diff --git a/heartbeat/crypt b/heartbeat/crypt index 56db37966..0b184305e 100755 --- a/heartbeat/crypt +++ b/heartbeat/crypt @@ -1,342 +1,378 @@ #!/bin/sh # # crypt/LUKS OCF RA. Manages cryptsetup devices. # # Copyright (c) 2020 Red Hat GmbH, Heinz Mauelshagen # All Rights Reserved. # # This program is free software; you can redistribute it and/or modify # it under the terms of version 2 of the GNU General Public License as # published by the Free Software Foundation. # # This program is distributed in the hope that it would be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # # Further, this software is distributed without any warranty that it is # free of the rightful claim of any third person regarding infringement # or the like. Any license provided herein, whether implied or # otherwise, applies only to this software file. Patent licenses, if # any, provided herein do not apply to combinations of this program with # other software, or any other product whatsoever. # # You should have received a copy of the GNU General Public License # along with this program; if not, write the Free Software Foundation, # Inc., 59 Temple Place - Suite 330, Boston MA 02111-1307, USA. # ####################################################################### # Initialization: : ${OCF_FUNCTIONS_DIR=${OCF_ROOT}/lib/heartbeat} . ${OCF_FUNCTIONS_DIR}/ocf-shellfuncs # Parameter defaults OCF_RESKEY_encrypted_dev_default="" OCF_RESKEY_crypt_dev_default="" OCF_RESKEY_key_file_default="" OCF_RESKEY_crypt_type_default="" OCF_RESKEY_force_stop_default="false" +OCF_RESKEY_use_clevis_default="false" : ${OCF_RESKEY_encrypted_dev=${OCF_RESKEY_encrypted_dev_default}} : ${OCF_RESKEY_crypt_dev=${OCF_RESKEY_crypt_dev_default}} : ${OCF_RESKEY_key_file=${OCF_RESKEY_key_file_default}} : ${OCF_RESKEY_crypt_type=${OCF_RESKEY_crypt_type_default}} : ${OCF_RESKEY_force_stop=${OCF_RESKEY_force_stop_default}} +: ${OCF_RESKEY_use_clevis=${OCF_RESKEY_use_clevis_default}} ####################################################################### meta_data() { cat < 1.0 This is a LUKS/crypt Resource Agent managing encrypted devices via cryptsetup(8). The agent imposes limitations on device types supported: luks, luks[1..N]. LUKS/crypt resource agent Encrypted backing device, which should be defined by UUID, 36 characters including '-'s as reported by blkid(8). Although it can be defined as a block device path (e.g. /dev/sdh), the UUID should be preferred over the block device path to allow for the unique discovery of the crypt backing device given the volatile nature of /dev entries (e.g. /dev/sdh on one node may be /dev/sdg on another). Only define as block device path if you know what you are doing. Encrypted device Encrypted device name, no path. I.e. the one given in "cryptsetup open name ...". The resulting block device path is /dev/mapper/name. Encrypted device Key file path containing the encryption passphrase (aka key; see cryptsetup(8)). For LUKS, the passphrase as of the key_file parameter is used to decrypt a randomly selected key when the device was created. Key file Encryption (device) type (e.g. "luks" or "luks2"). This parameter affirms the encryption format as of the crypt metadata thus allowing for safety measures when starting the encrypted resource. Encryption type If processes or kernel threads are using the crypt device, it cannot be stopped. We will try to stop processes, first by sending TERM and then, if that doesn't help in $PROC_CLEANUP_TIME seconds, using KILL. The lsof(8) program is required to get the list of array users. Of course, the kernel threads cannot be stopped this way. If the processes are critical for data integrity, then set this parameter to false. Note that in that case the stop operation will fail and the node will be fenced. force stop processes using the crpyt device + + +If LUKS volume is set up to unlock automatically using Tang/Clevis, +then set this parameter to "true". This has the side-effect of ignoring +the "key_file", "disable_locks" and "crypt_type" parameters. + +use clevis tools to unlock volume + + + END } # Disable cryptsetup auto-recovery