diff --git a/src/meson.build b/src/meson.build index 09c3d2c..fa1bb45 100644 --- a/src/meson.build +++ b/src/meson.build @@ -2,13 +2,16 @@ main = find_program('zlevis') encrypt = find_program('zlevis-encrypt') decrypt = find_program('zlevis-decrypt') +fetch = find_program('zlevis-fetch') # Test the scripts test('zlevis', main, args: '--summary') test('zlevis-encrypt', encrypt, args: '--summary') test('zlevis-decrypt', decrypt, args: '--summary') +test('zlevis-fetch', fetch, args: '--summary') # Add paths of scripts to bins bins += join_paths(meson.current_source_dir(), 'zlevis') bins += join_paths(meson.current_source_dir(), 'zlevis-encrypt') -bins += join_paths(meson.current_source_dir(), 'zlevis-decrypt') \ No newline at end of file +bins += join_paths(meson.current_source_dir(), 'zlevis-decrypt') +bins += join_paths(meson.current_source_dir(), 'zlevis-fetch') \ No newline at end of file diff --git a/src/zlevis-fetch b/src/zlevis-fetch new file mode 100755 index 0000000..39c8d0f --- /dev/null +++ b/src/zlevis-fetch @@ -0,0 +1,37 @@ +#!/bin/sh + +# Exit immediately if a command exits with a non-zero status +set -e + +# Summary of the script's functionality +summary="Decrypts a ZFS root pool with a TPM2.0 chip." + +# Display summary if requested +if [ "$1" = "--summary" ]; then + echo "$summary" + exit 0 +fi + +# Check if zlevis-decrypt is present +if ! command -v zlevis-decrypt > /dev/null; then + echo "Script zlevis-decrypt is not present" + exit 1 +fi + +# Read ZFS dataset information. +zfs list -Ho name,encryption,keystatus,encryptionroot,tpm:jwe | while IFS=$'\t' read -r ds enc keystatus encroot jwe; do + # Check if the dataset is the encryption root. + if [ "$ds" = "$encroot" ] && [ "$enc" != "off" ] && [ "$jwe" != "-" ]; then + if [ "$keystatus" = "available" ]; then + echo "Pool $ds already unlocked" + else + echo "Loading key for $ds" + if echo -n "$jwe" | zlevis-decrypt | zfs load-key -L prompt "$ds"; then + echo "Unlocked $ds" + else + echo "Failed to unlock $ds" >&2 + exit 1 + fi + fi + fi +done