PK�-]$��=��scripts/decrypt_keyctlnuȯ��
#!/bin/sh
# decrypt_keyctl - to use in /etc/crypttab as keyscript
#  Allows to cache passwords for cryptdevices for 60s
#  The same password is used for for cryptdevices with the same identifier.
#  The keyfile parameter, which is the third field from /etc/crypttab, is
#  used as identifier in this keyscript.
#
# sample crypttab entries:
# test1   /dev/sda1    test_pw         luks,keyscript=decrypt_keyctl
# test2   /dev/sda2    test_pw         luks,keyscript=decrypt_keyctl
# test3   /dev/sda3    test_other_pw   luks,keyscript=decrypt_keyctl
#
#  test1 and test2 have the same identifier thus test2 does not need a password
#  typed in manually

die()
{
    echo "$@" >&2
    exit 1
}

if [ -z "${CRYPTTAB_KEY:-}" ] || [ "$CRYPTTAB_KEY" = "none" ]; then
    # store the passphrase in the key name used by systemd-ask-password
    ID_="cryptsetup"
else
    # the keyfile given from crypttab is used as identifier in the keyring
    # including the prefix "cryptsetup:"
    ID_="cryptsetup:$CRYPTTAB_KEY"
fi
TIMEOUT_='60'
ASKPASS_='/lib/cryptsetup/askpass'
PROMPT_="Caching passphrase for ${CRYPTTAB_NAME}: "


if ! KID_="$(keyctl search @u user "$ID_" 2>/dev/null)" || \
        [ -z "$KID_" ] || [ "$CRYPTTAB_TRIED" -gt 0 ]; then
    # key not found or wrong, ask the user
    KEY_="$($ASKPASS_ "$PROMPT_")" || die "Error executing $ASKPASS_"
    if [ -n "$KID_" ]; then
        # I have cached wrong password and now i may use either `keyctl update`
        # to update $KID_ or just unlink old key, and add new. With `update` i
        # may hit "Key has expired", though. So i'll go "unlink and add" way.
        keyctl unlink "$KID_" @u
        KID_=""
    fi
    KID_="$(printf "%s" "$KEY_" | keyctl padd user "$ID_" @u)"
    [ -n "$KID_" ] || die "Error adding passphrase to kernel keyring"
    if ! keyctl timeout "$KID_" "$TIMEOUT_"; then
        keyctl unlink "$KID_" @u
        die "Error setting timeout on key ($KID_), removing"
    fi
else
    echo "Using cached passphrase for ${CRYPTTAB_NAME}." >&2
fi
keyctl pipe "$KID_"
PK�-]��7�[
[
scripts/decrypt_sslnuȯ��
#!/bin/sh
#
# Script to decrypt the key which is encrypted with openssl.
# See /usr/share/doc/cryptsetup/examples/gen-ssl-key to create such a key.
#

decrypt_ssl () {
	echo "" >&2
	echo "Decrypting ssl key $1..." >&2
	if ! /usr/bin/openssl enc -aes-256-cbc -d -salt -in "$1" 2>/dev/null; then
		return 1
	fi
	return 0
}

decrypt_ssl "$1"
exit $?
PK�-]YB�Xttscripts/decrypt_openscnuȯ��
#!/bin/sh

# Why not use "openct-tool rwait" instead of polling opensc-tool exit status?
# Well openct daemon has to be running which interferes with pcscd since both
# implement reader drivers, my particular CCID reader (SCM SCR331-LC1) doesn't
# work with the CCID driver in openct, however it does work with pcscd.

# Why not use "opensc-tool --wait" instead of polling opensc-tool exit status?
# Although opensc-tool --help reports that there is a --wait option, it doesn't
# seem to be implemented.

check_card() {
    cardfound=0

    if /usr/bin/opensc-tool -n >/dev/null 2>&1; then
        cardfound=1
    fi
}

wait_card() {
    check_card
    if [ $cardfound = 0 ] ; then
        echo "Waiting for Smart Card..." >&2
        tries=0
        while [ $cardfound = 0 ] && [ $tries -lt 60 ] ; do
            sleep 1
            check_card
            tries=$(($tries + 1))
        done
        if [ $cardfound = 0 ] ; then
            echo 'Failed to find Smart Card card!' >&2
            exit 1
        fi
    fi
}

wait_card
if [ -x /bin/plymouth ] && plymouth --ping; then
	# Get pin number from plymouth
	/usr/bin/pkcs15-crypt --decipher --input "$1" --pkcs1 --raw \
		--pin "$(plymouth ask-for-password --prompt "Enter pin for $CRYPTTAB_NAME: ")"
else
	# Get pin number from console
	/usr/bin/pkcs15-crypt --decipher --input "$1" --pkcs1 --raw </dev/console 2>/dev/console
fi
exit $?
PK�-]|��s8989scripts/passdevnuȯ��
ELF

>
�@�1@8
@@@@��


QQ
   dd
�,�<�< (-==�
�
88800hhhDDS�td88800P�tdP"P"P"<<Q�tdR�td�,�<�<
/lib64/ld-linux-x86-64.so.2 GNU���
GNU.$Q=�"Yd�"kՍ;��	ߖ
GNU
��e�mU�)
+
 ��J��8c�G
 q\����jPIvV
 ���"�"__libc_start_main__cxa_finalizestderr__vfprintf_chk__stack_chk_failfwriteexitgetenvstrtolstrchraccessstat__fprintf_chkmkdtempforkwaitpidstrlenmalloc__sprintf_chkopen__read_chkclosefreeumountrmdirsleepexecllibc.so.6GLIBC_2.33GLIBC_2.4GLIBC_2.34GLIBC_2.3.4GLIBC_2.2.5_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTable



�����ii
����
ti	
ui	
�<`�< @@�?�?�?�?�?�??
?? ?(?0?8?	@?
H?P?X?
`?h?p?x?�?�?�?�?�?�?�?�?�?�?��H��H��/H��t��H����5�.�%�.@��h���f���h
����f���h����f���h���f���h���f���h���f���h���f���h�r���f���h�b���f���h	�R���f���h
�B���f���h�2���f���h�"���f���h
����f���h����f���h��f���h���f���h����f���h����f���h���f���h���f���h���f���h���f���h�r���f���h�b���f����%&.fD���%.-fD���%&-fD���%-fD���%-fD���%-fD���%-fD���%�,fD���%�,fD���%�,fD���%�,fD���%�,fD���%�,fD���%�,fD���%�,fD���%�,fD���%�,fD���%�,fD���%�,fD���%�,fD���%�,fD���%�,fD���%�,fD���%~,fD���%v,fD���%n,fD��UH��AWAVAUATSH��H
fo�dH�%(H�E�1�Dž����XXX)�������t*H�L,��
H�=KH��;����
�!���H�=�H����H��t1��
H�������~�,
L�c�:L���R���H�����8���x
���H�X
�:H���"���H��t�8t
�x
��H��L��H�=�1��
E1�E1�1�L���j������?H��0���L��H��H���������A�ƅ�����H���%�=`��L��H�"H�/+�H�81��8������H�+��
H�=�H����������1�H�x
�
�{���H��L��H�=I��A��1��AE��~D��H�=t1��+E��A������H�������S���H������H���H��H�
�fHn�fHn�H�
yfl�H�sL������fHn�)����fHn�H�_fl�H�
NfHn�)���fHn�H�IH�
>fl�fHn�H�;)��fHn�fHn�H�
fl�H� )����fHn�H�� ���fl�)�����
���A�Ņ���
u�/��
,
1�L��D���d����������Ѓ�u߁����
H���������H��I�����M�lL������I��H����L������H��I��1��H�
�
L�����1�L���������t
H������L��������L��`���M����
1�L��1�����A�ƅ��
L��1��~���I��H��u.�'L��L��I�tD��HC�H)�H)����H���T
H
�L9�r�D������L���s���H������H�����H��1�����!L��I�t�
H)����H����
H
�L9�r�L���*���1��3���L��H�=�1��f�1�L��������������
�D���E��t�E�������A��
��A��
A���#���H��'L��H�D	H�81����H������������L��H���t���H��'��
H�=7	H����L���j���H����������H�m'�%�
H�=�H��\�������H�H'��
H�=9	H��7���L������D������H�'��
H�=�H������n���H��&��
H�=�H�����I���H��&��
H�=�H�����$���H��&��
H�=�H����L���n����N���L������L��1�Mc�H�=�H��L����
1������
��������1�1�H��1�����1Ҿ
H��1����1Ҿ
H��1����H��jH�=fAWN������H��L�
IATH�
CH�?P1����H�� �
���H��%��
H�=3H����� ���H��%��
H�=H�����V���D��1�I��^H��H���PTE1�1�H�=�����+%�f.�H�=Y%H�R%H9�tH�%H��t	�����H�=)%H�5"%H)�H��H��?H��H
�H�tH��$H��t��fD�����=�$u+UH�=�$H��tH�=�$�y����d�����$
]������w����UH��H���H��X���H��`���H��h���L��p���L��x�����t )E�)M�)U�)]�)e�)m�)u�)}�dH�%(H��H���1��=6$tKH�EH���Dž0���H��8���H��P���H��0���H��@���H��#Dž4���0H�8����H��H���dH+%(u��������H��H���
Incorrect number of arguments
Path is %p and filepath is %p
Failed to create temporary directory
noatime,nodiratime,nodev,noexec,nosuid,roDEBUGInvalid key path
Timeout is %i
Waiting for %s
Unable to stat %s
%s is no block device
ext4ext3ext2vfatbtrfsreiserfsxfsjfsntfsiso9660udfMounting %s at %s
/dev/null-o-t-n/bin/mountFailed to mount %s
Failed to allocate memory
%s/%sKeyfile doesn't exist
Unable to stat keyfile
Invalid keyfile size
Failed to open keyfile
Failed to read entire key
Failed to write entire key
/tmp/passdev.XXX
;<��pp�������0���X ����
zR
x
�
���&D$4X��
FJw�?9*3$"\��t���
 �P����A�C
�
A ��E�C
P�����` 
�
D�<�<���o���
p
�>X�	��	���o
���o����o
�oH���o=0@P`p�������� 0@P`p����@/usr/lib/debug/.dwz/x86_64-linux-gnu/cryptsetup.debug�##�U�\j��AB�*
l��m24513dc4225964c5226bd58d3bcd7fe509df96.debugR���.shstrtab.interp.note.gnu.property.note.gnu.build-id.note.ABI-tag.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.plt.sec.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.dynamic.data.bss.gnu_debugaltlink.gnu_debuglink

