From 947d21171bdd8375db6482bc7d758d74b27f7dd4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 5 Sep 2017 09:14:51 +0200 Subject: [PATCH 1/5] units: order cryptsetup-pre.target before cryptsetup.target Normally this happens automatically, but if it happened that both targets were pulled in, even though there were no cryptsetup units, they could be started in reverse order, which would be somewhat confusing. Add an explicit ordering to avoid this potential issue. --- units/cryptsetup-pre.target | 1 + 1 file changed, 1 insertion(+) diff --git a/units/cryptsetup-pre.target b/units/cryptsetup-pre.target index 65353419fc..42e35dd4e4 100644 --- a/units/cryptsetup-pre.target +++ b/units/cryptsetup-pre.target @@ -9,3 +9,4 @@ Description=Encrypted Volumes (Pre) Documentation=man:systemd.special(7) RefuseManualStart=yes +Before=cryptsetup.target From ed3657d5dbc5fa7724c50fd0c4cf6503cd0896e1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 5 Sep 2017 10:25:45 +0200 Subject: [PATCH 2/5] man: order fields alphabetically in crypttab(5) They already were mostly ordered alphabetically, but some disorder snuck in. Also, fix formatting. Some options were described using "--" prefixes, which looks like the text was just copied from crypttab(8). --- man/crypttab.xml | 93 ++++++++++++++++++++++++------------------------ 1 file changed, 46 insertions(+), 47 deletions(-) diff --git a/man/crypttab.xml b/man/crypttab.xml index 49896a45ba..5223e16664 100644 --- a/man/crypttab.xml +++ b/man/crypttab.xml @@ -69,8 +69,7 @@ Empty lines and lines starting with the # character are ignored. Each of the remaining lines describes one - encrypted block device, fields on the line are delimited by white - space. + encrypted block device. Fields are delimited by white space. Each line is in the formname encrypted-device password options The first two fields are mandatory, the remaining two are @@ -108,14 +107,6 @@ - - - - Allow discard requests to be passed through - the encrypted block device. This improves performance on SSD - storage but has security implications. - - @@ -127,6 +118,14 @@ recommended. + + + + Allow discard requests to be passed through the encrypted block + device. This improves performance on SSD storage but has security implications. + + + @@ -148,30 +147,6 @@ option. - - - - Start offset in the backend device, in 512-byte sectors. - This option is only relevant for plain devices. - - - - - - - How many 512-byte sectors of the encrypted data to skip - at the beginning. This is different from the - option with respect to the sector numbers used in initialization vector - (IV) calculation. Using will shift the IV - calculation by the same negative amount. Hence, if is given, - sector n will get a sector number of 0 for the IV calculation. - Using causes sector n to also be the first - sector of the mapped device, but with its number for IV generation being n. - - This option is only relevant for plain devices. - - - @@ -231,6 +206,13 @@ does not show up. + + + + Start offset in the backend device, in 512-byte sectors. This + option is only relevant for plain devices. + + @@ -244,6 +226,23 @@ mode. + + + + How many 512-byte sectors of the encrypted data to skip at the + beginning. This is different from the option with respect + to the sector numbers used in initialization vector (IV) calculation. Using + will shift the IV calculation by the same negative + amount. Hence, if is given, + sector n will get a sector number of 0 for the IV + calculation. Using causes sector + n to also be the first sector of the mapped device, but + with its number for IV generation being n. + + This option is only relevant for plain devices. + + + @@ -349,19 +348,6 @@ indefinitely (which is the default). - - - - Specifies how long systemd should wait for a - device to show up before giving up on the entry. The argument - is a time in seconds or explicitly specified units of - s, - min, - h, - ms. - - - @@ -393,6 +379,19 @@ typos. + + + + Specifies how long systemd should wait for a device to show up + before giving up on the entry. The argument is a time in seconds or explicitly + specified units of + s, + min, + h, + ms. + + + At early boot and when the system manager configuration is From 0f00528db4e941503ec8cb5052367b17a8b566ba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 