From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from list by lists.gnu.org with archive (Exim 4.71) id 1Xilip-0003kN-7R for mharc-grub-devel@gnu.org; Mon, 27 Oct 2014 10:56:39 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50386) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xilii-0003hr-5Q for grub-devel@gnu.org; Mon, 27 Oct 2014 10:56:36 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Xilid-0004Bd-En for grub-devel@gnu.org; Mon, 27 Oct 2014 10:56:32 -0400 Received: from mail.ixsystems.com ([12.229.62.4]:39287) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xilid-0004BN-44 for grub-devel@gnu.org; Mon, 27 Oct 2014 10:56:27 -0400 Received: from localhost (mail.ixsystems.com [10.2.55.1]) by mail.iXsystems.com (Postfix) with ESMTP id ACF8C886C1 for ; Mon, 27 Oct 2014 07:56:24 -0700 (PDT) Received: from mail.iXsystems.com ([10.2.55.1]) by localhost (mail.ixsystems.com [10.2.55.1]) (maiad, port 10024) with ESMTP id 81592-07 for ; Mon, 27 Oct 2014 07:56:24 -0700 (PDT) Received: from [192.168.0.51] (75-130-56-30.static.kgpt.tn.charter.com [75.130.56.30]) (using TLSv1 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by mail.iXsystems.com (Postfix) with ESMTPSA id 3C048886B8 for ; Mon, 27 Oct 2014 07:56:24 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=ixsystems.com; s=newknight0; t=1414421784; bh=NlaCLGI1z1VpcKKwroEf8ICmSQ5tXLDrW2h+CRgplNU=; h=Date:From:To:Subject:References:In-Reply-To; b=UqzuqUdt4bCsDk6fMpPxY7HwsGtiT/n82qMwniRkDbhSQAChpeBgsKUut307o1JNf J8iuYC0iq+1+GCwyFJBvtxgLz6B8hsh7nKynx6mi/f1nNr8begnYFIPjIy4hwkYq4u gnRXlnskuDkly3EkEUc5NfyNyRBBjm91Nfzrm450= Message-ID: <544E5D16.2070306@pcbsd.org> Date: Mon, 27 Oct 2014 10:56:22 -0400 From: Kris Moore User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:31.0) Gecko/20100101 Thunderbird/31.2.0 MIME-Version: 1.0 To: grub-devel@gnu.org Subject: Re: Patch to support GELI passphrase passthrough References: <5447E580.1010409@pcbsd.org> <20141022214724.19df0c1f@opensuse.site> <5447EE4F.5010002@pcbsd.org> In-Reply-To: <5447EE4F.5010002@pcbsd.org> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: FreeBSD 9.x X-Received-From: 12.229.62.4 X-BeenThere: grub-devel@gnu.org X-Mailman-Version: 2.1.14 Precedence: list Reply-To: The development of GNU GRUB List-Id: The development of GNU GRUB List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Oct 2014 14:56:37 -0000 On 10/22/2014 13:50, Kris Moore wrote: > On 10/22/2014 13:47, Andrei Borzenkov wrote: >> =D0=92 Wed, 22 Oct 2014 13:12:32 -0400 >> Kris Moore =D0=BF=D0=B8=D1=88=D0=B5=D1=82: >> >>> Hey, just a small patch to submit today. If you rather I send this to >>> the bug tracker then I can do that also. >>> >>> This patch allows exporting the FreeBSD GELI passphrase to the kernel >>> environment, which we will be doing in PC-BSD to avoid prompting for = the >>> passphrase a second time at bootup. >>> >>> if (!grub_password_get (passphrase, MAX_PASSPHRASE)) >>> return grub_error (GRUB_ERR_BAD_ARGUMENT, "Passphrase not suppli= ed"); >>> =20 >>> + /* Set the GELI passphrase to GRUB env, for passing to FreeBSD ker= nel */ >>> + grub_env_set ("gelipassphrase", passphrase); >>> + >> If I read BSD loader correctly, this should be kFreeBSD.gelipassphrase= . >> Is geli freebsd-specific? >> >>> /* Calculate the PBKDF2 of the user supplied passphrase. */ >>> if (grub_le_to_cpu32 (header.niter) !=3D 0) >>> { >> It sounds more logical to export it after it has been verified? >> >> I tried to find out about this "gelipassphrase" kernel variable but di= d >> not find anything. Is it already used anywhere? >> >>> Let me know if you have any suggestions or need any changes. I'm >>> currently hacking on support for EFI framebuffer settings to be passe= d >>> to FreeBSD kernel as well, will send patches once I get things workin= g >>> there. >>> >> _______________________________________________ >> Grub-devel mailing list >> Grub-devel@gnu.org >> https://lists.gnu.org/mailman/listinfo/grub-devel > Well, this patch just makes the variable available to grub.cfg file, > then we do some stuff there like this: > > set kFreeBSD.kern.geom.eli.passphrase=3D > > The patch for support in FreeBSD should be in HEAD soon, but here it is > if you want to take a look: > > https://github.com/pcbsd/freebsd/commit/79f4efcf6a7d4268781adc227d76ed9= f7f0b685d > Any further thoughts on this patch? The FreeBSD integration hit HEAD a few days back. https://github.com/freebsd/freebsd/commit/bdb0ac02b9fd8f331fa70c8a4c29495= b7ee43293 The reason I don't export the variable directly is so that when GRUB is used to boot older versions of FreeBSD we don't set that variable, where it isn't cleared from kernel memory. I would rather users enable it in their grub.cfg manually, just so they know what it is doing. --=20 Kris Moore PC-BSD Software iXsystems