RomanNum3ral
/
archinstall
mirror of https://github.com/archlinux/archinstall.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added missing check of disk encryption is None or not.

This commit is contained in:
Anton Hvornum 2023-02-23 07:47:53 +01:00
parent 6137b25078
commit 241a8a117a
No known key found for this signature in database
GPG Key ID: F1234C5BA67C59DF
1 changed files with 17 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
archinstall/lib/installer.py
View File

@ -198,7 +198,7 @@ class Installer:
def _create_keyfile(self,luks_handle , partition :dict, password :str): def _create_keyfile(self,luks_handle , partition :dict, password :str):
""" roiutine to create keyfiles, so it can be moved elsewhere """ roiutine to create keyfiles, so it can be moved elsewhere
""" """
if self._disk_encryption.generate_encryption_file(partition): if self._disk_encryption and self._disk_encryption.generate_encryption_file(partition):
if not (cryptkey_dir := pathlib.Path(f"{self.target}/etc/cryptsetup-keys.d")).exists(): if not (cryptkey_dir := pathlib.Path(f"{self.target}/etc/cryptsetup-keys.d")).exists():
cryptkey_dir.mkdir(parents=True) cryptkey_dir.mkdir(parents=True)
# Once we store the key as ../xyzloop.key systemd-cryptsetup can automatically load this key # Once we store the key as ../xyzloop.key systemd-cryptsetup can automatically load this key
@ -246,20 +246,21 @@ class Installer:
mount_queue = {} mount_queue = {}
# we manage the encrypted partititons # we manage the encrypted partititons
for partition in self._disk_encryption.partitions: if self._disk_encryption:
# open the luks device and all associate stuff for partition in self._disk_encryption.partitions:
loopdev = f"{storage.get('ENC_IDENTIFIER', 'ai')}{pathlib.Path(partition['device_instance'].path).name}" # open the luks device and all associate stuff
loopdev = f"{storage.get('ENC_IDENTIFIER', 'ai')}{pathlib.Path(partition['device_instance'].path).name}"
# note that we DON'T auto_unmount (i.e. close the encrypted device so it can be used # note that we DON'T auto_unmount (i.e. close the encrypted device so it can be used
with (luks_handle := luks2(partition['device_instance'], loopdev, self._disk_encryption.encryption_password, auto_unmount=False)) as unlocked_device: with (luks_handle := luks2(partition['device_instance'], loopdev, self._disk_encryption.encryption_password, auto_unmount=False)) as unlocked_device:
if self._disk_encryption.generate_encryption_file(partition) and not self._has_root(partition): if self._disk_encryption.generate_encryption_file(partition) and not self._has_root(partition):
list_luks_handles.append([luks_handle, partition, self._disk_encryption.encryption_password]) list_luks_handles.append([luks_handle, partition, self._disk_encryption.encryption_password])
# this way all the requesrs will be to the dm_crypt device and not to the physical partition # this way all the requesrs will be to the dm_crypt device and not to the physical partition
partition['device_instance'] = unlocked_device partition['device_instance'] = unlocked_device
if self._has_root(partition) and self._disk_encryption.generate_encryption_file(partition) is False: if self._has_root(partition) and self._disk_encryption.generate_encryption_file(partition) is False:
if self._disk_encryption.hsm_device: if self._disk_encryption.hsm_device:
Fido2.fido2_enroll(self._disk_encryption.hsm_device, partition['device_instance'], self._disk_encryption.encryption_password) Fido2.fido2_enroll(self._disk_encryption.hsm_device, partition['device_instance'], self._disk_encryption.encryption_password)
btrfs_subvolumes = [entry for entry in list_part if entry.get('btrfs', {}).get('subvolumes', [])] btrfs_subvolumes = [entry for entry in list_part if entry.get('btrfs', {}).get('subvolumes', [])]
@ -646,7 +647,7 @@ class Installer:
mkinit.write(f"BINARIES=({' '.join(self.BINARIES)})\n") mkinit.write(f"BINARIES=({' '.join(self.BINARIES)})\n")
mkinit.write(f"FILES=({' '.join(self.FILES)})\n") mkinit.write(f"FILES=({' '.join(self.FILES)})\n")
if not self._disk_encryption.hsm_device: if self._disk_encryption and not self._disk_encryption.hsm_device:
# For now, if we don't use HSM we revert to the old # For now, if we don't use HSM we revert to the old
# way of setting up encryption hooks for mkinitcpio. # way of setting up encryption hooks for mkinitcpio.
# This is purely for stability reasons, we're going away from this. # This is purely for stability reasons, we're going away from this.
@ -690,7 +691,7 @@ class Installer:
self.HOOKS.remove('fsck') self.HOOKS.remove('fsck')
if self.detect_encryption(partition): if self.detect_encryption(partition):
if self._disk_encryption.hsm_device: if self._disk_encryption and self._disk_encryption.hsm_device:
# Required bby mkinitcpio to add support for fido2-device options # Required bby mkinitcpio to add support for fido2-device options
self.pacstrap('libfido2') self.pacstrap('libfido2')
@ -882,7 +883,7 @@ class Installer:
kernel_options = f"options" kernel_options = f"options"
if self._disk_encryption.hsm_device: if self._disk_encryption and self._disk_encryption.hsm_device:
# Note: lsblk UUID must be used, not PARTUUID for sd-encrypt to work # Note: lsblk UUID must be used, not PARTUUID for sd-encrypt to work
kernel_options += f" rd.luks.name={real_device.uuid}=luksdev" kernel_options += f" rd.luks.name={real_device.uuid}=luksdev"
# Note: tpm2-device and fido2-device don't play along very well: # Note: tpm2-device and fido2-device don't play along very well: