3
# This hook was based and adapted from:
4
# http://lists.debian.org/debian-live/2009/04/msg00186.html
5
# ---------------------------------------------------------
8
# NOTE 1: this was not tested with persistent boot option,
9
# but it seems logic that persistent and lukshome can't
10
# coexist as boot options (because of snapshots and others), so lukshome
11
# won't be executed if any persistent option is given on boot.
13
# NOTE 2: if using an USB key, it will eventualy end up failing someday.
14
# You should backup the encrypted disk image file itself (luks-home.img) to
15
# prevent loosing your data.
17
# This hook will create 3 files:
19
# /usr/local/sbin/create-lukshome-file.sh
20
# script to create an disk file image (luks-home.img) with a
21
# LUKS encrypted ext2 filesystem inside to be placed in a
22
# partition labeled lukshome.
24
# /usr/local/sbin/lukshome.sh
25
# detects a partition with lukshome label, updates fstab and crypttab so
26
# the encrypted file is mounted later in a loopback device (/dev/loopX).
27
# It also changes /etc/init.d/umountfs so the encrypted home is correctly
30
# /usr/share/initramfs-tools/scripts/live-bottom/13live_luks_home
31
# a live-initramfs hook to execute lukshome.sh script
38
# First build your live system with this hook inside config/chroot_local-hooks/.
39
# If you have an existing live-helper build directory with a previous live
40
# build, you might have to run
45
# to make sure this hook is included in the live system. Then (re)build your
50
# After booting your (re)built live system, setup the encrypted losetup
51
# filesystem to be used as /home using the instructions present in the
52
# create-lukshome-file.sh script.
54
# Reboot and now use the "lukshome" boot option to mount the encrypted /home,
55
# like in using "persistent" boot option with a home-rw file in some partition.
59
echo "I: to see how use lukshome hook run create-lukshome-file.sh as root."
60
echo "I: creating script /usr/local/sbin/create-lukshome-file.sh"
61
cat > /usr/local/sbin/create-lukshome-file.sh << 'EOF'
64
# This script is to create an encrypted filesystem in a file to
65
# be used as /home in a live system built with Debian Live Helper with
66
# the lukshome hook in config/chroot_local-hooks/.
68
# The lukshome boot option will do the following:
69
# - search for a partition with label 'lukshome'
70
# (btw, you can't use the live system partition itself)
71
# - mount the partition as /luks-home in the live system
72
# - open /luks-home/luks-home.img file as a loopback device (/dev/loop)
73
# - open the loopback device with cryptsetup
74
# - mount the encrypted filesystem as /home
76
# This script will only create the luks-home.img file. Next are details of how
79
# CAUTION! THIS CAN WIPE YOUR DATA, backup first!
80
# Be sure to understand what you will do, or you can end up
81
# wiping disks or partitions you don't want to!
86
# Create a mountpoint (don't use /mnt, it will be used by this script):
87
# # mkdir /media/target
89
# !!! *** Skip the next line if you don't want to wipe a partition *** !!!
90
# !!! * Just change the partition label to 'lukshome' (without quotes) * !!!
91
# Create an ext2 filesystem in a partition with 'lukshome' label:
92
# # mkfs.ext2 -L lukshome /dev/the_partition_to_be_used
94
# Mount the partition and cd into it:
95
# # mount /dev/the_partition_to_be_used /media/target
98
# Create the encrypted file:
99
# # create-lukshome-file.sh
101
# The script is located in /usr/local/sbin/, so it's in root $PATH.
102
# It will copy the directories in /home/* into the file.
103
# Now return to $HOME to be able to umount the target partition:
106
# Umount the target partition:
107
# # umount /media/target
109
# Reboot and use the "lukshome" boot option to mount the encrypted /home,
110
# like in using "persistent" boot option with a home-rw file in some partition.
112
# Press Shift-PgUp/Shift-PgDn to scrool the instructions on the screen.
116
if [ "${USER}" != "root" ]
118
echo " ** Please run this script as root or with sudo."
122
# check if /mnt is available and empty
123
mount | grep "/mnt" > /dev/null
125
if [ "${MNT_IS_MOUNTED}" == 0 ]
127
echo "** ERROR: /mnt is mounted at the moment. Please umount it to use this script."
130
if [ "$(ls -A /mnt)" ]
132
echo "** ERROR: /mnt is not empty. An empty /mnt is needed to use this script."
