xCAT/confluent
2
0
Fork 0
mirror of https://github.com/xcat2/confluent.git synced 2024-11-22 01:22:00 +00:00
Code Issues Projects Releases Wiki Activity

Remove luks password from argv

Browse Source 
Pass the luks password by environment variable instead.
This commit is contained in:
Jarrod Johnson 2024-07-26 14:07:54 -04:00
parent 7a602f58b2
commit 2df902e80e
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
confluent_osdeploy/ubuntu22.04/profiles/default/scripts/addcrypt
View File

@ -1,11 +1,11 @@
import yaml
import sys
import os
ainst = {}
with open('/autoinstall.yaml', 'r') as allin:
ainst = yaml.safe_load(allin)
ainst['storage']['layout']['password'] = sys.argv[1]
ainst['storage']['layout']['password'] = os.environ['lukspass']
with open('/autoinstall.yaml', 'w') as allout:
yaml.safe_dump(ainst, allout)

3
confluent_osdeploy/ubuntu22.04/profiles/default/scripts/pre.sh
View File

@ -42,7 +42,8 @@ fi
sed -i s!%%INSTALLDISK%%!/dev/$(cat /tmp/installdisk)! /autoinstall.yaml
if [ "$cryptboot" != "" ] && [ "$cryptboot" != "none" ] && [ "$cryptboot" != "null" ]; then
lukspass=$(head -c 66 < /dev/urandom |base64 -w0)
run_remote_python addcrypt "$lukspass"
export lukspass
run_remote_python addcrypt
if ! grep 'password:' /autoinstall.yaml > /dev/null; then
echo "****Encrypted boot requested, but the user-data does not have a hook to enable,halting install" > /dev/console
[ -f '/tmp/autoconsdev' ] && (echo "****Encryptod boot requested, but the user-data does not have a hook to enable,halting install" >> $(cat /tmp/autoconsdev))