blob: 8d9af37382e0177a20f14e9f37b267e822536267 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
|
{ config, lib, pkgs, ... }:
let
cfg = config.boot.initrd.unl0kr;
in
{
options.boot.initrd.unl0kr = {
enable = lib.mkEnableOption (lib.mdDoc "unl0kr in initrd") // {
description = lib.mdDoc ''
Whether to enable the unl0kr on-screen keyboard in initrd to unlock LUKS.
'';
};
};
config = lib.mkIf cfg.enable {
meta.maintainers = with lib.maintainers; [ tomfitzhenry ];
assertions = [
{
assertion = cfg.enable -> config.boot.initrd.systemd.enable;
message = "boot.initrd.unl0kr is only supported with boot.initrd.systemd.";
}
];
boot.initrd.systemd = {
storePaths = with pkgs; [
"${pkgs.gnugrep}/bin/grep"
libinput
xkeyboard_config
"${config.boot.initrd.systemd.package}/lib/systemd/systemd-reply-password"
"${pkgs.unl0kr}/bin/unl0kr"
];
services = {
unl0kr-ask-password = {
description = "Forward Password Requests to unl0kr";
conflicts = [
"emergency.service"
"initrd-switch-root.target"
"shutdown.target"
];
unitConfig.DefaultDependencies = false;
after = [
"systemd-vconsole-setup.service"
"udev.service"
];
before = [
"shutdown.target"
];
script = ''
# This script acts as a Password Agent: https://systemd.io/PASSWORD_AGENTS/
DIR=/run/systemd/ask-password/
# If a user has multiple encrypted disks, the requests might come in different times,
# so make sure to answer as many requests as we can. Once boot succeeds, other
# password agents will be responsible for watching for requests.
while [ -d $DIR ] && [ "$(ls -A $DIR/ask.*)" ];
do
for file in `ls $DIR/ask.*`; do
socket="$(cat "$file" | ${pkgs.gnugrep}/bin/grep "Socket=" | cut -d= -f2)"
${pkgs.unl0kr}/bin/unl0kr | ${config.boot.initrd.systemd.package}/lib/systemd/systemd-reply-password 1 "$socket"
done
done
'';
};
};
paths = {
unl0kr-ask-password = {
description = "Forward Password Requests to unl0kr";
conflicts = [
"emergency.service"
"initrd-switch-root.target"
"shutdown.target"
];
unitConfig.DefaultDependencies = false;
before = [
"shutdown.target"
"paths.target"
"cryptsetup.target"
];
wantedBy = [ "sysinit.target" ];
pathConfig = {
DirectoryNotEmpty = "/run/systemd/ask-password";
MakeDirectory = true;
};
};
};
};
};
}
|