880&hh$9�� G���o��$Q��
Y��p

a���oHH@n���o��`
}����B�	�	X�
�
  �
�
���
���
�
``��
DD
�
  P�
P"P"<�
�"�"���<�,��<�,�=-�
�
�>�.
�
@0�@0



0J


\04
�0"

PK�-]�(sRRscripts/decrypt_derivednuȯ��
#!/bin/sh

# WARNING: If you use the decrypt_derived keyscript for devices with
# persistent data (i.e. not swap or temp devices), then you will lose
# access to that data permanently if something damages the LUKS header
# of the LUKS device you derive from. The same applies if you luksFormat
# the device, even if you use the same passphrase(s). A LUKS header
# backup, or better a backup of the data on the derived device may be
# a good idea. See the Cryptsetup FAQ on how to do this right.

if [ -z "$1" ]; then
    echo "$0: must be executed with a crypto device as argument" >&2
    exit 1
fi

unset -v keys count
keys="$(dmsetup table --target crypt --showkeys -- "$1" 2>/dev/null | cut -s -d' ' -f5)"
count="$(printf '%s' "$keys" | wc -l)"

if [ -n "$keys" ] && [ $count -le 1 ]; then
    if [ "${keys#:}" = "$keys" ]; then
        printf '%s' "$keys"
        exit 0
    else
        echo "$0: device $1 uses the kernel keyring" >&2
    fi
elif [ $count -eq 0 ]; then
    echo "$0: device $1 doesn't exist or isn't a crypto device" >&2
else
    echo "$0: more than one device match" >&2
fi
exit 1
PK�-]zz;���scripts/decrypt_gnupg-scnuȯ��
#!/bin/sh

if [ -d "/cryptroot/gnupghome" ]; then
    export GNUPGHOME="/cryptroot/gnupghome"
fi

run_gpg() {
    gpg --no-options --trust-model=always "$@"
}
decrypt_gpg () {
    local console _
    if ! GPG_TTY="$(tty)"; then
        read console _ </proc/consoles
        GPG_TTY="/dev/$console"
    fi
    export GPG_TTY

    if ! run_gpg --decrypt -- "$1"; then
        return 1
    fi
    return 0
}

# `gpg-connect-agent LEARN /bye` is another (lighter) way, but it's
# harder to retrieve the return code
if ! run_gpg --batch --quiet --no-tty --card-status >/dev/null; then
    echo "Please insert OpenPGP SmartCard..." >&2
    until run_gpg --batch --quiet --no-tty --card-status; do
        sleep 1
    done >/dev/null 2>&1
fi

if [ ! -x /usr/bin/gpg ]; then
    echo "$0: /usr/bin/gpg is not available" >&2
    exit 1
fi

if [ -z "$1" ] || [ ! -f "$1" ]; then
    echo "$0: missing key as argument" >&2
    exit 1
fi

decrypt_gpg "$1"
exit $?
PK�-]���i::scripts/decrypt_gnupgnuȯ��
#!/bin/sh

decrypt_gpg () {
	echo "Performing GPG symmetric decryption ..." >&2
	if ! /lib/cryptsetup/askpass "Enter passphrase for key $1: " | \
		/usr/bin/gpg -q --batch --no-options  \
		--no-random-seed-file --no-default-keyring \
		--keyring /dev/null --secret-keyring /dev/null \
		--trustdb-name /dev/null --passphrase-fd 0 --decrypt -- "$1"; then
		return 1
	fi
	return 0
}

if [ ! -x /usr/bin/gpg ]; then
	echo "$0: /usr/bin/gpg is not available" >&2
	exit 1
fi

if [ -z "$1" ]; then
	echo "$0: missing key as argument" >&2
	exit 1
fi

decrypt_gpg "$1"
exit $?
PK�-]ՠ��Y�Yaskpassnuȯ��
ELF

>
'@hR@8
@@@@��

��
   
@@@��
�L�\�\@�L�\�\�
�
88800hhhDDS�td88800P�td�@�@�@��Q�tdR�td�L�\�\��
/lib64/ld-linux-x86-64.so.2 GNU���
GNU
\�l]TeB
��B�I
GNU-
�-�e�m1
/
9�
 ���
�y�i=

(�"_�4R���
 �&
�I
�J���Xt

�
 �nd
�"__libc_start_main__cxa_finalizeclosememsetfreeread__errno_locationrealloclstataccesspipeforkdup2execlexit__stack_chk_failkillsystemstrdupstrlenmkfifotcsetattrstderrfputcklogctlstdin__getdelimclearerrisattyfreopenstdouttcgetattrfwritestrstrfputs__fprintf_chksigfillsetsigprocmask__fdelt_chkselectlibc.so.6GLIBC_2.3.4GLIBC_2.33GLIBC_2.15GLIBC_2.4GLIBC_2.34GLIBC_2.2.5_ITM_deregisterTMCloneTable__gmon_start___ITM_registerTMCloneTable



P
ti	Z
���f
���q
ii
|
����
ui	�
�\�'�\�'`` `"@(`�*0``)8`�+H`�@P`�-X`0*``P(p`U@x`P,�`�)�`,�`�@�`�/�`�.�`@.�_�_�_�_�_�_'�_-�_,�^
�^�^�^�^	�^
�^�^�^
�^�^�^�^____ _(_0_8_@_H_P_X_`_h_ p_!x_"�_#�_$�_%�_&�_(�_)�_*�_+��H��H��?H��t��H����5b>�%d>@��h���f���h
����f���h����f���h���f���h���f���h���f���h���f���h�r���f���h�b���f���h	�R���f���h
�B���f���h�2���f���h�"���f���h
����f���h����f���h��f���h���f���h����f���h����f���h���f���h���f���h���f���h���f���h�r���f���h�b���f���h�R���f���h�B���f���h�2���f���h�"���f���h����f���h����f���h��f���h ���f���h!����f���h"����f���h#���f���h$���f����%f=fD���%�;fD���%�;fD���%�;fD���%�;fD���%�;fD���%�;fD���%�;fD���%�;fD���%�;fD���%�;fD���%�;fD���%�;fD���%�;fD���%�;fD���%�;fD���%�;fD���%~;fD���%v;fD���%n;fD���%f;fD���%^;fD���%V;fD���%N;fD���%F;fD���%>;fD���%6;fD���%.;fD���%&;fD���%;fD���%;fD���%;fD���%;fD���%�:fD���%�:fD���%�:fD���%�:fD���%�:fD��UH��AWAVAUI��ATSH��8
dH�%(H�E�1�HDž����HDž������t1H��:L�H�
�H���H�81��D����
����H������L�5�:H��M���q���H��1�1�����D�=qI���A�|$"t$I�}A�T$A�D$$����A�|$ fE�|$!u	I��(I9�u�H��@���A�
H������H������1�M��E1���H�A�|$"t+Ic|$$��x"� ���A�L$$L��H��H	��@����A
D9�DM�I��(I9�u�E��t+H������E1�1�1�D�������(t��d����8t��j�
����fA�D$!�I���M��A�
A�"tKIc$��xC���A�$H��L��H��H#��@���t%H������H������A�W��tH������H��uI��(I9�u����H�������
���H��
�`�����
1��s�����1�I��^H��H���PTE1�1�H�=������8�f.�H�=�9H��9H9�tH�~8H��t	�����H�=Y9H�5R9H)�H��H��?H��H
�H�tH�]8H��t��fD�����=9u+UH�=:8H��tH�=F8����d�����8
]������w����UH��AUI��ATI��SH��H����x�Q���H�;H��t*I�$1�����H�;�v���H�I�EI�$H��[A\A]]�@��UH��x���H�=�8H��t;H��81�����H�=�8����H��8H��8H��8]�fDUH��AVA��AUI��ATI��SH�2H��I�$I�}H9�u�W�I�$H�3I�}H)�H
�D�����H��y����8t�1�[A\A]A^]�DH�3H
�H�3H��u��
��H��I�4$���I�EH��H��t	I�$H�3�1�I�$H����UH�
�7H��ATI��H�5�7SH��H��7�%�����u	[A\]�@H��7H�
�7H��t&H�t��>
u�H�
�7H�Q�H�
�7H��7I�$H�[A\]���UH�
\7H��ATI��H�5]7SH��H�J7�����tH�B7I�$H�/7H�[A\]����UH�
�6H��ATI��H�5�6SH��H��6�U�����tH��6I�$H��6H�[A\]����UH��ATSH��P���H��H�=hH��@
dH�%(H�E�1�������

