diff options
author | Dino A. Dai Zovi <ddz@theta44.org> | 2021-07-05 14:08:35 +0000 |
---|---|---|
committer | Dino A. Dai Zovi <ddz@theta44.org> | 2021-07-18 18:27:21 +0000 |
commit | 30b97d7ccaf25324926301524d040c4524470046 (patch) | |
tree | 4953d33b2f48ae2c5349190a7f475aa67af375ee /nixos/modules/system/boot/stage-1-init.sh | |
parent | b089c39a2364725a7331f8e9a3a5198fc3dc0ef8 (diff) | |
download | nixpkgs-30b97d7ccaf25324926301524d040c4524470046.tar nixpkgs-30b97d7ccaf25324926301524d040c4524470046.tar.gz nixpkgs-30b97d7ccaf25324926301524d040c4524470046.tar.bz2 nixpkgs-30b97d7ccaf25324926301524d040c4524470046.tar.lz nixpkgs-30b97d7ccaf25324926301524d040c4524470046.tar.xz nixpkgs-30b97d7ccaf25324926301524d040c4524470046.tar.zst nixpkgs-30b97d7ccaf25324926301524d040c4524470046.zip |
nixos/stage1: copy initrd secrets into place after special mounts
This modifies initialRamdiskSecretAppender to stage secrets in /.initrd-secrets/ and stage-1-init to copy them into place after mounting special file systems. This allows secrets to be copied into ramfs mounts like /run/keys for use after stage-1 finishes without copying them to disk (which would not be very secure).
Diffstat (limited to 'nixos/modules/system/boot/stage-1-init.sh')
-rw-r--r-- | nixos/modules/system/boot/stage-1-init.sh | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/nixos/modules/system/boot/stage-1-init.sh b/nixos/modules/system/boot/stage-1-init.sh index ddaf985878e..82e39c96fac 100644 --- a/nixos/modules/system/boot/stage-1-init.sh +++ b/nixos/modules/system/boot/stage-1-init.sh @@ -119,6 +119,18 @@ specialMount() { } source @earlyMountScript@ +# Copy initrd secrets from /.initrd-secrets to their actual destinations +if [ -d "/.initrd-secrets" ]; then + # + # Secrets are named by their full destination pathname and stored + # under /.initrd-secrets/ + # + for secret in $(cd "/.initrd-secrets"; find . -type f); do + mkdir -p $(dirname "/$secret") + cp "/.initrd-secrets/$secret" "$secret" + done +fi + # Log the script output to /dev/kmsg or /run/log/stage-1-init.log. mkdir -p /tmp mkfifo /tmp/stage-1-init.log.fifo |