diff --git a/g13/g13-syshelp.c b/g13/g13-syshelp.c
index cbb5f8dbf..b31964e6e 100644
--- a/g13/g13-syshelp.c
+++ b/g13/g13-syshelp.c
@@ -1,724 +1,745 @@
 /* g13-syshelp.c - Helper for disk key management with GnuPG
  * Copyright (C) 2015 Werner Koch
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <config.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <errno.h>
 #include <ctype.h>
 #include <unistd.h>
 #include <fcntl.h>
 #include <limits.h>
 #ifdef HAVE_PWD_H
 # include <pwd.h>
 #endif
 #include <unistd.h>
 
 #include "g13-syshelp.h"
 
 #include <gcrypt.h>
 #include <assuan.h>
 
 #include "i18n.h"
 #include "sysutils.h"
 #include "asshelp.h"
 #include "../common/init.h"
 #include "keyblob.h"
 
 
 enum cmd_and_opt_values {
   aNull = 0,
   oQuiet	= 'q',
   oVerbose	= 'v',
   oRecipient	= 'r',
 
   aGPGConfList  = 500,
 
   oDebug,
   oDebugLevel,
   oDebugAll,
   oDebugNone,
   oDebugWait,
   oDebugAllowCoreDump,
   oLogFile,
   oNoLogFile,
   oAuditLog,
 
   oOutput,
 
   oAgentProgram,
   oGpgProgram,
   oType,
 
   oDisplay,
   oTTYname,
   oTTYtype,
   oLCctype,
   oLCmessages,
   oXauthority,
 
   oStatusFD,
   oLoggerFD,
 
   oNoVerbose,
   oNoSecmemWarn,
   oHomedir,
   oDryRun,
   oNoDetach,
 
   oNoRandomSeedFile,
   oFakedSystemTime
  };
 
 
 static ARGPARSE_OPTS opts[] = {
 
   ARGPARSE_s_n (oDryRun, "dry-run", N_("do not make any changes")),
 
   ARGPARSE_s_n (oVerbose, "verbose", N_("verbose")),
   ARGPARSE_s_n (oQuiet,	"quiet",  N_("be somewhat more quiet")),
 
   ARGPARSE_s_s (oDebug, "debug", "@"),
   ARGPARSE_s_s (oDebugLevel, "debug-level",
                 N_("|LEVEL|set the debugging level to LEVEL")),
   ARGPARSE_s_n (oDebugAll, "debug-all", "@"),
   ARGPARSE_s_n (oDebugNone, "debug-none", "@"),
   ARGPARSE_s_i (oDebugWait, "debug-wait", "@"),
   ARGPARSE_s_n (oDebugAllowCoreDump, "debug-allow-core-dump", "@"),
 
   ARGPARSE_end ()
 };
 
 
 /* The list of supported debug flags.  */
 static struct debug_flags_s debug_flags [] =
   {
     { DBG_MOUNT_VALUE  , "mount"  },
     { DBG_CRYPTO_VALUE , "crypto"  },
     { DBG_MEMORY_VALUE , "memory"  },
     { DBG_MEMSTAT_VALUE, "memstat" },
     { DBG_IPC_VALUE    , "ipc"     },
     { 0, NULL }
   };
 
 
 /* The timer tick interval used by the idle task.  */
 #define TIMERTICK_INTERVAL_SEC     (1)
 
 /* It is possible that we are currently running under setuid permissions.  */
 static int maybe_setuid = 1;
 
 /* Helper to implement --debug-level and --debug.  */
 static const char *debug_level;
 static unsigned int debug_value;
 
 
 /* Local prototypes.  */
 static void g13_syshelp_deinit_default_ctrl (ctrl_t ctrl);
 static void release_tab_items (tab_item_t tab);
 static tab_item_t parse_g13tab (const char *username);
 
 
 
 static const char *
 my_strusage( int level )
 {
   const char *p;
 
   switch (level)
     {
     case 11: p = "@G13@-syshelp (@GNUPG@)";
       break;
     case 13: p = VERSION; break;
     case 17: p = PRINTABLE_OS_NAME; break;
     case 19: p = _("Please report bugs to <" PACKAGE_BUGREPORT ">.\n");
       break;
     case 1:
     case 40: p = _("Usage: @G13@-syshelp [options] [files] (-h for help)");
       break;
     case 41:
       p = _("Syntax: @G13@-syshelp [options] [files]\n"
             "Helper to perform root-only tasks for g13\n");
       break;
 
     case 31: p = "\nHome: "; break;
     case 32: p = opt.homedir; break;
 
     default: p = NULL; break;
     }
   return p;
 }
 
 
 /* Setup the debugging.  With a DEBUG_LEVEL of NULL only the active
    debug flags are propagated to the subsystems.  With DEBUG_LEVEL
    set, a specific set of debug flags is set; and individual debugging
    flags will be added on top.  */
 static void
 set_debug (void)
 {
   int numok = (debug_level && digitp (debug_level));
   int numlvl = numok? atoi (debug_level) : 0;
 
   if (!debug_level)
     ;
   else if (!strcmp (debug_level, "none") || (numok && numlvl < 1))
     opt.debug = 0;
   else if (!strcmp (debug_level, "basic") || (numok && numlvl <= 2))
     opt.debug = DBG_IPC_VALUE|DBG_MOUNT_VALUE;
   else if (!strcmp (debug_level, "advanced") || (numok && numlvl <= 5))
     opt.debug = DBG_IPC_VALUE|DBG_MOUNT_VALUE;
   else if (!strcmp (debug_level, "expert") || (numok && numlvl <= 8))
     opt.debug = (DBG_IPC_VALUE|DBG_MOUNT_VALUE|DBG_CRYPTO_VALUE);
   else if (!strcmp (debug_level, "guru") || numok)
     {
       opt.debug = ~0;
       /* if (numok) */
       /*   opt.debug &= ~(DBG_HASHING_VALUE); */
     }
   else
     {
       log_error (_("invalid debug-level '%s' given\n"), debug_level);
       g13_exit(2);
     }
 
   opt.debug |= debug_value;
 
