echo "

exit 1

b_deps "head" "cryptsetup" "qvm-prefs" "qvm-block" "qvm-check" "losetup" \

"df" "mktemp" "mkfs" "chmod" "readlink"

local vmDeps="cryptsetup

b_dom0_setVMDeps "$vmDeps"

local sourceFile="$1"

if [ -f "$sourceFile" ] ; then

local out=""

out="$(losetup -j "$sourceFile")" || exit 9

[ -z "$out" ] && exit 0 || exit 7

elif [ -b "$sourceFile" ] ; then

exit 8

#error

exit 9

local vm="$1"

local keyId="$2"

local vmUser=""

vmUser="$(qvm-prefs "$vm" default_user)" || { B_ERR="Failed to retrieve the default user for the VM $vm." ; B_E ; }

echo "${QCRYPT_KEYS/#~/\/home\/$vmUser}/$keyId"

b_args_init 0 "--mp" 1 "--inj" 2 "--size" 1 "--wd" 1 "--ks" 1 "--bak" 1 "--fs" 1 "--enkey" 1 "--encon" 1 "--cy" 2 "--keystore" 1

b_args_setOptionParamSeparator "<aosep>"

b_args_parse "$@"

assertCorrectParams

local ind="${1:-2}"

local fb="$2"

local ret=

local file=

file="$(b_args_get "$ind" "$fb")" || { ret=$? ; echo "$file" ; return $ret ; }

if [ -n "$file" ] ; then

readlink -m "$file" || { B_ERR="Failed to canonicalize the file: $file" ; B_E ; }

return 0

local cmd="$(b_args_get 0)"

local numArgs="$(b_args_getCount)"

local numOpts="$(b_args_getOptionCount)"

case "$cmd" in

"open")

b_args_assertOptions "-a" "--mp" "--inj" "--ro" "--cy"

;;

"luksInit")

#NOTE: we must also check for the supported luksFormat options here

b_args_assertOptions "-a" "--size" "--wd" "--ks" "--bak" "--fs" "--enkey" "--encon" "--cy" "--keystore"

;;

"close")

b_args_assertOptions "--sd" "--force"

;;

"status")

[ $numArgs -eq 1 ] && [ $numOpts -eq 0 ] && return 0

b_args_assertOptions "--mp"

;;

*)

usage

;;

[ $numArgs -lt 5 ] && usage

local keyId="$(b_args_get 3)"

local keyRegex='^[0-9a-zA-Z_+.-]+$'

[[ "$keyId" =~ $keyRegex ]] || { B_ERR="The given key ID $keyId appears to be invalid." ; B_E ; }

local i=

for ((i=0;i<$numArgs;i++)) ; do

[ -z "$(b_args_get $i)" ] && B_ERR="Found argument #$(($i +1)) to be empty." && B_E

return 0

local state=""

local ret=

state="$(b_args_parse "status" "$@" ; statusSingleC)"

ret=$?

[[ "$state" == *"ERROR"* ]] && B_ERR="Failed to retrieve the chain state."$'\n'"$state" && B_E

[ $ret -eq 0 ] && B_ERR="The chain is already open." && B_E

local re='device mounted:[[:space:]]+no'

[[ ! "$state" =~ $re ]] && B_ERR="The chain appears to be mounted. Overall state:"$'\n'"$state" && B_E

local reAttached='device attached:[[:space:]]+no'

local reDecrypted='device decrypted:[[:space:]]+no'

local devAttachedNoCnt=0

local devDecryptedCnt=0

while b_readLine ; do

if [[ "$B_LINE" =~ $reAttached ]] ; then

(( devAttachedNoCnt++ ))

elif [[ "$B_LINE" =~ $reDecrypted ]] ; then

(( devDecryptedCnt++ ))

fi

done <<< "$state"

local numDest=$(( $# - 3 ))

if [ $devAttachedNoCnt -eq $numDest ] && [ $devDecryptedCnt -eq $numDest ] ; then

return 0

B_ERR="The chain is partially open. Please --force close it first. Overall state:"$'\n'"$state"

