This is useful if your keyfile is a block device, and you want to use a specific part of it, such as an area between the MBR and the first partition.
This feature is documented in the Arch wiki[0], and has been supported by the Arch initscripts, so would be nice to get this into systemd. This requires libcryptsetup >= 1.4.2 (released 12.4.2012). Acked-by: Paul Menzel <[email protected]> [0]: <https://wiki.archlinux.org/index.php/System_Encryption_with_LUKS# Storing_the_key_between_MBR_and_1st_partition> --- configure.ac | 2 +- man/crypttab.xml | 12 ++++++++++++ src/cryptsetup/cryptsetup.c | 11 ++++++++++- 3 files changed, 23 insertions(+), 2 deletions(-) diff --git a/configure.ac b/configure.ac index e0a2526..e1876cc 100644 --- a/configure.ac +++ b/configure.ac @@ -333,7 +333,7 @@ AC_SUBST(AUDIT_LIBS) have_libcryptsetup=no AC_ARG_ENABLE(libcryptsetup, AS_HELP_STRING([--disable-libcryptsetup], [disable libcryptsetup tools])) if test "x$enable_libcryptsetup" != "xno"; then - PKG_CHECK_MODULES(LIBCRYPTSETUP, [ libcryptsetup ], + PKG_CHECK_MODULES(LIBCRYPTSETUP, [ libcryptsetup >= 1.4.2 ], [AC_DEFINE(HAVE_LIBCRYPTSETUP, 1, [Define if libcryptsetup is available]) have_libcryptsetup=yes], have_libcryptsetup=no) if test "x$have_libcryptsetup" = xno -a "x$enable_libcryptsetup" = xyes; then AC_MSG_ERROR([*** libcryptsetup support requested but libraries not found]) diff --git a/man/crypttab.xml b/man/crypttab.xml index f3bde71..2fa8e89 100644 --- a/man/crypttab.xml +++ b/man/crypttab.xml @@ -131,6 +131,18 @@ <varlistentry> + <term><varname>keyfile-offset=</varname></term> + + <listitem><para>Specifies the number + of bytes to skip at the start of + the keyfile; see + <citerefentry><refentrytitle>cryptsetup</refentrytitle><manvolnum>8</manvolnum></citerefentry> + for possible values and the default + value of this option.</para></listitem> + </varlistentry> + + + <varlistentry> <term><varname>hash=</varname></term> <listitem><para>Specifies the hash to diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c index b26fcca..f570724 100644 --- a/src/cryptsetup/cryptsetup.c +++ b/src/cryptsetup/cryptsetup.c @@ -37,6 +37,7 @@ static const char *opt_type = NULL; /* LUKS1 or PLAIN */ static char *opt_cipher = NULL; static unsigned opt_key_size = 0; +static unsigned opt_keyfile_offset = 0; static char *opt_hash = NULL; static unsigned opt_tries = 0; static bool opt_readonly = false; @@ -79,6 +80,13 @@ static int parse_one_option(const char *option) { return 0; } + } else if (startswith(option, "keyfile-offset=")) { + + if (safe_atou(option+15, &opt_keyfile_offset) < 0) { + log_error("keyfile-offset= parse failure, ignoring."); + return 0; + } + } else if (startswith(option, "hash=")) { char *t; @@ -462,7 +470,8 @@ int main(int argc, char *argv[]) { argv[3]); if (key_file) - k = crypt_activate_by_keyfile(cd, argv[2], CRYPT_ANY_SLOT, key_file, keyfile_size, flags); + k = crypt_activate_by_keyfile_offset(cd, argv[2], CRYPT_ANY_SLOT, key_file, keyfile_size, + opt_keyfile_offset, flags); else { char **p; -- 1.7.11.1 _______________________________________________ systemd-devel mailing list [email protected] http://lists.freedesktop.org/mailman/listinfo/systemd-devel
