cryptsetup/trunk/install-sd-encrypt

   1 #!/bin/bash
   2
   3 build() {
   4     local mod
   5
   6     add_module 'dm-crypt'
   7     add_module 'dm-integrity'
   8     if [[ $CRYPTO_MODULES ]]; then
   9         for mod in $CRYPTO_MODULES; do
  10             add_module "$mod"
  11         done
  12     else
  13         add_all_modules '/crypto/'
  14     fi
  15     add_checked_modules '/drivers/char/tpm/'
  16
  17     map add_udev_rule \
  18         '10-dm.rules' \
  19         '13-dm-disk.rules' \
  20         '60-fido-id.rules' \
  21         '95-dm-notify.rules' \
  22         '/usr/lib/initcpio/udev/11-dm-initramfs.rules'
  23
  24     map add_systemd_unit 'cryptsetup.target' \
  25         'systemd-ask-password-console.path' \
  26         'systemd-ask-password-console.service'
  27     map add_binary \
  28         '/usr/lib/systemd/system-generators/systemd-cryptsetup-generator' \
  29         '/usr/lib/systemd/systemd-cryptsetup' \
  30         '/usr/lib/cryptsetup/libcryptsetup-token-systemd-fido2.so' \
  31         '/usr/lib/cryptsetup/libcryptsetup-token-systemd-pkcs11.so' \
  32         '/usr/lib/cryptsetup/libcryptsetup-token-systemd-tpm2.so'
  33
  34     # cryptsetup calls pthread_create(), which dlopen()s libgcc_s.so.1
  35     add_binary '/usr/lib/libgcc_s.so.1'
  36
  37     # cryptsetup loads the legacy provider which is required for whirlpool
  38     add_binary '/usr/lib/ossl-modules/legacy.so'
  39
  40     # add libraries dlopen()ed by systemd-cryptsetup
  41     for FILE in $(find /usr/lib/ -maxdepth 1 -name "libfido2.so*"); do
  42         if [[ -L "${FILE}" ]]; then
  43             add_symlink "${FILE}"
  44         else
  45             add_binary "${FILE}"
  46         fi
  47     done
  48
  49     # add mkswap for creating swap space on the fly (see 'swap' in crypttab(5))
  50     add_binary 'mkswap'
  51
  52     [[ -f /etc/crypttab.initramfs ]] && add_file '/etc/crypttab.initramfs' '/etc/crypttab'
  53 }
  54
  55 help() {
  56     cat <<HELPEOF
  57 This hook allows for an encrypted root device with systemd initramfs.
  58
  59 See the manpage of systemd-cryptsetup-generator(8) for available kernel
  60 command line options. Alternatively, if the file /etc/crypttab.initramfs
  61 exists, it will be added to the initramfs as /etc/crypttab. See the
  62 crypttab(5) manpage for more information on crypttab syntax.
  63 HELPEOF
  64 }
  65
  66 # vim: set ft=sh ts=4 sw=4 et: