> > ah, I see, it is using getpass(3) if no keyfile has been > > specified. Hmm, after having a glance at the source code, > > the easiest thing seems to patch the source to accept > > a new command-line option to specify a different input fd. > > The rest of the code (lib/setup.c:get_key(), most importantly) > > should work without a change. > > maybe then the best would be to add support for a --timeout option, > instead of supporting another (insecure) input fd. The advantage of the fd patch is that it would be rather minimal - the support in setup.c:get_key() is already there (dealing with an arbitrary fd, and calling getpass() only if isatty() succeeds), I would only add a few lines to the main() method. But I agree with you that cryptsetup should support some sort of timeout mechanism internally. Supporting arbitrary fds for input would just make inclusion of cryptsetup a lot easier, and getpass() isn't any safer than a read() on a given fd. > > Shall I try to wrap something up? > > if you like, that would be great. i've not much experiences with coding > c(++). No problem. I'll do both (fd / timeout), so you can have a look at them and decide. Btw, have you talked to upstream about this? What is his opinion? Regards, Jan -- Jan C. Nordholz <jckn At gmx net>
Attachment:
signature.asc
Description: Digital signature