Merge pull request #14235 from fbuihuu/cryptsetup-fixes
Cryptsetup fixes
This commit is contained in:
Zbigniew Jędrzejewski-Szmek
GitHub
commit
36f43076b9
|
|
@ -92,17 +92,24 @@
|
|||
|
||||
<!-- note: do not use unicode ellipsis here, because docbook will replace that
|
||||
with three dots anyway, messing up alignment -->
|
||||
<programlisting>local-fs-pre.target
|
||||
<programlisting>(various cryptsetup
|
||||
devices...)
|
||||
|
|
||||
v
|
||||
(various mounts and (various swap (various cryptsetup
|
||||
fsck services...) devices...) devices...) (various low-level (various low-level
|
||||
| | | services: udevd, API VFS mounts:
|
||||
v v v tmpfiles, random mqueue, configfs,
|
||||
local-fs.target swap.target cryptsetup.target seed, sysctl, ...) debugfs, ...)
|
||||
| | | | |
|
||||
\__________________|_________________ | ___________________|____________________/
|
||||
\|/
|
||||
cryptsetup.target
|
||||
|
|
||||
v
|
||||
local-fs-pre.target
|
||||
|
|
||||
v
|
||||
(various mounts and (various swap
|
||||
fsck services...) devices...) (various low-level (various low-level
|
||||
| | services: udevd, API VFS mounts:
|
||||
v v tmpfiles, random mqueue, configfs,
|
||||
local-fs.target swap.target seed, sysctl, ...) debugfs, ...)
|
||||
| | | |
|
||||
\__________________|_________________ _________________|______________________/
|
||||
\ /
|
||||
v
|
||||
sysinit.target
|
||||
|
|
||||
|
|
|
|||
|
|
@ -431,6 +431,25 @@
|
|||
</para></listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term><option>x-initrd.attach</option></term>
|
||||
|
||||
<listitem><para>Setup this encrypted block device in the initramfs, similarly to
|
||||
<citerefentry><refentrytitle>systemd.mount</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
||||
units marked with <option>x-initrd.mount</option>.</para>
|
||||
|
||||
<para>Although it's not necessary to mark the mount entry for the root file system with
|
||||
<option>x-initrd.mount</option>, <option>x-initrd.attach</option> is still recommended with
|
||||
the encrypted block device containing the root file system as otherwise systemd will
|
||||
attempt to detach the device during the regular system shutdown while it's still in
|
||||
use. With this option the device will still be detached but later after the root file
|
||||
system is unmounted.</para>
|
||||
|
||||
<para>All other encrypted block devices that contain file systems mounted in the initramfs
|
||||
should use this option.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
</variablelist>
|
||||
|
||||
<para>At early boot and when the system manager configuration is
|
||||
|
|
|
|||
|
|
@ -227,7 +227,7 @@ static int create_disk(
|
|||
*filtered = NULL, *u_escaped = NULL, *filtered_escaped = NULL, *name_escaped = NULL, *header_path = NULL;
|
||||
_cleanup_fclose_ FILE *f = NULL;
|
||||
const char *dmname;
|
||||
bool noauto, nofail, tmp, swap, netdev;
|
||||
bool noauto, nofail, tmp, swap, netdev, attach_in_initrd;
|
||||
int r, detached_header, keyfile_can_timeout;
|
||||
|
||||
assert(name);
|
||||
|
|
@ -238,6 +238,7 @@ static int create_disk(
|
|||
tmp = fstab_test_option(options, "tmp\0");
|
||||
swap = fstab_test_option(options, "swap\0");
|
||||
netdev = fstab_test_option(options, "_netdev\0");
|
||||
attach_in_initrd = fstab_test_option(options, "x-initrd.attach\0");
|
||||
|
||||
keyfile_can_timeout = fstab_filter_options(options, "keyfile-timeout\0", NULL, &keyfile_timeout_value, NULL);
|
||||
if (keyfile_can_timeout < 0)
|
||||
|
|
@ -290,12 +291,15 @@ static int create_disk(
|
|||
"Documentation=man:crypttab(5) man:systemd-cryptsetup-generator(8) man:systemd-cryptsetup@.service(8)\n"
|
||||
"SourcePath=%s\n"
|
||||
"DefaultDependencies=no\n"
|
||||
"Conflicts=umount.target\n"
|
||||
"IgnoreOnIsolate=true\n"
|
||||
"After=%s\n",
|
||||
arg_crypttab,
|
||||
netdev ? "remote-fs-pre.target" : "cryptsetup-pre.target");
|
||||
|
||||
/* If initrd takes care of attaching the disk then it should also detach it during shutdown. */
|
||||
if (!attach_in_initrd)
|
||||
fprintf(f, "Conflicts=umount.target\n");
|
||||
|
||||
if (password) {
|
||||
password_escaped = specifier_escape(password);
|
||||
if (!password_escaped)
|
||||
|
|
|
|||
|
|
@ -228,7 +228,7 @@ static int parse_one_option(const char *option) {
|
|||
if (r < 0)
|
||||
return log_error_errno(r, "Failed to parse %s: %m", option);
|
||||
|
||||
} else
|
||||
} else if (!streq(option, "x-initrd.attach"))
|
||||
log_warning("Encountered unknown /etc/crypttab option '%s', ignoring.", option);
|
||||
|
||||
return 0;
|
||||
|
|
|
|||
|
|
@ -11,3 +11,4 @@
|
|||
Description=Local File Systems (Pre)
|
||||
Documentation=man:systemd.special(7)
|
||||
RefuseManualStart=yes
|
||||
After=cryptsetup.target
|
||||
|
|
|
|||
|
|
@ -74,6 +74,7 @@ units = [
|
|||
'sysinit.target.wants/'],
|
||||
['sysinit.target', ''],
|
||||
['syslog.socket', ''],
|
||||
['system-systemd\\x2dcryptsetup.slice', 'HAVE_LIBCRYPTSETUP'],
|
||||
['system-update.target', ''],
|
||||
['system-update-pre.target', ''],
|
||||
['system-update-cleanup.service', ''],
|
||||
|
|
|
|||
|
|
@ -11,3 +11,4 @@
|
|||
Description=Remote File Systems (Pre)
|
||||
Documentation=man:systemd.special(7)
|
||||
RefuseManualStart=yes
|
||||
After=remote-cryptsetup.target
|
||||
|
|
|
|||
13
units/system-systemd\x2dcryptsetup.slice
Normal file
13
units/system-systemd\x2dcryptsetup.slice
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# SPDX-License-Identifier: LGPL-2.1+
|
||||
#
|
||||
# This file is part of systemd.
|
||||
#
|
||||
# systemd is free software; you can redistribute it and/or modify it
|
||||
# under the terms of the GNU Lesser General Public License as published by
|
||||
# the Free Software Foundation; either version 2.1 of the License, or
|
||||
# (at your option) any later version.
|
||||
|
||||
[Unit]
|
||||
Description=Cryptsetup Units Slice
|
||||
Documentation=man:systemd.special(7)
|
||||
DefaultDependencies=no
|
||||
Loading…
Reference in a new issue