B_E

local mapName="$1"

declare -A ret=()

local i=0

local vm=

local par=

while b_args_getOption "--cy" "" "$i" > /dev/null ; do

vm="$(b_args_getOption "--cy" "" "$i" 0)" || { B_ERR="Failed to retrieve the VM for the cryptsetup option $i." ; B_E ; }

par="$(b_args_getOption "--cy" "" "$i" 1)" || { B_ERR="Failed to retrieve the parameter for the cryptsetup option $i." ; B_E ; }

b_arr_contains "$vm" "$@" || { B_ERR="The cryptsetup option VM $vm is not part of the destination VMs." ; B_E ; }

#NOTE: we don't escape here as the user is allowed to concatenate parameters himself --> he needs to escape himself (but cryptsetup appears to have almost no options that might require escaping)

ret["$vm"]="${ret["$vm"]} $par"

i=$(($i +1))

ret="$(declare -p ret 2> /dev/null)"

echo "${ret/declare -A ret/declare -A $mapName}"

DSTS=()

local i=

local numArgs="$(b_args_getCount)"

for ((i=4;i<$numArgs;i++)) ; do

DSTS+=("$(b_args_get "$i")")

return 0

local vm="$1"

local keyId="$2"

local storeDir="$3"

initKeysModule "$storeDir"

b_keys_get "${vm}_$keyId"

local vm="$1"

local keyId="$2"

local storeDir="$3"

b_execFuncAs "root" "retrieveFromKeyStore_root" "fs" "multithreading/mtx" "dmcrypt" "keys" - - "$@" || { B_ERR="Failed to retrieve the key $keyId for the VM $vm from the key store $storeDir." ; B_E ; }

local rwFlag=0

local autostart=1

declare -A injections

local sourceVM="$(b_args_get 1)"

local sourceFile=

sourceFile="$(getCanonicalFileParameter)" || { B_ERR="Failed to canonicalize the source file parameter." ; B_E ; }

local keyId="$(b_args_get 3)"

parseDestinations

b_args_getOption "-a" > /dev/null && autostart=0

b_args_getOption "--ro" > /dev/null && rwFlag=1

local mountPoint="$(b_args_getOption "--mp")"

local i=0

local injTarget=

local injKey=

while b_args_getOption "--inj" "" "$i" > /dev/null ; do

injTarget="$(b_args_getOption "--inj" "" "$i" 0)" || { B_ERR="Failed to retrieve the target VM for the injection $i." ; B_E ; }

injKey="$(b_args_getOption "--inj" "" "$i" 1)" || { B_ERR="Failed to retrieve the key for the injection $i." ; B_E ; }

b_arr_contains "$injTarget" "${DSTS[@]}" || { B_ERR="The injection VM $injTarget is not part of the destination VMs." ; B_E ; }

if [[ "$injKey" == "keystore://"* ]] ; then

local storeDir="${injKey#keystore:/}"

injKey="$(retrieveFromKeyStore "$injTarget" "$keyId" "$storeDir")" || { B_ERR="Could not resolve injection: Failed to retrieve the key $keyId for the VM $injTarget from the key store $storeDir." ; B_E ; }

fi

injections["$injTarget"]="$injKey"

[ -f "$injKey" ] || { B_ERR="No such file: $injKey" ; B_E ; }

i=$(($i +1))

local coptStr=

coptStr="$(parseCryptsetupParams "copt" "${DSTS[@]}")" || { B_ERR="Failed to parse the cryptsetup parameters." ; B_E ; }

eval "$coptStr" || { B_ERR="Programming error?!" ; B_E ; }

b_info "Checking whether the chain is fully closed..."

b_setErrorHandler 'b_defaultErrorHandler 1 1 1'

ensureClosed "$sourceVM" "$sourceFile" "$keyId" "${DSTS[@]}"

b_resetErrorHandler 1

if [[ "$B_ERR" == "The chain is already open." ]] ; then

b_info "$B_ERR Nothing to do."