H������H�=F��������H������H9�P�����L�%5�
L���^�������H�������Z�����������W6��xwuI�������&����������
������xE1�H��H��L��L��1��H����
���fD����������������H�U�dH+%(u/H��@
[A\]�����������������fD��������$���@��U�H��S��H���=�5�
�����H�]�H�
l5�H�l5H�5m5�����U�	H��S��H���=65�����H�]�H�
5�H�5H�5
5�����U�
H��ATL�%�SH��L��H��dH�%(H�E�1��������C
H�=��g������/
H�����H��H���,�����
��H�H�L�H�D��9:�����:��H�}�������������f4����uL�}��T����}�
�����x!E1�I��H�
IL��H�HL��1��r����
�(����H���H����}������E�H�U�dH+%(ueH��[A\]�D�X����H���D������ �4����
�5������&����}�����}���������������@��U��
H��SH��H��H�������t
��8uH��H�]��1���-���DH�]��������ff.�f���UH��S��H��H�=�2H��t0H��21����H�=�2�+�H��2H��2�=�2
uL��xHH�A2�߾�o2���H�?1�
H�0��H�]�1�1�ɿ�7����H�]���f.���UH�=,2H��AUATI�Ժ
SH��H�5
2H��L�-�0I�M��H��xQH�
�1�uI�$�
H�H��[A\A]]�@H��H�@�H�4
�>
u��H��H�
�1��f�I�}�G�H��1�[A\A]]�f.���UH��AWAVAUATI��1�SH��hdH�%(H�E�1�������H���H���v����
H��/H�5�H��H��E�H���o
H��/L�5�H��L��H�� �H���J
L�-�/L��H��I�U�
�H���+
1��a���
1�H�5p0����
fo[0H�U�1�fo
]0foe0�oi0�)E��E�)U���)M���]��E��w��|�������L�-/L�5�L�=�<f�H�޺
L��L)�Hc��z�H��teI�M�
�
L���_�H��tJL�cL��L����I�MH��H��u�H��L������x 1�1������/
�&f�H�i/�1���Dž|�������H�E�dH+%(u��|���H��h[A\A]A^A_]��:�f.�UH��ATSH�R.L����{"t�{!t�{$�S1��C$����f�C!H��(L9�u�[A\]���H��H���
/sys/fs/cgroup/sys/fs/cgroup/systemd/bin/systemd-ask-password--timeout=0/bin/plymouth/bin/plymouth --ping--promptask-for-password/lib/cryptsetup/passfifo/dev/consolera\nincorrect number of argumentsError: %s
Usage: %s PROMPT



;�(�����
�� 
�������8
X�`
���
h��
���
8���$��L�lX�����H������4��d
zR
x
�
8�&D$4@��`FJw�?9*3$"\x�tp�P$���\A�C
B�E�D�L���ZE�C
Q,�0��A�C
B�E�E�D�N
F(
��}E�J
B�K�W
ED 0
�IE�J
B�K�l T
0�IE�J
B�K�l$x
\�L
E�C
J��

A�
��@E�H
A�_�
��@E�H
A�_$�
���
E�H
B�H�

F$,�SE�H
A�p
JJ$0d��E�C
A��
QE,X���E�J
D��I�G
E},�l�E�C
H����J��

A �\�BA�C
C��z$�X�E�C
F���M���'�'
P
 
2�\�\���o�(�
�
�^x`
�
�	���o
���oh
���o
�o

���o�\0 @ P ` p � � � � � � � � !! !0!@!P!`!p!�!�!�!�!�!�!�!�!"" "0"@"P"`"p"`"@�*`)�+

�����@�-0*P(
����U@P,�),

�����@�/�.@.
����/usr/lib/debug/.dwz/x86_64-linux-gnu/cryptsetup.debug�##�U�\j��AB�*
l��m125c1e9f6c5d5408651942019e9b42ee98490c.debug�N�u.shstrtab.interp.note.gnu.property.note.gnu.build-id.note.ABI-tag.gnu.hash.dynsym.dynstr.gnu.version.gnu.version_r.rela.dyn.rela.plt.init.plt.got.plt.sec.text.fini.rodata.eh_frame_hdr.eh_frame.init_array.fini_array.dynamic.data.bss.gnu_debugaltlink.gnu_debuglink

880&hh$9�� G���o��$Q��P
Y((�

a���o



\n���oh
h
p
}�
�
��B`
`
x�
  �
    `�
�"�"�
�"�"P�
�$�$"
�
22
�
@@��
�@�@��
�A�A��\�L��\�L��\�L�
�
�^�N�
�
`P� ��`�P� 


�PJ


Q4
@Q"

PK�-]3g�o�"�"cryptdisks-functionsnu�[���
#
# This file is for inclusion with
#    . /lib/cryptsetup/cryptdisks-functions
# and should not be executed directly.

PATH="/usr/sbin:/usr/bin:/sbin:/bin"
CRYPTDISKS_ENABLE="Yes"

#set -x

# Sanity check #1
[ -x /sbin/cryptsetup ] || exit 0

. /lib/lsb/init-functions
. /lib/cryptsetup/functions

if [ -r /etc/default/cryptdisks ]; then
    . /etc/default/cryptdisks
fi

MOUNT="$CRYPTDISKS_MOUNT"


# do_start()
#   Unlock all devices in the crypttab(5)
do_start() {
    [ -s "$TABFILE" ] || return 0

    # Create locking directory before invoking cryptsetup(8) to avoid warnings
    mkdir -pm0700 /run/cryptsetup
    modprobe -qb dm-mod || true
    modprobe -qb dm-crypt || true
    dmsetup mknodes >/dev/null 2>&1 || true

    if [ "$INITSTATE" != "init" ]; then
        log_action_begin_msg "Starting $INITSTATE crypto disks"
    fi
    mount_fs

    crypttab_foreach_entry _do_start_callback

    umount_fs
    log_action_end_msg 0
}
_do_start_callback() {
    setup_mapping || log_action_end_msg $?
}

# mount_fs()
#   Premounts file systems
mount_fs() {
    local point
    MOUNTED=""

    for point in $MOUNT; do
        if mount "$point" >/dev/null; then
            MOUNTED="$MOUNTED $point"
        fi
    done
}

# Postunmounts file systems
umount_fs() {
    local point

    for point in $MOUNTED; do
        umount "$point" >/dev/null
    done
}

# setup_mapping()
#   Set up a crypttab(5) mapping defined by $CRYPTTAB_NAME,
#   $CRYPTTAB_SOURCE, $CRYPTTAB_KEY, $CRYPTTAB_OPTIONS.
setup_mapping() {
    if dm_blkdevname "$CRYPTTAB_NAME" >/dev/null; then
        device_msg "running"
        return 0
    fi

    local loud="${DEFAULT_LOUD:-}"
    crypttab_parse_options --export --missing-path=fail || return 1
    if [ -n "${CRYPTTAB_OPTION_quiet+x}" ]; then
        loud="no"
    elif [ -n "${CRYPTTAB_OPTION_loud+x}" ]; then
        loud="yes"
    fi

    if [ -z "${FORCE_START-}" ]; then
        if [ "$INITSTATE" = "early" -a -n "${CRYPTTAB_OPTION_noearly+x}" ] ||
                [ "$INITSTATE" != "manual" -a -n "${CRYPTTAB_OPTION_noauto+x}" ]; then
            device_msg "ignored"
            return 0
        fi
    fi

    if [ -z "${CRYPTTAB_OPTION_keyscript+x}" ] && [ "$CRYPTTAB_KEY" != "none" ]; then
        if ! crypttab_key_check; then
            device_msg "invalid key"
            return 1
        fi
        CRYPTTAB_OPTION_tries=1
    fi

    if ! crypttab_resolve_source; then
        if [ "$loud" = "yes" ]; then
            device_msg "skipped, device $CRYPTTAB_SOURCE does not exist"
        fi
        return 1
    fi
    device_msg "starting"

    local offset_bytes=""
    if [ -n "${CRYPTTAB_OPTION_offset+x}" ] && [ ${#CRYPTTAB_OPTION_offset} -le 7 ] && [ $CRYPTTAB_OPTION_offset -lt 4194304 ]; then
        # silently ignore large offset values which might cause the multiplication to overflow...
        offset_bytes=$((CRYPTTAB_OPTION_offset * 512))
    fi

