This commit is contained in:
наб 2021-10-17 02:23:24 +02:00
parent 01fa1b6031
commit d5107f9415
No known key found for this signature in database
GPG Key ID: BCFD0B018D2658F1
14 changed files with 30 additions and 11 deletions

View File

@ -42,17 +42,17 @@ WITH_PROMPTABLE_TTY{< /dev/console > /dev/console 2>&1}
# If pool encryption is active and the zfs command understands '-o encryption'
if [ "$(zpool list -H -o feature@encryption "$(echo "$BOOTFS" | awk -F/ '{print $1}')")" = "active" ]; then
if [ "$(zpool list -H -o feature@encryption "${BOOTFS%%/*}")" = "active" ]; then
ENCRYPTIONROOT="$(zfs get -H -o value encryptionroot "$BOOTFS")"
if ! [ "${ENCRYPTIONROOT}" = "-" ]; then
# Match this sexion to i-t/zfs-patch.sh
if command -v zfs-tpm2-load-key > /dev/null && ! [ "$(zfs-tpm-list -Hub TPM2 "$ENCRYPTIONROOT")" = "" ]; then
if command -v zfs-tpm2-load-key > /dev/null && [ -n "$(zfs-tpm-list -Hub TPM2 "$ENCRYPTIONROOT")" ]; then
with_promptable_tty zfs-tpm2-load-key "$ENCRYPTIONROOT"
exit
fi
if command -v zfs-tpm1x-load-key > /dev/null && ! [ "$(zfs-tpm-list -Hub TPM1.X "$ENCRYPTIONROOT")" = "" ]; then
if command -v zfs-tpm1x-load-key > /dev/null && [ -n "$(zfs-tpm-list -Hub TPM1.X "$ENCRYPTIONROOT")" ]; then
POTENTIALLY_START_TCSD{ss -ltO, > /dev/console 2>&1}
with_promptable_tty zfs-tpm1x-load-key "$ENCRYPTIONROOT"; err="$?"
POTENTIALLY_KILL_TCSD{}

View File

@ -14,12 +14,11 @@ PREREQ="zfs"
# which should be compatible with other hooks doing the same thing
[ "${verbose:-n}" = "y" ] && echo "Patching /scripts/zfs"
sed -Ei 's/^decrypt_fs\(\)/__tzpfms__&/' "$DESTDIR/scripts/zfs"
cat /usr/share/tzpfms/initramfs-tools-zfs-patch.sh >> "$DESTDIR/scripts/zfs"
cat /usr/share/tzpfms/initramfs-tools-zfs-patch.sh >> "$DESTDIR/scripts/zfs"
for x in zfs-tpm-list zfs-tpm2-load-key zfs-tpm1x-load-key tpm_resetdalock tcsd $(find /usr/lib -name 'libtss2-tcti*.so*'); do # TODO: there's got to be a better way™!
xloc="$(command -v "$x")"
[ "$xloc" = "" ] || copy_exec "$xloc"
xloc="$(command -v "$x")" && copy_exec "$xloc"
done
INSTALL_TPM1X{, DESTDIR, copy_file rule, copy_file config, copy_file state, copy_exec}

