debian-luks-suspend

#!/bin/bash 

set -u
trap 'echo "Press ENTER to continue."; read dummy' ERR

INITRAMFS_DIR="/run/initramfs/"
INITRAMFS_DIR_ORIG=${INITRAMFS_DIR}
SYSTEM_SLEEP_PATH=/lib/systemd/system-sleep
SYSTEM_SLEEP_BINARY=/lib/systemd/systemd-sleep
SUSPEND_SCRIPT=bin/encrypt-on-suspend
BIND_PATHS="/sys /proc /dev /run"
REMOUNT=0
CRYPTNAME="$(pvdisplay -C -o pv_name --noheadings | tr -d ' ' | cut -d\/ -f4)"
CHROOT_ARGS=""

# run_dir DIR ARGS...
# Run all executable scripts in directory DIR with arguments ARGS
run_dir() {
    local dir=$1
    shift
    find "${dir}" -type f -executable -exec "{}" "$@" ";"
}

ext4_cryptdevice_mount_options() {
    local mt="$(grep "^${1} " /proc/mounts | cut -d ' ' -f 3,4)"
    if [[ "${mt:0:5}" == "ext4 " ]]; then
        echo "${mt:5}"
    fi
}

mount_initramfs() {
    local INITRAMFS=$1

    mounted=`mount | grep $INITRAMFS_DIR`
    if [[ $? -eq 0 ]] ; then
        return
    fi
    
    if [[ ! -e "$INITRAMFS_DIR" ]] ; then
        mkdir "$INITRAMFS_DIR"
        chmod 700 "$INITRAMFS_DIR"
    fi

    mount -t tmpfs -o size=512m tmpfs ${INITRAMFS_DIR}

    unmkinitramfs "${INITRAMFS}" "${INITRAMFS_DIR}"
    if [[ -d ${INITRAMFS_DIR}/main ]] ; then
        INITRAMFS_DIR_ORIG=${INITRAMFS_DIR}
        INITRAMFS_DIR=${INITRAMFS_DIR}/main
    fi

    for p in ${BIND_PATHS}; do
        mkdir -p "${INITRAMFS_DIR}${p}"
        mount -o bind ${p} "${INITRAMFS_DIR}${p}"
    done
}

unmount_initramfs() {
    if [[ "${INITRAMFS_DIR_ORIG}" != "${INITRAMFS_DIR}" ]] ; then
        INITRAMFS_DIR=${INITRAMFS_DIR_ORIG}
    fi
    umount -R ${INITRAMFS_DIR}
}

service_is_running() {
    systemctl is-active --quiet "$1"
    echo $?
}

parse_command_line() {
    for i in "$@" ; do
        case $i in
            -g|--gui)
                CHROOT_ARGS=" -g"
            ;;
        esac
    done
}

## Main script
loginctl lock-sessions
parse_command_line "$@"

# parse boot command line into $kernel_cmdline
declare -A kernel_cmdline
for x in $(cat /proc/cmdline) ; do
    kernel_cmdline[$(echo $x | cut -f1 -d=)]=$(echo $x | cut -f2 -d=)
done

# clean up the terminal if a quiet console is requested
[[ -n "${kernel_cmdline[quiet]+x}" ]] && TERM=linux clear

# Retrieve cryptdevice name from boot command line
ROOT_CRYPT_DEVICE=${kernel_cmdline[root]}

# extract initramfs to switch to during suspend
INITRAMFS=`echo "/boot/${kernel_cmdline[BOOT_IMAGE]//vmlinuz/initrd.img}"`
mount_initramfs $INITRAMFS

[ -e "${INITRAMFS_DIR}/$SUSPEND_SCRIPT" ] || exec $SYSTEM_SLEEP_BINARY suspend

# Run pre-suspend scripts
run_dir "${SYSTEM_SLEEP_PATH}" pre suspend

# Stop udev service and prevent it to be autostarted.
# Otherwise, luksResume will hang waiting for udev, which is itself waiting
# for I/O on the root device.
bluetooth_state=`service_is_running bluetooth`

if [ $bluetooth_state -eq 0 ] ; then
    systemctl stop bluetooth
fi

systemctl stop NetworkManager-dispatcher
systemctl stop NetworkManager

systemctl stop systemd-udevd-control.socket
systemctl stop systemd-udevd-kernel.socket
systemctl stop systemd-udevd.service

# Journalled ext4 filesystems in kernel versions 3.11+ will block suspend
# if mounted with `barrier=1`, which is the default. Temporarily remount with
# `barrier=0` if this is true of the crypt fs.
MOUNT_OPTS="$(ext4_cryptdevice_mount_options "$ROOT_CRYPT_DEVICE")"
if [[ "$MOUNT_OPTS" ]] && ! [[ "$MOUNT_OPTS" == *nobarrier* || "$MOUNT_OPTS" == *barrier=0* ]]; then
    REMOUNT=1
    mount -o remount,"$MOUNT_OPTS",barrier=0 /
fi

# If we have a kernel that supports manual sync before suspend, enable it
[ -e /sys/power/sync_on_suspend ] && echo "0" > /sys/power/sync_on_suspend

# Hand over execution to script inside initramfs
# Nice it to help reduce race conditions
(cd "${INITRAMFS_DIR}" && nice -n -20 chroot . /$SUSPEND_SCRIPT $CRYPTNAME $CHROOT_ARGS)

[ -e /sys/power/sync_on_suspend ] && echo "1" > /sys/power/sync_on_suspend

# Restore original mount options if necessary
if ((REMOUNT)); then
    mount -o remount,"$MOUNT_OPTS",barrier=1 /
fi

# Quit the temporary udev process from the chroot
udevadm control --exit

# Restart services
systemctl start systemd-udevd-control.socket
systemctl start systemd-udevd-kernel.socket
systemctl start systemd-udevd.service

systemctl start NetworkManager
systemctl start NetworkManager-dispatcher

if [ $bluetooth_state -eq 0 ] ; then
    systemctl start bluetooth
fi

# Run post-suspend scripts
run_dir "${SYSTEM_SLEEP_PATH}" post suspend

unmount_initramfs

# Unlock user sessions
loginctl unlock-sessions