5 Sep 2017 11:20:14 +0200 Subject: [PATCH 3/5] man: add an explicit description of _netdev to systemd.mount(5) It was mentioned in passing, but having it in the list of options is also nice. --- man/systemd.mount.xml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/man/systemd.mount.xml b/man/systemd.mount.xml index 1bed7d17f1..3d3a0a7cc7 100644 --- a/man/systemd.mount.xml +++ b/man/systemd.mount.xml @@ -298,6 +298,23 @@ details. + + + + + Normally the file system type is used to determine if a + mount is a "network mount", i.e. if it should only be started after the + network is available. Using this option overrides this detection and + specifies that the mount requires network. + + Network mount units are ordered between remote-fs-pre.target + and remote-fs.target, instead of + local-fs-pre.target and local-fs.target. + They also pull in network-online.target and are ordered after + it and network.target. + + + From 889128b8b27abb13e1691a72e4ce0562c564e257 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 5 Sep 2017 10:15:13 +0200 Subject: [PATCH 4/5] units: add remote-cryptsetup.target and remote-cryptsetup-pre.target The pair is similar to remote-fs.target and remote-fs-pre.target. Any cryptsetup devices which require network shall be ordered after remote-cryptsetup-pre.target and before remote-cryptsetup.target. --- man/systemd.special.xml | 23 +++++++++++++++++++++++ units/cryptsetup-pre.target | 2 +- units/cryptsetup.target | 2 +- units/meson.build | 3 +++ units/remote-cryptsetup-pre.target | 15 +++++++++++++++ units/remote-cryptsetup.target | 10 ++++++++++ 6 files changed, 53 insertions(+), 2 deletions(-) create mode 100644 units/remote-cryptsetup-pre.target create mode 100644 units/remote-cryptsetup.target diff --git a/man/systemd.special.xml b/man/systemd.special.xml index 9c916bee6f..2993d67c76 100644 --- a/man/systemd.special.xml +++ b/man/systemd.special.xml @@ -82,6 +82,8 @@ poweroff.target, printer.target, reboot.target, + remote-cryptsetup-pre.target, + remote-cryptsetup.target, remote-fs-pre.target, remote-fs.target, rescue.target, @@ -477,6 +479,27 @@ this target unit, for compatibility with SysV. + + remote-cryptsetup-pre.target + + This target unit is automatically ordered before all cryptsetup devices + marked with the . It can be used to execute additional + units before such devices are set up. + + It is ordered after network.target and + network-online.target, and also pulls the latter in as a + Wants= dependency. + + + + remote-cryptsetup.target + + Similar to cryptsetup.target, but for encrypted + devices which are accessed over the network. It is used for + crypttab8 + entries marked with . + + remote-fs.target diff --git a/units/cryptsetup-pre.target b/units/cryptsetup-pre.target index 42e35dd4e4..6cb28a61ae 100644 --- a/units/cryptsetup-pre.target +++ b/units/cryptsetup-pre.target @@ -6,7 +6,7 @@ # (at your option) any later version. [Unit] -Description=Encrypted Volumes (Pre) +Description=Local Encrypted Volumes (Pre) Documentation=man:systemd.special(7) RefuseManualStart=yes Before=cryptsetup.target diff --git a/units/cryptsetup.target b/units/cryptsetup.target index 25d3e33f6a..10b17fd387 100644 --- a/units/cryptsetup.target +++ b/units/cryptsetup.target @@ -6,5 +6,5 @@ # (at your option) any later version. [Unit] -Description=Encrypted Volumes +Description=Local Encrypted Volumes Documentation=man:systemd.special(7) diff --git a/units/meson.build b/units/meson.build index be32a39e5f..2024d0bfa1 100644 --- a/units/meson.build +++ b/units/meson.build @@ -48,6 +48,9 @@ units = [ ['proc-sys-fs-binfmt_misc.mount', 'ENABLE_BINFMT'], ['reboot.target', '', 'runlevel6.target ctrl-alt-del.target'], + ['remote-cryptsetup-pre.target', 'HAVE_LIBCRYPTSETUP'], + ['remote-cryptsetup.target', 'HAVE_LIBCRYPTSETUP', + join_paths(pkgsysconfdir, 'system/multi-user.target.wants/')], ['remote-fs-pre.target', ''], ['remote-fs.target', '', join_paths(pkgsysconfdir, 'system/multi-user.target.wants/')], diff --git a/units/remote-cryptsetup-pre.target b/units/remote-cryptsetup-pre.target new file mode 100644 index 0000000000..a375e61889 --- /dev/null +++ b/units/remote-cryptsetup-pre.target @@ -0,0 +1,15 @@ +# This file is part of systemd. +# +# systemd is free