contrib/dracut/90zfs/zfs-load-key.sh.in

   1 #!/bin/bash
   2
   3 # This script only gets executed on systemd systems, see mount-zfs.sh for non-systemd systems
   4
   5 # import the libs now that we know the pool imported
   6 [ -f /lib/dracut-lib.sh ] && dracutlib=/lib/dracut-lib.sh
   7 [ -f /usr/lib/dracut/modules.d/99base/dracut-lib.sh ] && dracutlib=/usr/lib/dracut/modules.d/99base/dracut-lib.sh
   8 . "$dracutlib"
   9
  10 # load the kernel command line vars
  11 [ -z "$root" ] && root=$(getarg root=)
  12 # If root is not ZFS= or zfs: or rootfstype is not zfs then we are not supposed to handle it.
  13 [ "${root##zfs:}" = "${root}" -a "${root##ZFS=}" = "${root}" -a "$rootfstype" != "zfs" ] && exit 0
  14
  15 # There is a race between the zpool import and the pre-mount hooks, so we wait for a pool to be imported
  16 while true; do
  17     zpool list -H | grep -q -v '^$' && break
  18     [[ $(systemctl is-failed zfs-import-cache.service) == 'failed' ]] && exit 1
  19     [[ $(systemctl is-failed zfs-import-scan.service) == 'failed' ]] && exit 1
  20     sleep 0.1s
  21 done
  22
  23 # run this after import as zfs-import-cache/scan service is confirmed good
  24 if [[ "${root}" = "zfs:AUTO" ]] ; then
  25     root=$(zpool list -H -o bootfs | awk '$1 != "-" {print; exit}')
  26 else
  27     root="${root##zfs:}"
  28     root="${root##ZFS=}"
  29 fi
  30
  31 # if pool encryption is active and the zfs command understands '-o encryption'
  32 if [[ $(zpool list -H -o feature@encryption $(echo "${root}" | awk -F\/ '{print $1}')) == 'active' ]]; then
  33     # check if root dataset has encryption enabled
  34     if $(zfs list -H -o encryption "${root}" | grep -q -v off); then
  35         # figure out where the root dataset has its key, the keylocation should not be none
  36         while true; do
  37             if [[ $(zfs list -H -o keylocation "${root}") == 'none' ]]; then
  38                 root=$(echo -n "${root}" | awk 'BEGIN{FS=OFS="/"}{NF--; print}')
  39                 [[ "${root}" == '' ]] && exit 1
  40             else
  41                 break
  42             fi
  43         done
  44         # decrypt them
  45         TRY_COUNT=5
  46         while [ $TRY_COUNT != 0 ]; do
  47             zfs load-key "$root" <<< $(systemd-ask-password "Encrypted ZFS password for ${root}: ")
  48             [[ $? == 0 ]] && break
  49             ((TRY_COUNT-=1))
  50         done
  51     fi
  52 fi