Kyle Isom
ce10c41466
unlock: decrypts a LUKS volume without mounting. Idempotent — reports existing cleartext device if already unlocked. lock: locks a LUKS volume. If mounted, unmounts first (udisks2 with privileged fallback) then locks. Idempotent — reports if already locked. Both commands support alias completion and config resolution. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
69 lines
1.7 KiB
Go
69 lines
1.7 KiB
Go
package cmd
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"git.wntrmute.dev/kyle/arca/internal/config"
|
|
"git.wntrmute.dev/kyle/arca/internal/cryptsetup"
|
|
"git.wntrmute.dev/kyle/arca/internal/udisks"
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
var lockCmd = &cobra.Command{
|
|
Use: "lock <device|alias>",
|
|
Short: "Lock a LUKS volume without unmounting",
|
|
Long: "Locks (closes) a LUKS volume. If the volume is mounted, it will be unmounted first.",
|
|
Args: cobra.ExactArgs(1),
|
|
RunE: runLock,
|
|
ValidArgsFunction: completeDeviceOrAlias,
|
|
}
|
|
|
|
func init() {
|
|
rootCmd.AddCommand(lockCmd)
|
|
}
|
|
|
|
func runLock(cmd *cobra.Command, args []string) error {
|
|
cfg := config.Load()
|
|
target := args[0]
|
|
|
|
client, err := udisks.NewClient()
|
|
if err != nil {
|
|
return fmt.Errorf("connecting to udisks2: %w", err)
|
|
}
|
|
defer client.Close()
|
|
|
|
devCfg := cfg.ResolveDevice(target)
|
|
|
|
dev, err := client.FindDevice(devCfg.UUID, target)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// Check if already locked.
|
|
cleartext, err := client.CleartextDevice(dev)
|
|
if err != nil {
|
|
fmt.Fprintf(cmd.ErrOrStderr(), "%s is already locked\n", target)
|
|
return nil
|
|
}
|
|
|
|
// If mounted, unmount first — can't lock a mounted device.
|
|
if mp, mounted := client.IsMounted(cleartext); mounted {
|
|
if err := client.Unmount(cleartext); err != nil {
|
|
if err := cryptsetup.Unmount(mp); err != nil {
|
|
return fmt.Errorf("unmounting before lock: %w", err)
|
|
}
|
|
}
|
|
}
|
|
|
|
// Lock: try udisks2 first, fall back to cryptsetup close.
|
|
if err := client.Lock(dev); err != nil {
|
|
mapperName := cryptsetup.MapperName(dev.DevicePath)
|
|
if err := cryptsetup.Close(mapperName); err != nil {
|
|
return fmt.Errorf("locking: %w", err)
|
|
}
|
|
}
|
|
|
|
fmt.Printf("Locked %s\n", target)
|
|
return nil
|
|
}
|