dissect: add support for encrypted images

This adds support to the image dissector to deal with encrypted images (only
LUKS). Given that we now have a neatly isolated image dissector codebase, let's
add a new feature to it: support for automatically dealing with encrypted
images. This is then exposed in systemd-dissect and nspawn.

It's pretty basic: only support for passphrase-based encryption.

In order to ensure that "systemd-dissect --mount" results in mount points whose
backing LUKS DM devices are cleaned up automatically we use the DM_DEV_REMOVE
ioctl() directly on the device (in DM_DEFERRED_REMOVE mode). libgcryptsetup at
the moment doesn't provide a proper API for this. Thankfully, the ioctl() API
is pretty easy to use.

1 files changed, 17 insertions, 5 deletions

diff --git a/src/shared/dissect-image.h b/src/shared/dissect-image.h
index 04b19e8553..69484eb32c 100644
--- a/src/shared/dissect-image.h
+++ b/src/shared/dissect-image.h
@@ -25,6 +25,7 @@
 
 typedef struct DissectedImage DissectedImage;
 typedef struct DissectedPartition DissectedPartition;
+typedef struct DecryptedImage DecryptedImage;
 
 struct DissectedPartition {
         bool found:1;
@@ -33,6 +34,8 @@ struct DissectedPartition {
         int architecture;  /* Intended architecture: either native, secondary or unset (-1). */
         char *fstype;
         char *node;
+        char *decrypted_node;
+        char *decrypted_fstype;
 };
 
 enum  {
@@ -46,12 +49,15 @@ enum  {
         _PARTITION_DESIGNATOR_INVALID = -1
 };
 
-typedef enum DissectedImageMountFlags {
-        DISSECTED_IMAGE_READ_ONLY = 1,
-        DISSECTED_IMAGE_DISCARD_ON_LOOP = 2, /* Turn on "discard" if on loop device and file system supports it */
-} DissectedImageMountFlags;
+typedef enum DissectImageFlags {
+        DISSECT_IMAGE_READ_ONLY = 1,
+        DISSECT_IMAGE_DISCARD_ON_LOOP = 2,   /* Turn on "discard" if on loop device and file system supports it */
+        DISSECT_IMAGE_DISCARD = 4,           /* Turn on "discard" if file system supports it, on all block devices */
+        DISSECT_IMAGE_DISCARD_ON_CRYPTO = 8, /* Turn on "discard" also on crypto devices */
+} DissectImageFlags;
 
 struct DissectedImage {
+        bool encrypted;
         DissectedPartition partitions[_PARTITION_DESIGNATOR_MAX];
 };
 
@@ -60,7 +66,13 @@ int dissect_image(int fd, DissectedImage **ret);
 DissectedImage* dissected_image_unref(DissectedImage *m);
 DEFINE_TRIVIAL_CLEANUP_FUNC(DissectedImage*, dissected_image_unref);
 
-int dissected_image_mount(DissectedImage *m, const char *dest, DissectedImageMountFlags flags);
+int dissected_image_decrypt(DissectedImage *m, const char *passphrase, DissectImageFlags flags, DecryptedImage **ret);
+int dissected_image_decrypt_interactively(DissectedImage *m, const char *passphrase, DissectImageFlags flags, DecryptedImage **ret);
+int dissected_image_mount(DissectedImage *m, const char *dest, DissectImageFlags flags);
+
+DecryptedImage* decrypted_image_unref(DecryptedImage *p);
+DEFINE_TRIVIAL_CLEANUP_FUNC(DecryptedImage*, decrypted_image_unref);
+int decrypted_image_relinquish(DecryptedImage *d);
 
 const char* partition_designator_to_string(int i) _const_;
 int partition_designator_from_string(const char *name) _pure_;