   if (opt.debug && !opt.verbose)
     opt.verbose = 1;
   if (opt.debug)
     opt.quiet = 0;
 
   if (opt.debug & DBG_CRYPTO_VALUE )
     gcry_control (GCRYCTL_SET_DEBUG_FLAGS, 1);
   gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose);
 
   if (opt.debug)
     parse_debug_flag (NULL, &opt.debug, debug_flags);
 }
 
 
 int
 main ( int argc, char **argv)
 {
   ARGPARSE_ARGS pargs;
   int orig_argc;
   char **orig_argv;
   gpg_error_t err = 0;
   /* const char *fname; */
   int may_coredump;
   FILE *configfp = NULL;
   char *configname = NULL;
   unsigned configlineno;
   int parse_debug = 0;
   int no_more_options = 0;
   int default_config =1;
   char *logfile = NULL;
   /* int debug_wait = 0; */
   int use_random_seed = 1;
   /* int nodetach = 0; */
   /* int nokeysetup = 0; */
   struct server_control_s ctrl;
 
   /*mtrace();*/
 
   early_system_init ();
   gnupg_reopen_std (G13_NAME "-syshelp");
   set_strusage (my_strusage);
   gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
 
   log_set_prefix (G13_NAME "-syshelp", 1);
 
   /* Make sure that our subsystems are ready.  */
   i18n_init ();
   init_common_subsystems (&argc, &argv);
 
   /* Check that the Libgcrypt is suitable.  */
   if (!gcry_check_version (NEED_LIBGCRYPT_VERSION) )
     log_fatal (_("%s is too old (need %s, have %s)\n"), "libgcrypt",
                NEED_LIBGCRYPT_VERSION, gcry_check_version (NULL) );
 
   /* Take extra care of the random pool.  */
   gcry_control (GCRYCTL_USE_SECURE_RNDPOOL);
 
   may_coredump = disable_core_dumps ();
 
   g13_init_signals ();
 
   dotlock_create (NULL, 0); /* Register locking cleanup.  */
 
   opt.session_env = session_env_new ();
   if (!opt.session_env)
     log_fatal ("error allocating session environment block: %s\n",
                strerror (errno));
 
   opt.homedir = default_homedir ();
   /* Fixme: We enable verbose mode here because there is currently no
      way to do this when starting g13-syshelp.  To fix that we should
      add a g13-syshelp.conf file in /etc/gnupg.  */
   opt.verbose = 1;
 
   /* First check whether we have a debug option on the commandline.  */
   orig_argc = argc;
   orig_argv = argv;
   pargs.argc = &argc;
   pargs.argv = &argv;
   pargs.flags= (ARGPARSE_FLAG_KEEP | ARGPARSE_FLAG_NOVERSION);
   while (arg_parse( &pargs, opts))
     {
       if (pargs.r_opt == oDebug || pargs.r_opt == oDebugAll)
         parse_debug++;
     }
 
   /* Initialize the secure memory. */
   gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0);
   maybe_setuid = 0;
 
   /*
      Now we are now working under our real uid
   */
 
   /* Setup malloc hooks. */
   {
     struct assuan_malloc_hooks malloc_hooks;
 
     malloc_hooks.malloc = gcry_malloc;
     malloc_hooks.realloc = gcry_realloc;
     malloc_hooks.free = gcry_free;
     assuan_set_malloc_hooks (&malloc_hooks);
   }
 
   /* Prepare libassuan.  */
   assuan_set_gpg_err_source (GPG_ERR_SOURCE_DEFAULT);
   /*assuan_set_system_hooks (ASSUAN_SYSTEM_NPTH);*/
   setup_libassuan_logging (&opt.debug);
 
   /* Setup a default control structure for command line mode.  */
   memset (&ctrl, 0, sizeof ctrl);
   g13_syshelp_init_default_ctrl (&ctrl);
   ctrl.no_server = 1;
   ctrl.status_fd = -1; /* No status output. */
 
   if (default_config )
     configname = make_filename (gnupg_sysconfdir (),
                                 G13_NAME"-syshelp.conf", NULL);
 
   argc        = orig_argc;
   argv        = orig_argv;
   pargs.argc  = &argc;
   pargs.argv  = &argv;
   pargs.flags =  1;  /* Do not remove the args.  */
 
  next_pass:
   if (configname)
     {
       configlineno = 0;
       configfp = fopen (configname, "r");
       if (!configfp)
         {
           if (default_config)
             {
               if (parse_debug)
                 log_info (_("NOTE: no default option file '%s'\n"), configname);
             }
           else
             {
               log_error (_("option file '%s': %s\n"),
                          configname, strerror(errno));
               g13_exit(2);
             }
           xfree (configname);
           configname = NULL;
         }
       if (parse_debug && configname)
         log_info (_("reading options from '%s'\n"), configname);
       default_config = 0;
     }
 
   while (!no_more_options
          && optfile_parse (configfp, configname, &configlineno, &pargs, opts))
     {
       switch (pargs.r_opt)
         {
         case oQuiet: opt.quiet = 1; break;
 
         case oDryRun: opt.dry_run = 1; break;
 
         case oVerbose:
           opt.verbose++;
           gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose);
           break;
         case oNoVerbose:
           opt.verbose = 0;
           gcry_control (GCRYCTL_SET_VERBOSITY, (int)opt.verbose);
           break;
 
         case oLogFile: logfile = pargs.r.ret_str; break;
         case oNoLogFile: logfile = NULL; break;
 
         case oNoDetach: /*nodetach = 1; */break;
 
         case oDebug:
           if (parse_debug_flag (pargs.r.ret_str, &opt.debug, debug_flags))
             {
               pargs.r_opt = ARGPARSE_INVALID_ARG;
               pargs.err = ARGPARSE_PRINT_ERROR;
             }
             break;
         case oDebugAll: debug_value = ~0; break;
         case oDebugNone: debug_value = 0; break;
         case oDebugLevel: debug_level = pargs.r.ret_str; break;
         case oDebugWait: /*debug_wait = pargs.r.ret_int; */break;
         case oDebugAllowCoreDump:
           may_coredump = enable_core_dumps ();
           break;
 
