diff -Nru cryptsetup-2.2.2/configure.ac cryptsetup-2.3.1/configure.ac --- cryptsetup-2.2.2/configure.ac 2019-11-01 08:02:46.000000000 +0000 +++ cryptsetup-2.3.1/configure.ac 2020-03-12 08:39:20.000000000 +0000 @@ -1,9 +1,9 @@ AC_PREREQ([2.67]) -AC_INIT([cryptsetup],[2.2.2]) +AC_INIT([cryptsetup],[2.3.1]) dnl library version from ..[-] LIBCRYPTSETUP_VERSION=$(echo $PACKAGE_VERSION | cut -f1 -d-) -LIBCRYPTSETUP_VERSION_INFO=17:0:5 +LIBCRYPTSETUP_VERSION_INFO=18:0:6 AM_SILENT_RULES([yes]) AC_CONFIG_SRCDIR(src/cryptsetup.c) @@ -33,6 +33,7 @@ AC_ENABLE_STATIC(no) LT_INIT PKG_PROG_PKG_CONFIG +AM_ICONV dnl ========================================================================== dnl define PKG_CHECK_VAR for old pkg-config <= 0.28 @@ -59,6 +60,12 @@ AC_HEADER_STDC AC_CHECK_HEADERS(fcntl.h malloc.h inttypes.h sys/ioctl.h sys/mman.h \ sys/sysmacros.h sys/statvfs.h ctype.h unistd.h locale.h byteswap.h endian.h stdint.h) +AC_CHECK_DECLS([O_CLOEXEC],,[AC_DEFINE([O_CLOEXEC],[0], [Defined to 0 if not provided])], +[[ +#ifdef HAVE_FCNTL_H +# include +#endif +]]) AC_CHECK_HEADERS(uuid/uuid.h,,[AC_MSG_ERROR([You need the uuid library.])]) AC_CHECK_HEADER(libdevmapper.h,,[AC_MSG_ERROR([You need the device-mapper library.])]) @@ -348,6 +355,7 @@ AC_CHECK_DECLS([dm_task_deferred_remove], [], [], [#include ]) AC_CHECK_DECLS([dm_device_has_mounted_fs], [], [], [#include ]) AC_CHECK_DECLS([dm_device_has_holders], [], [], [#include ]) +AC_CHECK_DECLS([dm_device_get_name], [], [], [#include ]) AC_CHECK_DECLS([DM_DEVICE_GET_TARGET_VERSION], [], [], [#include ]) AC_CHECK_DECLS([DM_UDEV_DISABLE_DISK_RULES_FLAG], [have_cookie=yes], [have_cookie=no], [#include ]) if test "x$enable_udev" = xyes; then diff -Nru cryptsetup-2.2.2/debian/bash_completion/cryptdisks cryptsetup-2.3.1/debian/bash_completion/cryptdisks --- cryptsetup-2.2.2/debian/bash_completion/cryptdisks 2020-02-04 13:11:12.000000000 +0000 +++ cryptsetup-2.3.1/debian/bash_completion/cryptdisks 1970-01-01 00:00:00.000000000 +0000 @@ -1,42 +0,0 @@ -# cryptdisks_{start,stop} completion by first column of crypttab -# -# Copyright 2013 Claudius Hubig , 2-clause BSD - -_cryptdisks() { - local action="$1" t - for t in $( mawk -vt="${COMP_WORDS[COMP_CWORD]}" \ - '($1 !~ /^#/ && index($1,t) == 1) {print $1}' \ - "${TABFILE-"/etc/crypttab"}" ); do - if [ "$action" = start -a ! -e "/dev/mapper/$t" ] || - [ "$action" = stop -a -e "/dev/mapper/$t" ]; then - COMPREPLY+=( "$t" ) - fi - done - return 0; -} - -_cryptdisks_start() { - local i include_options=y - COMPREPLY=() - for (( i=0; i < COMP_CWORD-1; i++ )); do - if [ "${COMP_WORDS[i]}" = "--" ] || [[ "${COMP_WORDS[i]}" != -* ]]; then - include_options=n - break - fi - done - if [ "$include_options" = "y" ]; then - for i in "-r" "--readonly" "--"; do - if [[ "$i" == "${COMP_WORDS[COMP_CWORD]}"* ]]; then - COMPREPLY+=( "$i" ) - fi - done - fi - _cryptdisks start "$@" -} -_cryptdisks_stop() { - COMPREPLY=() - _cryptdisks stop "$@"; -} - -complete -F _cryptdisks_start cryptdisks_start -complete -F _cryptdisks_stop cryptdisks_stop diff -Nru cryptsetup-2.2.2/debian/bash_completion/cryptdisks_start cryptsetup-2.3.1/debian/bash_completion/cryptdisks_start --- cryptsetup-2.2.2/debian/bash_completion/cryptdisks_start 1970-01-01 00:00:00.000000000 +0000 +++ cryptsetup-2.3.1/debian/bash_completion/cryptdisks_start 2020-03-24 01:07:07.000000000 +0000 @@ -0,0 +1,42 @@ +# cryptdisks_{start,stop} completion by first column of crypttab +# +# Copyright 2013 Claudius Hubig , 2-clause BSD + +_cryptdisks() { + local action="$1" t + for t in $( mawk -vt="${COMP_WORDS[COMP_CWORD]}" \ + '($1 !~ /^#/ && index($1,t) == 1) {print $1}' \ + "${TABFILE-"/etc/crypttab"}" ); do + if [ "$action" = start -a ! -e "/dev/mapper/$t" ] || + [ "$action" = stop -a -e "/dev/mapper/$t" ]; then + COMPREPLY+=( "$t" ) + fi + done + return 0; +} + +_cryptdisks_start() { + local i include_options=y + COMPREPLY=() + for (( i=0; i < COMP_CWORD-1; i++ )); do + if [ "${COMP_WORDS[i]}" = "--" ] || [[ "${COMP_WORDS[i]}" != -* ]]; then + include_options=n + break + fi + done + if [ "$include_options" = "y" ]; then + for i in "-r" "--readonly" "--"; do + if [[ "$i" == "${COMP_WORDS[COMP_CWORD]}"* ]]; then + COMPREPLY+=( "$i" ) + fi + done + fi + _cryptdisks start "$@" +} +_cryptdisks_stop() { + COMPREPLY=() + _cryptdisks stop "$@"; +} + +complete -F _cryptdisks_start cryptdisks_start +complete -F _cryptdisks_stop cryptdisks_stop diff -Nru cryptsetup-2.2.2/debian/changelog cryptsetup-2.3.1/debian/changelog --- cryptsetup-2.2.2/debian/changelog 2020-02-27 06:16:14.000000000 +0000 +++ cryptsetup-2.3.1/debian/changelog 2020-05-01 14:07:58.000000000 +0000 @@ -1,3 +1,48 @@ +cryptsetup (2:2.3.1-1ubuntu1) groovy; urgency=low + + * Merge from Debian unstable. Remaining changes: + - debian/control: + + Recommend plymouth. + + Depend on busybox-initramfs instead of busybox | busybox-static. + - Fix cryptroot-unlock for busybox compatibility. + + -- Steve Langasek Fri, 01 May 2020 07:07:58 -0700 + +cryptsetup (2:2.3.1-1) unstable; urgency=medium + + * New upstream release. + * d/initramfs/hooks/cryptroot: Don't set unused variable LIBC_DIR. + + -- Guilhem Moulin Tue, 24 Mar 2020 02:07:07 +0100 + +cryptsetup (2:2.3.0-1) unstable; urgency=low + + * New upstream release, introducing support for BitLocker-compatible + devices (BITLK format) used in Windows systems. + WARNING: crypttab(5) support for these devices is currently *experimental* + and requires blkid from util-linux >=2.33 (i.e., Buster or later). These + devices currently have no keyword to use in the 4th field (unlike 'luks' + or 'plain'), the device type is inferred from the signature instead. + * crypttab(5): Make the 4th field (options) optional so we don't have to + introduce a new keyword for each new device type. (That field is also + optional in the systemd implementation.) Other fields (dm target name, + source device, and key file) remain required. + * Install cryptdisks_{start,stop} bash completion scripts to the right + path/name so they are loaded automatically. This was no longer the case + since 2:1.7.0-1. (Closes: #949623) + * d/*.install: Replace tabs with spaces. + * d/cryptdisks-functions: Fix broken $FORCE_START handling. Since + 2:2.0.3-2 the SysV init scripts' "force-start" option was no longer + overriding noauto/noearly. (Closes: #933142) + * Move