SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cryptsetup: load libcryptsetup via dlopen in setup binaries

Browse Source 
Convert systemd-cryptsetup, systemd-cryptenroll, systemd-veritysetup
and systemd-integritysetup to go through the existing dlopen wrapper
for libcryptsetup instead of linking the library directly. Each binary
calls dlopen_cryptsetup() at the start of its run() and uses the sym_*
variants for every libcryptsetup entry point.

Extend cryptsetup-util.{h,c} to cover the libcryptsetup symbols that
these binaries use and that the wrapper was missing:
crypt_activate_by_token_pin, crypt_deactivate, crypt_init_data_device,
crypt_keyslot_status, crypt_set_keyring_to_link (conditional on
HAVE_CRYPT_SET_KEYRING_TO_LINK), crypt_status and
crypt_token_external_path.

With no direct callers of crypt_free() left, drop the non-sym
crypt_freep cleanup variant and rename sym_crypt_freep back to
crypt_freep via DEFINE_TRIVIAL_CLEANUP_FUNC_FULL_RENAME, matching the
naming convention used by other dlopen wrappers (acl_freep,
xkb_context_unrefp, ...). Update the remaining users in src/shared,
src/repart, src/home and src/growfs to the new name.

The four affected meson targets switch from libcryptsetup to
libcryptsetup_cflags so they no longer record a DT_NEEDED entry for
libcryptsetup.so.12.
This commit is contained in:
Daan De Meyer
2026-04-23 06:42:24 +02:00
committed by Daan De Meyer
parent 4114bf7e70
commit 43dab5ea87
21 changed files with 157 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cryptsetup/cryptsetup.c
+45 -43
View File
@@ -823,19 +823,19 @@ static PassphraseType check_registered_passwords(struct crypt_device *cd) {
assert(cd);
if (!streq_ptr(crypt_get_type(cd), CRYPT_LUKS2)) {
log_debug("%s: not a LUKS2 device, only passphrases are supported", crypt_get_device_name(cd));
if (!streq_ptr(sym_crypt_get_type(cd), CRYPT_LUKS2)) {
log_debug("%s: not a LUKS2 device, only passphrases are supported", sym_crypt_get_device_name(cd));
return PASSPHRASE_REGULAR;
}
/* Search all used slots */
assert_se((slot_max = crypt_keyslot_max(CRYPT_LUKS2)) > 0);
assert_se((slot_max = sym_crypt_keyslot_max(CRYPT_LUKS2)) > 0);
slots = new(bool, slot_max);
if (!slots)
return log_oom();
for (int slot = 0; slot < slot_max; slot++)
slots[slot] = IN_SET(crypt_keyslot_status(cd, slot), CRYPT_SLOT_ACTIVE, CRYPT_SLOT_ACTIVE_LAST);
slots[slot] = IN_SET(sym_crypt_keyslot_status(cd, slot), CRYPT_SLOT_ACTIVE, CRYPT_SLOT_ACTIVE_LAST);
/* Iterate all LUKS2 tokens and keep track of all their slots */
for (int token = 0; token < sym_crypt_token_max(CRYPT_LUKS2); token++) {
@@ -1132,7 +1132,7 @@ static int measure_keyslot(
return log_oom();
_cleanup_free_ char *s = NULL;
s = strjoin("cryptsetup-keyslot:", escaped, ":", strempty(crypt_get_uuid(cd)), ":", strempty(mechanism), ":", strempty(k));
s = strjoin("cryptsetup-keyslot:", escaped, ":", strempty(sym_crypt_get_uuid(cd)), ":", strempty(mechanism), ":", strempty(k));
if (!s)
return log_oom();
@@ -1207,7 +1207,7 @@ static int measured_crypt_activate_by_volume_key(
key_id, arg_fixate_volume_key);
}
r = crypt_activate_by_volume_key(cd, name, volume_key, volume_key_size, flags);
r = sym_crypt_activate_by_volume_key(cd, name, volume_key, volume_key_size, flags);
if (r == -EEXIST) /* volume is already active */
return log_external_activation(r, name);
if (r < 0)
@@ -1250,7 +1250,7 @@ static int measured_crypt_activate_by_passphrase(
if (arg_tpm2_measure_pcr == UINT_MAX && !arg_fixate_volume_key)
goto shortcut;
r = crypt_get_volume_key_size(cd);
r = sym_crypt_get_volume_key_size(cd);
if (r < 0)