    local out tmpdev
    if [ "$CRYPTTAB_TYPE" != "luks" ] && [ "$CRYPTTAB_TYPE" != "bitlk" ]; then
        # fail if the device has a filesystem and the disk encryption format doesn't
        # verify the key digest (unlike LUKS); unless it's swap, otherwise people can't
        # easily convert an existing plainttext swap partition to an encrypted one
        if ! out="$(/lib/cryptsetup/checks/un_blkid "$CRYPTTAB_SOURCE" "" ${CRYPTTAB_OPTION_offset+"$offset_bytes"} 2>/dev/null)" &&
                ! /lib/cryptsetup/checks/blkid "$CRYPTTAB_SOURCE" swap ${CRYPTTAB_OPTION_offset+"$offset_bytes"} >/dev/null; then
            log_warning_msg "$CRYPTTAB_NAME: the precheck for '$CRYPTTAB_SOURCE' failed: $out"
            return 1
        fi
    fi

    local count=0 maxtries="${CRYPTTAB_OPTION_tries:-3}" fstype rv
    local target="$CRYPTTAB_NAME"
    CRYPTTAB_NAME="${CRYPTTAB_NAME}_unformatted" # XXX potential conflict
    while [ $maxtries -le 0 ] || [ $count -lt $maxtries ]; do
        if [ -z "${CRYPTTAB_OPTION_keyscript+x}" ] && [ "$CRYPTTAB_KEY" != "none" ]; then
            # unlock via keyfile
            unlock_mapping "$CRYPTTAB_KEY"
        else
            # unlock interactively or via keyscript
            CRYPTTAB_NAME="$target" run_keyscript "$count" | unlock_mapping
        fi
        rv=$?
        count=$(( $count + 1 ))

        if [ $rv -ne 0 ] || ! tmpdev="$(dm_blkdevname "$CRYPTTAB_NAME")"; then
            continue
        fi
        if [ -n "${CRYPTTAB_OPTION_check+x}" ] && \
                ! "$CRYPTTAB_OPTION_check" "$tmpdev" ${CRYPTTAB_OPTION_checkargs+"$CRYPTTAB_OPTION_checkargs"}; then
            log_warning_msg "$target: the check for '$CRYPTTAB_NAME' failed"
            cryptsetup remove -- "$CRYPTTAB_NAME"
            continue
        fi
        if [ "${CRYPTTAB_OPTION_swap+x}" ]; then
            if out="$(/lib/cryptsetup/checks/un_blkid "$tmpdev" "" ${CRYPTTAB_OPTION_offset+"$offset_bytes"} 2>/dev/null)" ||
                    /lib/cryptsetup/checks/blkid "$tmpdev" swap ${CRYPTTAB_OPTION_offset+"$offset_bytes"} >/dev/null 2>&1; then
                mkswap "$tmpdev" >/dev/null 2>&1
            else
                log_warning_msg "$target: the check for '$CRYPTTAB_NAME' failed. $CRYPTTAB_NAME contains data: $out"
                cryptsetup remove -- "$CRYPTTAB_NAME"
                return 1
            fi
        elif [ "${CRYPTTAB_OPTION_tmp+x}" ]; then
            local tmpdir="$(mktemp --tmpdir="/run/cryptsetup" --directory)" rv=0
            if ! mkfs -t "$CRYPTTAB_OPTION_tmp" -q "$tmpdev" >/dev/null 2>&1 ||
                    ! mount -t "$CRYPTTAB_OPTION_tmp" "$tmpdev" "$tmpdir" ||
                    ! chmod 1777 "$tmpdir"; then
                rv=1
            fi
            umount "$tmpdir" || true
            rmdir "$tmpdir" || true
            [ $rv -eq 0 ] || return $rv
        fi
        if command -v udevadm >/dev/null 2>&1; then
            udevadm settle
        fi
        dmsetup rename -- "$CRYPTTAB_NAME" "$target"
        device_msg "$target" "started"
        return 0
    done
    device_msg "$target" "failed"
    return 1
}

# Removes all mappings in crypttab, except the ones holding the root
# file system or /usr
do_stop() {
    local devno_rootfs devno_usr
    dmsetup mknodes
    log_action_begin_msg "Stopping $INITSTATE crypto disks"

    devno_rootfs="$(get_mnt_devno /)" || devno_rootfs=""
    devno_usr="$(get_mnt_devno /usr)" || devno_usr=""

    crypttab_foreach_entry _do_stop_callback
    log_action_end_msg 0
}
_do_stop_callback() {
    local skip="n" devno rv=0

    # traverse the device tree for each crypttab(5) entry and mark / and
    # /usr holders as skipped.  that's suboptimal but we can't use
    # mapped device names as they might contain any character other than
    # NUL.  shouldn't be much overhead anyway as the device tree is
    # likely not that long
    foreach_cryptdev _do_stop_skipped $devno_rootfs $devno_usr
    [ "$skip" = "n" ] || return $rv

    if devno="$(dmsetup info -c --noheadings -o devno -- "$CRYPTTAB_NAME" 2>/dev/null)" && [ -n "$devno" ]; then
        foreach_cryptdev --reverse _do_stop_remove "$devno" || rv=$? # try to remove slave devices first
    fi
    return $rv
}
_do_stop_skipped() {
    if [ "$1" = "$CRYPTTAB_NAME" ]; then
        skip="y"
    fi
}
_do_stop_remove() {
    local name="$1" i rv=0
    for i in 1 2 4 8 16 32; do
        remove_mapping "$name" 3<&- && break || rv=$?
        if [ $rv -eq 1 ] || [ $rv -eq 2 -a $i -gt 16 ]; then
            log_action_end_msg $rv
            break
        fi
        log_action_cont_msg "$name busy..."
        sleep $i
    done
}

# device_msg([$name], $message)
#   Convenience function to handle $VERBOSE
device_msg() {
    local name message
    if [ $# -eq 1 ]; then
        name="$CRYPTTAB_NAME"
        message="$1"
    else
        name="$1"
        message="$2"
    fi

    if [ "$VERBOSE" != "no" ]; then
        log_action_cont_msg "$name ($message)"
    fi
}

# remove_mapping($target)
#   Remove mapping $target
remove_mapping() {
    local CRYPTTAB_NAME="$1"

    if ! dm_blkdevname "$CRYPTTAB_NAME" >/dev/null; then
        device_msg "stopped"
        return 0
    fi

    if [ "$(dmsetup info --noheadings -c -o subsystem -- "$CRYPTTAB_NAME")" != "CRYPT" ]; then
        device_msg "error"
        return 1
    fi

    local opencount="$(dmsetup info -c --noheadings -o open -- "$CRYPTTAB_NAME" 2>/dev/null || true)"
    if [ -z "$opencount" ]; then
        device_msg "error"
        return 1
    elif [ "$opencount" != "0" ]; then
        device_msg "busy"
        if [ "$INITSTATE" = "early" ] || [ "$INITSTATE" = "manual" ]; then
            return 1
        elif [ "$INITSTATE" = "remaining" ]; then
            return 2
        fi
        return 0
    fi

    if cryptsetup remove -- "$CRYPTTAB_NAME"; then
        device_msg "stopping"
        return 0
    else
        device_msg "error"
        return 1
    fi
}

# vim: set filetype=sh :
PK�-]Ėbʓ�checks/swapnuȯ��
#!/bin/sh

echo "WARNING: The check script $0 is deprecated. Please use check script blkid instead." >&2

/lib/cryptsetup/checks/blkid "$1" "swap"
PK�-]лxİ�checks/un_blkidnuȯ��
#!/bin/sh
# this script depends on /sbin/blkid from the util-linux package

# usage: un_blkid <device> <fs_type> [<offset>]
# <device> may be any device that should be checked.
# if no <fs_type> is given, the check fails for any valid filesystem
# if <fs_type> is given, the check fails when a filesystem type <fs_type>
# is found on the device.

if test ! -x "/sbin/blkid"; then
  echo " - WARNING: blkid from util-linux is not available, impossible to run checks."
  exit 1
fi

dev="$1"
fs="$2"
offset="${3-}"

blkid="$(/sbin/blkid -o value -s TYPE -p ${offset:+-O "$offset"} -- "$dev")"

# blkid output is empty if $dev has an unknown filesystem
if [ -n "$blkid" ] && [ -z "$fs" ]; then
  echo " - The device $dev contains a filesystem type $blkid${offset:+" at offset $offset"}."
  exit 1
elif [ -n "$fs" ] && [ "$blkid" = "$fs" ]; then
  echo " - The device $dev contains a filesystem type $fs${offset:+" at offset $offset"}."
  exit 1
fi
PK�-](�'w�
�
checks/ext2nuȯ��
#!/bin/sh

echo "WARNING: The check script $0 is deprecated. Please use check script blkid instead." >&2

not_fs=""
for fs in ext2 ext3 ext4 ext4dev; do
	/lib/cryptsetup/checks/blkid "$1" "$fs" >/dev/null || not_fs="$not_fs $fs"
done
if [ "$not_fs" = " ext2 ext3 ext4 ext4dev" ]; then
	echo " - The device $1 does not contain a valid ext2, ext3, ext4 or ext4dev filesystem."
	exit 1
fi
PK�-]����
checks/xfsnuȯ��
#!/bin/sh

echo "WARNING: The check script $0 is deprecated. Please use check script blkid instead." >&2