some functions to d/function from the initramfs hook. + * SysV init scripts: skip devices holding the root FS and/or /usr during the + shutdown phase; these file systems are still mounted at this point so any + attempt to gracefully close the underlying device(s) is bound to fail. + (Closes: #916649, #918008) + * Bump Standards-Version to 4.5.0 (no changes necessary). + + -- Guilhem Moulin Wed, 04 Mar 2020 00:48:19 +0100 + cryptsetup (2:2.2.2-3ubuntu2) focal; urgency=medium * Depend on cryptsetup from cryptsetup-initramfs instead of the dummy @@ -18,7 +63,8 @@ cryptsetup (2:2.2.2-3) unstable; urgency=high * initramfs hook: Workaround fix for the libgcc_s's source location. - (Closes: #950628, #939766.) See #950254 for the proper fix. + (Closes: #950628, #939766.) Fixing #950254 will provide a better + solution. -- Guilhem Moulin Tue, 04 Feb 2020 14:11:12 +0100 diff -Nru cryptsetup-2.2.2/debian/control cryptsetup-2.3.1/debian/control --- cryptsetup-2.2.2/debian/control 2020-02-27 06:15:43.000000000 +0000 +++ cryptsetup-2.3.1/debian/control 2020-03-24 21:20:08.000000000 +0000 @@ -31,7 +31,7 @@ uuid-dev, xsltproc, xxd -Standards-Version: 4.4.1 +Standards-Version: 4.5.0 Homepage: https://gitlab.com/cryptsetup/cryptsetup Vcs-Browser: https://salsa.debian.org/cryptsetup-team/cryptsetup Vcs-Git: https://salsa.debian.org/cryptsetup-team/cryptsetup.git diff -Nru cryptsetup-2.2.2/debian/cryptdisks-functions cryptsetup-2.3.1/debian/cryptdisks-functions --- cryptsetup-2.2.2/debian/cryptdisks-functions 2020-02-04 13:11:12.000000000 +0000 +++ cryptsetup-2.3.1/debian/cryptdisks-functions 2020-03-24 21:20:09.000000000 +0000 @@ -85,13 +85,12 @@ loud="yes" fi - if [ -n "${CRYPTTAB_OPTION_noearly+x}" ] && [ "$INITSTATE" = "early" ]; then - [ -z "${FORCE_START-}" ] || device_msg "ignored" - return 0 - fi - if [ -n "${CRYPTTAB_OPTION_noauto+x}" ] && [ "$INITSTATE" != "manual" ]; then - [ -z "${FORCE_START-}" ] || device_msg "ignored" - return 0 + if [ -z "${FORCE_START-}" ]; then + if [ "$INITSTATE" = "early" -a -n "${CRYPTTAB_OPTION_noearly+x}" ] || + [ "$INITSTATE" != "manual" -a -n "${CRYPTTAB_OPTION_noauto+x}" ]; then + device_msg "ignored" + return 0 + fi fi if [ -z "${CRYPTTAB_OPTION_keyscript+x}" ] && [ "$CRYPTTAB_KEY" != "none" ]; then @@ -111,13 +110,12 @@ device_msg "starting" local out tmpdev - get_crypt_type # set CRYPTTAB_TYPE to the type of crypt device - if [ "$CRYPTTAB_TYPE" != "luks" ]; then + if [ "$CRYPTTAB_TYPE" != "luks" ] && [ "$CRYPTTAB_TYPE" != "bitlk" ]; then + # fail if the device has a filesystem and the disk encryption format doesn't + # verify the key digest (unlike LUKS); unless it's swap, otherwise people can't + # easily convert an existing plainttext swap partition to an encrypted one if ! out="$(/lib/cryptsetup/checks/un_blkid "$CRYPTTAB_SOURCE" 2>/dev/null)" && ! /lib/cryptsetup/checks/blkid "$CRYPTTAB_SOURCE" swap >/dev/null; then - # fail if the device has a filesystem; unless it's swap, - # otherwise people can't easily convert an existing - # plainttext swap partition to an encrypted one log_warning_msg "$CRYPTTAB_NAME: the precheck for '$CRYPTTAB_SOURCE' failed: $out" return 1 fi @@ -177,25 +175,44 @@ return 1 } -# Removes all mappings in crypttab +# Removes all mappings in crypttab, except the ones holding the root +# file system or /usr do_stop() { + local devno_rootfs devno_usr dmsetup mknodes log_action_begin_msg "Stopping $INITSTATE crypto disks" + devno_rootfs="$(get_mnt_devno /)" || devno_rootfs="" + devno_usr="$(get_mnt_devno /usr)" || devno_usr="" + crypttab_foreach_entry _do_stop_callback log_action_end_msg 0 } _do_stop_callback() { - local i rv=0 - for i in 1 2 4 8 16 32; do - remove_mapping "$CRYPTTAB_NAME" 3<&- && break || rv=$? - if [ $rv -eq 1 ] || [ $rv -eq 2 -a $i -gt 16 ]; then - log_action_end_msg $rv - break - fi - log_action_cont_msg "$CRYPTTAB_NAME busy..." - sleep $i - done + local i rv=0 skip="n" + + # traverse the device tree for each crypttab(5) entry, that's + # suboptimal but we can't use mapped device names as they might + # contain any character other than NUL. shouldn't be much overhead + # anyway as the device tree is likely not that long + loop_cryptdevs _do_stop_skipped $devno_rootfs $devno_usr + + if [ "$skip" = "n" ]; then + for i in 1 2 4 8 16 32; do + remove_mapping "$CRYPTTAB_NAME" 3<&- && break || rv=$? + if [ $rv -eq 1 ] || [ $rv -eq 2 -a $i -gt 16 ]; then + log_action_end_msg $rv + break + fi + log_action_cont_msg "$CRYPTTAB_NAME busy..." + sleep $i + done + fi +} +_do_stop_skipped() { + if [ "$1" = "$CRYPTTAB_NAME" ]; then + skip="y" + fi } # device_msg([$name], $message) diff -Nru cryptsetup-2.2.2/debian/cryptsetup-initramfs.install cryptsetup-2.3.1/debian/cryptsetup-initramfs.install --- cryptsetup-2.2.2/debian/cryptsetup-initramfs.install 2020-02-04 13:11:12.000000000 +0000 +++ cryptsetup-2.3.1/debian/cryptsetup-initramfs.install 2020-03-24 21:20:09.000000000 +0000 @@ -1,9 +1,9 @@ -debian/initramfs/conf-hook /etc/cryptsetup-initramfs/ -debian/initramfs/conf-hooks.d/cryptsetup /usr/share/initramfs-tools/conf-hooks.d/ -debian/initramfs/cryptroot-unlock /usr/share/cryptsetup/initramfs/bin/ -debian/initramfs/hooks/* /usr/share/initramfs-tools/hooks/ -debian/initramfs/scripts/local-block/cryptroot /usr/share/initramfs-tools/scripts/local-block/ -debian/initramfs/scripts/local-bottom/cryptgnupg-sc /usr/share/initramfs-tools/scripts/local-bottom/ -debian/initramfs/scripts/local-bottom/cryptopensc /usr/share/initramfs-tools/scripts/local-bottom/ -debian/initramfs/scripts/local-top/cryptopensc /usr/share/initramfs-tools/scripts/local-top/ -debian/initramfs/scripts/local-top/cryptroot /usr/share/initramfs-tools/scripts/local-top/ +debian/initramfs/conf-hook /etc/cryptsetup-initramfs/ +debian/initramfs/conf-hooks.d/cryptsetup /usr/share/initramfs-tools/conf-hooks.d/ +debian/initramfs/cryptroot-unlock /usr/share/cryptsetup/initramfs/bin/ +debian/initramfs/hooks/* /usr/share/initramfs-tools/hooks/ +debian/initramfs/scripts/local-block/cryptroot /usr/share/initramfs-tools/scripts/local-block/ +debian/initramfs/scripts/local-bottom/cryptgnupg-sc /usr/share/initramfs-tools/scripts/local-bottom/ +debian/initramfs/scripts/local-bottom/cryptopensc /usr/share/initramfs-tools/scripts/local-bottom/ +debian/initramfs/scripts/local-top/cryptopensc /usr/share/initramfs-tools/scripts/local-top/ +debian/initramfs/scripts/local-top/cryptroot /usr/share/initramfs-tools/scripts/local-top/ diff -Nru cryptsetup-2.2.2/debian/cryptsetup.install cryptsetup-2.3.1/debian/cryptsetup.install --- cryptsetup-2.2.2/debian/cryptsetup.install 2020-02-04 13:11:12.000000000 +0000 +++ cryptsetup-2.3.1/debian/cryptsetup.install 2020-03-24 21:20:08.000000000 +0000 @@ -1,9 +1,9 @@ -debian/askpass /lib/cryptsetup/ -debian/bash_completion/cryptdisks /usr/share/bash-completion/completions/ -debian/checks/* /lib/cryptsetup/checks/ -debian/cryptdisks-functions /lib/cryptsetup/ -debian/functions /lib/cryptsetup/ -debian/scripts/cryptdisks_* /sbin/ -debian/scripts/decrypt_* /lib/cryptsetup/scripts/ -debian/scripts/luksformat /usr/sbin/ -debian/scripts/passdev /lib/cryptsetup/scripts/ +debian/askpass /lib/cryptsetup/ +debian/bash_completion/cryptdisks_start /usr/share/bash-completion/completions/ +debian/checks/* /lib/cryptsetup/checks/ +debian/cryptdisks-functions /lib/cryptsetup/ +debian/functions /lib/cryptsetup/ +debian/scripts/cryptdisks_* /sbin/ +debian/scripts/decrypt_* /lib/cryptsetup/scripts/ +debian/scripts/luksformat /usr/sbin/ +debian/scripts/passdev /lib/cryptsetup/scripts/ diff -Nru cryptsetup-2.2.2/debian/cryptsetup.links cryptsetup-2.3.1/debian/cryptsetup.links --- cryptsetup-2.2.2/debian/cryptsetup.links 1970-01-01 00:00:00.000000000 +0000 +++ cryptsetup-2.3.1/debian/cryptsetup.links 2020-03-24 01:07:07.000000000 +0000 @@ -0,0 +1 @@ +/usr/share/bash-completion/completions/cryptdisks_start /usr/share/bash-completion/completions/cryptdisks_stop diff -Nru cryptsetup-2.2.2/debian/cryptsetup-udeb.install cryptsetup-2.3.1/debian/cryptsetup-udeb.install --- cryptsetup-2.2.2/debian/cryptsetup-udeb.install 2020-02-04 13:11:12.000000000 +0000 +++ cryptsetup-2.3.1/debian/cryptsetup-udeb.install 2020-03-24 21:20:09.000000000 +0000 @@ -1,7 +1,7 @@ -debian/askpass /lib/cryptsetup/ -debian/checks/* /lib/cryptsetup/checks/ -debian/cryptdisks-functions /lib/cryptsetup/ -debian/functions /lib/cryptsetup/ -debian/scripts/decrypt_* /lib/cryptsetup/scripts/ -debian/scripts/passdev /lib/cryptsetup/scripts/ +debian/askpass /lib/cryptsetup/ +debian/checks/* /lib/cryptsetup/checks/ +debian/cryptdisks-functions /lib/cryptsetup/ +debian/functions /lib/cryptsetup/ +debian/scripts/decrypt_* /lib/cryptsetup/scripts/ +debian/scripts/passdev /lib/cryptsetup/scripts/ sbin/cryptsetup diff -Nru cryptsetup-2.2.2/debian/doc/crypttab.xml cryptsetup-2.3.1/debian/doc/crypttab.xml --- cryptsetup-2.2.2/debian/doc/crypttab.xml 2020-02-04 13:11:12.000000000 +0000 +++ cryptsetup-2.3.1/debian/doc/crypttab.xml 2020-03-24 21:20:09.000000000 +0000 @@ -76,23 +76,20 @@ useful. - The fourth field, options, describes the cryptsetup - options associated with the encryption process. At minimum, the field should - contain either the string luks respectively - tcrypt or the cipher, - hash and size options. - Some options can be changed on active devices using + The fourth field, options, is an optional comma-separated + list of options and/or flags describing the device type (luks, + tcrypt, or plain which is also the default) + and cryptsetup options associated with the encryption process. The supported options + are described below. + For plain dm-crypt devices the cipher, hash + and size options are required. + Some options can be changed on active mappings using cryptsetup refresh [<options>] <name>. - Moreover some options can be permanently written to the metada of LUKS2 - headers using the --persistent option flag. + Furthermore some options can be permanently written into metadata of LUKS2 + headers using cryptsetup's --persistent flag. - Options are in the format: key=value - [,key=value …]. The - supported options are described below. - - - Note that all four fields are mandatory and that a missing field will lead + Note that the first three fields are required and that a missing field will lead to unspecified behaviour. @@ -299,7 +296,7 @@ - veracrypt, tcrypt-veracrypt + veracrypt, tcrypt-veracrypt Use VeraCrypt extension to TrueCrypt device. Only useful in @@ -310,7 +307,7 @@ - tcrypthidden, tcrypt-hidden + tcrypthidden, tcrypt-hidden Use hidden TCRYPT header (ignored for non-TCRYPT devices). diff -Nru cryptsetup-2.2.2/debian/functions cryptsetup-2.3.1/debian/functions --- cryptsetup-2.2.2/debian/functions 2020-02-04 13:11:12.000000000 +0000 +++ cryptsetup-2.3.1/debian/functions 2020-03-24 21:20:08.000000000 +0000 @@ -36,6 +36,7 @@ # For error and warning messages, CRYPTTAB_NAME, (resp. CRYPTTAB_KEY) # should be set to the (unmangled) mapped device name (resp. key # file). +# Moreover CRYPTTAB_TYPE is set the device type. # Return 1 on parsing error, 0 otherwise (incl. if unknown options # were encountered). crypttab_parse_options() { @@ -104,12 +105,18 @@ done IFS=" " - if [ "$quiet" = "n" ] && - [ -z "${CRYPTTAB_OPTION_luks+x}" ] && [ -n "${CRYPTTAB_OPTION_header+x}" ]; then - cryptsetup_message "WARNING: Option 'luks' missing in crypttab for target $CRYPTTAB_NAME." \ - "Headers are only supported for LUKS devices." + if ! _get_crypt_type; then # set CRYPTTAB_TYPE to the type of crypt device + CRYPTTAB_TYPE="plain" + if [ "$quiet" = "n" ]; then + cryptsetup_message "WARNING: $CRYPTTAB_NAME: couldn't determine device type," \ + "assuming default ($CRYPTTAB_TYPE)." + fi + fi + + if [ "$quiet" = "n" ] && [ -n "${CRYPTTAB_OPTION_header+x}" ] && [ "$CRYPTTAB_TYPE" != "luks" ]; then + cryptsetup_message "WARNING: $CRYPTTAB_NAME: Headers are only supported for LUKS devices." fi - if [ -z "${CRYPTTAB_OPTION_luks+x}" ] && [ -z "${CRYPTTAB_OPTION_tcrypt+x}" ]; then + if [ "$CRYPTTAB_TYPE" = "plain" ]; then # the compiled-in default for these are subject to change options='cipher size' if [ -n "${CRYPTTAB_OPTION_keyscript+x}" ] || [ "$CRYPTTAB_KEY" = "none" ]; then @@ -240,7 +247,7 @@ [ ! -f "$CRYPTTAB_SOURCE" ] || return 0 # otherwise resolve the block device specification local dev="$CRYPTTAB_SOURCE" - dev="$(resolve_device_spec "$dev")" && CRYPTTAB_SOURCE="$dev" || return 1 + dev="$(_resolve_device_spec "$dev")" && CRYPTTAB_SOURCE="$dev" || return 1 } # run_keyscript($keyscriptarg, $tried_count) @@ -272,21 +279,34 @@ exec "$keyscript" "$keyscriptarg" } -# get_crypt_type() +# _get_crypt_type() # Set CRYPTTAB_TYPE to the mapping type, depending on its # $CRYPTTAB_OPTION_