         case oStatusFD: ctrl.status_fd = pargs.r.ret_int; break;
         case oLoggerFD: log_set_fd (pargs.r.ret_int ); break;
 
         case oHomedir: opt.homedir = pargs.r.ret_str; break;
 
         case oFakedSystemTime:
           {
             time_t faked_time = isotime2epoch (pargs.r.ret_str);
             if (faked_time == (time_t)(-1))
               faked_time = (time_t)strtoul (pargs.r.ret_str, NULL, 10);
             gnupg_set_time (faked_time, 0);
           }
           break;
 
         case oNoSecmemWarn: gcry_control (GCRYCTL_DISABLE_SECMEM_WARN); break;
 
         case oNoRandomSeedFile: use_random_seed = 0; break;
 
         default:
           pargs.err = configfp? ARGPARSE_PRINT_WARNING:ARGPARSE_PRINT_ERROR;
           break;
 	}
     }
 
   if (configfp)
     {
       fclose (configfp);
       configfp = NULL;
       /* Keep a copy of the config filename. */
       opt.config_filename = configname;
       configname = NULL;
       goto next_pass;
     }
   xfree (configname);
   configname = NULL;
 
   if (!opt.config_filename)
     opt.config_filename = make_filename (opt.homedir, G13_NAME".conf", NULL);
 
   if (log_get_errorcount(0))
     g13_exit(2);
 
   /* Now that we have the options parsed we need to update the default
      control structure.  */
   g13_syshelp_init_default_ctrl (&ctrl);
 
   if (may_coredump && !opt.quiet)
     log_info (_("WARNING: program may create a core file!\n"));
 
   if (logfile)
     {
       log_set_file (logfile);
       log_set_prefix (NULL, 1|2|4);
     }
 
   if (gnupg_faked_time_p ())
     {
       gnupg_isotime_t tbuf;
 
       log_info (_("WARNING: running with faked system time: "));
       gnupg_get_isotime (tbuf);
       dump_isotime (tbuf);
       log_printf ("\n");
     }
 
   /* Print any pending secure memory warnings.  */
   gcry_control (GCRYCTL_RESUME_SECMEM_WARN);
 
   /* Setup the debug flags for all subsystems.  */
   set_debug ();
 
   /* Install a regular exit handler to make real sure that the secure
      memory gets wiped out.  */
   g13_install_emergency_cleanup ();
 
   /* Terminate if we found any error until now.  */
   if (log_get_errorcount(0))
     g13_exit (2);
 
   /* Set the standard GnuPG random seed file.  */
   if (use_random_seed)
     {
       char *p = make_filename (opt.homedir, "random_seed", NULL);
       gcry_control (GCRYCTL_SET_RANDOM_SEED_FILE, p);
       xfree(p);
     }
 
   /* Get the UID of the caller.  */
 #if defined(HAVE_PWD_H) && defined(HAVE_GETPWUID)
   {
     const char *uidstr;
     struct passwd *pwd = NULL;
 
     uidstr = getenv ("USERV_UID");
 
     /* Print a quick note if we are not started via userv.  */
     if (!uidstr)
       {
         if (getuid ())
           {
             log_info ("WARNING: Not started via userv\n");
             ctrl.fail_all_cmds = 1;
           }
         ctrl.client.uid = getuid ();
       }
     else
       {
         unsigned long myuid;
 
         errno = 0;
         myuid = strtoul (uidstr, NULL, 10);
         if (myuid == ULONG_MAX && errno)
           {
             log_info ("WARNING: Started via broken userv: %s\n",
                       strerror (errno));
             ctrl.fail_all_cmds = 1;
             ctrl.client.uid = getuid ();
           }
         else
           ctrl.client.uid = (uid_t)myuid;
       }
 
       pwd = getpwuid (ctrl.client.uid);
       if (!pwd || !*pwd->pw_name)
         {
           log_info ("WARNING: Name for UID not found: %s\n", strerror (errno));
           ctrl.fail_all_cmds = 1;
           ctrl.client.uname = xstrdup ("?");
         }
       else
         ctrl.client.uname = xstrdup (pwd->pw_name);
   }
 #else /*!HAVE_PWD_H || !HAVE_GETPWUID*/
   log_info ("WARNING: System does not support required syscalls\n");
   ctrl.fail_all_cmds = 1;
   ctrl.client.uid = getuid ();
   ctrl.client.uname = xstrdup ("?");
 #endif /*!HAVE_PWD_H || !HAVE_GETPWUID*/
 
   /* Read the table entries for this user.  */
   if (!ctrl.fail_all_cmds
       && !(ctrl.client.tab = parse_g13tab (ctrl.client.uname)))
     ctrl.fail_all_cmds = 1;
 
   /* Start the server.  */
   err = syshelp_server (&ctrl);
   if (err)
     log_error ("server exited with error: %s <%s>\n",
                gpg_strerror (err), gpg_strsource (err));
 
   /* Cleanup.  */
   g13_syshelp_deinit_default_ctrl (&ctrl);
   g13_exit (0);
   return 8; /*NOTREACHED*/
 }
 
 
 /* Store defaults into the per-connection CTRL object.  */
 void
 g13_syshelp_init_default_ctrl (ctrl_t ctrl)
 {
   ctrl->conttype = CONTTYPE_DM_CRYPT;
 }
 
 /* Release all resources allocated by default in the CTRl object.  */
 static void
 g13_syshelp_deinit_default_ctrl (ctrl_t ctrl)
 {
   xfree (ctrl->client.uname);
   release_tab_items (ctrl->client.tab);
 }
 
 
 /* Release the list of g13tab itejms at TAB.  */
 static void
 release_tab_items (tab_item_t tab)
 {
   while (tab)
     {
       tab_item_t next = tab->next;
       xfree (tab->mountpoint);
       xfree (tab);
       tab = next;
     }
 }
 