return r;
if (r == 0) {
@@ -1262,14 +1262,14 @@ static int measured_crypt_activate_by_passphrase(
if (!vk)
return -ENOMEM;
keyslot = crypt_volume_key_get(cd, keyslot, vk, &vks, passphrase, passphrase_size);
keyslot = sym_crypt_volume_key_get(cd, keyslot, vk, &vks, passphrase, passphrase_size);
if (keyslot < 0)
return keyslot;
return measured_crypt_activate_by_volume_key(cd, name, mechanism, keyslot, vk, vks, flags);
shortcut:
keyslot = crypt_activate_by_passphrase(cd, name, keyslot, passphrase, passphrase_size, flags);
keyslot = sym_crypt_activate_by_passphrase(cd, name, keyslot, passphrase, passphrase_size, flags);
if (keyslot == -EEXIST) /* volume is already active */
return log_external_activation(keyslot, name);
if (keyslot < 0)
@@ -1320,7 +1320,7 @@ static int attach_tcrypt(
if (key_data) {
params.passphrase = key_data->iov_base;
params.passphrase_size = key_data->iov_len;
r = crypt_load(cd, CRYPT_TCRYPT, &params);
r = sym_crypt_load(cd, CRYPT_TCRYPT, &params);
} else if (key_file) {
r = read_one_line_file(key_file, &passphrase);
if (r < 0) {
@@ -1329,13 +1329,13 @@ static int attach_tcrypt(
}
params.passphrase = passphrase;
params.passphrase_size = strlen(passphrase);
r = crypt_load(cd, CRYPT_TCRYPT, &params);
r = sym_crypt_load(cd, CRYPT_TCRYPT, &params);
} else {
r = -EINVAL;
STRV_FOREACH(p, passwords){
params.passphrase = *p;
params.passphrase_size = strlen(*p);
r = crypt_load(cd, CRYPT_TCRYPT, &params);
r = sym_crypt_load(cd, CRYPT_TCRYPT, &params);
if (r >= 0)
break;
}
@@ -1353,7 +1353,7 @@ static int attach_tcrypt(
return r;
}
return log_error_errno(r, "Failed to load tcrypt superblock on device %s: %m", crypt_get_device_name(cd));
return log_error_errno(r, "Failed to load tcrypt superblock on device %s: %m", sym_crypt_get_device_name(cd));
}
r = measured_crypt_activate_by_volume_key(
@@ -1365,7 +1365,7 @@ static int attach_tcrypt(
/* volume_key_size= */ 0,
flags);
if (r < 0)
return log_error_errno(r, "Failed to activate tcrypt device %s: %m", crypt_get_device_name(cd));
return log_error_errno(r, "Failed to activate tcrypt device %s: %m", sym_crypt_get_device_name(cd));
return 0;
}
@@ -1509,7 +1509,7 @@ static bool use_token_plugins(void) {
if (r == 0)
return false;
return crypt_token_external_path();
return sym_crypt_token_external_path();
#else
return false;
#endif
@@ -1554,7 +1554,7 @@ static int crypt_activate_by_token_pin_ask_password(
_cleanup_strv_free_erase_ char **pins = NULL;
int r;
r = crypt_activate_by_token_pin(cd, name, type, CRYPT_ANY_TOKEN, /* pin= */ NULL, /* pin_size= */ 0, userdata, activation_flags);
r = sym_crypt_activate_by_token_pin(cd, name, type, CRYPT_ANY_TOKEN, /* pin= */ NULL, /* pin_size= */ 0, userdata, activation_flags);
if (r > 0) /* returns unlocked keyslot id on success */
return 0;
if (r == -EEXIST) /* volume is already active */
@@ -1567,7 +1567,7 @@ static int crypt_activate_by_token_pin_ask_password(
return r;
STRV_FOREACH(p, pins) {
r = crypt_activate_by_token_pin(cd, name, type, CRYPT_ANY_TOKEN, *p, strlen(*p), userdata, activation_flags);
r = sym_crypt_activate_by_token_pin(cd, name, type, CRYPT_ANY_TOKEN, *p, strlen(*p), userdata, activation_flags);
if (r > 0) /* returns unlocked keyslot id on success */
return 0;
if (r == -EEXIST) /* volume is already active */
@@ -1597,7 +1597,7 @@ static int crypt_activate_by_token_pin_ask_password(
return r;
STRV_FOREACH(p, pins) {
r = crypt_activate_by_token_pin(cd, name, type, CRYPT_ANY_TOKEN, *p, strlen(*p), userdata, activation_flags);
r = sym_crypt_activate_by_token_pin(cd, name, type, CRYPT_ANY_TOKEN, *p, strlen(*p), userdata, activation_flags);
