cryptloop

#!/bin/sh
set -eu

with_new_cryptmapper() {
    image=$1 &&
    name=$2 &&
    shift 2 &&
    cryptsetup -v luksFormat "$image" &&
    cryptsetup open "$image" "$name" &&
    {
        "$@" && :
        : ${err=$?}
        cryptsetup close "$name" && :
        return $err
    }
}

try_cryptsetup() {
    image=$1 &&
    name=$2 &&
    shift 2 &&
    cryptsetup open "$image" "$name" &&
    if "$@"; then
        return
    else
        : ${err=$?}
        cryptsetup close "$name" && :
        return $err
    fi
}

# generate a name based on the image's true path;
# here we break the string into several pieces for compatibility reasons (some
# shells don't seem to handle nested backtick and/or quotes properly)
image_to_name() {
    dir=`dirname "$image"`
    base=`basename "$image"`
    dir=`cd "$dir" && pwd -P`
    name=`printf '%s' "$dir/$base" | md5sum | cut -f 1 -d " "`
}

create() {
    if [ $# -lt 2 ] || [ $# -gt 3 ]; then
        usage
    fi &&
    image=$1 &&
    size=$2 &&
    fs=${3-ext4} &&
    image_to_name &&
    dd if=/dev/urandom ibs=1024k obs=1024k | dd bs=1024k of="$image" count="$size" &&
    with_new_cryptmapper "$image" "$name" \
        "mkfs.$fs" "/dev/mapper/$name"
}

do_mount() {
    mount "/dev/mapper/$1" "$2" &&
    printf "%s\n" "$2" >"${rundir}/$1.mount"
}

open() {
    if [ $# -ne 2 ]; then
        usage
    fi &&
    image=$1 &&
    mount=$2 &&
    if ! modprobe loop; then
        : ${err=$?}
        cat >&2 <<EOF && :
$prog: can't load kernel module
$prog: are you root? or have you upgraded the kernel recently?
EOF
        return $err
    fi &&
    image_to_name &&
    if [ -f "${rundir}/${name}.mount" ]; then
    cat >&2 <<EOF && :
$prog: already opened
EOF
        return 1
    fi &&
    mkdir -p -m 700 "$rundir" &&
    try_cryptsetup "$image" "$name" \
        do_mount "$name" "$mount"
}

close() {
    if [ $# -ne 1 ]; then
        usage
    fi &&
    image=$1 &&
    image_to_name &&
    if [ ! -f "${rundir}/${name}.mount" ]; then
        cat >&2 <<EOF && :
$prog: not opened
EOF
        return 1
    fi
    mount=`cat "${rundir}/${name}.mount"` && {
        umount "$mount" && :
        : ${err=$?}
        cryptsetup close "$name" && :
        : ${err=$?}
        rm -f "${rundir}/${name}.mount" && :
        : ${err=$?}
        return $err
    }
}

usage() {
    cat >&2 <<EOF
usage:

  $prog create <image> <size-MiB> [<filesystem>]
  $prog open <image> <mount>
  $prog close <image>

EOF
    exit 1;
}

unset err
prog=`basename "$0"`

if [ "`id -u`" -ne 0 ]; then
    # the 'create' subcommand will fail halfway if not run as root
    cat >&2 <<EOF
$prog: must be run as root
EOF
   exit 1
fi

if [ "x${XDG_RUNTIME_DIR+y}" = x ]; then
    cat >&2 <<EOF
$prog: XDG_RUNTIME_DIR must be set
EOF
    exit 1
fi

rundir=$XDG_RUNTIME_DIR/cryptloop

if [ $# -lt 1 ]; then
    usage
fi

case $1 in
    create|open|close) "$@";;
    *) usage;;
esac