 
+void
+g13_syshelp_i_know_what_i_am_doing (void)
+{
+  const char * const yesfile = "Yes-g13-I-know-what-I-am-doing";
+  char *fname;
+
+  fname = make_filename (gnupg_sysconfdir (), yesfile, NULL);
+  if (access (fname, F_OK))
+    {
+      log_info ("*******************************************************\n");
+      log_info ("* The G13 support for DM-Crypt is new and not matured.\n");
+      log_info ("* Bugs or improper use may delete all your disks!\n");
+      log_info ("* To confirm that you are ware of this risk, create\n");
+      log_info ("* the file '%s'.\n", fname);
+      log_info ("*******************************************************\n");
+      exit (1);
+    }
+  xfree (fname);
+}
+
+
 /* Parse the /etc/gnupg/g13tab for user USERNAME.  Return a table for
    the user on success.  Return NULL on error and print
    diagnostics. */
 static tab_item_t
 parse_g13tab (const char *username)
 {
   gpg_error_t err;
   int c, n;
   char line[512];
   char *p;
   char *fname;
   estream_t fp;
   int lnr;
   char **words = NULL;
   tab_item_t table = NULL;
   tab_item_t *tabletail, ti;
 
   fname = make_filename (gnupg_sysconfdir (), G13_NAME"tab", NULL);
   fp = es_fopen (fname, "r");
   if (!fp)
     {
       err = gpg_error_from_syserror ();
       log_error (_("error opening '%s': %s\n"), fname, gpg_strerror (err));
       goto leave;
     }
 
   tabletail = &table;
   err = 0;
   lnr = 0;
   while (es_fgets (line, DIM(line)-1, fp))
     {
       lnr++;
       n = strlen (line);
       if (!n || line[n-1] != '\n')
         {
           /* Eat until end of line. */
           while ((c=es_getc (fp)) != EOF && c != '\n')
             ;
           err = gpg_error (*line? GPG_ERR_LINE_TOO_LONG
                            : GPG_ERR_INCOMPLETE_LINE);
           log_error (_("file '%s', line %d: %s\n"),
                      fname, lnr, gpg_strerror (err));
           continue;
         }
       line[--n] = 0; /* Chop the LF. */
       if (n && line[n-1] == '\r')
         line[--n] = 0; /* Chop an optional CR. */
 
       /* Allow for empty lines and spaces */
       for (p=line; spacep (p); p++)
         ;
       if (!*p || *p == '#')
         continue;
 
       /* Parse the line.  The format is
        * <username> <blockdev> [<label>|"-" [<mountpoint>]]
        */
       xfree (words);
       words = strtokenize (p, " \t");
       if (!words)
         {
           err = gpg_error_from_syserror ();
           break;
         }
       if (!words[0] || !words[1])
         {
           log_error (_("file '%s', line %d: %s\n"),
                      fname, lnr, gpg_strerror (GPG_ERR_SYNTAX));
           continue;
         }
       if (!(*words[1] == '/'
             || !strncmp (words[1], "PARTUUID=", 9)
             || !strncmp (words[1], "partuuid=", 9)))
         {
           log_error (_("file '%s', line %d: %s\n"),
                      fname, lnr, "Invalid block device syntax");
           continue;
         }
       if (words[2])
         {
           if (strlen (words[2]) > 16 || strchr (words[2], '/'))
             {
               log_error (_("file '%s', line %d: %s\n"),
                          fname, lnr, "Label too long or invalid syntax");
               continue;
             }
 
           if (words[3] && *words[3] != '/')
             {
               log_error (_("file '%s', line %d: %s\n"),
                          fname, lnr, "Invalid mountpoint syntax");
               continue;
             }
         }
       if (strcmp (words[0], username))
         continue; /* Skip entries for other usernames!  */
 
       ti = xtrymalloc (sizeof *ti + strlen (words[1]));
       if (!ti)
         {
           err = gpg_error_from_syserror ();
           break;
         }
       ti->next = NULL;
       ti->label = NULL;
       ti->mountpoint = NULL;
       strcpy (ti->blockdev, *words[1]=='/'? words[1] : words[1]+9);
       if (words[2])
         {
           if (strcmp (words[2], "-")
               && !(ti->label = xtrystrdup (words[2])))
             {
               err = gpg_error_from_syserror ();
               xfree (ti);
               break;
             }
           if (words[3] && !(ti->mountpoint = xtrystrdup (words[3])))
             {
               err = gpg_error_from_syserror ();
               xfree (ti->label);
               xfree (ti);
               break;
             }
         }
       *tabletail = ti;
       tabletail = &ti->next;
     }
 
   if (!err && !es_feof (fp))
     err = gpg_error_from_syserror ();
   if (err)
     log_error (_("error reading '%s', line %d: %s\n"),
                fname, lnr, gpg_strerror (err));
 
  leave:
   xfree (words);
   es_fclose (fp);
   xfree (fname);
   if (err)
     {
       release_tab_items (table);
       return NULL;
     }
   return table;
 }
diff --git a/g13/g13-syshelp.h b/g13/g13-syshelp.h
index 0503079cd..087fff609 100644
--- a/g13/g13-syshelp.h
+++ b/g13/g13-syshelp.h
@@ -1,90 +1,91 @@
 /* g130syshelp.h - Global definitions for G13-SYSHELP.
  * Copyright (C) 2015 Werner Koch
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef G13_SYSHELP_H
 #define G13_SYSHELP_H
 
 #include "g13-common.h"
 #include "g13tuple.h"
 
 struct tab_item_s;
 typedef struct tab_item_s *tab_item_t;
 
 struct tab_item_s
 {
   tab_item_t next;
   char *label;       /* Optional malloced label for that entry.  */
   char *mountpoint;  /* NULL or a malloced mountpoint.  */
   char blockdev[1];  /* String with the name of the block device.  If
                         it starts with a slash is is a regular device
                         name, otherwise it is a PARTUUID.  */
 };
 
 
 
 /* Forward declaration for an object defined in g13-sh-cmd.c.  */
 struct server_local_s;
 
 /* Session control object.  This object is passed down to most
    functions.  The default values for it are set by
    g13_syshelp_init_default_ctrl(). */
 struct server_control_s
 {
   int no_server;      /* We are not running under server control */
   int  status_fd;     /* Only for non-server mode */
   struct server_local_s *server_local;
 
   struct {
     uid_t uid;     /* UID of the client calling use.  */
     char *uname;
     tab_item_t tab;/* Linked list with the g13tab items for this user.  */
   } client;
 
