diff options
Diffstat (limited to 'crypto')
| -rw-r--r-- | crypto/crypto.go | 4 | ||||
| -rw-r--r-- | crypto/crypto_test.go | 18 | ||||
| -rw-r--r-- | crypto/key.go | 47 |
3 files changed, 13 insertions, 56 deletions
diff --git a/crypto/crypto.go b/crypto/crypto.go index b6368ce..62226b9 100644 --- a/crypto/crypto.go +++ b/crypto/crypto.go @@ -20,7 +20,6 @@ // Package crypto manages all the cryptography for fscrypt. This includes: // - Key management (key.go) // - Securely holding keys in memory -// - Inserting keys into the keyring // - Making recovery keys // - Randomness (rand.go) // - Cryptographic algorithms (crypto.go) @@ -63,9 +62,6 @@ var ( ErrGetrandomFail = util.SystemError("getrandom() failed") ErrKeyAlloc = util.SystemError("could not allocate memory for key") ErrKeyFree = util.SystemError("could not free memory of key") - ErrKeyringInsert = util.SystemError("could not insert key into the keyring") - ErrKeyringSearch = errors.New("could not find key with descriptor") - ErrKeyringDelete = util.SystemError("could not delete key from the keyring") ) // panicInputLength panics if "name" has invalid length (expected != actual) diff --git a/crypto/crypto_test.go b/crypto/crypto_test.go index 58aca9e..a069b1b 100644 --- a/crypto/crypto_test.go +++ b/crypto/crypto_test.go @@ -30,7 +30,10 @@ import ( "os" "testing" + "golang.org/x/sys/unix" + "github.com/google/fscrypt/metadata" + "github.com/google/fscrypt/security" ) // Reader that always returns the same byte @@ -52,6 +55,7 @@ var ( fakeValidDescriptor = "0123456789abcdef" fakeSalt = bytes.Repeat([]byte{'a'}, metadata.SaltLen) fakePassword = []byte("password") + defaultService = unix.FS_KEY_DESC_PREFIX fakeValidPolicyKey, _ = makeKey(42, metadata.PolicyKeyLen) fakeInvalidPolicyKey, _ = makeKey(42, metadata.PolicyKeyLen-1) @@ -237,12 +241,12 @@ func TestKeyLargeResize(t *testing.T) { // Adds and removes a key with various services. func TestAddRemoveKeys(t *testing.T) { - for _, service := range []string{DefaultService, "ext4:", "f2fs:"} { + for _, service := range []string{defaultService, "ext4:", "f2fs:"} { validDescription := service + fakeValidDescriptor if err := InsertPolicyKey(fakeValidPolicyKey, validDescription); err != nil { t.Error(err) } - if err := RemovePolicyKey(validDescription); err != nil { + if err := security.RemoveKey(validDescription); err != nil { t.Error(err) } } @@ -250,24 +254,24 @@ func TestAddRemoveKeys(t *testing.T) { // Adds a key twice (both should succeed) func TestAddTwice(t *testing.T) { - validDescription := DefaultService + fakeValidDescriptor + validDescription := defaultService + fakeValidDescriptor InsertPolicyKey(fakeValidPolicyKey, validDescription) if InsertPolicyKey(fakeValidPolicyKey, validDescription) != nil { t.Error("InsertPolicyKey should not fail if key already exists") } - RemovePolicyKey(validDescription) + security.RemoveKey(validDescription) } // Makes sure a key fails with bad policy or service func TestBadAddKeys(t *testing.T) { - validDescription := DefaultService + fakeValidDescriptor + validDescription := defaultService + fakeValidDescriptor if InsertPolicyKey(fakeInvalidPolicyKey, validDescription) == nil { - RemovePolicyKey(validDescription) + security.RemoveKey(validDescription) t.Error("InsertPolicyKey should fail with bad policy key") } invalidDescription := "ext4" + fakeValidDescriptor if InsertPolicyKey(fakeValidPolicyKey, invalidDescription) == nil { - RemovePolicyKey(invalidDescription) + security.RemoveKey(invalidDescription) t.Error("InsertPolicyKey should fail with bad service") } } diff --git a/crypto/key.go b/crypto/key.go index 1d9e72c..656e6dc 100644 --- a/crypto/key.go +++ b/crypto/key.go @@ -40,20 +40,11 @@ import ( "golang.org/x/sys/unix" "github.com/google/fscrypt/metadata" + "github.com/google/fscrypt/security" "github.com/google/fscrypt/util" ) const ( - // DefaultService is the service which should be used for all encryption - // keys unless not possible for legacy reasons. For ext4 systems before - // v4.8 and f2fs systems before v4.6, filesystem specific services must - // be used (these legacy services will still work with later kernels). - DefaultService = unix.FS_KEY_DESC_PREFIX - // KeyringID is the keyring that fscrypt's keys will be added to. Currently it - // is the user keyring to avoid hitting systemd/issues/5715. - KeyringID = unix.KEY_SPEC_USER_KEYRING - // keyType is always logon as required by filesystem encryption - keyType = "logon" // Keys need to readable and writable, but hidden from other processes. keyProtection = unix.PROT_READ | unix.PROT_WRITE keyMmapFlags = unix.MAP_PRIVATE | unix.MAP_ANONYMOUS @@ -252,34 +243,6 @@ func NewFixedLengthKeyFromReader(reader io.Reader, length int) (*Key, error) { return key, nil } -// FindPolicyKey tries to locate a policy key in the kernel keyring with the -// provided description. The keyring and key ids are returned if we can find the -// key. An error is returned if the key does not exist. -func FindPolicyKey(description string) (keyID int, err error) { - keyID, err = unix.KeyctlSearch(KeyringID, keyType, description, 0) - log.Printf("unix.KeyctlSearch(%d, %s, %s) = %d, %v", KeyringID, keyType, description, keyID, err) - if err != nil { - err = errors.Wrap(ErrKeyringSearch, err.Error()) - } - return -} - -// RemovePolicyKey tries to remove a policy key from the kernel keyring with the -// provided description. An error is returned if the key does not exist. -func RemovePolicyKey(description string) error { - keyID, err := FindPolicyKey(description) - if err != nil { - return err - } - - _, err = unix.KeyctlInt(unix.KEYCTL_UNLINK, keyID, KeyringID, 0, 0) - log.Printf("unix.KeyctlUnlink(%d, %d) = %v", keyID, KeyringID, err) - if err != nil { - return errors.Wrap(ErrKeyringDelete, err.Error()) - } - return nil -} - // InsertPolicyKey puts the provided policy key into the kernel keyring with the // provided description, and type logon. The key must be a policy key. func InsertPolicyKey(key *Key, description string) error { @@ -301,13 +264,7 @@ func InsertPolicyKey(key *Key, description string) error { fscryptKey.Size = metadata.PolicyKeyLen copy(fscryptKey.Raw[:], key.data) - keyID, err := unix.AddKey(keyType, description, payload.data, KeyringID) - log.Printf("unix.AddKey(%s, %s, <payload>, %d) = %d, %v", - keyType, description, KeyringID, keyID, err) - if err != nil { - return errors.Wrap(ErrKeyringInsert, err.Error()) - } - return nil + return security.InsertKey(payload.data, description) } var ( |