cryptsetup/trunk/install-sd-encrypt

   1 #!/bin/bash
   2
   3 build() {
   4     local mod
   5
   6     add_module 'dm-crypt'
   7     add_module 'dm-integrity'
   8     if [[ $CRYPTO_MODULES ]]; then
   9         for mod in $CRYPTO_MODULES; do
  10             add_module "$mod"
  11         done
  12     else
  13         add_all_modules '/crypto/'
  14     fi
  15     add_checked_modules '/drivers/char/tpm/'
  16
  17     map add_udev_rule \
  18         '10-dm.rules' \
  19         '13-dm-disk.rules' \
  20         '60-fido-id.rules' \
  21         '95-dm-notify.rules' \
  22         '/usr/lib/initcpio/udev/11-dm-initramfs.rules'
  23
  24     map add_systemd_unit 'cryptsetup.target' \
  25         'systemd-ask-password-console.path' \
  26         'systemd-ask-password-console.service'
  27     map add_binary \
  28         '/usr/lib/systemd/system-generators/systemd-cryptsetup-generator' \
  29         '/usr/lib/systemd/systemd-cryptsetup' \
  30         '/usr/lib/cryptsetup/libcryptsetup-token-systemd-fido2.so' \
  31         '/usr/lib/cryptsetup/libcryptsetup-token-systemd-pkcs11.so' \
  32         '/usr/lib/cryptsetup/libcryptsetup-token-systemd-tpm2.so'
  33
  34     # cryptsetup calls pthread_create(), which dlopen()s libgcc_s.so.1
  35     add_binary '/usr/lib/libgcc_s.so.1'
  36
  37     # add libraries dlopen()ed by systemd-cryptsetup
  38     for LIB in fido2 tss2-{{esys,rc,mu},tcti-'*'}; do
  39         for FILE in $(find /usr/lib/ -maxdepth 1 -name "lib${LIB}.so*"); do
  40             if [[ -L "${FILE}" ]]; then
  41                 add_symlink "${FILE}"
  42             else
  43                 add_binary "${FILE}"
  44             fi
  45         done
  46     done
  47
  48     # add mkswap for creating swap space on the fly (see 'swap' in crypttab(5))
  49     add_binary 'mkswap'
  50
  51     [[ -f /etc/crypttab.initramfs ]] && add_file '/etc/crypttab.initramfs' '/etc/crypttab'
  52 }
  53
  54 help() {
  55     cat <<HELPEOF
  56 This hook allows for an encrypted root device with systemd initramfs.
  57
  58 See the manpage of systemd-cryptsetup-generator(8) for available kernel
  59 command line options. Alternatively, if the file /etc/crypttab.initramfs
  60 exists, it will be added to the initramfs as /etc/crypttab. See the
  61 crypttab(5) manpage for more information on crypttab syntax.
  62 HELPEOF
  63 }
  64
  65 # vim: set ft=sh ts=4 sw=4 et: