svn commit: r280938 - in head: sys/boot/forth usr.sbin/bsdinstall/scripts
Devin Teske
dteske at FreeBSD.org
Wed Apr 1 02:01:36 UTC 2015
Author: dteske
Date: Wed Apr 1 02:01:34 2015
New Revision: 280938
URL: https://svnweb.freebsd.org/changeset/base/280938
Log:
Add "GELI Passphrase:" prompt to boot loader.
Summary:
Add "GELI Passphrase:" prompt to boot loader.
A new loader.conf(5) option of geom_eli_passphrase_prompt="YES" will now
allow you to enter your geli(8) root-mount credentials prior to invoking
the kernel.
See check-password.4th(8) for details.
Differential Revision: https://reviews.freebsd.org/D2105
Reviewed by: (your name[s] here)
MFC after: 3 days
X-MFC-to: stable/10
Relnotes: yes
Test Plan:
Drop a head copy of check-password.4th into /boot and then apply the patch
(only the patch to /boot/check-password.4th is required; no other changes are
required but you do have to have a HEAD copy of check-password.4th to
apply the patch).
NB: The rest of your /boot files can be up to 2 years old but no older.
NB: The test won't work unless your kernel has the following change
https://svnweb.freebsd.org/base?view=revision&revision=273489
Now, put into /boot/loader.conf:
geom_eli_passphrase_prompt="YES"
and reboot.
You should be prompted for a GELI passphrase before the menu (if enabled),
just after loading loader.conf(5).
NB: It doesn't matter if you're using GELI or not. However if you are using
GELI and a sufficiently new enough release (has SVN r273489) and you entered
the proper passphrase to mount your GELI encrypted root device(s), you should
notice that the boot process did not stop (you went from loader all the way to login).
Reviewers: cperciva, allanjude, scottl, kmoore
Subscribers: jkh, imp
Differential Revision: https://reviews.freebsd.org/D2105
Modified:
head/sys/boot/forth/check-password.4th
head/sys/boot/forth/check-password.4th.8
head/sys/boot/forth/loader.conf
head/usr.sbin/bsdinstall/scripts/zfsboot
Modified: head/sys/boot/forth/check-password.4th
==============================================================================
--- head/sys/boot/forth/check-password.4th Wed Apr 1 01:54:28 2015 (r280937)
+++ head/sys/boot/forth/check-password.4th Wed Apr 1 02:01:34 2015 (r280938)
@@ -146,6 +146,15 @@ only forth definitions also password-pro
2drop read-reset
else drop then
+ \ Prompt for GEOM ELI (geli(4)) passphrase if enabled
+ s" geom_eli_passphrase_prompt" getenv dup -1 <> if
+ s" YES" compare-insensitive 0= if
+ s" GELI Passphrase: " read ( prompt -- )
+ readval readlen @ s" kern.geom.eli.passphrase" setenv
+ read-reset
+ then
+ else drop then
+
\ Exit if a password was not set
s" password" getenv -1 = if exit else drop then
Modified: head/sys/boot/forth/check-password.4th.8
==============================================================================
--- head/sys/boot/forth/check-password.4th.8 Wed Apr 1 01:54:28 2015 (r280937)
+++ head/sys/boot/forth/check-password.4th.8 Wed Apr 1 02:01:34 2015 (r280938)
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2011-2012 Devin Teske
+.\" Copyright (c) 2011-2015 Devin Teske
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
@@ -24,7 +24,7 @@
.\"
.\" $FreeBSD$
.\"
-.Dd December 10, 2012
+.Dd March 20, 2015
.Dt CHECK-PASSWORD.4TH 8
.Os
.Sh NAME
@@ -33,8 +33,12 @@
.Sh DESCRIPTION
The file that goes by the name of
.Nm
-is a set of commands designed to either prevent booting or prevent modification
-of boot options without an appropriately configured password.
+is a set of commands designed to do one or more of the following:
+.Pp
+.Dl o Prevent booting without password
+.Dl o Prevent modification of boot options without password
+.Dl o Provide a password to mount geli(8) encrypted root disk(s)
+.Pp
The commands of
.Nm
by themselves are not enough for most uses.