   /* Flag indicating that we should fail all commands.  */
   int fail_all_cmds;
 
   /* Type of the current container.  See the CONTTYPE_ constants.  */
   int conttype;
 
   /* A pointer into client.tab with the selected tab line or NULL. */
   tab_item_t devti;
 };
 
 
 /*-- g13-syshelp.c --*/
 void g13_syshelp_init_default_ctrl (struct server_control_s *ctrl);
+void g13_syshelp_i_know_what_i_am_doing (void);
 
 /*-- sh-cmd.c --*/
 gpg_error_t syshelp_server (ctrl_t ctrl);
 gpg_error_t sh_encrypt_keyblob (ctrl_t ctrl,
                                 const void *keyblob, size_t keybloblen,
                                 char **r_enckeyblob, size_t *r_enckeybloblen);
 
 /*-- sh-blockdev.c --*/
 gpg_error_t sh_blockdev_getsz (const char *name, unsigned long long *r_nblocks);
 gpg_error_t sh_is_empty_partition (const char *name);
 
 /*-- sh-dmcrypt.c --*/
 gpg_error_t sh_dmcrypt_create_container (ctrl_t ctrl, const char *devname,
                                          estream_t devfp);
 gpg_error_t sh_dmcrypt_mount_container (ctrl_t ctrl, const char *devname,
                                         tupledesc_t keyblob);
 
 
 #endif /*G13_SYSHELP_H*/
diff --git a/g13/sh-dmcrypt.c b/g13/sh-dmcrypt.c
index f0693b1e9..e4d67aeb5 100644
--- a/g13/sh-dmcrypt.c
+++ b/g13/sh-dmcrypt.c
@@ -1,686 +1,690 @@
 /* sh-dmcrypt.c - The DM-Crypt part for g13-syshelp
- * Copyright (C) 2015 Werner Koch
+ * Copyright (C) 2015, 2016 Werner Koch
  *
  * This file is part of GnuPG.
  *
  * GnuPG is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 3 of the License, or
  * (at your option) any later version.
  *
  * GnuPG is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <config.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <stdarg.h>
 #include <errno.h>
 #include <assert.h>
 #include <sys/types.h>
 #ifdef HAVE_STAT
 # include <sys/stat.h>
 #endif
 #include <unistd.h>
 
 #include "g13-syshelp.h"
 #include <assuan.h>
 #include "i18n.h"
 #include "g13tuple.h"
 #include "exectool.h"
 #include "keyblob.h"
 
 /* The standard disk block size (logical).  */
 #define SECTOR_SIZE 512
 
 /* The physical block size used by modern devices.  */
 #define PHY_SECTOR_SIZE  (SECTOR_SIZE*8)  /* 4 KiB */
 
 /* The length of the crypto setup area in sectors.  16 KiB is a nice
    multiple of a modern block size and should be sufficient for all
    kind of extra public key encryption packets.  */
 #define SETUP_AREA_SECTORS 32  /* 16 KiB */
 
 /* The number of header block copies stored at the begin and end of
    the device.  */
 #define HEADER_SETUP_AREA_COPIES 2
 #define FOOTER_SETUP_AREA_COPIES 2
 
 /* The length in blocks of the space we put at the start and at the
    end of the device.  This space is used to store N copies of the
    setup area for the actual encrypted container inbetween.  */
 #define HEADER_SECTORS (SETUP_AREA_SECTORS * HEADER_SETUP_AREA_COPIES)
 #define FOOTER_SECTORS (SETUP_AREA_SECTORS * FOOTER_SETUP_AREA_COPIES)
 
 /* Minimim size of the encrypted space in blocks.  This is more or
    less an arbitrary value.  */
 #define MIN_ENCRYPTED_SPACE 32
 
 /* Some consistency checks for the above constants.  */
 #if (PHY_SECTOR_SIZE % SECTOR_SIZE)
 # error the physical secotor size should be a multiple of 512
 #endif
 #if ((SETUP_AREA_SECTORS*SECTOR_SIZE) % PHY_SECTOR_SIZE)
 # error The setup area size should be a multiple of the phy. sector size.
 #endif
 
 
 /* Check whether the block device DEVNAME is used by device mapper.
    Returns: 0 if the device is good and not yet used by DM.  */
 static gpg_error_t
 check_blockdev (const char *devname)
 {
   gpg_error_t err;
   struct stat sb;
   unsigned int devmajor, devminor;
   char *result = NULL;
   char **lines = NULL;
   char **fields = NULL;
   int lno, count;
 
   if (stat (devname, &sb))
     {
       err = gpg_error_from_syserror ();
       log_error ("error stating '%s': %s\n", devname, gpg_strerror (err));
       return err;
     }
   if (!S_ISBLK (sb.st_mode))
     {
       err = gpg_error (GPG_ERR_ENOTBLK);
       log_error ("can't use '%s': %s\n", devname, gpg_strerror (err));
       return err;
     }
   devmajor = major (sb.st_rdev);
   devminor = minor (sb.st_rdev);
 
   {
     const char *argv[2];
 
     argv[0] = "deps";
     argv[1] = NULL;
     err = gnupg_exec_tool ("/sbin/dmsetup", argv, NULL, &result, NULL);
   }
   if (err)
     {
       log_error ("error running '%s' to search for '%s': %s\n",
                  "dmsetup deps", devname, gpg_strerror (err));
       goto leave;
     }
   lines = strsplit (result, '\n', 0, NULL);
   if (!lines)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   if (lines[0] && !strcmp (lines[0], "No devices found"))
     ;
   else
     {
       for (lno=0; lines[lno]; lno++)
         {
           unsigned int xmajor, xminor;
 
           if (!*lines[lno])
             continue;
           xfree (fields);
           fields = strsplit (lines[lno], ':', 0, &count);
           if (!fields)
             {
               err = gpg_error_from_syserror ();
               goto leave;
             }
           if (count < 3
               || sscanf (fields[2], " (%u,%u)", &xmajor, &xminor) != 2)
             {
               log_error ("error running '%s' to search for '%s': %s\n",
                          "dmsetup deps", devname, "unexpected output");
               err = gpg_error (GPG_ERR_INV_VALUE);
               goto leave;
             }
 
