local sudo_eng="[sudo] Enter password for user ::1 user:: to gain superuser privileges"

local msg="$(gettext -s "$sudo_eng")"

msg=${(S)msg//::1*::/$USER}

sudo -p "

" ${@}

# Prepare some random material to overwrite vars

local rr="$RANDOM"

while [[ ${#rr} -lt 500 ]]; do

rr+="$RANDOM"

done

# Ensure no information is left in unallocated memory

TOMBPATH="$rr"; unset TOMBPATH

TOMBDIR="$rr"; unset TOMBDIR

TOMBFILE="$rr"; unset TOMBFILE

TOMBNAME="$rr"; unset TOMBNAME

TOMBKEY="$rr"; unset TOMBKEY

TOMBKEYFILE="$rr"; unset TOMBKEYFILE

TOMBSECRET="$rr"; unset TOMBSECRET

TOMBPASSWORD="$rr"; unset TOMBPASSWORD

# Clear temporary files

for f in $TOMBTMPFILES; do

${=WIPE} "$f"

done

unset TOMBTMPFILES

# Detach loop devices

for l in $TOMBLOOPDEVS; do

_sudo losetup -d "$l"

done

unset TOMBLOOPDEVS

# returns 0 if binary is found in path

[[ "$1" = "" ]] && return 1

command -v "$1" 1>/dev/null 2>/dev/null

return $?

local b=$1 # Path to a block device

local s="" # lsblk option -s (if available)

# Issue #163

# lsblk --inverse appeared in util-linux 2.22

# but --version is not consistent...

lsblk --help | grep -Fq -- --inverse

[[ $? -eq 0 ]] && s="--inverse"

sudo lsblk $s -o type -n $b 2>/dev/null \

| egrep -q '^crypt$'

return $?

local -i r=1 # Return code: 0 no swap, 1 unsafe swap, 2 encrypted

local -a swaps # List of swap partitions

local bone is_crypt

swaps="$(awk '/^\// { print $1 }' /proc/swaps 2>/dev/null)"

[[ -z "$swaps" ]] && return 0 # No swap partition is active

_message "An active swap partition is detected..."

for s in $=swaps; do

if _is_encrypted_block $s; then

r=2;

else

# We're dealing with unencrypted stuff.

# Maybe it lives on an encrypted filesystem anyway.

# @todo: verify it's actually on an encrypted FS (see #163 and !189)

# Well, no: bail out.

r=1; break;

fi

done

if [[ $r -eq 2 ]]; then

_success "The undertaker found that all swap partitions are encrypted. Good."

else

_warning "This poses a security risk."

_warning "You can deactivate all swap partitions using the command:"

_warning " swapoff -a"

_warning "[#163] I may not detect plain swaps on an encrypted volume."

_warning "But if you want to proceed like this, use the -f (force) flag."

fi

return $r

}

_check_swap() {

if ! option_is_set -f && ! option_is_set --ignore-swap; then

_ensure_safe_swap

case $? in

0|2) # No, or encrypted swap

return 0

;;

*) # Unencrypted swap

_failure "Operation aborted."

;;

esac

fi

}

ask_password() {

local description="$1"

local title="${2:-Enter tomb password.}"

local output

local password

local gtkrc

local theme

# Distributions have broken wrappers for pinentry: they do

# implement fallback, but they disrupt the output somehow. We are

# better off relying on less intermediaries, so we implement our

# own fallback mechanisms. Pinentry supported: curses, gtk-2, qt4

# and x11.

# make sure LANG is set, default to C

LANG=${LANG:-C}

_verbose "asking password with tty=$TTY lc-ctype=$LANG"

if [[ "$DISPLAY" = "" ]]; then

if _is_found "pinentry-curses"; then

_verbose "using pinentry-curses"

output=`cat <<EOF | pinentry-curses