B_ERR=""

return 0

B_E

if [ $autostart -eq 0 ] ; then

b_info "Starting the VMs $sourceVM ${DSTS[*]}..." 0 1

b_dom0_ensureRunning "$sourceVM" "${DSTS[@]}"

b_info "Done." 1 0

#check source & dest and only autostart intermediate VMs

b_dom0_isRunning "$sourceVM" "${DSTS[-1]}"

declare -a interm=("${DSTS[@]::${#DSTS[@]}-1}")

if [ ${#interm[@]} -gt 0 ] ; then

b_info "Starting the intermediate VMs ${interm[*]}..." 0 1

b_dom0_ensureRunning "${interm[@]}"

b_info "Done." 1 0

fi

b_info "Preparing the source VM ${sourceVM}..."

b_silence b_dom0_execFuncIn "$sourceVM" "" "getSourceDeviceType" - - "$sourceFile"

case $? in

0)

#all good

;;

7)

#existing loop device

b_dom0_removeUnusedLoopDevice "$sourceVM" "$sourceFile" 1 || { B_ERR="$sourceFile inside $sourceVM is either in use by Qubes OS or by the VM itself. Please check qvm-block ls. Backing off..." ; B_E ; }

#all good

;;

*)

B_ERR="Failed to identify the source device type or the source is in an invalid state. Maybe the file doesn't exist?!"

B_E

local toCreate="$sourceFile"

sourceFile="$(b_dom0_createLoopDeviceIfNecessary "$sourceVM" "$toCreate")" || { B_ERR="Failed to create a loop device for the file $toCreate in the VM $sourceVM." ; B_E ; }

local injTarget=""

local injKey=""

local keyPath=""

for injTarget in "${!injections[@]}" ; do

injKey="${injections["$injTarget"]}"

keyPath="$(getKeyPath "$injTarget" "$keyId")"

b_info "Injecting the dom0 key $injKey into the VM $injTarget ($keyPath)..." 0 1

local ret=2

b_setBE 1

#NOTE: we never overwrite!

b_dom0_copy "$injKey" "$injTarget" "$keyPath" 1 1 2> /dev/null

ret=$?

b_resetErrorHandler 1

if [ $ret -eq 0 ] ; then

b_info "Done." 1 0

else

if [[ "$B_ERR" == *"blib_dom0_copyPrepareTarget failed"* ]] ; then

#ignore errors caused due to existing files

B_ERR=""

b_info "Likely injected before." 1 0

else

b_info "Failed." 1 0

B_E

fi

fi

local attachFrom="$sourceVM"

local attachFromDevice="$sourceFile"

local mpTo=""

local mapperName="$keyId"

local i=

local lastInd=$(( ${#DSTS[@]} -1 ))

for ((i=0;i<=$lastInd;i++)) ; do

local attachTo="${DSTS[$i]}"

local attachToDevice=""

[ $i -eq $lastInd ] && mpTo="$mountPoint" || mpTo=""

b_info "Attaching to ${attachTo}..."

attachToDevice="$(b_dom0_crossAttachDevice "$attachFrom" "$attachFromDevice" "$attachTo" "$rwFlag")" || { B_ERR="Failed to attach the device $attachFromDevice from the VM $attachFrom to the VM $attachTo." ; B_E ; }

keyPath="$(getKeyPath "$attachTo" "$keyId")" || { B_ERR="Failed to retrieve the key file path inside the VM $attachTo for the key ID $keyId." ; B_E ; }

#NOTE: we use the key ID as device mapper name

b_info "Decrypting inside ${attachTo}..."

#shellcheck disable=SC2154

b_dom0_openCrypt "$attachTo" "$attachToDevice" "$mapperName" "$rwFlag" "$mpTo" "$keyPath" "${copt["$attachTo"]}" || { B_ERR="Failed to decrypt the device $attachToDevice inside the VM $attachTo using the key file $keyPath." ; B_E ; }

#special case: last run

if [ $i -eq $lastInd ] ; then

[ -n "$mpTo" ] && b_info "Mounted the decrypted data to: $mpTo"

else

#update vars

#NOTE: unfortunately /dev/mapper/xyz is a symlink to /dev/dm-[0-9]+ and Qubes only accepts the latter to identify the backend --> we need to find that name from qvm-block

#example for /dev/mapper/foo:

