Initial implementation

README

@@ -0,0 +1,3 @@
+uuidgen > challenge
+ykchalresp $(cat challenge)
+cryptsetup luksAddKey /dev/sda2

helper

@@ -0,0 +1,28 @@
+#! /bin/sh
+
+set -e
+set -x
+
+R="$(ykchalresp "$(cat /etc/yubikey-challenge)" 2>/dev/null || true )"
+if [ -z "$R" ]; then
+    echo "Please insert yubikey or press enter to use password unlocking" >&2
+    read a
+    R="$(ykchalresp "$(cat /etc/yubikey-challenge)" 2>/dev/null || true)"
+fi
+
+if [ -z "$R" ]; then
+    cryptkey="Unlocking the disk $cryptsource ($crypttarget)\nEnter passphrase: "
+    if [ -x /bin/plymouth ] && plymouth --ping; then
+	cryptkeyscript="plymouth ask-for-password --prompt"
+	cryptkey=$(echo -e "$cryptkey")
+    else
+	cryptkeyscript="/lib/cryptsetup/askpass"
+    fi
+    exec $cryptkeyscript "$cryptkey"
+fi
+
+mkdir -p /dev/.run/ykfde
+chmod 700 /dev/.run/ykfde
+echo "$R" > /dev/.run/ykfde/secret
+echo "$cryptsource" > /dev/.run/ykfde/cryptsource
+echo -n "$R"

hook

@@ -0,0 +1,26 @@
+#!/bin/sh
+
+set -e
+
+PREREQ="cryptroot"
+
+prereqs()
+{
+	echo "$PREREQ"
+}
+
+case $1 in
+prereqs)
+	prereqs
+	exit 0
+	;;
+esac
+
+. /usr/share/initramfs-tools/hook-functions
+
+copy_exec /usr/bin/ykchalresp
+cat > ${DESTDIR}/etc/yubikey-challenge <<EOF
+f5ef03d4-9148-452d-99f0-4ad09d73e234
+EOF
+cp /home/tfheen/src/ykfde/helper "${DESTDIR}/sbin/ykfde-keyscript"
+exit 0

script

@@ -0,0 +1,23 @@
+#! /bin/sh
+
+set -e
+
+PREREQ=""
+
+prereqs()
+{
+	echo "$PREREQ"
+}
+
+case $1 in
+# get pre-requisites
+prereqs)
+	prereqs
+	exit 0
+	;;
+esac
+
+if [ -e /etc/yubikey-challenge ]; then
+    sed -i 's|$|,keyscript=/sbin/ykfde-keyscript|' /conf/conf.d/cryptroot
+fi
+exit 0