/lib/cryptsetup/checks/blkid "$1" "xfs"
PK�-]�Ƥ�checks/blkidnuȯ��
#!/bin/sh
# this script depends on /sbin/blkid from the util-linux package

# usage: blkid <device> <fs_type> [<offset>]
# <device> may be any device that should be checked.
# if no <fs_type> is given, the check fails if no valid filesystem is found.
# if <fs_type> is given, the check fails when no filesystem type <fs_type>
# is found on the device. if <fs_type> is 'none', the check fails if any
# know filesystem is found.

if test ! -x "/sbin/blkid"; then
  echo " - WARNING: blkid from util-linux is not available, impossible to run checks."
  exit 1
fi

dev="$1"
fs="$2"
offset="${3-}"

blkid="$(/sbin/blkid -o value -s TYPE -p ${offset:+-O "$offset"} -- "$dev")"

# blkid output is empty if $dev has an unknown filesystem
if [ -z "$blkid" ] && [ -z "$fs" ]; then
  echo " - The device $dev does not contain a known filesystem${offset:+" at offset $offset"}."
  exit 1
elif [ -n "$blkid" ] && [ "$fs" = "none" ]; then
  echo " - The device $dev contains a filesystem type $blkid${offset:+" at offset $offset"}."
  exit 1
elif [ -n "$fs" ] && [ "$blkid" != "$fs" ]; then
  echo " - The device $dev does not contain a filesystem type $fs${offset:+" at offset $offset"}."
  exit 1
fi
PK�-]�Kn�j�j	functionsnu�[���
if [ "${0#/usr/share/initramfs-tools/hooks/}" != "$0" ] ||
        [ "${0#/etc/initramfs-tools/hooks/}" != "$0" ]; then
    # called from an initramfs-tools hook script
    TABFILE="$DESTDIR/cryptroot/crypttab"
elif [ "${0#/scripts/}" != "$0" ]; then
    # called at initramfs stage from a boot script
    TABFILE="/cryptroot/crypttab"
    CRYPTROOT_COUNT_FILE="/run/cryptroot.initrd.cnt"
else
    TABFILE="${TABFILE-/etc/crypttab}"
fi
export DM_DEFAULT_NAME_MANGLING_MODE=hex # for dmsetup(8)

# Logging helpers. Send the argument list to plymouth(1), or fold it
# and print it to the standard error.
cryptsetup_message() {
    local IFS=' '
    if [ "${0#/scripts/}" != "$0" ] && [ -x /bin/plymouth ] && plymouth --ping; then
        plymouth message --text="cryptsetup: $*"
    elif [ ${#*} -lt 70 ]; then
        echo "cryptsetup: $*" >&2
    else
        # use busybox's fold(1) and sed(1) at initramfs stage
        echo "cryptsetup: $*" | fold -s | sed '1! s/^/    /' >&2
    fi
    return 0
}

# crypttab_parse_options([--export], [--quiet], [--missing-path={ignore|warn|fail}])
#   Parse $_CRYPTTAB_OPTIONS, a comma-separated option string from the
#   crypttab(5) 4th column, and sets corresponding variables
#   CRYPTTAB_OPTION_<option>=<value> (which are added to the environment
#   if --export is set).  If --path-exists isn't set to "ignore" (the
#   default), then options taking a file name, such as header=<path>,
#   need to point to an existing path, otherwise a warning is printed;
#   and an error is raised if the value is set to "fail".
#   For error and warning messages, CRYPTTAB_NAME, (resp. CRYPTTAB_KEY)
#   should be set to the (unmangled) mapped device name (resp. key
#   file).
#   Moreover CRYPTTAB_TYPE is set the device type.
#   Return 1 on parsing error, 0 otherwise (incl. if unknown options
#   were encountered).
crypttab_parse_options() {
    local quiet="n" export="n" missing_path="ignore"
    while [ $# -gt 0 ]; do
        case "$1" in
            --quiet) quiet="y";;
            --export) export="y";;
            --missing-path=*) missing_path="${1#--missing-path=}";;
            *) cryptsetup_message "WARNING: crypttab_parse_options(): unknown option $1"
        esac
        shift
    done

    local IFS=',' x OPTION VALUE
    CRYPTTAB_TYPE=""
    unset -v CRYPTTAB_OPTION_cipher \
             CRYPTTAB_OPTION_size \
             CRYPTTAB_OPTION_sector_size \
             CRYPTTAB_OPTION_hash \
             CRYPTTAB_OPTION_offset \
             CRYPTTAB_OPTION_skip \
             CRYPTTAB_OPTION_verify \
             CRYPTTAB_OPTION_readonly \
             CRYPTTAB_OPTION_discard \
             CRYPTTAB_OPTION_plain \
             CRYPTTAB_OPTION_luks \
             CRYPTTAB_OPTION_tcrypt \
             CRYPTTAB_OPTION_veracrypt \
             CRYPTTAB_OPTION_bitlk \
             CRYPTTAB_OPTION_fvault2 \
             CRYPTTAB_OPTION_swap \
             CRYPTTAB_OPTION_tmp \
             CRYPTTAB_OPTION_check \
             CRYPTTAB_OPTION_checkargs \
             CRYPTTAB_OPTION_tries \
             CRYPTTAB_OPTION_initramfs \
             CRYPTTAB_OPTION_noearly \
             CRYPTTAB_OPTION_noauto \
             CRYPTTAB_OPTION_loud \
             CRYPTTAB_OPTION_quiet \
             CRYPTTAB_OPTION_keyscript \
             CRYPTTAB_OPTION_keyslot \
             CRYPTTAB_OPTION_header \
             CRYPTTAB_OPTION_tcrypthidden \
             CRYPTTAB_OPTION_same_cpu_crypt \
             CRYPTTAB_OPTION_submit_from_crypt_cpus \
             CRYPTTAB_OPTION_no_read_workqueue \
             CRYPTTAB_OPTION_no_write_workqueue
    # use $_CRYPTTAB_OPTIONS not $CRYPTTAB_OPTIONS as options values may
    # contain '\054' which is decoded to ',' in the latter
    for x in $_CRYPTTAB_OPTIONS; do
        OPTION="${x%%=*}"
        VALUE="${x#*=}"
        if [ "$x" = "$OPTION" ]; then
            unset -v VALUE
        else
            VALUE="$(printf '%b' "$VALUE")"
        fi
        if ! crypttab_validate_option; then
            if [ "$quiet" = "n" ]; then
                cryptsetup_message "ERROR: $CRYPTTAB_NAME: invalid value for '${x%%=*}' option, skipping"
            fi
            return 1
        elif [ -z "${OPTION+x}" ]; then
            continue
        fi
        if [ "$export" = "y" ]; then
            export "CRYPTTAB_OPTION_$OPTION"="${VALUE-yes}"
        else
            eval "CRYPTTAB_OPTION_$OPTION"='${VALUE-yes}'
        fi
    done
    IFS=" "

    if ! _get_crypt_type; then # set CRYPTTAB_TYPE to the type of crypt device
        CRYPTTAB_TYPE="plain"
        if [ "$quiet" = "n" ]; then
            cryptsetup_message "WARNING: $CRYPTTAB_NAME: couldn't determine device type," \
                               "assuming default ($CRYPTTAB_TYPE)."
        fi
    fi

    if [ "$quiet" = "n" ] && [ -n "${CRYPTTAB_OPTION_header+x}" ] && [ "$CRYPTTAB_TYPE" != "luks" ]; then
        cryptsetup_message "WARNING: $CRYPTTAB_NAME: Headers are only supported for LUKS devices."
    fi
    if [ "$CRYPTTAB_TYPE" = "plain" ]; then
        # the compiled-in default for these are subject to change
        options='cipher size'
        if [ -n "${CRYPTTAB_OPTION_keyscript+x}" ] || [ "$CRYPTTAB_KEY" = "none" ]; then
            options="$options hash" # --hash is being ignored in plain mode with keyfile specified
        fi
        for o in $options; do
            if [ "$quiet" = "n" ] && eval [ -z "\${CRYPTTAB_OPTION_$o+x}" ]; then
                cryptsetup_message "WARNING: Option '$o' missing in crypttab for plain dm-crypt" \
                    "mapping $CRYPTTAB_NAME. Please read /usr/share/doc/cryptsetup-initramfs/README.initramfs.gz and" \
                    "add the correct '$o' option to your crypttab(5)."
            fi
        done
    fi
}

# crypttab_validate_option()
#   Validate $OPTION=$VALUE (or flag $OPTION if VALUE is unset).  return
#   1 on error, unsets OPTION for unknown or useless options.
crypttab_validate_option() {
    # option aliases
    case "$OPTION" in
        read-only) OPTION="readonly";;
        key-slot) OPTION="keyslot";;
        tcrypt-hidden) OPTION="tcrypthidden";;
        tcrypt-veracrypt) OPTION="veracrypt";;
    esac

