Date: Wed, 1 Apr 2015 02:01:35 +0000 (UTC) From: Devin Teske <dteske@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r280938 - in head: sys/boot/forth usr.sbin/bsdinstall/scripts Message-ID: <201504010201.t3121Zoq057109@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: dteske Date: Wed Apr 1 02:01:34 2015 New Revision: 280938 URL: https://svnweb.freebsd.org/changeset/base/280938 Log: Add "GELI Passphrase:" prompt to boot loader. Summary: Add "GELI Passphrase:" prompt to boot loader. A new loader.conf(5) option of geom_eli_passphrase_prompt="YES" will now allow you to enter your geli(8) root-mount credentials prior to invoking the kernel. See check-password.4th(8) for details. Differential Revision: https://reviews.freebsd.org/D2105 Reviewed by: (your name[s] here) MFC after: 3 days X-MFC-to: stable/10 Relnotes: yes Test Plan: Drop a head copy of check-password.4th into /boot and then apply the patch (only the patch to /boot/check-password.4th is required; no other changes are required but you do have to have a HEAD copy of check-password.4th to apply the patch). NB: The rest of your /boot files can be up to 2 years old but no older. NB: The test won't work unless your kernel has the following change https://svnweb.freebsd.org/base?view=revision&revision=273489 Now, put into /boot/loader.conf: geom_eli_passphrase_prompt="YES" and reboot. You should be prompted for a GELI passphrase before the menu (if enabled), just after loading loader.conf(5). NB: It doesn't matter if you're using GELI or not. However if you are using GELI and a sufficiently new enough release (has SVN r273489) and you entered the proper passphrase to mount your GELI encrypted root device(s), you should notice that the boot process did not stop (you went from loader all the way to login). Reviewers: cperciva, allanjude, scottl, kmoore Subscribers: jkh, imp Differential Revision: https://reviews.freebsd.org/D2105 Modified: head/sys/boot/forth/check-password.4th head/sys/boot/forth/check-password.4th.8 head/sys/boot/forth/loader.conf head/usr.sbin/bsdinstall/scripts/zfsboot Modified: head/sys/boot/forth/check-password.4th ============================================================================== --- head/sys/boot/forth/check-password.4th Wed Apr 1 01:54:28 2015 (r280937) +++ head/sys/boot/forth/check-password.4th Wed Apr 1 02:01:34 2015 (r280938) @@ -146,6 +146,15 @@ only forth definitions also password-pro 2drop read-reset else drop then + \ Prompt for GEOM ELI (geli(4)) passphrase if enabled + s" geom_eli_passphrase_prompt" getenv dup -1 <> if + s" YES" compare-insensitive 0= if + s" GELI Passphrase: " read ( prompt -- ) + readval readlen @ s" kern.geom.eli.passphrase" setenv + read-reset + then + else drop then + \ Exit if a password was not set s" password" getenv -1 = if exit else drop then Modified: head/sys/boot/forth/check-password.4th.8 ============================================================================== --- head/sys/boot/forth/check-password.4th.8 Wed Apr 1 01:54:28 2015 (r280937) +++ head/sys/boot/forth/check-password.4th.8 Wed Apr 1 02:01:34 2015 (r280938) @@ -1,4 +1,4 @@ -.\" Copyright (c) 2011-2012 Devin Teske +.\" Copyright (c) 2011-2015 Devin Teske .\" All rights reserved. .\" .\" Redistribution and use in source and binary forms, with or without @@ -24,7 +24,7 @@ .\" .\" $FreeBSD$ .