reimplement cryptinit as shell script

3 files changed, 19 insertions, 497 deletions

diff --git a/package/cryptinit/Makefile b/package/cryptinit/Makefile
index b63b87751..bc9d4f122 100644
--- a/package/cryptinit/Makefile
+++ b/package/cryptinit/Makefile
@@ -4,13 +4,25 @@
 include ${TOPDIR}/rules.mk
 
 PKG_NAME:=		cryptinit
-PKG_VERSION:=		1.0.2
+PKG_VERSION:=		2.0
 PKG_RELEASE:=		1
 PKG_DESCR:=		init for encrypted rootfilesystem
 PKG_SECTION:=		base
-PKG_BUILDDEP:=		cryptsetup lvm
+PKG_DEPENDS:=		cryptsetup opensc pcsc-lite
 
-PKG_CFLINE_CRYPTINIT:=	depends on ADK_TARGET_ROOTFS_ENCRYPTED
+PKG_CFLINE_CRYPTINIT:=	select BUSYBOX_STTY@
+PKG_CFLINE_CRYPTINIT+=	select BUSYBOX_SWITCH_ROOT@
+
+PKG_FLAVOURS_CRYPTINIT:=NO_GRUB
+PKGFD_NO_GRUB:=		predefine root/swap partition (without grub)
+
+PKG_FLAVOURS_STRING_CRYPTINIT:=	ROOT SWAP
+PKGFD_ROOT:=		root partition
+PKGFX_ROOT:=		/dev/sda2
+PKGFC_ROOT:=		depends on ADK_PACKAGE_CRYPTINIT_NO_GRUB
+PKGFD_SWAP:=		swap partition
+PKGFX_SWAP:=		/dev/sda3
+PKGFC_SWAP:=		depends on ADK_PACKAGE_CRYPTINIT_NO_GRUB
 
 WRKDIST=		${WRKDIR}/${PKG_NAME}-${PKG_VERSION}
 NO_DISTFILES:=		1
@@ -23,22 +35,10 @@ CONFIG_STYLE:=		manual
 BUILD_STYLE:=		manual
 INSTALL_STYLE:=		manual
 
-do-build:
-	${TARGET_CC} ${TARGET_CPPFLAGS} ${TARGET_CFLAGS} -c \
-		-o ${WRKBUILD}/cryptinit.o ${WRKBUILD}/cryptinit.c
-	( cd ${WRKBUILD}; \
-	${TARGET_CC} -static -o cryptinit cryptinit.o \
-		 ${STAGING_TARGET_DIR}/usr/lib/libcryptsetup.a \
-		-L${STAGING_TARGET_DIR}/lib -L${STAGING_TARGET_DIR}/usr/lib \
-		-ldevmapper -lpthread \
-		${STAGING_TARGET_DIR}/usr/lib/libgcrypt.a \
-		${STAGING_TARGET_DIR}/usr/lib/libgpg-error.a \
-		-luuid -Wl,--rpath -Wl,${STAGING_TARGET_DIR}/usr/lib \
-	);
-
 do-install:
-	$(CP) ./files/initramfs_list $(LINUX_DIR)
-	$(CP) ${WRKBUILD}/cryptinit $(LINUX_DIR)
-	@touch ${IDIR_CRYPTINIT}/.empty
+	$(INSTALL_DIR) $(IDIR_CRYPTINIT)/sbin
+	$(TARGET_CC) $(TARGET_CFLAGS) -Wall -o $(IDIR_CRYPTINIT)/sbin/p \
+		./src/p.c
+	$(INSTALL_BIN) ./src/cryptinit $(IDIR_CRYPTINIT)/
 
 include ${TOPDIR}/mk/pkg-bottom.mk
diff --git a/package/cryptinit/files/initramfs_list b/package/cryptinit/files/initramfs_list
deleted file mode 100644
index caa30ece3..000000000
--- a/package/cryptinit/files/initramfs_list
+++ /dev/null
@@ -1,17 +0,0 @@
-dir /dev 755 0 0
-dir /dev/mapper 755 0 0
-dir /proc 755 0 0
-dir /sys 755 0 0
-dir /mnt 755 0 0
-nod /dev/console 644 0 0 c 5 1
-nod /dev/tty 660 0 0 c 5 0
-nod /dev/tty0 600 0 0 c 4 0
-nod /dev/sda 644 0 0 b 8 0
-nod /dev/sda1 644 0 0 b 8 1
-nod /dev/sda2 644 0 0 b 8 2
-nod /dev/sda3 644 0 0 b 8 3
-nod /dev/sda4 644 0 0 b 8 4
-nod /dev/null 644 0 0 c 1 3
-nod /dev/mapper/control 644 0 0 c 10 62
-nod /dev/urandom 644 0 0 c 1 9
-file /init ./cryptinit 755 0 0
