FM / hooks

/usr/share/initramfs-tools/hooks

Name	Size	Mode	Actions
amd64_microcode	3856	0755	edit dl rm
bcache	543	0755	edit dl rm
btrfs	701	0755	edit dl rm
cloud-initramfs-dyn-netconf	118	0755	edit dl rm
console_setup	3142	0755	edit dl rm
copymods	280	0755	edit dl rm
cryptgnupg	958	0755	edit dl rm
cryptgnupg-sc	2242	0755	edit dl rm
cryptkeyctl	457	0755	edit dl rm
cryptopensc	1518	0755	edit dl rm
cryptpassdev	888	0755	edit dl rm
cryptroot	15360	0755	edit dl rm
cryptroot-unlock	1010	0755	edit dl rm
dmsetup	506	0755	edit dl rm
fixrtc	436	0755	edit dl rm
framebuffer	579	0755	edit dl rm
fsck	2109	0755	edit dl rm
fuse	231	0755	edit dl rm
intel_microcode	4944	0755	edit dl rm
iscsi	732	0755	edit dl rm
kbd	301	0755	edit dl rm
klibc-utils	646	0755	edit dl rm
kmod	432	0755	edit dl rm
linux-firmware	865	0755	edit dl rm
lvm2	691	0755	edit dl rm
mdadm	2975	0755	edit dl rm
ntfs_3g	304	0755	edit dl rm
overlayroot	732	0755	edit dl rm
plymouth	5823	0755	edit dl rm
resume	3116	0755	edit dl rm
sg3-utils	485	0755	edit dl rm
thermal	1324	0755	edit dl rm
thin-provisioning-tools	369	0755	edit dl rm
udev	1890	0755	edit dl rm
xfs	850	0755	edit dl rm
zz-busybox-initramfs	2233	0755	edit dl rm
zz-dhclient	478	0755	edit dl rm

Edit: /usr/share/initramfs-tools/hooks/cryptgnupg-sc (2242B)

#!/bin/sh

set -e

PREREQ="cryptroot"

prereqs()
{
	echo "$PREREQ"
}

case "$1" in
    prereqs)
        prereqs
        exit 0
        ;;
esac

. /usr/share/initramfs-tools/hook-functions
. /lib/cryptsetup/functions

if [ ! -x "$DESTDIR/lib/cryptsetup/scripts/decrypt_gnupg-sc" ] || [ ! -f "$TABFILE" ]; then
    exit 0
fi

# Hooks for loading gnupg software and encrypted key into the initramfs
copy_keys() {
    crypttab_parse_options
    if [ "${CRYPTTAB_OPTION_keyscript-}" = "/lib/cryptsetup/scripts/decrypt_gnupg-sc" ]; then
        if [ -f "$CRYPTTAB_KEY" ]; then
            [ -f "$DESTDIR$CRYPTTAB_KEY" ] || copy_file keyfile "$CRYPTTAB_KEY" || RV=$?
        else
            cryptsetup_message "ERROR: Target $CRYPTTAB_NAME has a non-existing key file $CRYPTTAB_KEY"
            RV=1
        fi
    fi
}

RV=0
crypttab_foreach_entry copy_keys

PUBRING="/etc/cryptsetup-initramfs/pubring.gpg"
if [ ! -f "$PUBRING" ]; then
    cryptsetup_message "WARNING: $PUBRING: No such file"
else
    [ -d "$DESTDIR/cryptroot/gnupghome" ] || mkdir -pm0700 "$DESTDIR/cryptroot/gnupghome"
    # let gpg(1) create the keyring on the fly; we're not relying on its
    # internals since it's the very same binary we're copying to the
    # initramfs
    /usr/bin/gpg --no-options --no-autostart --trust-model=always \
        --quiet --batch --no-tty --logger-file=/dev/null \
        --homedir="$DESTDIR/cryptroot/gnupghome" --import <"$PUBRING"
    # make sure not to clutter the initramfs with backup keyrings
    find "$DESTDIR/cryptroot" -name "*~" -type f -delete
fi

