diff options
| author | Ctem <c@ctem.me> | 2020-12-21 06:24:14 +0900 |
|---|---|---|
| committer | Ctem <c@ctem.me> | 2021-02-08 03:55:17 +0900 |
| commit | 9e8781328e497dc3725371d731b1a7aa0fc9f90f (patch) | |
| tree | 5770c1e81fa72bb2c776b0bf80491cf20803ad70 | |
| parent | 86ff1e45cece6f001cf0971559cdec6d25bb9db7 (diff) | |
| download | nixpkgs-9e8781328e497dc3725371d731b1a7aa0fc9f90f.tar nixpkgs-9e8781328e497dc3725371d731b1a7aa0fc9f90f.tar.gz nixpkgs-9e8781328e497dc3725371d731b1a7aa0fc9f90f.tar.bz2 nixpkgs-9e8781328e497dc3725371d731b1a7aa0fc9f90f.tar.lz nixpkgs-9e8781328e497dc3725371d731b1a7aa0fc9f90f.tar.xz nixpkgs-9e8781328e497dc3725371d731b1a7aa0fc9f90f.tar.zst nixpkgs-9e8781328e497dc3725371d731b1a7aa0fc9f90f.zip | |
boot.initrd.luks: add reusePassphrases support for YubiKey 2FA
| -rw-r--r-- | nixos/modules/system/boot/luksroot.nix | 28 |
1 files changed, 26 insertions, 2 deletions
diff --git a/nixos/modules/system/boot/luksroot.nix b/nixos/modules/system/boot/luksroot.nix index 8dd2ea20519..7b9101fb772 100644 --- a/nixos/modules/system/boot/luksroot.nix +++ b/nixos/modules/system/boot/luksroot.nix @@ -254,8 +254,27 @@ let for try in $(seq 3); do ${optionalString yubikey.twoFactor '' echo -n "Enter two-factor passphrase: " - read -r k_user - echo + k_user= + while true; do + if [ -e /crypt-ramfs/passphrase ]; then + echo "reused" + k_user=$(cat /crypt-ramfs/passphrase) + break + else + # Try reading it from /dev/console with a timeout + IFS= read -t 1 -r k_user + if [ -n "$k_user" ]; then + ${if luks.reusePassphrases then '' + # Remember it for the next device + echo -n "$k_user" > /crypt-ramfs/passphrase + '' else '' + # Don't save it to ramfs. We are very paranoid + ''} + echo + break + fi + fi + done ''} if [ ! -z "$k_user" ]; then @@ -268,6 +287,11 @@ let if [ $? == 0 ]; then opened=true + ${if luks.reusePassphrases then '' + # We don't rm here because we might reuse it for the next device + '' else '' + rm -f /crypt-ramfs/passphrase + ''} break else opened=false |