forks/linsk
forks/linsk
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement LUKS container mount

Browse source
This commit is contained in:
AlexSSD7 2023-09-27 14:49:48 +01:00
commit e25069e1f3
3 changed files with 35 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

8
cmd/run.go
View file

@ -61,8 +61,8 @@ var runCmd = &cobra.Command{
os.Exit(1) os.Exit(1)
} }
if luksFlag && !allowLUKSLowMemoryFlag { if (luksFlag || luksContainerFlag != "") && !allowLUKSLowMemoryFlag {
if vmMemAllocFlag < 2048 { if vmMemAllocFlag < defaultMemAllocLUKS {
if vmMemAllocFlag != defaultMemAlloc { if vmMemAllocFlag != defaultMemAlloc {
slog.Warn("Enforcing minimum LUKS memory allocation. Please add --allow-luks-low-memory to disable this.", "min", vmMemAllocFlag, "specified", vmMemAllocFlag) slog.Warn("Enforcing minimum LUKS memory allocation. Please add --allow-luks-low-memory to disable this.", "min", vmMemAllocFlag, "specified", vmMemAllocFlag)
} }
@ -75,6 +75,8 @@ var runCmd = &cobra.Command{
slog.Info("Mounting the device", "dev", vmMountDevName, "fs", fsType, "luks", luksFlag) slog.Info("Mounting the device", "dev", vmMountDevName, "fs", fsType, "luks", luksFlag)
err := fm.Mount(vmMountDevName, vm.MountOptions{ err := fm.Mount(vmMountDevName, vm.MountOptions{
LUKSContainerPreopen: luksContainerFlag,
FSType: fsType, FSType: fsType,
LUKS: luksFlag, LUKS: luksFlag,
}) })
@ -128,6 +130,7 @@ var runCmd = &cobra.Command{
var ( var (
luksFlag bool luksFlag bool
luksContainerFlag string
allowLUKSLowMemoryFlag bool allowLUKSLowMemoryFlag bool
shareListenIPFlag string shareListenIPFlag string
ftpExtIPFlag string ftpExtIPFlag string
@ -138,6 +141,7 @@ var (
func init() { func init() {
runCmd.Flags().BoolVarP(&luksFlag, "luks", "l", false, "Use cryptsetup to open a LUKS volume (password will be prompted).") runCmd.Flags().BoolVarP(&luksFlag, "luks", "l", false, "Use cryptsetup to open a LUKS volume (password will be prompted).")
runCmd.Flags().StringVar(&luksContainerFlag, "luks-container", "", `Specifies a device path (without "dev/" prefix) to preopen as a LUKS container (password will be prompted). Useful for accessing LVM partitions behind LUKS.`)
runCmd.Flags().BoolVar(&allowLUKSLowMemoryFlag, "allow-luks-low-memory", false, "Allow VM memory allocation lower than 2048 MiB when LUKS is enabled.") runCmd.Flags().BoolVar(&allowLUKSLowMemoryFlag, "allow-luks-low-memory", false, "Allow VM memory allocation lower than 2048 MiB when LUKS is enabled.")
runCmd.Flags().BoolVar(&debugShellFlag, "debug-shell", false, "Start a VM shell when the network file share is active.") runCmd.Flags().BoolVar(&debugShellFlag, "debug-shell", false, "Start a VM shell when the network file share is active.")

4
cmd/runvm/runvm.go
View file

@ -93,9 +93,9 @@ func RunVM(vi *vm.VM, initFileManager bool, tapRuntimeCtx *share.NetTapRuntimeCo
return 1 return 1
case <-vi.SSHUpNotifyChan(): case <-vi.SSHUpNotifyChan():
if fm != nil { if fm != nil {
err := fm.Init() err := fm.InitLVM()
if err != nil { if err != nil {
slog.Error("Failed to initialize File Manager", "error", err.Error()) slog.Error("Failed to initialize File Manager LVM", "error", err.Error())
return 1 return 1
} }
} }

32
vm/filemanager.go
View file

@ -52,7 +52,7 @@ func NewFileManager(logger *slog.Logger, vm *VM) *FileManager {
} }
} }
func (fm *FileManager) Init() error { func (fm *FileManager) InitLVM() error {
sc, err := fm.vm.DialSSH() sc, err := fm.vm.DialSSH()
if err != nil { if err != nil {
return errors.Wrap(err, "dial vm ssh") return errors.Wrap(err, "dial vm ssh")
@ -83,13 +83,13 @@ func (fm *FileManager) Lsblk() ([]byte, error) {
} }
type MountOptions struct { type MountOptions struct {
LUKSContainerPreopen string
FSType string FSType string
LUKS bool LUKS bool
} }
const luksDMName = "cryptmnt" func (fm *FileManager) luksOpen(sc *ssh.Client, fullDevPath string, luksDMName string) error {
func (fm *FileManager) luksOpen(sc *ssh.Client, fullDevPath string) error {
lg := fm.logger.With("vm-path", fullDevPath) lg := fm.logger.With("vm-path", fullDevPath)
return sshutil.NewSSHSessionWithDelayedTimeout(fm.vm.ctx, time.Second*15, sc, func(sess *ssh.Session, startTimeout func(preTimeout func())) error { return sshutil.NewSSHSessionWithDelayedTimeout(fm.vm.ctx, time.Second*15, sc, func(sess *ssh.Session, startTimeout func(preTimeout func())) error {
@ -197,8 +197,30 @@ func (fm *FileManager) Mount(devName string, mo MountOptions) error {
defer func() { _ = sc.Close() }() defer func() { _ = sc.Close() }()
if mo.LUKSContainerPreopen != "" {
if !utils.ValidateDevName(mo.LUKSContainerPreopen) {
return fmt.Errorf("bad luks container device name")
}
fullContainerDevPath := "/dev/" + mo.LUKSContainerPreopen
fm.logger.Info("Preopening a LUKS container", "container", fullContainerDevPath)
err := fm.luksOpen(sc, fullContainerDevPath, "cryptcontainer")
if err != nil {
return errors.Wrap(err, "luks (pre)open container")
}
err = fm.InitLVM()
if err != nil {
return errors.Wrap(err, "reinit lvm")
}
}
if mo.LUKS { if mo.LUKS {
err = fm.luksOpen(sc, fullDevPath) luksDMName := "cryptmnt"
err = fm.luksOpen(sc, fullDevPath, luksDMName)
if err != nil { if err != nil {
return errors.Wrap(err, "luks open") return errors.Wrap(err, "luks open")
} }