SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

repart: make --key-file also configurable in repart.d/*

Browse Source 
Add repart.d KeyFile= option with the same syntax as --key-file.
This allows a per-partition key file encryption, and not rely on a global key
applicable to all partitions.

The global --key-file overrides KeyFile config. If none of them is
defined, rely on default.
This commit is contained in:
Emanuele Giuseppe Esposito
2025-08-26 07:17:12 -04:00
parent 49dcc89ddc
commit eb44fa4d19
3 changed files with 75 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/repart/repart.c
+60 -18
View File
@@ -411,6 +411,7 @@ typedef struct Partition {
OrderedHashmap *subvolumes;
char *default_subvolume;
EncryptMode encrypt;
struct iovec key;
Tpm2PCRValue *tpm2_hash_pcr_values;
size_t tpm2_n_hash_pcr_values;
VerityMode verity;
@@ -681,6 +682,8 @@ static Partition* partition_free(Partition *p) {
free(p->compression);
free(p->compression_level);
iovec_done_erase(&p->key);
copy_files_free_many(p->copy_files, p->n_copy_files);
iovec_done(&p->roothash);
@@ -723,6 +726,8 @@ static void partition_foreignize(Partition *p) {
p->compression = mfree(p->compression);
p->compression_level = mfree(p->compression_level);
iovec_done_erase(&p->key);
copy_files_free_many(p->copy_files, p->n_copy_files);
p->copy_files = NULL;
p->n_copy_files = 0;
@@ -2496,6 +2501,51 @@ static int config_parse_tpm2_pcrs(
&partition->tpm2_n_hash_pcr_values);
}
static int parse_key_file(const char *filename, struct iovec *key) {
_cleanup_(erase_and_freep) char *k = NULL;
size_t n = 0;
int r;
r = read_full_file_full(
AT_FDCWD, filename,
/* offset= */ UINT64_MAX,
/* size= */ SIZE_MAX,
READ_FULL_FILE_SECURE|READ_FULL_FILE_WARN_WORLD_READABLE|READ_FULL_FILE_CONNECT_SOCKET,
/* bind_name= */ NULL,
&k, &n);
if (r < 0)
return log_error_errno(r, "Failed to read key file '%s': %m", filename);
iovec_done_erase(key);
*key = IOVEC_MAKE(TAKE_PTR(k), n);
return 0;
}
static int config_parse_key_file(
const char *unit,
const char *filename,
unsigned line,
const char *section,
unsigned section_line,
const char *lvalue,
int ltype,
const char *rvalue,
void *data,
void *userdata) {
Partition *partition = ASSERT_PTR(userdata);
assert(rvalue);
if (isempty(rvalue)) {
iovec_done_erase(&partition->key);
return 0;
}
return parse_key_file(rvalue, &partition->key);
}
static DEFINE_CONFIG_PARSE_ENUM_WITH_DEFAULT(config_parse_verity, verity_mode, VerityMode, VERITY_OFF);
static DEFINE_CONFIG_PARSE_ENUM_WITH_DEFAULT(config_parse_minimize, minimize_mode, MinimizeMode, MINIMIZE_OFF);
@@ -2602,6 +2652,7 @@ static int partition_read_definition(Partition *p, const char *path, const char
{ "Partition", "MountPoint", config_parse_mountpoint, 0, p },
{ "Partition", "EncryptedVolume", config_parse_encrypted_volume, 0, p },
{ "Partition", "TPM2PCRs", config_parse_tpm2_pcrs, 0, p },
{ "Partition", "KeyFile", config_parse_key_file, 0, p },
{ "Partition", "Compression", config_parse_string, CONFIG_PARSE_STRING_SAFE_AND_ASCII, &p->compression },
{ "Partition", "CompressionLevel", config_parse_string, CONFIG_PARSE_STRING_SAFE_AND_ASCII, &p->compression_level },
{ "Partition", "SupplementFor", config_parse_string, 0, &p->supplement_for_name },
@@ -4823,18 +4874,21 @@ static int partition_encrypt(Context *context, Partition *p, PartitionTarget *ta
return log_error_errno(r, "Failed to LUKS2 format future partition: %m");
if (IN_SET(p->encrypt, ENCRYPT_KEY_FILE, ENCRYPT_KEY_FILE_TPM2)) {
/* Use partition-specific key if available, otherwise fall back to global key */
struct iovec *iovec_key = arg_key.iov_base ? &arg_key : &p->key;
r = sym_crypt_keyslot_add_by_volume_key(
cd,
CRYPT_ANY_SLOT,
NULL,
VOLUME_KEY_SIZE,
strempty(arg_key.iov_base),
arg_key.iov_len);
strempty(iovec_key->iov_base),
iovec_key->iov_len);
if (r < 0)
return log_error_errno(r, "Failed to add LUKS2 key: %m");
passphrase = strempty(arg_key.iov_base);
passphrase_size = arg_key.iov_len;
passphrase = strempty(iovec_key->iov_base);
passphrase_size = iovec_key->iov_len;
}
if (IN_SET(p->encrypt, ENCRYPT_TPM2, ENCRYPT_KEY_FILE_TPM2)) {
@@ -8845,21 +8899,9 @@ static int parse_argv(int argc, char *argv[], X509 **ret_certificate, EVP_PKEY *
break;
case ARG_KEY_FILE: {
struct iovec key = {};
r = read_full_file_full(
AT_FDCWD, optarg,
/* offset= */ UINT64_MAX,
/* size= */ SIZE_MAX,
READ_FULL_FILE_SECURE|READ_FULL_FILE_WARN_WORLD_READABLE|READ_FULL_FILE_CONNECT_SOCKET,
/* bind_name= */ NULL,
(char **) &key.iov_base,
&key.iov_len);
r = parse_key_file(optarg, &arg_key);
if (r < 0)
return log_error_errno(r, "Failed to read key file '%s': %m", optarg);
iovec_done_erase(&arg_key);
arg_key = key;
return r;
break;
}