-
Notifications
You must be signed in to change notification settings - Fork 0
/
README
90 lines (62 loc) · 2.52 KB
/
README
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
------------------------------------------------------------------------
The scripts do stuff more or less in the following order:
1. choose_method/crypto
2. active_partition/*
3. choose_partition/crypto
4. init.d/crypto
5. blockdev-keygen
6. update.d/crypto_visuals
7. finish.d/check_randomfskey, aptinstall_crypto
choose_method/
crypto
Entry in the "Use as:" menu. All encryption types (currenly only
dm-crypt) are merged into one choice. Writes "crypto" into
$dev/$id/method and activates the below crypto options.
active_partition/*
Entries in the partition menu. Which are shown depends on crypt_type
and cipher. The chosen values are stored in $dev/$id/<entry>
choose_partition/
crypto
"Setup encrypted volumes" in the main menu. Checks for valid cipher
options and safe swap. Creates keyfiles, erases to-be-encrypted
parititons and finally does losetup/dmsetup.
init.d/
crypto
Creates the partman cryptdisks once for each crypto partition.
update.d/
crypto_visuals
Shows "crypt" in the method column, and the name of the crypt disk as
mountpoint, so the user can see which dm device is which after
they have been setup.
finish.d/
crypto_check_mountpoints
Shows a warning if user chose to create a filesystem on a crypt disk
with keytype random. User can force to continue, maybe that should
eventually be disabled. Note: random keytype can make sense for the
/tmp partition, but actually requires random/1777 keytype.
finish.d/
crypto_config
Adds crypttab entries.
finish.d/
crypto_aptinstall
Installs userspace tools and helper packages for encryption. This
is responsible for installing installs cryptsetup etc.
blockdev-keygen
Asks for a passphrase, confirms that it has been entered correctly
and optionally tests for a minimum length.
This script uses the cdebconf plugin "entropy" if available. See
notes at the beginning of the script for important steps for the
caller.
ciphers/$crypt_type/$cipher
Lists supported ciphers for each crypt_type. The following files
exist for each cipher directory. They are used to display a short
description of the cipher for the user and to determine allowed
crypto parameters (TODO):
- desc (description)
- options (crypt_type specific)
Structure is
ciphers/$crypt_type/$cipher/<file>
mountoptions
mountoptions/crypto
Should be no longer required. Maybe resurrect once we find a cleaner
approach for setting crypto-specific mount options.