fscrypt.git/cli-tests/t_v1_policy.out, branch v0.3.2 Go tool for managing Linux filesystem encryption cmd/fscrypt: adjust status message for v1-encrypted dirs 2020-06-13T17:06:15+00:00 Eric Biggers ebiggers@google.com 2020-06-13T17:06:15+00:00 5c1f617c647eb0e9af5ce57758fa58f7e3f4db83 When 'fscrypt status DIR' detects that a v1-encrypted directory is still usable but its key seems to be absent, it shows the status as "Unlocked: Partially (incompletely locked)". But actually it can also be the case that the directory is unlocked by another user. Adjust the status message accordingly. This commit also fixes cli-tests/t_v1_policy. 
When 'fscrypt status DIR' detects that a v1-encrypted directory is still
usable but its key seems to be absent, it shows the status as
"Unlocked: Partially (incompletely locked)".  But actually it can also
be the case that the directory is unlocked by another user.  Adjust the
status message accordingly.

This commit also fixes cli-tests/t_v1_policy.
cmd/fscrypt: improve errors 2020-05-09T22:21:31+00:00 Eric Biggers ebiggers@google.com 2020-05-09T21:52:07+00:00 181600d6327ed34a3f62eda0dd03a6d2ae49e5f9 In checkEncryptable(), check whether the directory is already encrypted before checking whether it's empty. Also improve the error message for when a directory is nonempty. Finally, translate keyring.ErrKeyAddedByOtherUsers and keyring.ErrKeyFilesOpen into errors which include the directory. 
In checkEncryptable(), check whether the directory is already encrypted
before checking whether it's empty.

Also improve the error message for when a directory is nonempty.

Finally, translate keyring.ErrKeyAddedByOtherUsers and
keyring.ErrKeyFilesOpen into errors which include the directory.
keyring: improve errors 2020-05-09T22:21:31+00:00 Eric Biggers ebiggers@google.com 2020-05-09T21:52:07+00:00 fb88d74f0335cdf8218bb8dfbaa03f23773318cf ErrAccessUserKeyring: Include the user, and fix the backwards wrapping. ErrSessionUserKeyring: Include the user. ErrKeyAdd: ErrKeyRemove: ErrKeySearch: ErrLinkUserKeyring: Replace these with one-off unnamed errors because they are never checked for, and this makes it easier for the callers to provide better messages, e.g. fixing the backwards wrapping. 
ErrAccessUserKeyring:
	Include the user, and fix the backwards wrapping.

ErrSessionUserKeyring:
	Include the user.

ErrKeyAdd:
ErrKeyRemove:
ErrKeySearch:
ErrLinkUserKeyring:
	Replace these with one-off unnamed errors because they are
	never checked for, and this makes it easier for the callers to
	provide better messages, e.g. fixing the backwards wrapping.
Try to detect incomplete locking of v1-encrypted directory 2020-05-09T22:16:13+00:00 Eric Biggers ebiggers@google.com 2020-05-09T21:17:17+00:00 de51add609bc74b7247ec4776bd694abbea24a45 'fscrypt lock' on a v1-encrypted directory doesn't warn about in-use files, as the kernel doesn't provide a way to easily detect it. Instead, implement a heuristic where we check whether a subdirectory can be created. If yes, then the directory must not be fully locked. Make both 'fscrypt lock' and 'fscrypt status' use this heuristic. Resolves https://github.com/google/fscrypt/issues/215 
'fscrypt lock' on a v1-encrypted directory doesn't warn about in-use
files, as the kernel doesn't provide a way to easily detect it.

Instead, implement a heuristic where we check whether a subdirectory can
be created.  If yes, then the directory must not be fully locked.

Make both 'fscrypt lock' and 'fscrypt status' use this heuristic.

Resolves https://github.com/google/fscrypt/issues/215
cli-tests: add t_v1_policy 2020-05-09T21:04:47+00:00 Eric Biggers ebiggers@google.com 2020-05-09T21:04:47+00:00 b13bfeef21c18302dcb31f7fb6d354da9a5a567b Test using v1 encryption policies (deprecated). 
Test using v1 encryption policies (deprecated).