@@ -58,14 +62,23 @@ The commands provided by it are:
.Pp
.Bl -tag -width disable-module_module -compact -offset indent
.It Ic check-password
-Dual-purpose function that can either protect the interactive boot menu or
-prevent boot without password (separately).
+Multi-purpose function that can protect the interactive boot menu,
+prevent boot without password, or prompt for geli(8) passphrase
+.Pq depending on Xr loader.conf 5 settings .
.Pp
First checks
.Va bootlock_password
and if-set, the user cannot continue until the correct password is entered.
.Pp
-Next checks
+Next, checks
+.Va geom_eli_passphrase_prompt
+and if set to
+.Li YES
+.Pq case-insensitive
+prompts the user to enter their GELI password for later mounting of the root
+device(s) during boot.
+.Pp
+Last, checks
.Va password
and if-set, tries to
.Ic autoboot
@@ -81,6 +94,11 @@ The environment variables that effect it
Sets the bootlock password (up to 16 characters long) that is required by
.Ic check-password
to be entered before the system is allowed to boot.
+.It Va geom_eli_passphrase_prompt
+Selects whether loader(8) will prompt for GELI credentials, handing-off to the
+kernel for later mounting of
+.Xr geli 8
+encrypted root device(s).
.It Va password
Sets the password (up to 16 characters long) that is required by
.Ic check-password
@@ -122,6 +140,16 @@ to prevent booting without password:
.Bd -literal -offset indent -compact
bootlock_password="boot"
.Ed
+.Pp
+Add the following to
+.Xr loader.conf 5
+to generate a prompt at boot to collect GELI credentials for mounting
+.Xr geli 8
+encrypted root device(s):
+.Pp
+.Bd -literal -offset indent -compact
+geom_eli_passphrase_prompt="YES"
+.Ed
.Sh SEE ALSO
.Xr loader.conf 5 ,
.Xr loader 8 ,
Modified: head/sys/boot/forth/loader.conf
==============================================================================
--- head/sys/boot/forth/loader.conf Wed Apr 1 01:54:28 2015 (r280937)
+++ head/sys/boot/forth/loader.conf Wed Apr 1 02:01:34 2015 (r280938)
@@ -62,6 +62,7 @@ entropy_cache_type="/boot/entropy"
# "NO" to disable autobooting
#password="" # Prevent changes to boot options
#bootlock_password="" # Prevent booting (see check-password.4th(8))
+#geom_eli_passphrase_prompt="NO" # Prompt for geli(8) passphrase to mount root
#beastie_disable="NO" # Turn the beastie boot menu on and off
#kernels="kernel kernel.old" # Kernels to display in the boot menu
#loader_logo="orbbw" # Desired logo: orbbw, orb, fbsdbw, beastiebw, beastie, none
Modified: head/usr.sbin/bsdinstall/scripts/zfsboot
==============================================================================
--- head/usr.sbin/bsdinstall/scripts/zfsboot Wed Apr 1 01:54:28 2015 (r280937)
+++ head/usr.sbin/bsdinstall/scripts/zfsboot Wed Apr 1 02:01:34 2015 (r280938)
@@ -1343,6 +1343,9 @@ zfs_create_boot()
$BSDINSTALL_TMPBOOT/loader.conf.aesni || return $FAILURE
f_eval_catch $funcname echo "$ECHO_APPEND" 'geom_eli_load=\"YES\"' \
$BSDINSTALL_TMPBOOT/loader.conf.geli || return $FAILURE
+ f_eval_catch $funcname echo "$ECHO_APPEND" \
+ 'geom_eli_passphrase_prompt=\"YES\"' \
+ $BSDINSTALL_TMPBOOT/loader.conf.geli || return $FAILURE
for disk in $disks; do
f_eval_catch $funcname printf "$PRINTF_CONF" \
geli_%s_keyfile0_load "$disk$targetpart YES" \
More information about the svn-src-all
mailing list