copy_exec /usr/bin/gpg
copy_exec /usr/bin/gpg-agent
copy_exec /usr/lib/gnupg/scdaemon
copy_exec /usr/bin/gpgconf
copy_exec /usr/bin/gpg-connect-agent

if [ ! -x "$DESTDIR/usr/bin/pinentry" ]; then
    if [ -x "/usr/bin/pinentry-curses" ]; then
        pinentry="/usr/bin/pinentry-curses"
    elif [ -x "/usr/bin/pinentry-tty" ]; then
        pinentry="/usr/bin/pinentry-tty"
    else
        cryptsetup_message "ERROR: missing required binary pinentry-curses or pinentry-tty"
        RV=1
    fi
    copy_exec "$pinentry"
    ln -s "$pinentry" "$DESTDIR/usr/bin/pinentry"
fi
[ -f "$DESTDIR/lib/terminfo/l/linux" ] || copy_file terminfo /lib/terminfo/l/linux || RV=$?

exit $RV

#!/bin/sh set -e PREREQ="cryptroot" prereqs() { echo "$PREREQ" } case "$1" in prereqs) prereqs exit 0 ;; esac . /usr/share/initramfs-tools/hook-functions . /lib/cryptsetup/functions if [ ! -x "$DESTDIR/lib/cryptsetup/scripts/decrypt_gnupg-sc" ] || [ ! -f "$TABFILE" ]; then exit 0 fi # Hooks for loading gnupg software and encrypted key into the initramfs copy_keys() { crypttab_parse_options if [ "${CRYPTTAB_OPTION_keyscript-}" = "/lib/cryptsetup/scripts/decrypt_gnupg-sc" ]; then if [ -f "$CRYPTTAB_KEY" ]; then [ -f "$DESTDIR$CRYPTTAB_KEY" ] || copy_file keyfile "$CRYPTTAB_KEY" || RV=$? else cryptsetup_message "ERROR: Target $CRYPTTAB_NAME has a non-existing key file $CRYPTTAB_KEY" RV=1 fi fi } RV=0 crypttab_foreach_entry copy_keys PUBRING="/etc/cryptsetup-initramfs/pubring.gpg" if [ ! -f "$PUBRING" ]; then cryptsetup_message "WARNING: $PUBRING: No such file" else [ -d "$DESTDIR/cryptroot/gnupghome" ] || mkdir -pm0700 "$DESTDIR/cryptroot/gnupghome" # let gpg(1) create the keyring on the fly; we're not relying on its # internals since it's the very same binary we're copying to the # initramfs /usr/bin/gpg --no-options --no-autostart --trust-model=always \ --quiet --batch --no-tty --logger-file=/dev/null \ --homedir="$DESTDIR/cryptroot/gnupghome" --import <"$PUBRING" # make sure not to clutter the initramfs with backup keyrings find "$DESTDIR/cryptroot" -name "*~" -type f -delete fi copy_exec /usr/bin/gpg copy_exec /usr/bin/gpg-agent copy_exec /usr/lib/gnupg/scdaemon copy_exec /usr/bin/gpgconf copy_exec /usr/bin/gpg-connect-agent if [ ! -x "$DESTDIR/usr/bin/pinentry" ]; then if [ -x "/usr/bin/pinentry-curses" ]; then pinentry="/usr/bin/pinentry-curses" elif [ -x "/usr/bin/pinentry-tty" ]; then pinentry="/usr/bin/pinentry-tty" else cryptsetup_message "ERROR: missing required binary pinentry-curses or pinentry-tty" RV=1 fi copy_exec "$pinentry" ln -s "$pinentry" "$DESTDIR/usr/bin/pinentry" fi [ -f "$DESTDIR/lib/terminfo/l/linux" ] || copy_file terminfo /lib/terminfo/l/linux || RV=$? exit $RV