if (r > 0) /* returns unlocked keyslot id on success */
return 0;
if (r == -EEXIST) /* volume is already active */
@@ -1658,7 +1658,7 @@ static int attach_luks_or_plain_or_bitlk_by_fido2(
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"FIDO2 mode with manual parameters selected, but no keyfile specified, refusing.");
friendly = friendly_disk_name(crypt_get_device_name(cd), name);
friendly = friendly_disk_name(sym_crypt_get_device_name(cd), name);
if (!friendly)
return log_oom();
@@ -1776,7 +1776,7 @@ static int attach_luks2_by_pkcs11_via_plugin(
#if HAVE_LIBCRYPTSETUP_PLUGINS
int r;
if (!streq_ptr(crypt_get_type(cd), CRYPT_LUKS2))
if (!streq_ptr(sym_crypt_get_type(cd), CRYPT_LUKS2))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Automatic PKCS#11 metadata requires LUKS2 device.");
systemd_pkcs11_plugin_params params = {
@@ -1786,7 +1786,7 @@ static int attach_luks2_by_pkcs11_via_plugin(
.askpw_flags = arg_ask_password_flags,
};
r = crypt_activate_by_token_pin(cd, name, "systemd-pkcs11", CRYPT_ANY_TOKEN, NULL, 0, &params, flags);
r = sym_crypt_activate_by_token_pin(cd, name, "systemd-pkcs11", CRYPT_ANY_TOKEN, NULL, 0, &params, flags);
if (r > 0) /* returns unlocked keyslot id on success */
r = 0;
if (r == -EEXIST) /* volume is already active */
@@ -1842,7 +1842,7 @@ static int attach_luks_or_plain_or_bitlk_by_pkcs11(
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "PKCS#11 mode selected but no key file specified, refusing.");
}
friendly = friendly_disk_name(crypt_get_device_name(cd), name);
friendly = friendly_disk_name(sym_crypt_get_device_name(cd), name);
if (!friendly)
return log_oom();
@@ -2036,7 +2036,7 @@ static int attach_luks_or_plain_or_bitlk_by_tpm2(
assert(name);
assert(arg_tpm2_device || arg_tpm2_device_auto);
friendly = friendly_disk_name(crypt_get_device_name(cd), name);
friendly = friendly_disk_name(sym_crypt_get_device_name(cd), name);
if (!friendly)
return log_oom();
@@ -2382,7 +2382,7 @@ static int attach_luks_or_plain_or_bitlk(
assert(cd);
assert(name);
if ((!arg_type && !crypt_get_type(cd)) || streq_ptr(arg_type, CRYPT_PLAIN)) {
if ((!arg_type && !sym_crypt_get_type(cd)) || streq_ptr(arg_type, CRYPT_PLAIN)) {
struct crypt_params_plain params = {
.offset = arg_offset,
.skip = arg_skip,
@@ -2421,7 +2421,7 @@ static int attach_luks_or_plain_or_bitlk(
/* In contrast to what the name crypt_format() might suggest this doesn't actually format
* anything, it just configures encryption parameters when used for plain mode. */
r = crypt_format(cd, CRYPT_PLAIN, cipher, cipher_mode, NULL, NULL, arg_keyfile_size, &params);
r = sym_crypt_format(cd, CRYPT_PLAIN, cipher, cipher_mode, NULL, NULL, arg_keyfile_size, &params);
if (r < 0)
return log_error_errno(r, "Loading of cryptographic parameters failed: %m");
@@ -2430,10 +2430,10 @@ static int attach_luks_or_plain_or_bitlk(
}
log_info("Set cipher %s, mode %s, key size %i bits for device %s.",
crypt_get_cipher(cd),
crypt_get_cipher_mode(cd),
crypt_get_volume_key_size(cd)*8,
crypt_get_device_name(cd));
sym_crypt_get_cipher(cd),
sym_crypt_get_cipher_mode(cd),
sym_crypt_get_volume_key_size(cd)*8,
sym_crypt_get_device_name(cd));
if (token_type == TOKEN_TPM2)
return attach_luks_or_plain_or_bitlk_by_tpm2(cd, name, key_file, key_data, until, flags, pass_volume_key);
@@ -2643,19 +2643,19 @@ static int verb_attach(int argc, char *argv[], uintptr_t _data, void *userdata)
if (arg_header) {
if (streq_ptr(arg_type, CRYPT_TCRYPT)){
log_debug("tcrypt header: %s", arg_header);
r = crypt_init_data_device(&cd, arg_header, source);
r = sym_crypt_init_data_device(&cd, arg_header, source);
