blob: d64af3743707a7a035254789f88cf2ba87c3a96c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
|
#!/bin/sh
# lh_binary_encryption(1) - encrypts rootfs
# Copyright (C) 2006-2009 Daniel Baumann <daniel@debian.org>
#
# live-helper comes with ABSOLUTELY NO WARRANTY; for details see COPYING.
# This is free software, and you are welcome to redistribute it
# under certain conditions; see COPYING for details.
set -e
# Including common functions
. "${LH_BASE:-/usr/share/live-helper}"/functions.sh
# Setting static variables
DESCRIPTION="$(Echo 'encrypts rootfs')"
HELP=""
USAGE="${PROGRAM} [--force]"
Arguments "${@}"
# Reading configuration files
Read_conffiles config/all config/common config/bootstrap config/chroot config/binary config/source
Set_defaults
if [ "${LH_BINARY_IMAGES}" = "virtual-hdd" ]
then
exit 0
fi
case "${LH_ENCRYPTION}" in
aes128|aes192|aes256)
;;
""|disabled)
exit 0
;;
*)
Echo_error "Encryption type %s not supported." "${LH_ENCRYPTION}"
exit 1
;;
esac
case "${LH_CHROOT_FILESYSTEM}" in
ext2|squashfs)
;;
*)
Echo_error "Encryption not yet supported on %s filesystems." "${LH_CHROOT_FILESYSTEM}"
exit 1
;;
esac
Echo_message "Begin encrypting root filesystem image..."
# Requiring stage file
Require_stagefile .stage/config .stage/bootstrap .stage/binary_rootfs
# Checking stage file
Check_stagefile .stage/binary_encryption
# Checking lock file
Check_lockfile .lock
# Creating lock file
Create_lockfile .lock
case "${LH_INITRAMFS}" in
casper)
INITFS="casper"
;;
live-initramfs)
INITFS="live"
;;
esac
# Checking depends
Check_package chroot/usr/bin/aespipe aespipe
# Restoring cache
Restore_cache cache/packages_binary
# Installing depends
Install_package
Echo_message "Encrypting binary/%s/filesystem.%s with %s..." "${INITFS}" "${LH_CHROOT_FILESYSTEM}" "${LH_ENCRYPTION}"
if [ "${LH_CHROOT_BUILD}" = "enabled" ]
then
# Moving image
mv binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM} chroot
fi
while true
do
echo
echo " **************************************"
Echo " ** Configuring encrypted filesystem **"
echo " **************************************"
Echo " (Passwords must be at least 20 characters long)"
echo
case "${LH_CHROOT_BUILD}" in
enabled)
if Chroot chroot aespipe -e ${LH_ENCRYPTION} -T \
< chroot/filesystem.${LH_CHROOT_FILESYSTEM} \
> chroot/filesystem.${LH_CHROOT_FILESYSTEM}.tmp
then
mv chroot/filesystem.${LH_CHROOT_FILESYSTEM}.tmp binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM}
break
fi
;;
disabled)
if aespipe -e ${LH_ENCRYPTION} -T \
< binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM} \
> binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM}.tmp
then
mv binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM}.tmp binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM}
break
fi
;;
esac
printf "\nThere was an error configuring encryption ... Retry? [Y/n] "
read ANSWER
if [ "$(echo "${ANSWER}" | cut -b1 | tr A-Z a-z)" = "n" ]
then
unset ANSWER
break
fi
done
# Cleanup temporary filesystems
rm -f chroot/filesystem.${LH_CHROOT_FILESYSTEM}
rm -f chroot/filesystem.${LH_CHROOT_FILESYSTEM}.tmp
rm -f binary/${INITFS}/filesystem.${LH_CHROOT_FILESYSTEM}.tmp
# Saving cache
Save_cache cache/packages_binary
# Removing depends
Remove_package
# Creating stage file
Create_stagefile .stage/binary_encryption
|