diff --git a/package/cryptinit/src/cryptinit.c b/package/cryptinit/src/cryptinit.c
deleted file mode 100644
index 98f7a5a19..000000000
--- a/package/cryptinit/src/cryptinit.c
+++ /dev/null
@@ -1,461 +0,0 @@
-/*
- * cryptinit 1.0.2 - setup encrypted root/swap system using LUKS
- *
- * Copyright (C) 2009 Waldemar Brodkorb <mail@waldemar-brodkorb.de>
- * Copyright (C) 2008 Phil Sutter <phil@nwl.cc>
- *		
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- * 
- * strongly based on ideas and work from Phil Sutter
- * http://nwl.cc/cgi-bin/git/gitweb.cgi?p=initramfs-init.git;a=summary
- *   - used with cryptsetup 1.0.6 (needs a small cryptsetup-patch)
- *   - see comment at the end of file for a useful initramfs filelist
- *   - compile and link with following commands to get a static init
- *     gcc -Wall -c -o init.o cryptinit.c
- *     libtool --mode=link --tag=CC gcc -all-static -o init init.o \
- *	/usr/lib/libcryptsetup.la
- */
-
-#include <errno.h>
-#include <fcntl.h>
-#include <stdarg.h> 
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <libcryptsetup.h>
-#include <sys/mount.h>
-#include <sys/reboot.h>
-#include <sys/types.h>
-#include <sys/utsname.h>
-#include <sys/wait.h>
-
-#define HOSTNAME "linux"
-#define DOMAINNAME "foo.bar"
-
-#define CRYPT_SWAP_DEV "/dev/sda3"
-#define CRYPT_SWAP_NAME "swap"
-#define CRYPT_ROOT_DEV "/dev/sda2"
-#define CRYPT_ROOT_NAME "root"
-
-#define PROCPATH "/proc"
-#define SYSPATH "/sys"
-#define PROCFS "proc"
-#define SYSFS "sysfs"
-
-#define DEF_KERN_CONS "/dev/console"
-#define DEF_KERN_SWAP "/dev/mapper/swap"
-#define DEF_KERN_ROOT_SRC "/dev/mapper/root"
-#define DEF_KERN_ROOT_TGT "/mnt"
-#define DEF_KERN_ROOT_FS "xfs"
-#define DEF_KERN_INIT "/init"
-
-#ifndef MS_MOVE
-#define MS_MOVE         8192
-#endif
-
-/* a structure for holding options to mount() a device */
-struct mntopts {
-        char *source;
-        char *target;
-        char *fstype;
-        unsigned long flags;
-};
-
-/* a structure for holding kernel boot parameters */
-struct commandline {
-        struct mntopts root;
-        char *init;
-        char *resume;
-        ushort do_resume;
-        ushort debug;
-};
-
-struct commandline cmdline;
-
-void debug_printf(const char *format, ...) {
-	va_list params;
-	if(cmdline.debug) {
-		va_start(params, format);
-		vprintf(format, params);
-		va_end(params);
-	}
-}
-
-void debug_msg(const char *s) {
-	if(cmdline.debug)
-		fputs(s, stderr);
-}
-
-void log_msg(const char *s) {
-	fputs(s, stdout);
-}
-
-/* logging function from cryptsetup library */
-static void cmdLineLog(int class, char *msg) {
-	switch(class) {
-	case CRYPT_LOG_NORMAL:
-		debug_msg(msg);
-		break;
-	case CRYPT_LOG_ERROR:
-		debug_msg(msg);
-		break;
-	default:
-		fprintf(stderr, "Internal error for msg: %s", msg);
-		break;
-	}
-}
-