} else {
log_debug("LUKS header: %s", arg_header);
r = crypt_init(&cd, arg_header);
r = sym_crypt_init(&cd, arg_header);
}
} else
r = crypt_init(&cd, source);
r = sym_crypt_init(&cd, source);
if (r < 0)
return log_error_errno(r, "crypt_init() failed: %m");
cryptsetup_enable_logging(cd);
status = crypt_status(cd, volume);
status = sym_crypt_status(cd, volume);
if (IN_SET(status, CRYPT_ACTIVE, CRYPT_BUSY)) {
log_info("Volume %s already active.", volume);
return 0;
@@ -2680,21 +2680,21 @@ static int verb_attach(int argc, char *argv[], uintptr_t _data, void *userdata)
}
if (!arg_type || STR_IN_SET(arg_type, ANY_LUKS, CRYPT_LUKS1, CRYPT_LUKS2)) {
r = crypt_load(cd, !arg_type || streq(arg_type, ANY_LUKS) ? CRYPT_LUKS : arg_type, NULL);
r = sym_crypt_load(cd, !arg_type || streq(arg_type, ANY_LUKS) ? CRYPT_LUKS : arg_type, NULL);
if (r < 0)
return log_error_errno(r, "Failed to load LUKS superblock on device %s: %m", crypt_get_device_name(cd));
return log_error_errno(r, "Failed to load LUKS superblock on device %s: %m", sym_crypt_get_device_name(cd));
/* since cryptsetup 2.7.0 (Jan 2024) */
#if HAVE_CRYPT_SET_KEYRING_TO_LINK
if (arg_link_key_description) {
r = crypt_set_keyring_to_link(cd, arg_link_key_description, NULL, arg_link_key_type, arg_link_keyring);
r = sym_crypt_set_keyring_to_link(cd, arg_link_key_description, NULL, arg_link_key_type, arg_link_keyring);
if (r < 0)
log_warning_errno(r, "Failed to set keyring or key description to link volume key in, ignoring: %m");
}
#endif
if (arg_header) {
r = crypt_set_data_device(cd, source);
r = sym_crypt_set_data_device(cd, source);
if (r < 0)
return log_error_errno(r, "Failed to set LUKS data device %s: %m", source);
}
@@ -2716,14 +2716,14 @@ static int verb_attach(int argc, char *argv[], uintptr_t _data, void *userdata)
return 0;
}
log_debug_errno(r, "Token activation unsuccessful for device %s: %m", crypt_get_device_name(cd));
log_debug_errno(r, "Token activation unsuccessful for device %s: %m", sym_crypt_get_device_name(cd));
}
}
if (streq_ptr(arg_type, CRYPT_BITLK)) {
r = crypt_load(cd, CRYPT_BITLK, NULL);
r = sym_crypt_load(cd, CRYPT_BITLK, NULL);
if (r < 0)
return log_error_errno(r, "Failed to load Bitlocker superblock on device %s: %m", crypt_get_device_name(cd));
return log_error_errno(r, "Failed to load Bitlocker superblock on device %s: %m", sym_crypt_get_device_name(cd));
}
bool use_cached_passphrase = true, try_discover_key = !key_file;
@@ -2850,7 +2850,7 @@ static int verb_detach(int argc, char *argv[], uintptr_t _data, void *userdata)
if (!filename_is_valid(volume))
return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Volume name '%s' is not valid.", volume);
r = crypt_init_by_name(&cd, volume);
r = sym_crypt_init_by_name(&cd, volume);
if (r == -ENODEV) {
log_info("Volume %s already inactive.", volume);
return 0;
@@ -2860,7 +2860,7 @@ static int verb_detach(int argc, char *argv[], uintptr_t _data, void *userdata)
cryptsetup_enable_logging(cd);
r = crypt_deactivate(cd, volume);
r = sym_crypt_deactivate(cd, volume);
if (r < 0)
return log_error_errno(r, "Failed to deactivate '%s': %m", volume);
@@ -2879,7 +2879,9 @@ static int run(int argc, char *argv[]) {
if (r <= 0)
return r;
cryptsetup_enable_logging(NULL);
r = dlopen_cryptsetup(LOG_ERR);
if (r < 0)
return r;
return dispatch_verb_with_args(args, NULL);
}
src/cryptsetup/meson.build
+1 -1
View File
@@ -18,7 +18,7 @@ executables += [
'public' : true,
'sources' : systemd_cryptsetup_sources,
'dependencies' : [
libcryptsetup,
libcryptsetup_cflags,
libfido2_cflags,
libmount_cflags,
libopenssl,