\" -.Dd December 10, 2012 +.Dd March 20, 2015 .Dt CHECK-PASSWORD.4TH 8 .Os .Sh NAME @@ -33,8 +33,12 @@ .Sh DESCRIPTION The file that goes by the name of .Nm -is a set of commands designed to either prevent booting or prevent modification -of boot options without an appropriately configured password. +is a set of commands designed to do one or more of the following: +.Pp +.Dl o Prevent booting without password +.Dl o Prevent modification of boot options without password +.Dl o Provide a password to mount geli(8) encrypted root disk(s) +.Pp The commands of .Nm by themselves are not enough for most uses. @@ -58,14 +62,23 @@ The commands provided by it are: .Pp .Bl -tag -width disable-module_module -compact -offset indent .It Ic check-password -Dual-purpose function that can either protect the interactive boot menu or -prevent boot without password (separately). +Multi-purpose function that can protect the interactive boot menu, +prevent boot without password, or prompt for geli(8) passphrase +.Pq depending on Xr loader.conf 5 settings . .Pp First checks .Va bootlock_password and if-set, the user cannot continue until the correct password is entered. .Pp -Next checks +Next, checks +.Va geom_eli_passphrase_prompt +and if set to +.Li YES +.Pq case-insensitive +prompts the user to enter their GELI password for later mounting of the root +device(s) during boot. +.Pp +Last, checks .Va password and if-set, tries to .Ic autoboot @@ -81,6 +94,11 @@ The environment variables that effect it Sets the bootlock password (up to 16 characters long) that is required by .Ic check-password to be entered before the system is allowed to boot. +.It Va geom_eli_passphrase_prompt +Selects whether loader(8) will prompt for GELI credentials, handing-off to the +kernel for later mounting of +.Xr geli 8 +encrypted root device(s). .It Va password Sets the password (up to 16 characters long) that is required by .Ic check-password @@ -122,6 +140,16 @@ to prevent booting without password: .Bd -literal -offset indent -compact bootlock_password="boot" .Ed +.Pp +Add the following to +.Xr loader.conf 5 +to generate a prompt at boot to collect GELI credentials for mounting +.Xr geli 8 +encrypted root device(s): +.Pp +.Bd -literal -offset indent -compact +geom_eli_passphrase_prompt="YES" +.Ed .Sh SEE ALSO .Xr loader.conf 5 , .Xr loader 8 , Modified: head/sys/boot/forth/loader.conf ============================================================================== --- head/sys/boot/forth/loader.conf Wed Apr 1 01:54:28 2015 (r280937) +++ head/sys/boot/forth/loader.conf Wed Apr 1 02:01:34 2015 (r280938) @@ -62,6 +62,7 @@ entropy_cache_type="/boot/entropy" # "NO" to disable autobooting #password="" # Prevent changes to boot options #bootlock_password="" # Prevent booting (see check-password.4th(8)) +#geom_eli_passphrase_prompt="NO" # Prompt for geli(8) passphrase to mount root #beastie_disable="NO" # Turn the beastie boot menu on and off #kernels="kernel kernel.old" # Kernels to display in the boot menu #loader_logo="orbbw" # Desired logo: orbbw, orb, fbsdbw, beastiebw, beastie, none Modified: head/usr.sbin/bsdinstall/scripts/zfsboot ============================================================================== --- head/usr.sbin/bsdinstall/scripts/zfsboot Wed Apr 1 01:54:28 2015 (r280937) +++ head/usr.sbin/bsdinstall/scripts/zfsboot Wed Apr 1 02:01:34 2015 (r280938) @@ -1343,6 +1343,9 @@ zfs_create_boot() $BSDINSTALL_TMPBOOT/loader.conf.aesni || return $FAILURE f_eval_catch $funcname echo "$ECHO_APPEND" 'geom_eli_load=\"YES\"' \ $BSDINSTALL_TMPBOOT/loader.conf.geli || return $FAILURE + f_eval_catch $funcname echo "$ECHO_APPEND" \ + 'geom_eli_passphrase_prompt=\"YES\"' \ + $BSDINSTALL_TMPBOOT/loader.conf.geli || return $FAILURE for disk in $disks; do f_eval_catch $funcname printf "$PRINTF_CONF" \ geli_%s_keyfile0_load "$disk$targetpart YES" \
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201504010201.t3121Zoq057109>