software; you can redistribute it and/or modify it +# under the terms of the GNU Lesser General Public License as published by +# the Free Software Foundation; either version 2.1 of the License, or +# (at your option) any later version. + +[Unit] +Description=Remote Encrypted Volumes (Pre) +Documentation=man:systemd.special(7) +RefuseManualStart=yes +Before=remote-cryptsetup.target + +After=network.target network-online.target +Wants=network-online.target diff --git a/units/remote-cryptsetup.target b/units/remote-cryptsetup.target new file mode 100644 index 0000000000..60943bd1cb --- /dev/null +++ b/units/remote-cryptsetup.target @@ -0,0 +1,10 @@ +# This file is part of systemd. +# +# systemd is free software; you can redistribute it and/or modify it +# under the terms of the GNU Lesser General Public License as published by +# the Free Software Foundation; either version 2.1 of the License, or +# (at your option) any later version. + +[Unit] +Description=Remote Encrypted Volumes +Documentation=man:systemd.special(7) From b001ad61e91b6499897f0c977045c7608c233bfa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 5 Sep 2017 11:30:33 +0200 Subject: [PATCH 5/5] cryptsetup-generator: use remote-cryptsetup.target when _netdev is present This allows such devices to depend on the network. Their startup will be delayed similarly to network mount units. Fixes #4642. --- man/crypttab.xml | 13 ++++++++++++ src/cryptsetup/cryptsetup-generator.c | 30 +++++++++++++++------------ 2 files changed, 30 insertions(+), 13 deletions(-) diff --git a/man/crypttab.xml b/man/crypttab.xml index 5223e16664..ac7d55271c 100644 --- a/man/crypttab.xml +++ b/man/crypttab.xml @@ -191,6 +191,19 @@ . + + + + Marks this cryptsetup device as requiring network. It will be + started after the network is available, similarly to + systemd.mount5 + units marked with . The service unit to set up this device + will be ordered between remote-cryptsetup-pre.target and + remote-cryptsetup.target, instead of + cryptsetup-pre.target and + cryptsetup.target. + + diff --git a/src/cryptsetup/cryptsetup-generator.c b/src/cryptsetup/cryptsetup-generator.c index 613b018ce6..11d9892658 100644 --- a/src/cryptsetup/cryptsetup-generator.c +++ b/src/cryptsetup/cryptsetup-generator.c @@ -62,7 +62,7 @@ static int create_disk( *filtered = NULL; _cleanup_fclose_ FILE *f = NULL; const char *dmname; - bool noauto, nofail, tmp, swap; + bool noauto, nofail, tmp, swap, netdev; int r; assert(name); @@ -72,6 +72,7 @@ static int create_disk( nofail = fstab_test_yes_no_option(options, "nofail\0" "fail\0"); tmp = fstab_test_option(options, "tmp\0"); swap = fstab_test_option(options, "swap\0"); + netdev = fstab_test_option(options, "_netdev\0"); if (tmp && swap) { log_error("Device '%s' cannot be both 'tmp' and 'swap'. Ignoring.", name); @@ -102,20 +103,22 @@ static int create_disk( if (!f) return log_error_errno(errno, "Failed to create unit file %s: %m", p); - fputs_unlocked("# Automatically generated by systemd-cryptsetup-generator\n\n" - "[Unit]\n" - "Description=Cryptography Setup for %I\n" - "Documentation=man:crypttab(5) man:systemd-cryptsetup-generator(8) man:systemd-cryptsetup@.service(8)\n" - "SourcePath=/etc/crypttab\n" - "DefaultDependencies=no\n" - "Conflicts=umount.target\n" - "IgnoreOnIsolate=true\n" - "After=cryptsetup-pre.target\n", - f); + fprintf(f, + "# Automatically generated by systemd-cryptsetup-generator\n\n" + "[Unit]\n" + "Description=Cryptography Setup for %%I\n" + "Documentation=man:crypttab(5) man:systemd-cryptsetup-generator(8) man:systemd-cryptsetup@.service(8)\n" + "SourcePath=/etc/crypttab\n" + "DefaultDependencies=no\n" + "Conflicts=umount.target\n" + "IgnoreOnIsolate=true\n" + "After=%s\n", + netdev ? "remote-cryptsetup-pre.target" : "cryptsetup-pre.target"); if (!nofail) fprintf(f, - "Before=cryptsetup.target\n"); + "Before=%s\n", + netdev ? "remote-cryptsetup.target" : "cryptsetup.target"); if (password) { if (STR_IN_SET(password, "/dev/urandom", "/dev/random", "/dev/hw_random")) @@ -191,7 +194,8 @@ static int create_disk( if (r < 0) return r; - r = generator_add_symlink(arg_dest, "cryptsetup.target", + r = generator_add_symlink(arg_dest, + netdev ? "remote-cryptsetup.target" : "cryptsetup.target", nofail ? "wants" : "requires", n); if (r < 0) return r;