* g13/g13.c (oNoMount): New.
(opts): Add --no-mount.
(main): Implement this.
* g13/g13-common.h (opt): Add field no_mount.
* common/status.h (STATUS_PLAINDEV): New.
* g13/sh-cmd.c (has_option): Uncomment.
(cmd_mount): Add option --no-mount and pass down.
* g13/sh-dmcrypt.c (sh_dmcrypt_mount_container): Add arg nomount and
emit PLAINDEV status line.
(sh_dmcrypt_umount_container): Rund findmnt before umount.
--
This option can be used to decrypt a device but not to mount it. For
example to run fsck first. A command or option to run fsck before a
mount will eventually be added.
The use of findmnt is needed so that we can easily remove a device
which has not been mounted.
* g13/g13.c (aSuspend, aResume): New.
(opts): Add commands --suspend and --resume.
(main): Implement dummy command aUmount. Implement commands aResume
and aSuspend.
* g13/sh-cmd.c (cmd_suspend): New.
(cmd_resume): New.
(register_commands): Add commands RESUME and SUSPEND.
* g13/server.c (cmd_suspend): New.
(cmd_resume): New.
(register_commands): Add commands RESUME and SUSPEND.
* g13/be-dmcrypt.c (be_dmcrypt_suspend_container): New.
(be_dmcrypt_resume_container): New.
* g13/backend.c (be_suspend_container): New.
(be_resume_container): New.
* g13/suspend.c, g13/suspend.h: New.
* g13/mount.c (parse_header, read_keyblob_prefix, read_keyblob)
(decrypt_keyblob, g13_is_container): Move to ...
* g13/keyblob.c: new file.
(keyblob_read): Rename to g13_keyblob_read and make global.
(keyblob_decrypt): Rename to g13_keyblob_decrypt and make global.
* g13/sh-dmcrypt.c (check_blockdev): Add arg expect_busy.
(sh_dmcrypt_suspend_container): New.
(sh_dmcrypt_resume_container): New.
* g13/call-syshelp.c (call_syshelp_run_suspend): New.
(call_syshelp_run_resume): New.
--
The --suspend command can be used before a hibernate operation to make
the encrypted partition inaccessible and wipe the key from the memory.
Before --suspend is called a sync(1) should be run to make sure that
their are no dirty buffers (dmsetup, as called by g13, actually does
this for you but it does not harm to do it anyway. After the
partition has been suspended a
echo 3 >proc/sys/vm/drop_caches
required to flush all caches which may still have content from the
encrypted partition.
The --resume command reverses the effect of the suspend but to do this
it needs to decrypt again. Now, if the .gnupg directory lives on the
encrypted partition this will be problematic because due to the
suspend all processes accessing data on the encrypted partition will
be put into an uninterruptible sleep (ps(1) shows a state of 'D').
This needs to be avoided. A workaround is to have a separate GnuPG
home directory (say, "~/.gnupg-fallback") with only the public keys
required to decrypt the partition along with a properly setup
conf files. A
GNUPGHOME=$(pwd)/.gnupg-fallback g13 --resume
should then be able to resume the encrypted partition using the
private key stored on a smartcard.
The implementation is pretty basic right now but useful to me.
Signed-off-by: Werner Koch <wk@gnupg.org>
* g13/g13-syshelp.c (g13_syshelp_i_know_what_i_am_doing):
* g13/sh-dmcrypt.c (sh_dmcrypt_create_container): Call it.
(sh_dmcrypt_mount_container): Call it.
Signed-off-by: Werner Koch <wk@gnupg.org>
* g13/be-dmcrypt.c, g13/be-dmcrypt.h: New.
* g13/Makefile.am (g13_SOURCES): Add them.
* g13/backend.c: Include be-dmcrypt.h and call-syshelp.h.
(no_such_backend): Rename to _no_such_backend and provide replacement
macro.
(be_is_supported_conttype): Support DM-Crypt.
(be_take_lock_for_create): Call set_segvice for DM-Crypt.
(be_create_new_keys): Make it a dummy for DM-Crypt.
(be_create_container): Call be_dmcrypt_create_container.
(be_mount_container): call be_dmcrypt_mount_container.
* g13/g13-syshelp.c (main): Enable verbose mode.
* g13/g13tuple.c (get_tupledesc_data): New.
* g13/g13tuple.h (unref_tupledesc): New.
* g13/g13.h (server_control_): Add field "recipients".
* g13/g13.c (main): Fix setting of recipients via cmdline.
(g13_deinit_default_ctrl): Release recipients list.
(g13_request_shutdown): New. Replace all direct update of
shutdown_pending by calls this function.
* g13/server.c (server_local_s): Remove field recipients which is now
part of CTRL.
(reset_notify, cmd_recipient, cmd_create): Adjust for this change.
* g13/create.c (encrypt_keyblob): Rename to g13_encrypt_keyblob.
(g13_create_container): Support DM-Crypt.
* g13/mount.c (parse_header): Allow for meta data copies.
(g13_mount_container): Support DM-Crypt.
* g13/sh-cmd.c (cmd_create): Make it work.
(cmd_mount): New.
* g13/sh-dmcrypt.c (sh_dmcrypt_create_container): Make it work.
(sh_dmcrypt_mount_container): New.
--
With this patch we can now create an encrypted partition and partly
mount it (i.e. setup keys and create the mapped device). We do not yet
create a file system or mount that file system
Signed-off-by: Werner Koch <wk@gnupg.org>
* g13/sh-exectool.c: Remove. It has been replaced by common/exectool.c.
* g13/Makefile.am (g13_syshelp_SOURCES): Remove sh-exectool.c
* g13/sh-blockdev.c: Include exectool.h. Change sh_exec_tool to
gnupg_exec-tool.
* g13/sh-dmcrypt.c: Ditto.
--
With commit 2ae07f826a the exectool code
was moved from a g13 feature branch to common/ so that it could be
used by gpgtar. With this patch we finally remove the original code
and use the one in common/.
Signed-off-by: Werner Koch <wk@gnupg.org>
Werner Koch