thiemonagel / partman-crypto Goto Github PK

------------------------------------------------------------------------
The scripts do stuff more or less in the following order:

 1. choose_method/crypto
 2. active_partition/*
 3. choose_partition/crypto
 4. init.d/crypto
 5. blockdev-keygen
 6. update.d/crypto_visuals
 7. finish.d/check_randomfskey, aptinstall_crypto

choose_method/
  crypto

    Entry in the "Use as:" menu. All encryption types (currenly only
    dm-crypt) are merged into one choice. Writes "crypto" into
    $dev/$id/method and activates the below crypto options.

active_partition/*

    Entries in the partition menu. Which are shown depends on crypt_type
    and cipher. The chosen values are stored in $dev/$id/<entry>

choose_partition/
  crypto

    "Setup encrypted volumes" in the main menu. Checks for valid cipher
    options and safe swap. Creates keyfiles, erases to-be-encrypted
    parititons and finally does losetup/dmsetup.

init.d/
  crypto

    Creates the partman cryptdisks once for each crypto partition.

update.d/
  crypto_visuals

    Shows "crypt" in the method column, and the name of the crypt disk as
    mountpoint, so the user can see which dm device is which after
    they have been setup.

finish.d/
  crypto_check_mountpoints

    Shows a warning if user chose to create a filesystem on a crypt disk
    with keytype random. User can force to continue, maybe that should
    eventually be disabled. Note: random keytype can make sense for the
    /tmp partition, but actually requires random/1777 keytype.

finish.d/
  crypto_config

    Adds crypttab entries.

finish.d/
  crypto_aptinstall

    Installs userspace tools and helper packages for encryption. This
    is responsible for installing installs cryptsetup etc.

blockdev-keygen

    Asks for a passphrase, confirms that it has been entered correctly
    and optionally tests for a minimum length.

    This script uses the cdebconf plugin "entropy" if available. See
    notes at the beginning of the script for important steps for the
    caller.

ciphers/$crypt_type/$cipher

    Lists supported ciphers for each crypt_type. The following files
    exist for each cipher directory. They are used to display a short
    description of the cipher for the user and to determine allowed
    crypto parameters (TODO):

    - desc (description)
    - options (crypt_type specific)

    Structure is
      ciphers/$crypt_type/$cipher/<file>

mountoptions
mountoptions/crypto

    Should be no longer required. Maybe resurrect once we find a cleaner
    approach for setting crypto-specific mount options.