if cloned. disable_locks="" ocf_is_clone && disable_locks="--disable-locks" crypt_usage() { cat </dev/null if [ $? -eq 0 ] && [ -z "$crypt_dev" ]; then ocf_exit_reason "Crypt device \"$crypt_dev\" name has to at least 1 character long and without path" return $OCF_ERR_ARGS fi if [ ! -r "$key_file" ]; then ocf_exit_reason "Hash key file $key_file not accessible" return $OCF_ERR_ARGS fi if ocf_is_true "$force_stop" && ! have_binary lsof; then ocf_exit_reason "Force stop requested, please install lsof(8)" return $OCF_ERR_INSTALLED fi cryptsetup isLuks $encrypted_dev 2>/dev/null if [ $? -ne 0 ]; then ocf_exit_reason "$encrypted_dev is not a Luks formatted device" return $OCF_ERR_CONFIGURED fi return $OCF_SUCCESS } + +detect_clevis() { + if ! have_binary clevis; then + use_clevis="false" #We can't use clevis, if we don't have it installed + elif ! ocf_is_true "$use_clevis"; then #if not already specified by user to use clevis + #Try to detect whether clevis is available + if clevis luks list -d $encrypted_dev | grep -q '^[[:digit:]]\+:'; then + use_clevis="true" #if grep finds output that matches, we have clevis, therefore use it + fi + fi +} + + get_users_pids() { ocf_log debug "running lsof to list \"$crypt_dev\" users..." ocf_run -warn 'lsof $crypt_dev_path | tail -n +2 | awk "{print $2}" | sort -u' } stop_crypt_users() { local pids=`get_users_pids` if [ -z "$pids" ]; then ocf_log warn "lsof reported no users holding arrays" return 2 fi ocf_stop_processes TERM $PROC_CLEANUP_TIME $pids } show_users() { local dm_dev ocf_log info "running lsof to list \"$crypt_dev\" users..." ocf_run -warn lsof $crypt_dev_path dm_dev=$(basename $(realpath $crypt_dev_path)) if [ -d /sys/block/$dm_dev/holders ]; then ocf_log debug "ls -l /sys/block/$dm_dev/holders" ocf_run -warn ls -l /sys/block/$dm_dev/holders fi } crypt_stop_one() { cryptsetup close $crypt_dev $disable_locks } ####################################################################### # # Action: START an encrypted resource # crypt_start() { local rc - - cryptsetup open $encrypted_dev $crypt_dev --type $crypt_type $disable_locks --key-file=$key_file - rc=$? + detect_clevis + + if ocf_is_true "$use_clevis"; then + clevis luks unlock -d $encrypted_dev -n $crypt_dev + rc=$? + else + cryptsetup open $encrypted_dev $crypt_dev --type $crypt_type $disable_locks --key-file=$key_file + rc=$? + fi if [ $rc -eq 0 ];then crypt_monitor rc=$? else rc=$OCF_ERR_GERNERIC fi [ $rc -ne $OCF_SUCCESS ] && ocf_exit_reason "Failed to start encrypted device \"$crypt_dev\"" return $rc } # # Action: STOP an encrypted resource # crypt_stop() { local rc crypt_monitor rc=$? if [ $rc -ne $OCF_NOT_RUNNING ]; then crypt_stop_one crypt_monitor rc=$? fi if [ $rc -ne $OCF_NOT_RUNNING ] && ocf_is_true $force_stop; then stop_crypt_users case $? in 2) rc=$OCF_SUCCESS;; *) crypt_stop_one crypt_monitor rc=$?;; esac fi if [ $rc -ne $OCF_NOT_RUNNING ]; then ocf_log warn "Couldn't stop crypt device \"$crypt_dev\" (rc=$rc)" show_users ocf_exit_reason "Failed to stop crypt device \"$crypt_dev\"!" return $OCF_ERR_GENERIC fi return $OCF_SUCCESS } # # Action: MONITOR an encrypted resource # crypt_monitor() { cryptsetup status $crypt_dev $disable_locks >/dev/null 2>&1 if [ $? -eq 0 ]; then if [ -b "$encrypted_dev" ] || [ -L $crypt_dev_path ]; then return $OCF_SUCCESS fi return $OCF_ERR_GENERIC fi [ "$__OCF_ACTION" = "monitor" ] && ! ocf_is_probe && ocf_exit_reason "Crypt resource not running" return $OCF_NOT_RUNNING } # Check for stange argument count. if [ $# -ne 1 ]; then usage exit $OCF_ERR_ARGS fi case "$__OCF_ACTION" in meta-data) meta_data exit $OCF_SUCCESS;; usage|help) crypt_usage exit $OCF_SUCCESS;; esac # XME: remove once pacemaker is fixed and calls this action crypt_validate_all rc=$? [ $rc -ne $OCF_SUCCESS ] && exit $rc case "$__OCF_ACTION" in start) crypt_start; rc=$?;; stop) crypt_stop; rc=$?;; monitor) crypt_monitor; rc=$?;; validate-all) rc=$OCF_SUCCESS;; # crypt_validate_all would have errored out above already. *) crypt_usage exit $OCF_ERR_UNIMPLEMENTED;; esac ocf_log debug "${OCF_RESOURCE_INSTANCE} $__OCF_ACTION : $rc" exit $rc