           if (xmajor == devmajor && xminor == devminor)
             {
               log_error ("device '%s' (%u:%u) already used by device mapper\n",
                          devname, devmajor, devminor);
               err = gpg_error (GPG_ERR_EBUSY);
               goto leave;
             }
         }
     }
 
 
  leave:
   xfree (fields);
   xfree (lines);
   xfree (result);
   return err;
 }
 
 
 /* Return a malloced buffer with the prefix of the setup area.  This
    is the data written right before the encrypted keyblob.  Return NULL
    on error and sets ERRNO.  */
 static void *
 mk_setup_area_prefix (size_t *r_length)
 {
   unsigned char *packet;
   size_t setuparealen;
 
   packet = xtrymalloc (32);
   if (!packet)
     return NULL;
   *r_length = 32;
 
   setuparealen = SETUP_AREA_SECTORS * SECTOR_SIZE;
 
   packet[0] = (0xc0|61); /* CTB for the private packet type 0x61.  */
   packet[1] = 0xff;      /* 5 byte length packet, value 20.  */
   packet[2] = 0;
   packet[3] = 0;
   packet[4] = 0;
   packet[5] = 26;
   memcpy (packet+6, "GnuPG/G13", 10); /* Packet subtype.  */
   packet[16] = 1;   /* G13 packet format version.  */
   packet[17] = 0;   /* Reserved.  */
   packet[18] = 0;   /* Reserved.  */
   packet[19] = 1;   /* OS Flag = Linux  */
   packet[20] = (setuparealen >> 24);  /* Total length of header.  */
   packet[21] = (setuparealen >> 16);
   packet[22] = (setuparealen >> 8);
   packet[23] = (setuparealen);
   packet[24] = HEADER_SETUP_AREA_COPIES;
   packet[25] = FOOTER_SETUP_AREA_COPIES;
   packet[26] = 0;   /* Reserved.  */
   packet[27] = 0;   /* Reserved.  */
   packet[28] = 0;   /* Reserved.  */
   packet[29] = 0;   /* Reserved.  */
   packet[30] = 0;   /* Reserved.  */
   packet[31] = 0;   /* Reserved.  */
 
   return packet;
 }
 
 
 /* Create a new g13 styloe DM-Crypt container on devoce DEVNAME.  */
 gpg_error_t
 sh_dmcrypt_create_container (ctrl_t ctrl, const char *devname, estream_t devfp)
 {
   gpg_error_t err;
   char *header_space;
   size_t header_space_size, header_space_used;
   size_t paddinglen;
   char *targetname = NULL;
   size_t nread;
   char *p;
   char hexkey[16*2+1];
   char *table = NULL;
   unsigned long long nblocks;
   char *result = NULL;
   unsigned char twobyte[2];
   membuf_t keyblob;
   void  *keyblob_buf = NULL;
   size_t keyblob_len;
   size_t n;
   const char *s;
   unsigned char *packet;
   int copy;
 
   if (!ctrl->devti)
     return gpg_error (GPG_ERR_INV_ARG);
 
+  g13_syshelp_i_know_what_i_am_doing ();
+
   header_space_size = SETUP_AREA_SECTORS * SECTOR_SIZE;
   header_space = xtrymalloc (header_space_size);
   if (!header_space)
     return gpg_error_from_syserror ();
 
   /* Start building the keyblob.  */
   init_membuf (&keyblob, 512);
   append_tuple (&keyblob, KEYBLOB_TAG_BLOBVERSION, "\x01", 1);
   n = CONTTYPE_DM_CRYPT;
   twobyte[0] = (n >> 8);
   twobyte[1] = n;
   append_tuple (&keyblob, KEYBLOB_TAG_CONTTYPE, twobyte, 2);
   {
     gnupg_isotime_t tbuf;
 
     gnupg_get_isotime (tbuf);
     append_tuple (&keyblob, KEYBLOB_TAG_CREATED, tbuf, strlen (tbuf));
   }
 
   /* Rewind device stream.  */
   if (es_fseeko (devfp, 0, SEEK_SET))
     {
       err = gpg_error_from_syserror ();
       log_error ("error seeking to begin of '%s': %s\n",
                  devname, gpg_strerror (err));
       goto leave;
     }
   es_clearerr (devfp);
 
   /* Extra check that the device is empty.  */
   if (es_read (devfp, header_space, header_space_size, &nread))
     err = gpg_error_from_syserror ();
   else if (nread != header_space_size)
     err = gpg_error (GPG_ERR_TOO_SHORT);
   else
     err = 0;
   if (err)
     {
       log_error ("error reading header space of '%s': %s\n",
                  devname, gpg_strerror (err));
       goto leave;
     }
   for (p=header_space; nread && !*p; nread--, p++)
     ;
   if (nread)
     {
       log_error ("header space of '%s' already used - use %s to override\n",
                  devname, "--force");
       err = gpg_error (GPG_ERR_NOT_SUPPORTED);
       goto leave;
     }
 
   /* Check that the device is not used by device mapper. */
   err = check_blockdev (devname);
   if (err)
     goto leave;
 
   /* Compute the number of blocks.  */
   err = sh_blockdev_getsz (devname, &nblocks);
   if (err)
     {
       log_error ("error getting size of '%s': %s\n",
                  devname, gpg_strerror (err));
       goto leave;
     }
   if (nblocks <= HEADER_SECTORS + MIN_ENCRYPTED_SPACE + FOOTER_SECTORS)
     {
       log_error ("device '%s' is too small (min=%d blocks)\n",
                  devname,
                  HEADER_SECTORS + MIN_ENCRYPTED_SPACE + FOOTER_SECTORS);
       err = gpg_error (GPG_ERR_TOO_SHORT);
       goto leave;
     }
   append_tuple_uint (&keyblob, KEYBLOB_TAG_CONT_NSEC, nblocks);
   nblocks -= HEADER_SECTORS + FOOTER_SECTORS;
   append_tuple_uint (&keyblob, KEYBLOB_TAG_ENC_NSEC, nblocks);
   append_tuple_uint (&keyblob, KEYBLOB_TAG_ENC_OFF, HEADER_SECTORS);
 
