diff options
| author | Eric Biggers <ebiggers@google.com> | 2021-12-23 11:39:08 -0600 |
|---|---|---|
| committer | Eric Biggers <ebiggers@google.com> | 2021-12-23 11:44:13 -0600 |
| commit | 6ebd5a54eae2dfb16b66da649e75848fe6030b7f (patch) | |
| tree | 35560cae2edcc7ad7206412c2df9d98b2eef6a65 /actions/policy.go | |
| parent | 57be034ce4700fb07c10b771628c1c63d8483d09 (diff) | |
cmd/fscrypt: don't load protector in remove-protector-from-policy
Make remove-protector-from-policy work even if the protector cannot be
loaded (for example, due to having been deleted already).
Fixes https://github.com/google/fscrypt/issues/258
Fixes https://github.com/google/fscrypt/issues/272
Diffstat (limited to 'actions/policy.go')
| -rw-r--r-- | actions/policy.go | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/actions/policy.go b/actions/policy.go index 6c48117..7204380 100644 --- a/actions/policy.go +++ b/actions/policy.go @@ -461,14 +461,15 @@ func (policy *Policy) AddProtector(protector *Protector) error { } // RemoveProtector updates the data that is wrapping the Policy Key so that the -// provided Protector is no longer protecting the specified Policy. If an error -// is returned, no data has been changed. Note that no protector links are +// protector with the given descriptor is no longer protecting the specified +// Policy. If an error is returned, no data has been changed. Note that the +// protector itself won't be removed, nor will a link to the protector be // removed (in the case where the protector and policy are on different -// filesystems). The policy and protector can be locked or unlocked. -func (policy *Policy) RemoveProtector(protector *Protector) error { - idx, ok := policy.findWrappedKeyIndex(protector.Descriptor()) +// filesystems). The policy can be locked or unlocked. +func (policy *Policy) RemoveProtector(protectorDescriptor string) error { + idx, ok := policy.findWrappedKeyIndex(protectorDescriptor) if !ok { - return &ErrNotProtected{policy.Descriptor(), protector.Descriptor()} + return &ErrNotProtected{policy.Descriptor(), protectorDescriptor} } if len(policy.data.WrappedPolicyKeys) == 1 { |