[PATCH] Unlock encrypted partitions before finding installations (#901917)

David Lehman dlehman at redhat.com
Wed Sep 18 21:59:12 UTC 2013


On Wed, 2013-09-18 at 15:05 +0200, Vratislav Podzimek wrote:
> Before trying to find existing installations, we should prompt user for
> passphrase to unlock encrypted paritions and try to unlock them.

ACK, with one comment below.

> 
> Signed-off-by: Vratislav Podzimek <vpodzime at redhat.com>
> ---
>  pyanaconda/rescue.py | 36 ++++++++++++++++++++++++++++++++++++
>  1 file changed, 36 insertions(+)
> 
> diff --git a/pyanaconda/rescue.py b/pyanaconda/rescue.py
> index 91ff18d..7a88afe 100644
> --- a/pyanaconda/rescue.py
> +++ b/pyanaconda/rescue.py
> @@ -39,6 +39,7 @@ from kickstart import runPostScripts
>  
>  from blivet import mountExistingSystem
>  from blivet.errors import StorageError
> +from blivet.devices import LUKSDevice
>  
>  from pykickstart.constants import KS_REBOOT, KS_SHUTDOWN
>  
> @@ -217,6 +218,40 @@ def _exception_handler_wrapper(orig_except_handler, screen, *args):
>      screen.finish()
>      return orig_except_handler(*args)
>  
> +def _unlock_devices(intf, storage):
> +    try_passphrase = None
> +    for device in storage.devices:
> +        if device.format.type == "luks":
> +            skip = False
> +            unlocked = False
> +            while not (skip or unlocked):
> +                if try_passphrase is None:
> +                    passphrase = intf.passphraseEntryWindow(device.name)
> +                else:
> +                    passphrase = try_passphrase
> +
> +                if passphrase is None:
> +                    # canceled
> +                    skip = True
> +                else:
> +                    device.format.passphrase = passphrase
> +                    try:
> +                        device.setup()
> +                        device.format.setup()
> +                        luks_dev = LUKSDevice(device.format.mapName,
> +                                              parents=[device],
> +                                              exists=True)
> +                        storage.devicetree._addDevice(luks_dev)
> +                        storage.devicetree.populate() # XXX: needed?

Yes -- for example if the encrypted device is an LVM PV we'd want to
scan in the VG and LVs after opening the last PV.

> +                        unlocked = True
> +                        # try to use the same passhprase for other devices
> +                        try_passphrase = passphrase
> +                    except StorageError as serr:
> +                        log.error("Failed to unlock %s: %s", device.name, serr)
> +                        device.teardown(recursive=True)
> +                        device.format.passphrase = None
> +                        try_passphrase = None
> +
>  def doRescue(intf, rescue_mount, ksdata):
>      import blivet
>  
> @@ -273,6 +308,7 @@ def doRescue(intf, rescue_mount, ksdata):
>  
>      sto = blivet.Blivet(ksdata=ksdata)
>      blivet.storageInitialize(sto, ksdata, [])
> +    _unlock_devices(intf, sto)
>      roots = blivet.findExistingInstallations(sto.devicetree)
>  
>      if not roots:




More information about the anaconda-patches mailing list