2.41.0
next prev parent reply other threads:[~2023-08-01 21:58 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-01 20:53 [bug#65002] [PATCH 0/2] Add support for unlocking root device via a key file Tomas Volf
2023-08-01 21:09 ` Tomas Volf [this message]
2023-08-01 21:09 ` [bug#65002] [PATCH 2/2] gnu: bootloader: grub: Add support for loading an additional initrd Tomas Volf
2023-08-02 13:02 ` [bug#65002] [PATCH v2 1/2] mapped-devices: Allow unlocking by a key file Tomas Volf
2023-08-02 13:02 ` [bug#65002] [PATCH v2 2/2] gnu: bootloader: grub: Add support for loading an additional initrd Tomas Volf
2024-01-09 23:28 ` Ludovic Courtès
2024-01-11 13:32 ` Tomas Volf
2024-01-09 23:21 ` [bug#65002] [PATCH v2 1/2] mapped-devices: Allow unlocking by a key file Ludovic Courtès
2024-01-11 12:39 ` Tomas Volf
2024-01-11 17:39 ` Tomas Volf
2023-08-10 0:22 ` [bug#65002] [PATCH 0/2] Add support for unlocking root device via " Dominik Riva via Guix-patches via
2024-01-11 17:32 ` [bug#65002] [PATCH 1/6] mapped-devices: Allow unlocking by " Tomas Volf
2024-01-11 17:32 ` [bug#65002] [PATCH 2/6] gnu: bootloader: grub: Add support for loading an additional initrd Tomas Volf
2024-01-11 17:32 ` [bug#65002] [PATCH 3/6] tests: Add `encrypted-home-os-key-file' installation test Tomas Volf
2024-01-11 17:32 ` [bug#65002] [PATCH 4/6] tests: install: Use the smallest possible iteration time for LUKS Tomas Volf
2024-01-11 17:32 ` [bug#65002] [PATCH 5/6] tests: install: Fix encrypted-root-os test Tomas Volf
2024-01-11 17:32 ` [bug#65002] [PATCH 6/6] tests: install: Fix encrypted-home-os, encrypted-home-os-key-file tests Tomas Volf
2024-01-11 17:35 ` [bug#65002] [PATCH v3 1/6] mapped-devices: Allow unlocking by a key file Tomas Volf
2024-01-11 17:35 ` [bug#65002] [PATCH v3 2/6] gnu: bootloader: grub: Add support for loading an additional initrd Tomas Volf
2024-01-11 17:35 ` [bug#65002] [PATCH v3 3/6] tests: Add `encrypted-home-os-key-file' installation test Tomas Volf
2024-01-11 17:35 ` [bug#65002] [PATCH v3 4/6] tests: install: Use the smallest possible iteration time for LUKS Tomas Volf
2024-01-14 20:54 ` Ludovic Courtès
2024-01-11 17:35 ` [bug#65002] [PATCH v3 5/6] tests: install: Fix encrypted-root-os test Tomas Volf
2024-01-11 17:35 ` [bug#65002] [PATCH v3 6/6] tests: install: Fix encrypted-home-os, encrypted-home-os-key-file tests Tomas Volf
2024-01-14 20:53 ` bug#65002: [PATCH v3 1/6] mapped-devices: Allow unlocking by a key file Ludovic Courtès
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f868b4ab8b6ffdee7cfa0f2fc0c4ee3d7100f081.1690922760.git.wolf@wolfsden.cz \
--to=wolf@wolfsden.cz \
--cc=65002@debbugs.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).