[ Version ( since = "1.49.3" ) ]
public bool clevis_luks_unlock (string device, string mapname) throws Error
open an encrypted LUKS block device with Clevis and Tang
This command opens a block device that has been encrypted according to the Linux Unified Key Setup (LUKS) standard, using network-bound disk encryption (NBDE).
device is the encrypted block device.
The appliance will connect to the Tang servers noted in the tree of Clevis pins that is bound to a keyslot of the LUKS header. The Clevis
pin tree may comprise sss (redundancy) pins as internal nodes (optionally), and tang pins as leaves. tpm2
pins are not supported. The appliance unlocks the encrypted block device by combining responses from the Tang servers with
metadata from the LUKS header; there is no key parameter.
This command will fail if networking has not been enabled for the appliance. Refer to set_network.
The command creates a new block device called /dev/mapper/mapname. Reads and writes to this block device are decrypted from and encrypted
to the underlying device respectively. Close the decrypted block device with
cryptsetup_close.
mapname cannot be "control" because that name is reserved by device-mapper.
If this block device contains LVM volume groups, then calling lvm_scan with
the activate parameter true will make them visible.
Use list_dm_devices to list all device mapper devices.
This function depends on the feature "clevisluks". See also feature_available.
| this |
A GuestfsSession object |
|
true on success, false on error |