summaryrefslogtreecommitdiff
path: root/scripts/build/lb_binary_encryption
blob: 2508e85d6d9ce519891db77c7095b0bb40d758c9 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
#!/bin/sh

## live-build(7) - System Build Scripts
## Copyright (C) 2006-2011 Daniel Baumann <daniel@debian.org>
##
## live-build comes with ABSOLUTELY NO WARRANTY; for details see COPYING.
## This is free software, and you are welcome to redistribute it
## under certain conditions; see COPYING for details.


set -e

# Including common functions
. "${LB_BASE:-/usr/share/live/build}"/scripts/build.sh

# Setting static variables
DESCRIPTION="$(Echo 'encrypts rootfs')"
HELP=""
USAGE="${PROGRAM} [--force]"

Arguments "${@}"

# Reading configuration files
Read_conffiles config/all config/common config/bootstrap config/chroot config/binary config/source
Set_defaults

if [ "${LB_BINARY_IMAGES}" = "virtual-hdd" ]
then
	exit 0
fi

case "${LB_ENCRYPTION}" in
	aes128|aes192|aes256)
		;;
	""|false)
		exit 0
		;;
	*)
		Echo_error "Encryption type %s not supported." "${LB_ENCRYPTION}"
		exit 1
		;;
esac

case "${LB_CHROOT_FILESYSTEM}" in
	ext2|squashfs)
		;;

	*)
		Echo_error "Encryption not yet supported on %s filesystems." "${LB_CHROOT_FILESYSTEM}"
		exit 1
		;;
esac

Echo_message "Begin encrypting root filesystem image..."

# Requiring stage file
Require_stagefile .stage/config .stage/bootstrap .stage/binary_rootfs

# Checking stage file
Check_stagefile .stage/binary_encryption

# Checking lock file
Check_lockfile .lock

# Creating lock file
Create_lockfile .lock

case "${LB_INITRAMFS}" in
	casper)
		INITFS="casper"
		;;

	live-initramfs|live-boot)
		INITFS="live"
		;;
esac

# Checking depends
Check_package chroot/usr/bin/aespipe aespipe

# Restoring cache
Restore_cache cache/packages_binary

# Installing depends
Install_package

Echo_message "Encrypting binary/%s/filesystem.%s with %s..." "${INITFS}" "${LB_CHROOT_FILESYSTEM}" "${LB_ENCRYPTION}"

if [ "${LB_BUILD_WITH_CHROOT}" = "true" ]
then
	# Moving image
	mv binary/${INITFS}/filesystem.${LB_CHROOT_FILESYSTEM} chroot
fi

while true
do
	echo
	echo " **************************************"
	Echo " ** Configuring encrypted filesystem **"
	echo " **************************************"
	Echo " (Passwords must be at least 20 characters long)"
	echo

	case "${LB_BUILD_WITH_CHROOT}" in
		true)
			if Chroot chroot aespipe -e ${LB_ENCRYPTION} -T \
				< chroot/filesystem.${LB_CHROOT_FILESYSTEM} \
				> chroot/filesystem.${LB_CHROOT_FILESYSTEM}.tmp
			then
				mv chroot/filesystem.${LB_CHROOT_FILESYSTEM}.tmp binary/${INITFS}/filesystem.${LB_CHROOT_FILESYSTEM}
				break
			fi
			;;
		false)
			if aespipe -e ${LB_ENCRYPTION} -T \
				< binary/${INITFS}/filesystem.${LB_CHROOT_FILESYSTEM} \
				> binary/${INITFS}/filesystem.${LB_CHROOT_FILESYSTEM}.tmp
			then
				mv binary/${INITFS}/filesystem.${LB_CHROOT_FILESYSTEM}.tmp binary/${INITFS}/filesystem.${LB_CHROOT_FILESYSTEM}
				break
			fi
			;;
	esac

	printf "\nThere was an error configuring encryption ... Retry? [Y/n] "
	read ANSWER

	if [ "$(echo "${ANSWER}" | cut -b1 | tr A-Z a-z)" = "n" ]
	then
		unset ANSWER
		break
	fi
done
	
# Cleanup temporary filesystems
rm -f chroot/filesystem.${LB_CHROOT_FILESYSTEM}
rm -f chroot/filesystem.${LB_CHROOT_FILESYSTEM}.tmp
rm -f binary/${INITFS}/filesystem.${LB_CHROOT_FILESYSTEM}.tmp

# Saving cache
Save_cache cache/packages_binary

# Removing depends
Remove_package

# Creating stage file
Create_stagefile .stage/binary_encryption