-int switch_root(char *console, char *newroot, char *init) {
-
-	if (chdir(newroot)) {
-		fprintf(stderr,"bad newroot %s\n",newroot);
-		return 1;
-	}
-	/* Overmount / with newdir and chroot into it.  The chdir is needed to
-	 * recalculate "." and ".." links. */
-	if (mount(".", "/", NULL, MS_MOVE, NULL) || chroot(".") || chdir("/")) {
-		fprintf(stderr,"switch_root: error moving root\n");
-		return 2;
-	}
-
-	/* If a new console specified, redirect stdin/stdout/stderr to that. */
-	if (console) {
-		close(0);
-		if(open(console, O_RDWR) < 0) {
-			fprintf(stderr,"Bad console '%s'\n",console);
-			return 4;
-		}
-		dup2(0, 1);
-		dup2(0, 2);
-	}
-
-	log_msg("Starting Linux from encrypted root disk\n");
-	/* Exec real init.  (This is why we must be pid 1.) */
-	execl(init, init, (char *)NULL);
-	fprintf(stderr,"Bad init '%s'\n",init);
-	return 3;
-}
-
-char *read_cmdline(void) {
-	FILE *fp;
-	int linelen, i;
-	char *str;
-
-	if((fp=fopen("/proc/cmdline","r")) == NULL) {
-		perror("fopen()");
-		return NULL;
-	}
-	linelen = 10;
-	str = calloc(linelen, sizeof(char));
-	for(i=0;(str[i]=fgetc(fp)) != EOF; i++) {
-		if(i>linelen-1) {
-			linelen += 10;
-			if((str=realloc(str, linelen)) == NULL) {
-				perror("realloc()");
-				return NULL;
-			}
-		}
-	}
-	str[i-1] = '\0'; /* substitutes \n for \0 */
-	fclose(fp);
-	return str;
-}
-
-int parse_cmdline(char *line) {
-	int tmpnum;
-	char *tmpstr, *lstr, *rstr, *idx;
-	char *invchars[1];
-
-	tmpstr = strtok(line, " ");
-	do {
-		if((idx=strchr(tmpstr, '=')) != NULL) {
-			rstr = idx + 1;
-			idx = '\0';
-			lstr = tmpstr;
-
-			if(!strncmp(lstr, "rootfstype", 10)) {
-				cmdline.root.fstype = rstr;
-
-			} else if(!strncmp(lstr, "root", 4)) {
-				cmdline.root.source = rstr;
-
-			} else if(!strncmp(lstr, "init", 4)) {
-				cmdline.init = rstr;
-
-			} else if(!strncmp(lstr, "resume", 6)) {
-				cmdline.resume = rstr;
-			}
-
-		} else if(!strncmp(tmpstr, "noresume", 8)) {
-			cmdline.do_resume = 0;
-
-		} else if(!strncmp(tmpstr, "debug", 5)) {
-			cmdline.debug=1;
-
-		} else {
-			if(cmdline.debug)
-				printf("unknown bootparam flag %s\n",tmpstr);
-		}
-	} while((tmpstr = strtok(NULL, " ")) != NULL);
-
-	debug_printf("\n Bootparams scanned:\n");
-	debug_printf("root\t%s\nrootfstype\t%s\ninit\t%s\nresume\t%s\ndo_resume\t%i\n",
-			cmdline.root.source,cmdline.root.fstype,cmdline.init,cmdline.resume,cmdline.do_resume);
-	debug_printf("debug\t%i\n\n",
-			cmdline.debug);
-	return 0;
-}
-
-int get_cmdline() {
-	char *str;
-
-	/* first set some useful defaults */
-	cmdline.root.source = DEF_KERN_ROOT_SRC;
-	cmdline.root.target = DEF_KERN_ROOT_TGT;
-	cmdline.root.fstype = DEF_KERN_ROOT_FS;
-	cmdline.root.flags = MS_RDONLY;
-	cmdline.init = DEF_KERN_INIT;
-	cmdline.resume = DEF_KERN_SWAP;
-	cmdline.do_resume = 1;
-	cmdline.debug = 0;
-
-	/* read out cmdline from /proc */
-	str = read_cmdline();
-
-	/* parse the cmdline */
-	if(parse_cmdline(str))
-		return -1;
-
-	return 0;
-}
-
-void kmsg_log(int level) {
-	FILE *fd;
-
-	debug_msg("Finetune kernel log\n");
-	if((fd = fopen("/proc/sys/kernel/printk", "r+")) == NULL) {
-		perror("fopen()");
-		return;
-	}
-	fprintf(fd, "%d", level);
-	fclose(fd);
-}
-
-void do_resume(void) {
-	FILE *fd;
-
-	debug_msg("Trying to resume\n");
-	if((fd = fopen("/sys/power/resume", "a")) == NULL) {
-		return;
-	}
-	fprintf(fd, "254:0\n");
-	fclose(fd);
-}
-
-void do_halt(void) {
-	int pid;
-
-	/* run sync just to be sure */
-	sync();
-
-	/* fork to prevent a kernel panic while killing init */
-	if((pid=fork()) == 0) {
-		reboot(0x4321fedc);
-		_exit(0);
-	}
-	waitpid(pid, NULL, 0);
-}
-
-int do_mount(struct mntopts o) {
-	debug_printf("do_mount: mounting %s with fstype %s\n", o.source, o.fstype);
-	if(mount(o.source, o.target, o.fstype, o.flags, NULL)) {
-		perror("mount()");
-		debug_printf("do_mount: mounting %s with fstype %s\n failed", o.source, o.fstype);
-		return errno;
-	}
-	return 0;
-}
-
-int main(void) {
-	char errormsg[100];
-	int i;
-	int wrongpass;
-	char *pass;
-	struct utsname info;
-	int ret;
-	const char hostname[20] = HOSTNAME;
-	const char domainname[20] = DOMAINNAME;
-	struct crypt_options options;
-	struct interface_callbacks cmd_icb; 
-
-	struct mntopts mopts[2] = {
-		{ "proc", PROCPATH, PROCFS, 0 },
-		{ "sysfs", SYSPATH, SYSFS, 0 }
-	};
-	
-	/* need to set callback functions, log is required */
-	cmd_icb.yesDialog = NULL;
-	cmd_icb.log = cmdLineLog;
-
-	/* first try to mount needed virtual filesystems */
-	if(do_mount(mopts[0]) || do_mount(mopts[1])) {
-		fprintf(stderr, "Error mounting %s and %s\n", 
-			PROCPATH, SYSPATH);
-		exit(errno);
-	}
-
-	/* get kernel command line */
-	if(get_cmdline() == -1) {
-		fprintf(stderr, "Failed to parse kernel commandline\n");
-		exit(errno);
-	}
-
-	/* keep kernel quiet while asking for password */
-	kmsg_log(0);
-
-	/* first unlock swap partition for resume */
-	memset(&options, 0, sizeof(struct crypt_options));
-	options.name = CRYPT_SWAP_NAME;
-	options.device = CRYPT_SWAP_DEV;
-	options.icb = &cmd_icb;
-
-	ret = uname(&info);
-	if (ret < 0)
-		fprintf(stderr, "Error calling uname function\n");
-
-	/* security by obscurity */
-	printf("This is %s.%s (Linux %s %s)\n", hostname, domainname, info.machine, info.release);
-	printf("%s login: ", hostname);
-	fflush(stdout);
-	while(getchar() != '\n');
-	/* unlock swap */
-	debug_msg("Unlocking Swap\n");
-	for(i=0; i<3; i++) {
-		/* ask user for password */
-		if((pass=getpass("Password: ")) == NULL) {
-			perror("getpass()");
-			return errno;
-		}
-		options.passphrase = pass;
-		/* try to unlock swap */
-		if((wrongpass=crypt_luksOpen(&options))) {
-			printf("Login incorrect\n");
-			crypt_get_error(errormsg, 99);	
-			debug_printf("Error: %s\n", errormsg);
-		} else { /* success */
-			if(i > 0)
-				fprintf(stderr, "%i incorrect attempts\n",i);
-			break;
-		}
-	}
-	
-	if(wrongpass) {
-		fprintf(stderr, "Panic - you are not allowed!\n");
-		sleep(3);
-		do_halt();
-	}
-
-	/* try to resume here */
-	if(cmdline.do_resume) {
-		debug_msg("Trying to resume from swap\n");
-		do_resume();
-		debug_msg("Resume failed, starting normal boot\n");
-	}
-
-	/* resume returned, starting normal boot */
-	options.name = CRYPT_ROOT_NAME;
-	options.device = CRYPT_ROOT_DEV;
-
-	/* unlock root device */
-	debug_msg("Unlocking Root\n");
-	if(crypt_luksOpen(&options)) {
-		perror("crypt_luksOpen()");
-		crypt_get_error(errormsg, 99);
-		debug_printf("Error: %s\n", errormsg);
-	}
-	
-	/* mount root filesystem */
-	if(do_mount(cmdline.root)) {
-		puts("Error mounting root");
-		exit(errno);
-	}
-
-	kmsg_log(6);
-
-	/* no need for /sys anymore */
-	debug_msg("Unmounting /sys\n");
-	if(umount("/sys"))
-		perror("umount()");
-
-	/* no need for /proc anymore */
-	debug_msg("Unmounting /proc\n");
-	if(umount("/proc"))
-		perror("umount()");
-
-	/* remove password from RAM */
-	memset(pass, 0, strlen(pass)*sizeof(char));
-
-	debug_msg("Switching root\n");
-	switch_root(DEF_KERN_CONS, cmdline.root.target, cmdline.init);
-	
-	return(0);
-}
-/*
-example initramfs file list:
- 
-dir /dev 755 0 0
-dir /dev/mapper 755 0 0
-dir /proc 755 0 0
-dir /sys 755 0 0
-dir /mnt 755 0 0
-nod /dev/console 644 0 0 c 5 1
-nod /dev/tty 660 0 0 c 5 0
-nod /dev/tty0 600 0 0 c 4 0
-nod /dev/sda 644 0 0 b 8 0
-nod /dev/sda1 644 0 0 b 8 1
-nod /dev/sda2 644 0 0 b 8 2
-nod /dev/sda3 644 0 0 b 8 3
-nod /dev/sda4 644 0 0 b 8 4
-nod /dev/null 644 0 0 c 1 3
-nod /dev/mapper/control 644 0 0 c 10 62
-nod /dev/urandom 644 0 0 c 1 9
-file /init /usr/src/init 755 0 0
-
-cryptsetup patch:
-
-Index: lib/setup.c
-===================================================================
---- lib/setup.c	(revision 40)
-+++ lib/setup.c	(working copy)
-@@ -538,10 +538,17 @@
- start:
- 	mk=NULL;
- 
--	if(get_key("Enter LUKS passphrase: ",&password,&passwordLen, 0, options->key_file,  options->passphrase_fd, options->timeout, options->flags))
--		tries--;
--	else
--		tries = 0;
-+	if(options->passphrase) {
-+		password = NULL;
-+		password = safe_alloc(512);
-+		strcpy(password, options->passphrase);
-+		passwordLen = strlen(password);
-+	} else {
-+		if(get_key("Enter LUKS passphrase: ",&password,&passwordLen, 0, options->key_file,  options->passphrase_fd, options->timeout, options->flags))
-+			tries--;
-+		else
-+			tries = 0;
-+	}
- 
- 	if(!password) {
- 		r = -EINVAL; goto out;
-*/