    # sanitize the option name so CRYPTTAB_OPTION_$OPTION is a valid variable name
    local o="$OPTION"
    case "$o" in
        keyfile-offset) OPTION="keyfile_offset";;
        keyfile-size) OPTION="keyfile_size";;
        sector-size) OPTION="sector_size";;
        same-cpu-crypt) OPTION="same_cpu_crypt";;
        submit-from-crypt-cpus) OPTION="submit_from_crypt_cpus";;
        no-read-workqueue) OPTION="no_read_workqueue";;
        no-write-workqueue) OPTION="no_write_workqueue";;
    esac

    case "$o" in
        # value must be a non-empty string
        cipher|hash)
            [ -n "${VALUE:+x}" ] || return 1
        ;;
        # value must be a non-empty string, and an existing path if --missing-path is set
        header)
            [ -n "${VALUE:+x}" ] || return 1
            if [ "$missing_path" != "ignore" ]; then
                if [ ! -e "$VALUE" ]; then
                    cryptsetup_message "WARNING: $CRYPTTAB_NAME: $VALUE does not exist";
                    [ "$missing_path" = "warn" ] || return 1
                fi
            fi
        ;;
        # numeric options >0
        size|keyfile-size|sector-size)
            if ! printf '%s' "${VALUE-}" | grep -Exq "0*[1-9][0-9]*"; then
                return 1
            fi
        ;;
        # numeric options >=0
        offset|skip|tries|keyslot|keyfile-offset)
            if ! printf '%s' "${VALUE-}" | grep -Exq "[0-9]+"; then
                return 1
            fi
        ;;
        tmp)
            if [ -z "${VALUE+x}" ]; then
                VALUE="ext4" # 'tmp flag'
            elif [ -z "$VALUE" ]; then
                return 1
            fi
        ;;
        check)
            if [ -z "${VALUE+x}" ]; then
                if [ -n "${CRYPTDISKS_CHECK-}" ]; then
                    VALUE="$CRYPTDISKS_CHECK"
                else
                    unset -v OPTION
                    return 0
                fi
            fi
            if [ "${VALUE#/}" = "$VALUE" ]; then
                VALUE="/lib/cryptsetup/checks/$VALUE"
            fi
            if [ ! -x "$VALUE" ] || [ ! -f "$VALUE" ]; then
                return 1
            fi
        ;;
        checkargs)
            [ -n "${VALUE+x}" ] || return 1 # must have a value (possibly empty)
        ;;
        keyscript)
            [ -n "${VALUE:+x}" ] || return 1 # must have a value
            if [ "${VALUE#/}" = "$VALUE" ]; then
                VALUE="/lib/cryptsetup/scripts/$VALUE"
            fi
            if [ ! -x "$VALUE" ] || [ ! -f "$VALUE" ]; then
                return 1
            fi
        ;;
        # and now the flags
        verify) ;;
        loud) ;;
        quiet) ;;
        initramfs) ;;
        noearly) ;;
        noauto) ;;
        readonly) ;;
        discard) ;;
        plain) ;;
        luks) ;;
        swap) ;;
        tcrypt) ;;
        veracrypt) ;;
        tcrypthidden) ;;
        bitlk) ;;
        fvault2) ;;
        same-cpu-crypt) ;;
        submit-from-crypt-cpus) ;;
        no-read-workqueue) ;;
        no-write-workqueue) ;;
        *)
            if [ "${quiet:-n}" = "n" ]; then
                cryptsetup_message "WARNING: $CRYPTTAB_NAME: ignoring unknown option '$o'";
            fi
            unset -v OPTION
        ;;
    esac
}

# crypttab_resolve_source()
#   Resolve the CRYPTTAB_SOURCE variable, containing value of the second
#   field of a crypttab(5)-like file.
#   On error (non-existing source), CRYPTTAB_SOURCE is not changed and 1
#   is returned.
crypttab_resolve_source() {
    # return immediately if source is a regular file
    [ ! -f "$CRYPTTAB_SOURCE" ] || return 0
    # otherwise resolve the block device specification
    local dev="$CRYPTTAB_SOURCE"
    dev="$(_resolve_device_spec "$dev")" && CRYPTTAB_SOURCE="$dev" || return 1
}

# run_keyscript($tried_count)
#   exec()'ute `$CRYPTTAB_OPTION_keyscript "$CRYPTTAB_KEY"`.
#   If $CRYPTTAB_OPTION_keyscript is unset or null and $CRYPTTAB_KEY is
#   "none" (meaning the passphrase is to be read interactively from the
#   console), then use `/lib/cryptsetup/askpass` as keyscript with a
#   suitable prompt message instead.
#   Since the shell process is replaced with the $CRYPTTAB_OPTION_keyscript
#   program, run_keyscript() must be used on the left-hand side of a
#   pipe, or similar.
run_keyscript() {
    local keyscript keyscriptarg="$CRYPTTAB_KEY"
    export CRYPTTAB_NAME CRYPTTAB_SOURCE CRYPTTAB_OPTIONS
    export _CRYPTTAB_NAME _CRYPTTAB_SOURCE _CRYPTTAB_OPTIONS
    export CRYPTTAB_TRIED="$1"

    if [ -n "${CRYPTTAB_OPTION_keyscript+x}" ] && \
            [ "$CRYPTTAB_OPTION_keyscript" != "/lib/cryptsetup/askpass" ]; then
        # 'keyscript' option is present: export its argument as $CRYPTTAB_KEY
        export CRYPTTAB_KEY _CRYPTTAB_KEY
        keyscript="$CRYPTTAB_OPTION_keyscript"
    elif [ "$keyscriptarg" = "none" ]; then
        # don't export the prompt message as CRYPTTAB_KEY
        keyscript="/lib/cryptsetup/askpass"
        keyscriptarg="Please unlock disk $CRYPTTAB_NAME: "
    fi

    exec "$keyscript" "$keyscriptarg"
}

# _get_crypt_type()
#    Set CRYPTTAB_TYPE to the mapping type, depending on its
#    $CRYPTTAB_OPTION_<option> values
#    Return a non-zero status if the mapping couldn't be determined
_get_crypt_type() {
    local s="$CRYPTTAB_SOURCE" t="" blk_t

    if [ "${CRYPTTAB_OPTION_luks-}" = "yes" ]; then
        t="luks"
    elif [ "${CRYPTTAB_OPTION_tcrypt-}" = "yes" ]; then
        t="tcrypt"
    elif [ "${CRYPTTAB_OPTION_plain-}" = "yes" ]; then
        t="plain"
    elif [ "${CRYPTTAB_OPTION_bitlk-}" = "yes" ]; then
        t="bitlk"
    elif [ "${CRYPTTAB_OPTION_fvault2-}" = "yes" ]; then
        t="fvault2"
    elif [ -n "${CRYPTTAB_OPTION_header+x}" ]; then
        # detached headers are only supported for LUKS devices
        if [ -e "$CRYPTTAB_OPTION_header" ] && /sbin/cryptsetup isLuks -- "$CRYPTTAB_OPTION_header"; then
            t="luks"
        fi
    elif [ -f "$s" ] || s="$(_resolve_device_spec "$CRYPTTAB_SOURCE")"; then
        if /sbin/cryptsetup isLuks -- "$s"; then
            t="luks"
        elif blk_t="$(blkid -s TYPE -o value -- "$s")" && [ "$blk_t" = "BitLocker" ]; then
            t="bitlk"
        fi
    fi

    [ -n "$t" ] || return 1
    CRYPTTAB_TYPE="$t"
}

# unlock_mapping([$keyfile])
#   Run cryptsetup(8) with suitable options and arguments to unlock
#   $CRYPTTAB_SOURCE and setup dm-crypt managed device-mapper mapping
#   $CRYPTTAB_NAME.
unlock_mapping() {
    local keyfile="${1:--}"

    if [ "$CRYPTTAB_TYPE" = "luks" ] || [ "$CRYPTTAB_TYPE" = "tcrypt" ]; then
        # ignored for LUKS and TCRYPT devices
        unset -v CRYPTTAB_OPTION_cipher \
                 CRYPTTAB_OPTION_size \
                 CRYPTTAB_OPTION_hash \
                 CRYPTTAB_OPTION_offset \
                 CRYPTTAB_OPTION_skip
    fi
    if [ "$CRYPTTAB_TYPE" = "plain" ] || [ "$CRYPTTAB_TYPE" = "tcrypt" ]; then
        unset -v CRYPTTAB_OPTION_keyfile_size
    fi
    if [ "$CRYPTTAB_TYPE" = "tcrypt" ]; then
        # ignored for TCRYPT devices
        unset -v CRYPTTAB_OPTION_keyfile_offset
    else
        # ignored for non-TCRYPT devices
        unset -v CRYPTTAB_OPTION_veracrypt CRYPTTAB_OPTION_tcrypthidden
    fi

    if [ "$CRYPTTAB_TYPE" != "luks" ]; then
        # ignored for non-LUKS devices
        unset -v CRYPTTAB_OPTION_keyslot
    fi