#testing-vm:dm-2 foo

local qvmBlockInfo=""

qvmBlockInfo="$(b_dom0_parseQvmBlock "map")" || { B_ERR="Failed to parse qvm-block ls." ; B_E ; }

attachFromDevice="$(b_dom0_getQvmBlockInfo "$qvmBlockInfo" "device id" "backend" "$attachTo" "description" "$mapperName" "frontend-dev" "")" || { B_ERR="Failed to find the correct backend device ID for the mapper $mapperName inside the VM $attachTo. qvm-block output:"$'\n'"$(qvm-block ls)" ; B_E ; }

attachFrom="$attachTo"

fi

b_info "Open done."

return 0

local vm="$1"

local file="$2"

local fileEsc=""

printf -v fileEsc '%q' "$file"

local cmd="[ -e $fileEsc ] && exit 5 || exit 0"

local ret=-1

b_silence b_dom0_qvmRun "$vm" "$cmd"

ret=$?

[ $ret -eq 5 ] && B_ERR="There already appears to exist a file named $file in the VM $vm. Will not overwrite." && B_E

[ $ret -ne 0 ] && B_ERR="Failed to execute a command in the VM $vm." && B_E

return 0

local dir="$1"

local req="$2"

local avail=""

avail="$(df -B1 --output=avail "$dir")" || { B_ERR="Failed to run df on the directory $dir." ; B_E ; }

while b_readLine ; do

[[ "$B_LINE" =~ ^([0-9]+) ]] && avail="${BASH_REMATCH[1]}" && break

done <<< "$avail"

[ $avail -gt $req ]

local sourceVM="$(b_args_get 1)"

local sourceFile=

sourceFile="$(getCanonicalFileParameter)" || { B_ERR="Failed to canonicalize the source file parameter." ; B_E ; }

local keyId="$(b_args_get 3)"

parseDestinations

local autostart=1

b_args_getOption "-a" > /dev/null && autostart=0

local size="$(b_args_getOption "--size" "1073741824")"

size="$(b_fs_parseSize "$size")" || { B_ERR="Failed to parse the --size parameter: $size" ; B_E ; }

local workingDir="$(b_args_getOption "--wd" "/tmp")"

mkdir -p "$workingDir" || { B_ERR="Failed to create $workingDir." ; B_E ; }

[ -d "$workingDir" ] || { B_ERR="No directory: $workingDir" ; B_E ; }

local keySize="$(b_args_getOptionInt "--ks" "100")"

local enKey="$(b_args_getOption "--enkey" "/dev/random")"

[ -c "$enKey" ] || { B_ERR="No valid entropy source: $enKey" ; B_E ; }

local enCon="$(b_args_getOption "--encon" "/dev/urandom")"

[ -c "$enCon" ] || { B_ERR="No valid entropy source: $enCon" ; B_E ; }

local keyBackupFolder="$(b_args_getOption "--bak")"

if [ -n "$keyBackupFolder" ] ; then

mkdir -p "$keyBackupFolder" || { B_ERR="Failed to create $keyBackupFolder." ; B_E ; }

[ -d "$keyBackupFolder" ] || { B_ERR="No directory: $keyBackupFolder" ; B_E ; }

local keyStore="$(b_args_getOption "--keystore")"

if [ -n "$keyStore" ] ; then

[[ "$keyStore" == "//" ]] && keyStore="$(b_keys_getDefaultStore)"

[ ! -d "$keyStore" ] && [ -e "$keyStore" ] && B_ERR="No directory: $keyStore" && B_E

local fsType="$(b_args_getOption "--fs" "btrfs")"

local coptStr=

coptStr="$(parseCryptsetupParams "copt" "${DSTS[@]}")" || { B_ERR="Failed to parse the cryptsetup parameters." ; B_E ; }

eval "$coptStr" || { B_ERR="Programming error?!" ; B_E ; }

local dst=

for dst in "${DSTS[@]}" ; do

local opts="${copt["$dst"]}"

if [[ "$opts" != *"--type"** ]] && [[ "$opts" != *"--pbkdf-memory"* ]] ; then

#limit the memory requirements to 10MB

copt["$dst"]="$opts --pbkdf-memory 10240"

fi

b_info "Doing some safety checks..."

b_enforceUser "root"

[[ "$fsType" == "btrfs" ]] && b_deps "btrfs"

checkAvailableSpace "$workingDir" "$size" || { B_ERR="$workingDir provides less space than required by the --size parameter." ; B_E ; }

