document kernel command-line parameters

hooks/luks/luks

@@ -3,9 +3,6 @@
 #
 # false positive
 # shellcheck disable=2154
-#
-# word splitting is safe by design
-# shellcheck disable=2086
 {
     [ "$hostonly" = 1 ] &&
         for _module in \
@@ -21,16 +18,21 @@
     # see https://bugs.archlinux.org/task/56771
     [ -e /lib/libgcc_s.so.1 ] && copy_file /lib/libgcc_s.so.1 /lib 755 1
 
-    IFS=,; set -- $luks_opts; unset IFS
+    [ "$luks_key" ] && {
+        copy_file "${luks_key#*=}" /root 400 0
 
-    for opt; do case "${opt%%=*}" in
-        key | header)
-            copy_file "${opt#*=}" /root 400 0
+        sed "s|${luks_key#*=}|/root/key|" \
+            "${tmpdir}/etc/tinyramfs/config" > "${tmpdir}/_"
 
-            sed "s|${opt#*=}|/root/${opt%%=*}|" \
-                "${tmpdir}/etc/tinyramfs/config" > "${tmpdir}/_"
+        mv "${tmpdir}/_" "${tmpdir}/etc/tinyramfs/config"
+    }
 
-            mv "${tmpdir}/_" "${tmpdir}/etc/tinyramfs/config"
-            chmod 600        "${tmpdir}/etc/tinyramfs/config"
-    esac || panic; done
+    [ "$luks_header" ] && {
+        copy_file "${luks_header#*=}" /root 400 0
+
+        sed "s|${luks_header#*=}|/root/header|" \
+            "${tmpdir}/etc/tinyramfs/config" > "${tmpdir}/_"
+
+        mv "${tmpdir}/_" "${tmpdir}/etc/tinyramfs/config"
+    }
 }

hooks/luks/luks.init

@@ -5,32 +5,18 @@
 # shellcheck disable=2154
 #
 # word splitting is safe by design
-# shellcheck disable=2086,2068
+# shellcheck disable=2068
 {
     [ "$break" = luks ] && { print "break before unlock_luks()"; sh; }
 
+    export DM_DISABLE_UDEV=1
     mkdir -p /run/cryptsetup
 
-    IFS=,; set -- $luks_opts; unset IFS
-
-    for opt; do case "$opt" in
-        discard=1) luks_discard="--allow-discards" ;;
-        header=*)  luks_header="--${opt}"  ;;
-        name=*)    luks_name="${opt#*=}"   ;;
-        root=*)    luks_root="${opt#*=}"   ;;
-        key=*)     luks_key="-d ${opt#*=}" ;;
-    esac; done
-
     resolve_device "$luks_root"
 
     set -- \
-        "$luks_key" "$luks_header" "$luks_discard" \
-        "$device" "${luks_name:-crypt-${device##*/}}"
-
-    # libdevice-mapper assumes that udev has dm rules
-    # which is not true because we use our device-helper for dm stuff
-    # this variable fixes possible(?) hang
-    export DM_DISABLE_UDEV=1
+         "${luks_discard:+--allow-discards}" "${luks_header:+--header $luks_header}" \
+         "${luks_key:+-d $luks_key}" "$device" "${luks_name:-crypt-${device##*/}}"
 
     cryptsetup open $@ || panic "failed to unlock LUKS"
 }