   /* Device mapper needs a name for the device: Take it from the label
      or use "0".  */
   targetname = strconcat ("g13-", ctrl->client.uname, "-",
                           ctrl->devti->label? ctrl->devti->label : "0",
                           NULL);
   if (!targetname)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
 
   /* Create the key.  */
   {
     char key[16];
     gcry_randomize (key, sizeof key, GCRY_STRONG_RANDOM);
     append_tuple (&keyblob, KEYBLOB_TAG_ENCKEY, key, sizeof key);
     bin2hex (key, 16, hexkey);
     wipememory (key, 16);
     /* Add a 2*(4+16) byte filler to conceal the fact that we use
        AES-128.  If we ever want to switch to 256 bit we can resize
        that filler to keep the keyblob at the same size.  */
     append_tuple (&keyblob, KEYBLOB_TAG_FILLER, key, sizeof key);
     append_tuple (&keyblob, KEYBLOB_TAG_FILLER, key, sizeof key);
   }
 
   /* Build dmcrypt table. */
   s = "aes-cbc-essiv:sha256";
   append_tuple (&keyblob, KEYBLOB_TAG_ALGOSTR, s, strlen (s));
   table = es_bsprintf ("0 %llu crypt %s %s 0 %s %d",
                        nblocks, s, hexkey, devname, HEADER_SECTORS);
   if (!table)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   wipememory (hexkey, sizeof hexkey);
 
   /* Add a copy of the setup area prefix to the keyblob.  */
   p = mk_setup_area_prefix (&n);
   if (!p)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   append_tuple (&keyblob, KEYBLOB_TAG_HDRCOPY, p, n);
   assert (n < header_space_size);
   memcpy (header_space, p, n);
   header_space_used = n;
 
   /* Turn the keyblob into a buffer and callback to encrypt it.  */
   keyblob_buf = get_membuf (&keyblob, &keyblob_len);
   if (!keyblob_buf)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
   err = sh_encrypt_keyblob (ctrl, keyblob_buf, keyblob_len, &p, &n);
   if (err)
     {
       log_error ("encrypting the keyblob failed: %s\n", gpg_strerror (err));
       goto leave;
     }
   log_debug ("plain setuparea=%p %zu bytes\n", keyblob_buf, keyblob_len);
   wipememory (keyblob_buf, keyblob_len);
   xfree (keyblob_buf);
   keyblob_buf = NULL;
 
   log_debug ("encry setuparea=%p %zu bytes\n", p, n);
   if (n >= header_space_size || (header_space_used + n) >= header_space_size)
     {
       err = gpg_error (GPG_ERR_TOO_LARGE);
       log_error ("setup area would overflow: %s\n", gpg_strerror (err));
       goto leave;
     }
   memcpy (header_space + header_space_used, p, n);
   header_space_used += n;
 
   /* Write the padding.  */
   packet = header_space + header_space_used;
   paddinglen = header_space_size - header_space_used;
   if (paddinglen < 16)
     {
       err = gpg_error (GPG_ERR_TOO_LARGE);
       log_error ("setup area too short for padding: %s\n", gpg_strerror (err));
       goto leave;
     }
   packet[0] = (0xc0|61); /* CTB for Private packet type 0x61.  */
   packet[1] = 0xff;      /* 5 byte length packet, value 20.  */
   packet[2] = (paddinglen-6) >> 24;
   packet[3] = (paddinglen-6) >> 16;
   packet[4] = (paddinglen-6) >> 8;
   packet[5] = (paddinglen-6);
   packet += 6;
   paddinglen -= 6;
   header_space_used += 6;
   for ( ;paddinglen >= 10;
         paddinglen -= 10, packet += 10, header_space_used += 10)
     memcpy (packet, "GnuPG/PAD", 10);
   for ( ;paddinglen; paddinglen--, packet++, header_space_used++)
     *packet = 0;
 
   if (header_space_used != header_space_size)
     BUG ();
 
   /* Create the container.  */
   {
     const char *argv[3];
 
     argv[0] = "create";
     argv[1] = targetname;
     argv[2] = NULL;
     log_debug ("now running \"dmsetup create %s\"\n", targetname);
     log_debug ("  with table='%s'\"\n", table);
     err = gnupg_exec_tool ("/sbin/dmsetup", argv, table, &result, NULL);
   }
   if (err)
     {
       log_error ("error running dmsetup for '%s': %s\n",
                  devname, gpg_strerror (err));
       goto leave;
     }
   if (result && *result)
     log_debug ("dmsetup result: %s\n", result);
 
   /* Write the setup area.  */
   if (es_fseeko (devfp, 0, SEEK_SET))
     {
       err = gpg_error_from_syserror ();
       log_error ("error seeking to begin of '%s': %s\n",
                  devname, gpg_strerror (err));
       goto leave;
     }
   es_clearerr (devfp);
 
   for (copy = 0; copy < HEADER_SETUP_AREA_COPIES; copy++)
     {
       size_t nwritten;
 
       if (es_write (devfp, header_space, header_space_size, &nwritten))
         {
           err = gpg_error_from_syserror ();
           break;
         }
       else if (nwritten != header_space_size)
         {
           err = gpg_error (GPG_ERR_TOO_SHORT);
           break;
         }
     }
   if (err)
     {
       log_error ("error writing header space copy %d of '%s': %s\n",
                  copy, devname, gpg_strerror (err));
       goto leave;
     }
 
   if (es_fseeko (devfp,
                  (- header_space_size * FOOTER_SETUP_AREA_COPIES), SEEK_END))
     {
       err = gpg_error_from_syserror ();
       log_error ("error seeking to end of '%s': %s\n",
                  devname, gpg_strerror (err));
       goto leave;
     }
   es_clearerr (devfp);
 
   for (copy = 0; copy < FOOTER_SETUP_AREA_COPIES; copy++)
     {
       size_t nwritten;
 
       if (es_write (devfp, header_space, header_space_size, &nwritten))
         {
           err = gpg_error_from_syserror ();
           break;
         }
       else if (nwritten != header_space_size)
         {
           err = gpg_error (GPG_ERR_TOO_SHORT);
           break;
         }
     }
   if (!err && es_fflush (devfp))
     err = gpg_error_from_syserror ();
   if (err)
     {
       log_error ("error writing footer space copy %d of '%s': %s\n",
                  copy, devname, gpg_strerror (err));
       goto leave;
     }
 
  leave:
   wipememory (hexkey, sizeof hexkey);
   if (table)
     {
       wipememory (table, strlen (table));
       xfree (table);
     }
   if (keyblob_buf)
     {
       wipememory (keyblob_buf, keyblob_len);
       xfree (keyblob_buf);
     }
   xfree (get_membuf (&keyblob, NULL));
   xfree (targetname);
   xfree (result);
   xfree (header_space);
   return err;
 }
 