[ $autostart -eq 0 ] && b_dom0_ensureRunning "$sourceVM" "${DSTS[@]}" || b_dom0_isRunning "$sourceVM" "${DSTS[@]}"

ensureFileDoesNotExistIn "$sourceVM" "$sourceFile"

local dst=""

local vmKeyPath=""

declare -A vmKeyPaths

for dst in "${DSTS[@]}" ; do

vmKeyPath="$(getKeyPath "$dst" "$keyId")" || { B_ERR="Failed to retrieve the key file path inside the VM $dst for the key ID $keyId." ; B_E ; }

vmKeyPaths["$dst"]="$vmKeyPath"

ensureFileDoesNotExistIn "$dst" "$vmKeyPath"

local dom0Container=""

local cmd=""

dom0Container="$(mktemp -p "$workingDir")" || { B_ERR="Failed to create a temporary file." ; B_E ; }

printf -v cmd 'rm -f %q' "$dom0Container"

b_traps_add "$cmd" EXIT || { B_ERR="Failed to register a cleanup trap." ; B_E ; }

b_info "Initializing the luks container (this may take a while)..."

head -c $size < "$enCon" > "$dom0Container" || { B_ERR="Failed to initialize the container at $dom0Container." ; B_E ; }

local dom0ContainerLoop=""

dom0ContainerLoop="$(losetup -f --show "$dom0Container")" || { B_ERR="Failed to create a loop device." ; B_E ; }

printf -v cmd 'losetup -d %q' "$dom0ContainerLoop"

b_traps_prepend "$cmd" EXIT || { B_ERR="Failed to register a cleanup trap." ; B_E ; }

local dom0KeyFile=""

declare -A dom0KeyFiles

local curDevice="$dom0ContainerLoop"

for dst in "${DSTS[@]}" ; do

#generate key

b_info "Generating the key for the VM ${dst}..."

dom0KeyFile="$(mktemp -p "$workingDir")" || { B_ERR="Failed to create a temporary file." ; B_E ; }

printf -v cmd 'b_fs_removeRelativelySafely %q' "$dom0KeyFile"

b_traps_add "$cmd" EXIT || { B_ERR="Failed to register a cleanup trap." ; B_E ; }

head -c "$keySize" < "$enKey" > "$dom0KeyFile" || { B_ERR="Failed to initialize the key for the VM $dst at $dom0KeyFile." ; B_E ; }

dom0KeyFiles["$dst"]="$dom0KeyFile"

#format

b_info "Generating the encryption layer for the VM ${dst}..."

cryptsetup -q --key-file "$dom0KeyFile" ${copt["$dst"]} luksFormat "$curDevice" || { B_ERR="Failed to run cryptsetup luksFormat." ; B_E ; }

#open the newly created layer

b_info "Switching to the next encryption layer..."

local luksName="$dst-$keyId"

cryptsetup open --type luks --key-file "$dom0KeyFile" "$curDevice" "$luksName" || { B_ERR="Failed to open the encryption layer created for the VM $dst." ; B_E ; }

printf -v cmd 'cryptsetup close %q' "$luksName"

b_traps_prepend "$cmd" EXIT || { B_ERR="Failed to register a cleanup trap." ; B_E ; }

curDevice="/dev/mapper/$luksName"

if [ -n "$fsType" ] ; then

b_info "Creating the file system..."

mkfs -t "$fsType" "$curDevice" &> /dev/null || { B_ERR="Failed to create the file system of type $fsType on $curDevice." ; B_E ; }

if [[ "$fsType" == "btrfs" ]] ; then

b_info "Enabling btrfs zstd compression..."

