rancher/kcrypt
1
0
Fork 0
mirror of https://github.com/kairos-io/kcrypt.git synced 2025-04-27 19:29:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

Allow random partitions encryption

Browse Source 
Signed-off-by: Itxaka <itxaka@kairos.io>
This commit is contained in:
Itxaka 2025-03-12 17:16:22 +01:00
parent 654d4de653
commit a1295df1c6
No known key found for this signature in database
GPG Key ID: FF934753A9D6AC56
2 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
pkg/lib/lock.go
View File

@ -208,9 +208,12 @@ func formatLuks(device, name, mapper, label, pass string, logger types.KairosLog
}
l.Debug().Msg("discards")
out, err = SH(fmt.Sprintf("cryptsetup refresh --persistent --allow-discards %s", mapper))
// Refresh needs the password as its doing actions on the device directly
cmd := exec.Command("cryptsetup", "refresh", "--persistent", "--allow-discards", mapper)
cmd.Stdin = strings.NewReader(pass)
output, err := cmd.CombinedOutput()
if err != nil {
return fmt.Errorf("refresh err: %w, out: %s", err, out)
return fmt.Errorf("refresh err: %w, out: %s", err, string(output))
}
l.Debug().Msg("close")

8
pkg/lib/unlock.go
View File

@ -72,8 +72,14 @@ func UnlockAllWithLogger(tpm bool, log types.KairosLogger) error {
}
} else {
p.FilesystemLabel, err = config.GetLabelForUUID(volumeUUID)
// This is a not known filesystem label, so we will try to unlock by uuid or by partition label
// Notice that we lock by uuid and filesystem label so the label usually wont match between the fs label and partition label
// Unless set by the user to be the same one
if err != nil {
return err
if p.FilesystemLabel == "" || p.FilesystemLabel == "unknown" {
p.FilesystemLabel = p.Label
}
logger.Warn().Msg("Not known filesystem label, will try to unlock by uuid or by partition label")
}
err = UnlockDisk(p)
if err != nil {