    /sbin/cryptsetup -T1 \
        ${CRYPTTAB_OPTION_header:+--header="$CRYPTTAB_OPTION_header"} \
        ${CRYPTTAB_OPTION_cipher:+--cipher="$CRYPTTAB_OPTION_cipher"} \
        ${CRYPTTAB_OPTION_size:+--key-size="$CRYPTTAB_OPTION_size"} \
        ${CRYPTTAB_OPTION_sector_size:+--sector-size="$CRYPTTAB_OPTION_sector_size"} \
        ${CRYPTTAB_OPTION_hash:+--hash="$CRYPTTAB_OPTION_hash"} \
        ${CRYPTTAB_OPTION_offset:+--offset="$CRYPTTAB_OPTION_offset"} \
        ${CRYPTTAB_OPTION_skip:+--skip="$CRYPTTAB_OPTION_skip"} \
        ${CRYPTTAB_OPTION_verify:+--verify-passphrase} \
        ${CRYPTTAB_OPTION_readonly:+--readonly} \
        ${CRYPTTAB_OPTION_discard:+--allow-discards} \
        ${CRYPTTAB_OPTION_veracrypt:+--veracrypt} \
        ${CRYPTTAB_OPTION_keyslot:+--key-slot="$CRYPTTAB_OPTION_keyslot"} \
        ${CRYPTTAB_OPTION_tcrypthidden:+--tcrypt-hidden} \
        ${CRYPTTAB_OPTION_keyfile_size:+--keyfile-size="$CRYPTTAB_OPTION_keyfile_size"} \
        ${CRYPTTAB_OPTION_keyfile_offset:+--keyfile-offset="$CRYPTTAB_OPTION_keyfile_offset"} \
        ${CRYPTTAB_OPTION_same_cpu_crypt:+--perf-same_cpu_crypt} \
        ${CRYPTTAB_OPTION_submit_from_crypt_cpus:+--perf-submit_from_crypt_cpus} \
        ${CRYPTTAB_OPTION_no_read_workqueue:+--perf-no_read_workqueue} \
        ${CRYPTTAB_OPTION_no_write_workqueue:+--perf-no_write_workqueue} \
        --type="$CRYPTTAB_TYPE" --key-file="$keyfile" \
        open -- "$CRYPTTAB_SOURCE" "$CRYPTTAB_NAME"
}

# resume_mapping([$keyfile])
#   Run cryptsetup(8) with suitable options and arguments to resume
#   $CRYPTTAB_NAME.
resume_mapping() {
    local keyfile="${1:--}"

    /sbin/cryptsetup -T1 \
        ${CRYPTTAB_OPTION_header:+--header="$CRYPTTAB_OPTION_header"} \
        ${CRYPTTAB_OPTION_keyslot:+--key-slot="$CRYPTTAB_OPTION_keyslot"} \
        ${CRYPTTAB_OPTION_keyfile_size:+--keyfile-size="$CRYPTTAB_OPTION_keyfile_size"} \
        ${CRYPTTAB_OPTION_keyfile_offset:+--keyfile-offset="$CRYPTTAB_OPTION_keyfile_offset"} \
        --type="$CRYPTTAB_TYPE" --key-file="$keyfile" \
        luksResume "$CRYPTTAB_NAME"
}

# resume_device($device)
#   Resume $device with endless retries. Used by cryptsetup-suspend-wrapper.
resume_device() {
    local device="$1"
    # check if device is really suspended
    if [ "$(dmsetup info -c --noheadings -o suspended -- "$device" 2>/dev/null)" != "Suspended" ]; then
        cryptsetup_message "ERROR: $device: device was not suspendend"
        return 1
    fi

    if ! crypttab_find_entry "$device" || ! crypttab_parse_options --quiet; then
        cryptsetup_message "ERROR: $device: not found in $TABFILE"
        return 1
    fi

    if [ "$CRYPTTAB_TYPE" != "luks" ]; then
        cryptsetup_message "ERROR: $CRYPTTAB_NAME: unable to resume non-LUKS device"
        return 1
    fi

    # Loop endlessly until the resume command succeeded
    while true; do
        if [ -z "${CRYPTTAB_OPTION_keyscript+x}" ] && [ "$CRYPTTAB_KEY" != "none" ]; then
            resume_mapping "$CRYPTTAB_KEY" && break || true
        else
            run_keyscript 1 | resume_mapping && break || true
        fi
    done
}

# crypttab_key_check()
#   Sanity checks for keyfile $CRYPTTAB_KEY.  CRYPTTAB_NAME and
#   CRYPTTAB_OPTION_<option> must be set appropriately.
crypttab_key_check() {
    if [ ! -f "$CRYPTTAB_KEY" ] && [ ! -b "$CRYPTTAB_KEY" ] && [ ! -c "$CRYPTTAB_KEY" ] ; then
        cryptsetup_message "WARNING: $CRYPTTAB_NAME: keyfile '$CRYPTTAB_KEY' not found"
        return 0
    fi

    if [ "$CRYPTTAB_KEY" = "/dev/random" ] || [ "$CRYPTTAB_KEY" = "/dev/urandom" ]; then
        if [ -n "${CRYPTTAB_OPTION_luks+x}" ] || [ -n "${CRYPTTAB_OPTION_tcrypt+x}" ]; then
            cryptsetup_message "WARNING: $CRYPTTAB_NAME: has random data as key"
            return 1
        else
            return 0
        fi
    fi

    local mode="$(stat -L -c"%04a" -- "$CRYPTTAB_KEY")"
    if [ $(stat -L -c"%u" -- "$CRYPTTAB_KEY") -ne 0 ] || [ "${mode%00}" = "$mode" ]; then
        cryptsetup_message "WARNING: $CRYPTTAB_NAME: key file $CRYPTTAB_KEY has" \
            "insecure ownership, see /usr/share/doc/cryptsetup/README.Debian.gz."
    fi
}

# _resolve_device_spec($spec)
#   Resolve LABEL=<label>, UUID=<uuid>, PARTUUID=<partuuid> and
#   PARTLABEL=<partlabel> to a block special device.  If $spec is
#   already a (link to a block special device) then it is echoed as is.
#   Return 1 if $spec doesn't correspond to a block special device.
_resolve_device_spec() {
    local spec="$1"
    case "$spec" in
        UUID=*|LABEL=*|PARTUUID=*|PARTLABEL=*)
            # don't use /dev/disk/by-label/... to avoid gessing udev mangling
            spec="$(blkid -l -t "$spec" -o device)" || spec=
        ;;
    esac
    [ -b "$spec" ] && printf '%s\n' "$spec" || return 1
}

# dm_blkdevname($name)
#   Print the mapped device name, or return 1 if the the device doesn't exist.
dm_blkdevname() {
    local name="$1" dev
    # /dev/mapper/$name isn't reliable due to udev mangling
    if dev="$(dmsetup info -c --noheadings -o blkdevname -- "$name" 2>/dev/null)" &&
            [ -n "$dev" ] && [ -b "/dev/$dev" ]; then
        echo "/dev/$dev"
        return 0
    else
        return 1
    fi
}

# crypttab_find_entry([--quiet], $target)
#   Search in the crypttab(5) for the given $target, and sets the
#   variables CRYPTTAB_NAME, CRYPTTAB_SOURCE, CRYPTTAB_KEY and
#   CRYPTTAB_OPTIONS accordingly.  (In addition _CRYPTTAB_NAME,
#   _CRYPTTAB_SOURCE, _CRYPTTAB_KEY and _CRYPTTAB_OPTIONS are set to the
#   unmangled values before decoding the escape sequence.)  If there are
#   duplicates then only the first match is considered.
#   Return 0 if a match is found, and 1 otherwise.
crypttab_find_entry() {
    local target="$1" quiet="n" IFS
    if [ "$target" = "--quiet" ] && [ $# -eq 2 ]; then
        quiet="y"
        target="$2"
    fi

    if [ -f "$TABFILE" ]; then
        while IFS=" 	" read -r _CRYPTTAB_NAME _CRYPTTAB_SOURCE _CRYPTTAB_KEY _CRYPTTAB_OPTIONS; do
            if [ "${_CRYPTTAB_NAME#\#}" != "$_CRYPTTAB_NAME" ] || [ -z "$_CRYPTTAB_NAME" ]; then
                # ignore comments and empty lines
                continue
            fi

            # unmangle names
            CRYPTTAB_NAME="$(printf '%b' "$_CRYPTTAB_NAME")"
            if [ -z "$_CRYPTTAB_SOURCE" ] || [ -z "$_CRYPTTAB_KEY" ]; then
                cryptsetup_message "WARNING: '$CRYPTTAB_NAME' is missing some arguments, see crypttab(5)"
                continue
            elif [ "$CRYPTTAB_NAME" = "$target" ]; then
                CRYPTTAB_SOURCE="$( printf '%b' "$_CRYPTTAB_SOURCE" )"
                CRYPTTAB_KEY="$(    printf '%b' "$_CRYPTTAB_KEY"    )"
                CRYPTTAB_OPTIONS="$(printf '%b' "$_CRYPTTAB_OPTIONS")"
                return 0
            fi
        done <"$TABFILE"
    fi

    if [ "$quiet" = "n" ]; then
        cryptsetup_message "WARNING: target '$target' not found in $TABFILE"
    fi
    return 1
}