#unfortunately we have to mount it for that

local tmpMp=

tmpMp="$(mktemp -d)" || { B_ERR="Failed to create a temporary directory." ; B_E ; }

mount "$curDevice" "$tmpMp" || { B_ERR="Failed to mount the btrfs device $curDevice to $tmpMp." ; B_E ; }

btrfs property set "$tmpMp" compression zstd || { B_ERR="Failed to enable btrfs compression." ; B_E ; }

umount "$tmpMp" || { B_ERR="Failed to umount the btrfs mount $tmpMp." ; B_E ; }

rm -rf "$tmpMp" || { B_ERR="Failed to remove $tmpMp." ; B_E ; }

fi

if [ -n "$keyBackupFolder" ] ; then

b_info "Backing up all keys to $keyBackupFolder..."

for dst in "${DSTS[@]}" ; do

dom0KeyFile="${dom0KeyFiles["$dst"]}"

local bakFile="$keyBackupFolder/${dst}_$keyId"

[ -e "$bakFile" ] && B_ERR="A file called $bakFile already exists. Rejecting to overwrite." && B_E

cp "$dom0KeyFile" "$bakFile" || { B_ERR="Failed to copy the key file $dom0KeyFile to $bakFile." ; B_E ; }

chmod 666 "$bakFile"

done

if [ -n "$keyStore" ] ; then

b_info "Adding the keys to the blib key store $keyStore..."

initKeysModule "$keyStore"

for dst in "${DSTS[@]}" ; do

dom0KeyFile="${dom0KeyFiles["$dst"]}"

b_keys_add "${dst}_$keyId" "$dom0KeyFile"

done

for dst in "${DSTS[@]}" ; do

dom0KeyFile="${dom0KeyFiles["$dst"]}"

vmKeyPath="${vmKeyPaths["$dst"]}"

b_info "Passing the key $dom0KeyFile to the VM $dst as $vmKeyPath..."

b_dom0_copy "$dom0KeyFile" "$dst" "$vmKeyPath" 1 1 || { B_ERR="Failed to copy the key file $dom0KeyFile." ; B_E ; }

b_info "Copying the encrypted container to the VM $sourceVM at ${sourceFile}..."

sync

b_dom0_copy "$dom0Container" "$sourceVM" "$sourceFile" 1 1 || { B_ERR="Failed to copy the encrypted container to the source VM $sourceVM." ; B_E ; }

sync

b_info "Luks init done."

b_info "Cleaning up... (this is not hanging)"

return 0

local mapperName="$1"

local mapperNameEsc=""

printf -v mapperNameEsc '%q' "$mapperName"

! [ -b /dev/mapper/$mapperNameEsc ] && exit 11

cryptsetup close $mapperNameEsc || exit 22

exit 0

local sourceVM="$1"

local sourceFile="$2"

local ret=

b_info "Closing the loop device inside $sourceVM..." 0 1

b_setBE 1

b_dom0_execFuncIn "$sourceVM" "" "detachLoop" - - "$sourceFile" &> /dev/null

ret=$?

b_resetErrorHandler

if [ $ret -eq 17 ] ; then

b_info "No loop device found. All good." 1 0

elif [ $ret -eq 0 ] ; then

b_info "Done." 1 0

#last action, no need for force

B_ERR="Failed to close."

B_E

return 0

local force="$1" #currently cannot be 0

local shutdown="$2"

local sourceVM="$3"

local sourceFile="$4"

local keyId="$5"

shift 5

declare -a dsts=("$@")

local mapperName="$keyId"

local mapperNameEsc=""

printf -v mapperNameEsc '%q' "$mapperName"

local err=""

local dst="${dsts[*]: -1}"

local ret=-1

b_info "Umounting the plaintext device inside ${dst}..." 0 1

local cmd="findmnt -n -o TARGET -S /dev/mapper/$mapperNameEsc | head -n1 | xargs umount -A -R || exit 17"

b_setBE 1

b_dom0_qvmRun "$dst" "$cmd" &> /dev/null

ret=$?

b_resetErrorHandler

if [ $ret -eq 17 ] ; then

b_info "Was not mounted. All good." 1 0

elif [ $ret -eq 0 ] ; then

b_info "Done." 1 0

err="Failed to umount."

[ $force -eq 0 ] && b_info "$err Proceeding anyway..." 1 0 || { B_ERR="$err No point in proceeding." ; B_E ; }

local qvmBlockInfo=""

qvmBlockInfo="$(b_dom0_parseQvmBlock "map")" || { B_ERR="Failed to parse qvm-block ls." ; B_E ; }

local i=

local desc=

for ((i=${#dsts[@]}-1;i >= 0;i--)) ; do

local vm="${dsts[$i]}"

#close

b_info "Closing the dm-crypt device inside ${vm}..." 0 1

b_setBE 1

b_dom0_execFuncIn "$vm" "" "closeDecryptedData" - - "$mapperName" &> /dev/null

ret=$?

b_resetErrorHandler

case $ret in

0)

b_info "Done." 1 0

;;

11)

b_info "Was not open. All good." 1 0

;;

*)

err="Failed to close the dm-crypt device (status: $ret)."