 
 /* Mount a DM-Crypt congtainer on device DEVNAME taking keys and other
  * meta data from KEYBLOB.  */
 gpg_error_t
 sh_dmcrypt_mount_container (ctrl_t ctrl, const char *devname,
                             tupledesc_t keyblob)
 {
   gpg_error_t err;
   char *targetname = NULL;
   char hexkey[16*2+1];
   char *table = NULL;
   unsigned long long nblocks, nblocks2;
   char *result = NULL;
   size_t n;
   const char *s;
   const char *algostr;
   size_t algostrlen;
 
   if (!ctrl->devti)
     return gpg_error (GPG_ERR_INV_ARG);
 
+  g13_syshelp_i_know_what_i_am_doing ();
+
   /* Check that the device is not yet used by device mapper. */
   err = check_blockdev (devname);
   if (err)
     goto leave;
 
   /* Compute the number of blocks and compare them to the value
      provided as meta data.  */
   err = sh_blockdev_getsz (devname, &nblocks);
   if (err)
     {
       log_error ("error getting size of '%s': %s\n",
                  devname, gpg_strerror (err));
       goto leave;
     }
   err = find_tuple_uint (keyblob, KEYBLOB_TAG_CONT_NSEC, &nblocks2);
   if (err)
     {
       log_error ("error getting size from keyblob: %s\n", gpg_strerror (err));
       goto leave;
     }
   if (nblocks != nblocks2)
     {
       log_error ("inconsistent size of container: expected==%llu got=%llu\n",
                  nblocks2, nblocks);
       err = gpg_error (GPG_ERR_INV_DATA);
       goto leave;
     }
   if (nblocks <= HEADER_SECTORS + MIN_ENCRYPTED_SPACE + FOOTER_SECTORS)
     {
       log_error ("device '%s' is too small (min=%d blocks)\n",
                  devname,
                  HEADER_SECTORS + MIN_ENCRYPTED_SPACE + FOOTER_SECTORS);
       err = gpg_error (GPG_ERR_TOO_SHORT);
       goto leave;
     }
   nblocks -= HEADER_SECTORS + FOOTER_SECTORS;
   err = find_tuple_uint (keyblob, KEYBLOB_TAG_ENC_NSEC, &nblocks2);
   if (err)
     {
       log_error ("error getting enc size from keyblob: %s\n",
                  gpg_strerror (err));
       goto leave;
     }
   if (nblocks != nblocks2)
     {
       log_error ("inconsistent size of enc data: expected==%llu got=%llu\n",
                  nblocks2, nblocks);
       err = gpg_error (GPG_ERR_INV_DATA);
       goto leave;
     }
   /* Check that the offset is consistent.  */
   err = find_tuple_uint (keyblob, KEYBLOB_TAG_ENC_OFF, &nblocks2);
   if (err)
     {
       log_error ("error getting enc offset from keyblob: %s\n",
                  gpg_strerror (err));
       goto leave;
     }
   if (nblocks2 != HEADER_SECTORS)
     {
       log_error ("inconsistent offset of enc data: expected==%llu got=%d\n",
                  nblocks2, HEADER_SECTORS);
       err = gpg_error (GPG_ERR_INV_DATA);
       goto leave;
     }
 
   /* Device mapper needs a name for the device: Take it from the label
      or use "0".  */
   targetname = strconcat ("g13-", ctrl->client.uname, "-",
                           ctrl->devti->label? ctrl->devti->label : "0",
                           NULL);
   if (!targetname)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
 
   /* Get the algorithm string.  */
   algostr = find_tuple (keyblob, KEYBLOB_TAG_ALGOSTR, &algostrlen);
   if (!algostr || algostrlen > 100)
     {
       log_error ("algo string not found in keyblob or too long\n");
       err = gpg_error (GPG_ERR_INV_DATA);
       goto leave;
     }
 
   /* Get the key.  */
   s = find_tuple (keyblob, KEYBLOB_TAG_ENCKEY, &n);
   if (!s || n != 16)
     {
       if (!s)
         log_error ("no key found in keyblob\n");
       else
         log_error ("unexpected size of key (%zu)\n", n);
       err = gpg_error (GPG_ERR_INV_KEYLEN);
       goto leave;
     }
   bin2hex (s, 16, hexkey);
 
   /* Build dmcrypt table. */
   table = es_bsprintf ("0 %llu crypt %.*s %s 0 %s %d",
                        nblocks, (int)algostrlen, algostr,
                        hexkey, devname, HEADER_SECTORS);
   wipememory (hexkey, sizeof hexkey);
   if (!table)
     {
       err = gpg_error_from_syserror ();
       goto leave;
     }
 
   /* Load the table.  */
   {
     const char *argv[3];
 
     argv[0] = "create";
     argv[1] = targetname;
     argv[2] = NULL;
     log_debug ("now running \"dmsetup create %s\"\n", targetname);
     err = gnupg_exec_tool ("/sbin/dmsetup", argv, table, &result, NULL);
   }
   if (err)
     {
       log_error ("error running dmsetup for '%s': %s\n",
                  devname, gpg_strerror (err));
       goto leave;
     }
   if (result && *result)
     log_debug ("dmsetup result: %s\n", result);
 
 
  leave:
   wipememory (hexkey, sizeof hexkey);
   if (table)
     {
       wipememory (table, strlen (table));
       xfree (table);
     }
   xfree (targetname);
   xfree (result);
   return err;
 }