# crypttab_foreach_entry($callback)
#   Iterate through the crypttab(5) and run the given $callback for each
#   entry found. Variables CRYPTTAB_NAME, CRYPTTAB_SOURCE, CRYPTTAB_KEY
#   and CRYPTTAB_OPTIONS are set accordingly and available to the
#   $callback.  (In addition _CRYPTTAB_NAME, _CRYPTTAB_SOURCE,
#   _CRYPTTAB_KEY and _CRYPTTAB_OPTIONS are set to the original values
#   before decoding the escape sequence.)
#   Return 0 if a match is found, and 1 otherwise.
crypttab_foreach_entry() {
    local callback="$1" IFS
    local _CRYPTTAB_NAME _CRYPTTAB_SOURCE _CRYPTTAB_KEY _CRYPTTAB_OPTIONS \
           CRYPTTAB_NAME  CRYPTTAB_SOURCE  CRYPTTAB_KEY  CRYPTTAB_OPTIONS

    [ -f "$TABFILE" ] || return
    while IFS=" 	" read -r _CRYPTTAB_NAME _CRYPTTAB_SOURCE _CRYPTTAB_KEY _CRYPTTAB_OPTIONS <&9; do
        if [ "${_CRYPTTAB_NAME#\#}" != "$_CRYPTTAB_NAME" ] || [ -z "$_CRYPTTAB_NAME" ]; then
            # ignore comments and empty lines
            continue
        fi

        # unmangle names
        CRYPTTAB_NAME="$(printf '%b' "$_CRYPTTAB_NAME")"

        if [ -z "$_CRYPTTAB_SOURCE" ] || [ -z "$_CRYPTTAB_KEY" ]; then
            cryptsetup_message "WARNING: '$CRYPTTAB_NAME' is missing some arguments, see crypttab(5)"
            continue
        fi

        CRYPTTAB_SOURCE="$( printf '%b' "$_CRYPTTAB_SOURCE" )"
        CRYPTTAB_KEY="$(    printf '%b' "$_CRYPTTAB_KEY"    )"
        CRYPTTAB_OPTIONS="$(printf '%b' "$_CRYPTTAB_OPTIONS")"

        "$callback" 9<&-
    done 9<"$TABFILE"
}

# _device_uuid($device)
#   Print the UUID attribute of given block special $device.  Return 0
#   on success, 1 on error.
_device_uuid() {
    local device="$1" uuid
    if uuid="$(blkid -s UUID -o value -- "$device")" && [ -n "$uuid" ]; then
        printf '%s\n' "$uuid"
    else
        return 1
    fi
}

# _resolve_device({$device | $spec})
#   Take a path to (or spec for) a block special device, and set DEV to
#   the (symlink to block) device, and MAJ (resp. MIN) to its major-ID
#   (resp. minor ID) decimal value.  On error these variables are not
#   changed and 1 is returned.
_resolve_device() {
    local spec="$1" dev devno maj min
    if dev="$(_resolve_device_spec "$spec")" &&
            devno="$(stat -L -c"%t:%T" -- "$dev" 2>/dev/null)" &&
            maj="${devno%:*}" && min="${devno#*:}" &&
            [ "$devno" = "$maj:$min" ] && [ -n "$maj" ] && [ -n "$min" ] &&
            maj=$(( 0x$maj )) && min=$(( 0x$min )) && [ $maj -gt 0 ]; then
        DEV="$dev"
        MAJ="$maj"
        MIN="$min"
        return 0
    else
        cryptsetup_message "ERROR: Couldn't resolve device $spec"
    fi
    return 1
}

# get_mnt_devno($mountpoint)
#   Print the major:minor device ID(s) holding the file system currently
#   mounted currenty mounted on $mountpoint.
#   Return 0 on success, 1 on error (if $mountpoint is not a mountpoint).
#   devno will be empty if the filesystem must be excluded.
get_mnt_devno() {
    local wantmount="$1" devnos="" uuid dev
    local out spec fstype DEV MAJ MIN

    # use awk rather than a `while read; do done` loop here as /proc/mounts
    # can be many thousands lines long and the `read` builtin goes one
    # read(2) at the time which slows down execution time, see MR !36
    out="$(awk -v mp="$wantmount" -- '
        BEGIN {
            FS = "[ \t]"
            ret = ""
        }
        !/^\s*(#|$)/ {
            # decode octal sequences; per procfs(5) the format of /proc/mounts
            # is analogous to fstab(5)
            head = ""
            while (match($2, /\\[0-7]{3}/)) {
                oct = substr($2, RSTART+1, RLENGTH-1)
                dec = (substr(oct, 1, 1) * 8 + substr(oct, 2, 1)) * 8 + substr(oct, 3, 1)
                head = head substr($2, 1, RSTART-1) sprintf("%c", dec)
                $2 = substr($2, RSTART+RLENGTH)
            }
            if (head $2 == mp) {
                # take the last mountpoint if used several times (shadowed)
                ret = $1 "	" $3
            }
        }
        END {
            print ret
        }' </proc/mounts)" || out=""

    spec="$(printf '%b' "${out%	*}")"
    if [ -n "$out" ];then
        fstype="${out##*	}"
        if [ "$fstype" = "zfs" ]; then
            # Ignore ZFS entries as they don't have a major/minor and won't
            # be imported when local-top cryptroot script will ran.
            # Returns success with empty devno
            printf ''
            return 0
        fi
        if _resolve_device "$spec"; then # _resolve_device() already warns on error
            if [ "$fstype" = "btrfs" ]; then
                # btrfs can span over multiple devices
                if uuid="$(_device_uuid "$DEV")"; then
                    for dev in "/sys/fs/$fstype/$uuid/devices"/*/dev; do
                        devnos="${devnos:+$devnos }$(cat "$dev")"
                    done
                else
                    cryptsetup_message "ERROR: $spec: Couldn't determine UUID"
                fi
            elif [ -n "$fstype" ]; then
                devnos="$MAJ:$MIN"
            fi
        fi
    fi

    if [ -z "${devnos:+x}" ]; then
        return 1 # not found
    else
        printf '%s' "$devnos"
    fi
}

# foreach_cryptdev([--reverse], $callback, $maj:$min, [$maj:$min ..])
#   Run $callback on the (unmangled) name of each dm-crypt device
#   recursively holding $maj:$min (typically corresponding to an md,
#   linear, or dm-crypt device).  Slaves that aren't dm-crypt devices
#   are ignored.
#   By default each device is processed after its *slaves*.  If
#   --reverse is set then each device is processed after its *holders*
#   instead.
foreach_cryptdev() {
    local callback="$1" reverse="n" devno base
    shift
    if [ "$callback" = "--reverse" ]; then
        reverse="y"
        callback="$1"
        shift
    fi
    for devno in "$@"; do
        base="/sys/dev/block/$devno"
        if [ ! -d "$base" ]; then
            cryptsetup_message "ERROR: Couldn't find sysfs directory for $devno"
            return 1
        fi
        _foreach_cryptdev "$base"
    done
}
_foreach_cryptdev() {
    local d="$1" devno maj min name t d2
    [ "$reverse" = "y" ] && t="holders" || t="slaves"
    [ -d "$d/$t" ] || return 0
    for d2 in "$d/$t"/*; do
        if [ -d "$d2" ] && d2="$(realpath -e -- "$d2")"; then
            _foreach_cryptdev "$d2"
        fi
    done
    if [ -d "$d/dm" ] && devno="$(cat "$d/dev")" &&
            maj="${devno%:*}" && min="${devno#*:}" &&
            [ "$devno" = "$maj:$min" ] && [ -n "$maj" ] && [ -n "$min" ] &&
            [ "$(dmsetup info -c --noheadings -o subsystem -j "$maj" -m "$min")" = "CRYPT" ] &&
            name="$(dmsetup info -c --noheadings -o unmangled_name -j "$maj" -m "$min")"; then
        "$callback" "$name"
    fi
}

# vim: set filetype=sh :
PK
�-]$��=��scripts/decrypt_keyctlnuȯ��
PK
�-]��7�[
[
@scripts/decrypt_sslnuȯ��
PK
�-]YB�Xtt�	scripts/decrypt_openscnuȯ��
PK
�-]|��s8989�scripts/passdevnuȯ��
PK
�-]�(sRRIscripts/decrypt_derivednuȯ��
PK
�-]zz;����Mscripts/decrypt_gnupg-scnuȯ��
PK
�-]���i::�Qscripts/decrypt_gnupgnuȯ��
PK
�-]ՠ��Y�Y(Taskpassnuȯ��
PK
�-]3g�o�"�"G�cryptdisks-functionsnu�[���
PK
�-]Ėbʓ�K�checks/swapnuȯ��
PK
�-]лxİ��checks/un_blkidnuȯ��
PK
�-](�'w�
�
�checks/ext2nuȯ��
PK
�-]����
��checks/xfsnuȯ��
PK
�-]�Ƥ���checks/blkidnuȯ��
PK
�-]�Kn�j�j	q�functionsnu�[���
PK�aH