@@ -41,7 +41,7 @@ tpm_device=/dev/tpmrm0
partition_sets="$PARTITIONS"
create_file_system_cmd="$CREATE_FILE_SYSTEM_CMD"
-if [ -z "${create_file_system_cmd}" ];then
+if [ -z "${create_file_system_cmd}" ]; then
create_file_system_cmd="mke2fs -t ext4"
fi
@@ -73,7 +73,6 @@ reencrypt_existing_partition() {
else
/usr/sbin/cryptsetup reencrypt --encrypt --reduce-device-size "$reduce_device_size"k "$1" < "$2"
fi
-
}
if [ ! -e "$tpm_device" ]; then
@@ -89,7 +88,7 @@ for partition_set in $partition_sets; do
partition_label="$(awk -v var="$partition_set" 'BEGIN{split(var,a,":"); print a[1]}')"
partition_mountpoint="$(awk -v var="$partition_set" 'BEGIN{split(var,a,":"); print a[2]}')"
partition_format="$(awk -v var="$partition_set" 'BEGIN{split(var,a,":"); print a[3]}')"
- partition=/dev/disk/by-partlabel/$partition_label
+ partition=/dev/disk/by-partlabel/"$partition_label"
crypt_mount_name="encrypted_$partition_label"
decrypted_part=/dev/mapper/"$crypt_mount_name"
# clevis does not work with links in /dev/disk*
@@ -8,6 +8,7 @@
# Quirin Gylstorff <quirin.gylstorff@siemens.com>
#
# SPDX-License-Identifier: MIT
+
prereqs()
{
# Make sure that this script is run last in local-top
@@ -52,11 +53,11 @@ open_tpm2_partition() {
}
enroll_tpm2_token() {
- #check systemd version and export password if necessary
+ # check systemd version and export password if necessary
if [ -x /usr/bin/systemd-cryptenroll ]; then
systemd_version=$(systemd-cryptenroll --version | \
awk -F " " 'NR==1{print $2 }')
- #check systemd version and export password if necessary
+ # check systemd version and export password if necessary
if [ "$systemd_version" -ge "251" ]; then
PASSWORD=$(cat "$2" )
export PASSWORD
@@ -72,20 +73,19 @@ enroll_tpm2_token() {
}
reencrypt_existing_partition() {
- part_device=$(readlink -f "$partition")
- part_size_blocks=$(cat /sys/class/block/"$(awk -v dev="$part_device" 'BEGIN{split(dev,a,"/"); print a[3]}' )"/size)
+ part_device="$(readlink -f "$partition")"
+ part_size_blocks="$(cat /sys/class/block/"$(awk -v dev="$part_device" 'BEGIN{split(dev,a,"/"); print a[3]}' )"/size)"
# reduce the filesystem and partition by 32M to fit the LUKS header
reduce_device_size=32768
- reduced_size=$(expr "$part_size_blocks" - 65536 )
- reduced_size_in_byte=$(expr "$reduced_size" \* 512)
- reduced_size_in_kb=$(expr "$reduced_size_in_byte" / 1024)K
+ reduced_size="$(expr "$part_size_blocks" - 65536 )"
+ reduced_size_in_byte="$(expr "$reduced_size" \* 512)"
+ reduced_size_in_kb="$(expr "$reduced_size_in_byte" / 1024)K"
resize2fs "$1" "${reduced_size_in_kb}"
if [ -x /usr/sbin/cryptsetup-reencrypt ]; then
/usr/sbin/cryptsetup-reencrypt --new --reduce-device-size "$reduce_device_size"k "$1" < "$2"
else
/usr/sbin/cryptsetup reencrypt --encrypt --reduce-device-size "$reduce_device_size"k "$1" < "$2"
fi
-
}
if [ ! -e "$tpm_device" ]; then
@@ -93,9 +93,9 @@ if [ ! -e "$tpm_device" ]; then
fi
for partition_set in $partition_sets; do
- partition_label=$(awk -v var="$partition_set" 'BEGIN{split(var,a,":"); print a[1]}')
- partition_mountpoint=$(awk -v var="$partition_set" 'BEGIN{split(var,a,":"); print a[2]}')
- partition_format=$(awk -v var="$partition_set" 'BEGIN{split(var,a,":"); print a[3]}')
+ partition_label="$(awk -v var="$partition_set" 'BEGIN{split(var,a,":"); print a[1]}')"
+ partition_mountpoint="$(awk -v var="$partition_set" 'BEGIN{split(var,a,":"); print a[2]}')"
+ partition_format="$(awk -v var="$partition_set" 'BEGIN{split(var,a,":"); print a[3]}')"
partition=/dev/disk/by-partlabel/"$partition_label"
crypt_mount_name="encrypted_$partition_label"
decrypted_part=/dev/mapper/"$crypt_mount_name"