Skip to content

Commit

Permalink
dracut, initramfs: Skip loading already loaded key
Browse files Browse the repository at this point in the history
The user might have loaded the key manually or by other means
before the scripts get called.

Issue openzfs#9495
  • Loading branch information
vozhyk- committed Nov 3, 2019
1 parent 7a736d7 commit b50c0ec
Show file tree
Hide file tree
Showing 3 changed files with 15 additions and 5 deletions.
14 changes: 9 additions & 5 deletions contrib/dracut/90zfs/mount-zfs.sh.in
Original file line number Diff line number Diff line change
Expand Up @@ -62,11 +62,15 @@ if import_pool "${ZFS_POOL}" ; then
# if the root dataset has encryption enabled
ENCRYPTIONROOT="$(zfs get -H -o value encryptionroot "${ZFS_DATASET}")"
if ! [ "${ENCRYPTIONROOT}" = "-" ]; then
# decrypt them
ask_for_password \
--tries 5 \
--prompt "Encrypted ZFS password for ${ENCRYPTIONROOT}: " \
--cmd "zfs load-key '${ENCRYPTIONROOT}'"
KEYSTATUS="$(zfs get -H -o value keystatus "${ENCRYPTIONROOT}")"
# if the key needs to be loaded
if [ "$KEYSTATUS" = "unavailable" ]; then
# decrypt them
ask_for_password \
--tries 5 \
--prompt "Encrypted ZFS password for ${ENCRYPTIONROOT}: " \
--cmd "zfs load-key '${ENCRYPTIONROOT}'"
fi
fi
fi
# Let us tell the initrd to run on shutdown.
Expand Down
3 changes: 3 additions & 0 deletions contrib/dracut/90zfs/zfs-load-key.sh.in
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,9 @@ if [ "$(zpool list -H -o feature@encryption $(echo "${BOOTFS}" | awk -F\/ '{prin
# if the root dataset has encryption enabled
ENCRYPTIONROOT=$(zfs get -H -o value encryptionroot "${BOOTFS}")
if ! [ "${ENCRYPTIONROOT}" = "-" ]; then
KEYSTATUS="$(zfs get -H -o value keystatus "${ENCRYPTIONROOT}")"
# continue only if the key needs to be loaded
[ "$KEYSTATUS" = "unavailable" ] || exit 0
# decrypt them
TRY_COUNT=5
while [ $TRY_COUNT -gt 0 ]; do
Expand Down
3 changes: 3 additions & 0 deletions contrib/initramfs/scripts/zfs.in
Original file line number Diff line number Diff line change
Expand Up @@ -414,6 +414,9 @@ decrypt_fs()

# If root dataset is encrypted...
if ! [ "${ENCRYPTIONROOT}" = "-" ]; then
KEYSTATUS="$(${ZFS} get -H -o value keystatus "${ENCRYPTIONROOT}")"
# Continue only if the key needs to be loaded
[ "$KEYSTATUS" = "unavailable" ] || return 0
TRY_COUNT=3
# Prompt with plymouth, if active
if [ -e /bin/plymouth ] && /bin/plymouth --ping 2>/dev/null; then
Expand Down

0 comments on commit b50c0ec

Please sign in to comment.