136
# check if /dev/mapper/luks-home is available
137
if [ -f /dev/mapper/luks-home ]
139
echo "** ERROR: /dev/mapper/luks-home is being used at the moment. Please run «cryptsetup remove luks-home» to use this script."
146
echo "** Instructions to use create-lukshome-file.sh (this script):"
147
sed -n '2,51p' /usr/local/sbin/create-lukshome-file.sh | sed 's/^.//'
152
echo "** Do you want to proceed with this script? (y/N)"
167
echo "** Please type the size of the file disk image."
168
echo "Size of the file in MB: "
172
echo "** Creating file luks-home.img."
173
echo "** Filling file image with /dev/urandom output. It will take some time."
174
echo "(Edit this script to use /dev/random. It's know to more secure but "
175
echo "it will take a *very* long time to complete."
176
dd if=/dev/urandom of=luks-home.img bs=1M count=${FILE_SIZE}
177
# To use /dev/random comment the line above and uncomment the next line
178
#dd if=/dev/random of=luks-home.img ibs=128 obs=128 count=$((8192*${FILE_SIZE}))
179
# You might have to increase kernel entropy by moving the mouse, typing keyboard,
180
# make the computer read disk or use network connections.
185
FREE_LOSETUP=$(losetup -f)
186
echo "** Using ${FREE_LOSETUP} to open luks-home.img"
187
losetup ${FREE_LOSETUP} ./luks-home.img
192
echo "** Running cryptsetup."
195
cryptsetup luksFormat ${FREE_LOSETUP}
197
if [ "${EXIT_CODE}" != 0 ]
199
echo "** ERROR: Error while trying to format disk file image."
200
losetup -d ${FREE_LOSETUP}
206
cryptsetup luksOpen ${FREE_LOSETUP} luks-home
208
if [ "${EXIT_CODE}" != 0 ]
210
echo "** ERROR: Error while trying to open LUKS file image."
211
losetup -d ${FREE_LOSETUP}
216
# format encrypted filesystem
217
echo "** Now formating /dev/mapper/luks-home"
218
mkfs.ext2 /dev/mapper/luks-home
220
if [ "${EXIT_CODE}" != 0 ]
222
echo "** ERROR: Error while trying to format LUKS file."
223
cryptsetup remove luks-home
224
losetup -d ${FREE_LOSETUP}
230
echo "** Now mounting luks-home.img in /mnt"
231
mount /dev/mapper/luks-home /mnt
233
if [ "${EXIT_CODE}" != 0 ]
235
echo "** ERROR: Error while trying to mount LUKS file in /mnt."
237
cryptsetup remove luks-home
238
losetup -d ${FREE_LOSETUP}
246
echo "** Copying ${HOME_DIR}."
247
cp -rav ${HOME_DIR} /mnt
249
if [ "${EXIT_CODE}" != 0 ]
251
echo "** ERROR: Error while trying to copy files to /mnt."
253
cryptsetup remove luks-home
254
losetup -d ${FREE_LOSETUP}
261
echo "** Closing losetup, cryptsetup and mounted /mnt."
264
cryptsetup remove luks-home
265
losetup -d ${FREE_LOSETUP}
266
echo "** The disk file image luks-home.img is done and ready. Move it into a partition"
267
echo "** with 'lukshome' as label and reboot with lukshome boot option to use it."
272
chmod 0755 /usr/local/sbin/create-lukshome-file.sh
276
echo "I: creating script /usr/local/sbin/lukshome.sh"
277
cat > /usr/local/sbin/lukshome.sh << 'EOF'
280
# this script is to be executed by a hook in live-initramfs. It searches
281
# for a partition with 'lukshome' label, mounts it as /luks-home, then opens an
282
# encrypted disk image file called luks-home.img as a loopback device, opens it
283
# with cryptsetup and finally mounts the present filesystem as /home.
284
# It also changes /etc/init.d/umountfs to umount the lukshome partition
285
# (/luks-home) and clear the loopback device on shutdown.
287
# functions taken from live-helpers
288
. /usr/share/initramfs-tools/scripts/live-helpers
290
# search for a partition labeled "lukshome"
291
for sysblock in $(echo /sys/block/* | tr ' ' '\n' | grep -v loop | grep -v ram | grep -v fd)
293
for dev in $(subdevices "${sysblock}")
295
devname=$(sys2dev "${dev}")
296
# find partition name and filesystem type
297
if [ "$(/lib/udev/vol_id -l ${devname} 2>/dev/null)" = "lukshome" ]
299
# found one partition named "lukshome"
300
CRYPTHOME="${devname}"
301
# don't search further
305
# if already found, don't search further
306
if [ -n "${CRYPTHOME}" ]
312
# if no partition found, exit
313
if [ -z "${CRYPTHOME}" ]
315
echo "Could not find any partition with lukshome label. "
316
echo "Proceeding with no encrypted /home."
