Manage /etc/crypttab entries for encrypted volumes.

library/blivet.py

@@ -72,6 +72,9 @@
 mounts:
  description: list of dicts describing mounts to set up
  type: list of dict
+crypts:
+ description: list of dicts describing crypttab entries to set up
+ type: list of dict
 pools:
  description: list of dicts describing the pools w/ device path for each volume
  type: list of dict
@@ -785,6 +788,20 @@ def handle_new_mount(volume, fstab):
  return mount_info
 
 
+def get_crypt_info(actions):
+ info = list()
+ for action in actions:
+ if not (action.is_format and action.format.type == 'luks'):
+ continue
+
+ info.append(dict(backing_device=action.device.path,
+ name=action.format.map_name,
+ password=action.format.key_file or '-',
+ state='present' if action.is_create else 'absent'))
+
+ return sorted(info, key=lambda e: e['state'])
+
+
 def get_required_packages(b, pools, volumes):
  packages = list()
  for pool in pools:
@@ -861,6 +878,7 @@ def run_module():
  actions=list(),
  leaves=list(),
  mounts=list(),
+ crypts=list(),
  pools=list(),
  volumes=list(),
  packages=list(),
@@ -956,6 +974,7 @@ def action_dict(action):
  activate_swaps(b, module.params['pools'], module.params['volumes'])
 
  result['mounts'] = get_mount_info(module.params['pools'], module.params['volumes'], actions, fstab)
+ result['crypts'] = get_crypt_info(actions)
  result['leaves'] = [d.path for d in b.devicetree.leaves]
  result['pools'] = module.params['pools']
  result['volumes'] = module.params['volumes']

tasks/main-blivet.yml

@@ -165,6 +165,19 @@
  daemon_reload: yes
  when: blivet_output['mounts']
 
+#
+# Manage /etc/crypttab
+#
+- name: Manage /etc/crypttab to account for changes we just made
+ crypttab:
+ name: "{{ entry.name }}"
+ backing_device: "{{ entry.backing_device }}"
+ password: "{{ entry.password }}"
+ state: "{{ entry.state }}"
+ loop: "{{ blivet_output.crypts }}"
+ loop_control:
+ loop_var: entry
+
 #
 # Update facts since we may have changed system state.
 #

tests/test-verify-volume-encryption.yml

@@ -33,3 +33,35 @@
  that: "{{ storage_test_blkinfo.info[storage_test_volume._device].type == 'crypt' }}"
  when: _storage_test_volume_present and storage_test_volume.encryption
 
+- set_fact:
+ _storage_test_expected_crypttab_entries: "{{ (storage_test_volume.encryption and _storage_test_volume_present)|ternary(1, 0) }}"
+ _storage_test_crypttab_entries: "{{ storage_test_crypttab.stdout_lines|map('regex_search', '^' + storage_test_volume._device|basename + ' .*$')|select('string')|list }}"
+ _storage_test_expected_crypttab_key_file: "{{ storage_test_volume.encryption_key_file or '-' }}"
+
+- name: Check for /etc/crypttab entry
+ assert:
+ that: "{{ _storage_test_crypttab_entries|length == _storage_test_expected_crypttab_entries|int }}"
+ msg: "Incorrect number of crypttab entries found for volume {{ storage_test_volume.name }}"
+
+- name: Validate the format of the crypttab entry
+ assert:
+ that: "{{ _storage_test_crypttab_entries[0].split()|length >= 3 }}"
+ msg: "Incorrectly formatted crypttab line for volume {{ storage_test_volume.name }}"
+ when: _storage_test_expected_crypttab_entries|int == 1
+
+- name: Check backing device of crypttab entry
+ assert:
+ that: "{{ _storage_test_crypttab_entries[0].split()[1] == storage_test_volume._raw_device }}"
+ msg: "Incorrect backing device in crypttab entry for volume {{ storage_test_volume.name }}"
+ when: _storage_test_expected_crypttab_entries|int == 1
+
+- name: Check key file of crypttab entry
+ assert:
+ that: "{{ _storage_test_crypttab_entries[0].split()[2] == _storage_test_expected_crypttab_key_file }}"
+ msg: "Incorrect key file in crypttab entry for volume {{ storage_test_volume.name }}"
+ when: _storage_test_expected_crypttab_entries|int == 1
+
+- set_fact:
+ _storage_test_expected_crypttab_entries: null
+ _storage_test_crypttab_entries: null
+ _storage_test_expected_crypttab_key_file: null

tests/verify-role-results.yml

@@ -21,6 +21,11 @@
  register: storage_test_fstab
  changed_when: false
 
+- name: Read the /etc/crypttab file
+ command: cat /etc/crypttab
+ register: storage_test_crypttab
+ changed_when: false
+
 #
 # Verify pools and the volumes they contain.
 #
@@ -51,5 +56,6 @@
 - name: Clean up variable namespace
  set_fact:
  storage_test_fstab: null
+ storage_test_crypttab: null
  storage_test_blkinfo: null
  storage_test_volume: null