[ $force -eq 0 ] && b_info "$err Proceeding anyway..." 1 0 || { B_ERR="$err No point in proceeding." ; B_E ; }

esac

#detach

#example qvm-block ls output:

#result of `qcrypt open -- disp287 /tmp/foo4 foo4 testing-pers d-testing`

#BACKEND:DEVID DESCRIPTION USED BY

#disp287:loop0 /tmp/foo4 testing-pers (read-only=no, frontend-dev=xvdi)

#testing-pers:dm-0 foo4 d-testing (read-only=no, frontend-dev=xvdi)

#foo4 is the /dev/mapper/foo4 name inside testing-pers providing a symlink to /dev/dm-0 and used by d-testing as /dev/xvdi

#--> we'd have to detach:

# qvm-block d d-testing testing-pers:dm-0

# qvm-block d testing-pers disp287:loop0

#--> resulting in an empty "used by" column

[ $i -eq 0 ] && desc="$sourceFile" || desc="$mapperName"

b_info "Detaching the device from the VM $vm..." 0 1

local backend=""

backend="$(b_dom0_getQvmBlockInfo "$qvmBlockInfo" "id" "description" "$desc" "used by" "$vm")"

[ $? -eq $B_RC ] && { B_ERR="Failed to parse qvm-block ls." ; B_E ; }

if [ -z "$backend" ] ; then

b_info "Was not attached. All good." 1 0

else

qvm-block d "$vm" "$backend" &> /dev/null

if [ $? -eq 0 ] ; then

b_info "Done." 1 0

else

if [ $shutdown -eq 0 ] ; then

#similar to what --force does, but we attempted to properly detach it before

b_info "Failed, trying to shutdown... " 1 1

b_dom0_ensureHalted "$vm"

b_info "Done." 1 0

else

err="Failed to detach the backend $backend from the VM $vm. No point in proceeding."

[ $force -eq 0 ] && b_info "$err Proceeding anyway..." 1 0 || { B_ERR="$err No point in proceeding." ; B_E ; }

fi

fi

fi

closeSourceLoop "$sourceVM" "$sourceFile"

[ -z "$err" ]

local sourceVM="$1"

local sourceFile="$2"

local keyId="$3"

shift 3

declare -a dsts=("$@")

local i=

for ((i=${#dsts[@]}-1;i >= 0;i--)) ; do

local vm="${dsts[$i]}"

#NOTES:

# - using qvm-block in any way is likely to trigger Qubes OS bug #4784

# - we better shut down one after another as this will give Qubes OS some time to do the device detach cleanup (and in order)

b_info "Shutting down the VM ${vm}..." 0 1

b_dom0_ensureHalted "$vm"

#give Qubes OS some time to clean up the mess (i.e. do the detach)

sleep 0.2

b_info "Done." 1 0

closeSourceLoop "$sourceVM" "$sourceFile"

return 0

local force=1

local shutdown=1

b_args_getOption "--force" > /dev/null && force=0

b_args_getOption "--sd" > /dev/null && shutdown=0

local sourceVM="$(b_args_get 1)"

local sourceFile=

sourceFile="$(getCanonicalFileParameter)" || { B_ERR="Failed to canonicalize the source file parameter." ; B_E ; }

local keyId="$(b_args_get 3)"

parseDestinations

if [ $force -ne 0 ] ; then

b_info "Checking the validity of the chain..." 0 1

local state=""

state="$(b_args_parse "status" "$sourceVM" "$sourceFile" "$keyId" "${DSTS[@]}" ; statusSingleC)" || { B_ERR="The chain has a bad status - check it below. If you want to continue nonetheless, use --force."$'\n'"$state" ; B_E ; }

b_info "Done. All good." 1 0

cleanClose "$force" "$shutdown" "$sourceVM" "$sourceFile" "$keyId" "${DSTS[@]}"