320
# mount partition where file container is
321
echo "Mounting /luks-home with ${CRYPTHOME}."
323
mount -t $(get_fstype "${CRYPTHOME}") "${CRYPTHOME}" /luks-home
325
# mount losetup encrypted file
326
FREE_LOOP="$(/sbin/losetup -f)"
327
echo "Opening /luks-home/luks-home.img in ${FREE_LOOP}."
329
if [ -f /luks-home/luks-home.img ]
331
/sbin/losetup ${FREE_LOOP} /luks-home/luks-home.img
333
echo "Adding ${FREE_LOOP} home to /etc/crypttab and setting it as /home in /etc/fstab."
336
echo "home ${FREE_LOOP} none luks,check,timeout" >> /etc/crypttab
339
echo "/dev/mapper/home /home ext2 defaults,noatime 0 0" >> /etc/fstab
341
echo "Did not found any luks-home.img file in ${CRYPTHOME}!"
342
echo "Proceeding with no encrypted /home."
347
# changes to /etc/init.d/umountfs to make /luks-home being umounted on shutdown
348
sed -i 's/[\t]do_stop/CHANGE_HERE/' /etc/init.d/umountfs
349
sed -i 's|CHANGE_HERE| \
350
# added by lukshome hook - umount \/luks-home to prevent busy device on shutdown \
351
LOOP_LUKSHOME=$(losetup -a \| grep luks-home \|cut -c 1-10) \
352
if [ -n ${LOOP_LUKSHOME} ] \
354
umount -r -d \/home \
355
cryptsetup remove home \
356
losetup -d ${LOOP_LUKSHOME} \
357
umount -r \/luks-home \
361
|' /etc/init.d/umountfs
365
chmod 0755 /usr/local/sbin/lukshome.sh
369
# scripts/live-bottom/13live_luks_home, right after 12fstab
370
echo "I: creating /usr/share/initramfs-tools/scripts/live-bottom/13live_luks_home"
372
cat > /usr/share/initramfs-tools/scripts/live-bottom/13live_luks_home << 'EOF'
377
# initramfs-tools header
393
. /scripts/live-functions
395
# live-initramfs hook to use an disk image file with encrypted filesystem as /home.
397
log_begin_msg "Executing losetup-lukshome"
399
# get boot option lukshome - adapted from live-helpers
400
for ARGUMENT in $(cat /proc/cmdline)
402
case "${ARGUMENT}" in
409
# don't use persistent* and lukshome
410
if [ -n "${PERSISTENT}" ] && [ -n "${LUKSHOME}" ]
412
echo "You should not use persistent and lukshome at the same time."
413
echo "Skipping lukshome. Persistent medium, if any, will be used instead."
418
# if no lukshome boot option, exit
419
if [ -z "${LUKSHOME}" ]
425
log_begin_msg "Executing lukshome.sh script."
427
mount -o bind /sys /root/sys
428
mount -o bind /proc /root/proc
429
mount -o bind /dev /root/dev
431
# lukshome.sh detects lukshome partition and file location, mounts it
432
# and opens the file and then updates fstab and crypttab to use it as /home.
433
chroot /root /usr/local/sbin/lukshome.sh
439
# delete the lukshome scripts, not needed anymore
440
# rm -f /root/usr/local/sbin/lukshome.sh
441
# rm -f /root/usr/local/sbin/create-lukshome-file.sh
447
chmod 0755 /usr/share/initramfs-tools/scripts/live-bottom/13live_luks_home
451
echo "I: update-initramfs to include 13live_luks_home."
452
# if you already have installed the update-initramfs.sh hook, you can remove
455
for KERNEL in /boot/vmlinuz-*
457
VERSION="$(basename ${KERNEL} | sed -e 's|vmlinuz-||')"
459
update-initramfs -k ${VERSION} -t -u
added
removed
examples/hooks/losetup-lukshome.sh