View File

@ -17,17 +17,17 @@ decrypt_fs() {
# First three lines borrowed from /scripts/zfs#decrypt_fs()
# If pool encryption is active and the zfs command understands '-o encryption'
if [ "$(zpool list -H -o feature@encryption "$(echo "$fs" | awk -F/ '{print $1}')")" = "active" ]; then
if [ "$(zpool list -H -o feature@encryption "${fs%%/*}")" = "active" ]; then
ENCRYPTIONROOT="$(get_fs_value "$fs" encryptionroot)"
if ! [ "$ENCRYPTIONROOT" = "-" ]; then
# Match this sexion to dracut/tzpfms-load-key.sh
if command -v zfs-tpm2-load-key > /dev/null && ! [ "$(zfs-tpm-list -Hub TPM2 "$ENCRYPTIONROOT")" = "" ]; then
if command -v zfs-tpm2-load-key > /dev/null && [ -n "$(zfs-tpm-list -Hub TPM2 "$ENCRYPTIONROOT")" ]; then
with_promptable_tty zfs-tpm2-load-key "$ENCRYPTIONROOT"
return
fi
if command -v zfs-tpm1x-load-key > /dev/null && ! [ "$(zfs-tpm-list -Hub TPM1.X "$ENCRYPTIONROOT")" = "" ]; then
if command -v zfs-tpm1x-load-key > /dev/null && [ -n "$(zfs-tpm-list -Hub TPM1.X "$ENCRYPTIONROOT")" ]; then
POTENTIALLY_START_TCSD{netstat -lt, }
with_promptable_tty zfs-tpm1x-load-key "$ENCRYPTIONROOT"; err="$?"
POTENTIALLY_KILL_TCSD{}

View File

@ -9,7 +9,7 @@
# Instead, clear if there's a "quiet", leave alone otherwise, and always restore;
# cmdline option "plymouth.ignore-show-splash" can be used to disable splashes altogether, if desired.
with_promptable_tty() {
if command -v plymouth > /dev/null && plymouth --ping; then
if plymouth --ping 2>/dev/null; then
plymouth hide-splash
# shellcheck disable=SC2217
[ "${quiet:-n}" = "y" ] && printf '\033c' REDIREXIONS
@ -19,7 +19,7 @@
plymouth show-splash
else
# Mimic /scripts/zfs#decrypt_fs(): setting "printk" temporarily to "7" will allow prompt even if kernel option "quiet"
printk="$(awk '{print $1}' /proc/sys/kernel/printk)"
read -r printk _ < /proc/sys/kernel/printk
[ "$printk" = "7" ] || echo 7 > /proc/sys/kernel/printk
"$@" REDIREXIONS; ret="$?"

View File

@ -1,3 +1,5 @@
.\" SPDX-License-Identifier: MIT
.
.Sh TPM1.X back-end configuration
.Ss TPM selection
The

View File

@ -1,3 +1,5 @@
.\" SPDX-License-Identifier: MIT
.
.Sh TPM2 back-end configuration
.Ss Environment variables
.Bl -tag -compact -width "TSS2_LOG"

View File

@ -1,3 +1,5 @@
.\" SPDX-License-Identifier: MIT
.
.Sh SPECIAL THANKS
To all who support further development, in particular:
.Bl -bullet -offset 4n -compact -width 0

View File

@ -1,3 +1,5 @@
.\" SPDX-License-Identifier: MIT
.
.Dd
.Dt ZFS-TPM-LIST 8
.Os

View File

@ -1,3 +1,5 @@
.\" SPDX-License-Identifier: MIT
.
.Dd
.Dt ZFS-TPM1X-CHANGE-KEY 8
.Os

View File

@ -1,3 +1,5 @@
.\" SPDX-License-Identifier: MIT
.
.Dd
.Dt ZFS-TPM1X-CLEAR-KEY 8
.Os

View File

@ -1,3 +1,5 @@
.\" SPDX-License-Identifier: MIT
.
.Dd
.Dt ZFS-TPM1X-LOAD-KEY 8
.Os

View File

@ -1,3 +1,5 @@
.\" SPDX-License-Identifier: MIT
.
.Dd
.Dt ZFS-TPM2-CHANGE-KEY 8
.Os

View File

@ -1,3 +1,5 @@
.\" SPDX-License-Identifier: MIT
.
.Dd
.Dt ZFS-TPM2-CLEAR-KEY 8
.Os

View File

@ -1,3 +1,5 @@
.\" SPDX-License-Identifier: MIT
.
.Dd
.Dt ZFS-TPM2-LOAD-KEY 8
.Os