Fix #1 Limit allowed attempts of password input to increase security

README.md

@@ -27,12 +27,13 @@ DefaultDependencies=no
 Before=zfs-mount.service
 Before=systemd-user-sessions.service
 After=zfs-import.target
+OnFailure=emergency.target
 
 [Service]
 Type=oneshot
 RemainAfterExit=yes
 
-ExecStart=zfs-multi-mount.sh --systemd -no-mount
+ExecStart=zfs-multi-mount.sh --systemd --no-mount
 
 [Install]
 WantedBy=zfs-mount.service

zfs-multi-mount.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 PATH=/usr/bin:/sbin:/bin
 
@@ -30,6 +30,9 @@ done
 datasets=("$@")
 [ ${#datasets[@]} -eq 0 ] && datasets=($(zfs list -H -o name))
 
+attempt=0
+attempt_limit=3
+
 function ask_password {
   if [ -v systemd ]; then
     key=$(systemd-ask-password "Enter $dataset passphrase:" --no-tty) # While booting.
@@ -40,12 +43,17 @@ function ask_password {
 
 function load_key {
   ! zfs list -H -o name | grep -qx "$dataset" && echo "ERROR: Dataset '$dataset' does not exist." && return 1
+  [[ $attempt == "$attempt_limit" ]] && echo "No more attempts left." && exit 1
   [[ ! $(zfs get keystatus "$1" -H -o value) == "unavailable" ]] && return 0
-  [ ! -v key ] && ask_password
+  if [ ! -v key ]; then
+    ((attempt++))
+    ask_password
+  fi
   if ! echo "$key" | zfs load-key "$1"; then
     unset key
     load_key $1
   fi
+  attempt=0
   return 0
 }