58e13cd079
* Prevent empty drive encryption passwords * Use sudo, quote the confirmation compare, and cover mismatches in test The unquoted [[ $new_password == $confirmation ]] made the confirmation a glob pattern, so a confirmation like * matched any password. And pkexec brought nothing over the repo-standard sudo here while failing outright in sessions without a polkit agent. Verified against a loopback LUKS device: new key lands from stdin without a trailing newline while the current passphrase is prompted on the tty. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: mplaczek99 <mplaczek99@gmail.com> Co-authored-by: David Heinemeier Hansson <david@hey.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
33 lines
1.2 KiB
Bash
Executable File
33 lines
1.2 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# omarchy:summary=Set a new encryption password for a drive selected.
|
|
# omarchy:requires-sudo=true
|
|
|
|
encrypted_drives=$(blkid -t TYPE=crypto_LUKS -o device)
|
|
|
|
if [[ -n $encrypted_drives ]]; then
|
|
if (( $(wc -l <<<"$encrypted_drives") == 1 )); then
|
|
drive_to_change="$encrypted_drives"
|
|
else
|
|
drive_to_change="$(omarchy-drive-select "$encrypted_drives")"
|
|
fi
|
|
|
|
if [[ -n $drive_to_change ]]; then
|
|
new_password=$(gum input --password --header "New encryption password") || exit 1
|
|
[[ -n $new_password ]] || { echo "Password cannot be empty."; exit 1; }
|
|
|
|
confirmation=$(gum input --password --header "Confirm new encryption password") || exit 1
|
|
[[ $new_password == "$confirmation" ]] || { echo "Passwords do not match."; exit 1; }
|
|
|
|
echo "Changing full-disk encryption password for $drive_to_change"
|
|
# The new key travels over stdin and reaches cryptsetup as a keyfile via
|
|
# <(cat), leaving the tty free for the current-passphrase prompt.
|
|
printf "%s" "$new_password" | sudo bash -c 'exec cryptsetup luksChangeKey --pbkdf argon2id --iter-time 2000 "$1" <(cat) </dev/tty' bash "$drive_to_change"
|
|
else
|
|
echo "No drive selected."
|
|
fi
|
|
else
|
|
echo "No encrypted drives available."
|
|
exit 1
|
|
fi
|