| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
|
|
Release: v0.2.4
|
|
|
|
Cleanup privilege dropping/raising in pam_fscrypt
|
|
|
|
This change makes sure that, when we set the ruid and euid in order to
get the user keyring linked into the current process keyring, we will
always be able to reverse these changes (using a suid of 0).
This fixes an issue where "su <user>" would result in a system error
when called by an unprivileged user. It also explains exactly how and
why we are making these privilege changes.
|
|
This change makes sure after dropping then elevating privileges for a
process, the euid, guid, and groups are all the same as they were
originally. This significantly simplifies the privilege logic.
This fixes CVE-2018-6558, which allowed an unprivleged user to gain
membership in the root group (gid 0) due to the groups not being
properly reset in the process.
|
|
Fix Travis to only use Go 1.10
|
|
|
|
|
|
Use proper sizes when casting to Go slice
|
|
Addresses most of the issues in #101.
The following commands now succeed:
GOARCH=mips go build github.com/google/fscrypt/util
GOARCH=mipsle go build github.com/google/fscrypt/util
|
|
security: drop and regain privileges in all threads
|
|
pam: return error when PAM info item is unset
|
|
After enabling pam_fscrypt for "session" and creating a directory
protected with a login protector, I was no longer able to log in as that
user. The problem is that the Go runtime is creating threads after
pam_fscrypt drops privileges, but pam_fscrypt is not re-acquiring
privileges on those threads because the Go wrappers for setreuid(),
setregid(), and setgroups() in the "sys/unix" package are using the raw
syscalls which operate on the calling thread only.
This violates glibc's assumption that all threads have the same uids and
gids, causing it to abort() the process when a later module in the PAM
stack (pam_mail in my case) tries to drop privileges using the glibc
functions.
Fix it by dropping and regaining privileges using the glibc functions
rather than the "sys/unix" functions.
This also avoids any possibility that privileges could be changed in a
thread other than the "main" one for pam_fscrypt, since the Go runtime
does not guarantee which OS-level thread runs what.
It would be nice to also exit all Go worker threads before returning
from pam_fscrypt, but the Go runtime doesn't seem to support that.
|
|
pam_fscrypt is crashing with a segfault in copyIntoSecret() when using
Ctrl-C to interrupt a 'sudo' prompt. It is dereferencing a NULL pointer
that is supposed point to the PAM_AUTHTOK item. The problem is that the
Go code assumes pam_get_item() returns a non-success status if the item
is unset, when actually it sets the data pointer to NULL and returns
PAM_SUCCESS.
Fix it by making pam.Handle.GetItem() return an error in that case.
|
|
Also clarifies some other minor points.
|
|
According to:
https://www.gnu.org/software/coreutils/manual/html_node/arch-invocation.html
the arch command isn't portable, so we switch to uname.
|
|
Protoc: https://github.com/google/protobuf/blob/a711e3d5b4ee1dd7f9d21197dca8432a5819a64e/protoc-artifacts/build-protoc.sh#L82-L83
Go: https://github.com/golang/sys/blob/37707fdb30a5b38865cfb95e5aab41707daec7fd/unix/linux/mkall.go#L43-L79
|
|
Using "arch" instead of "go env GOARCH" is more standard and doesn't
generate a warning on "sudo make install".
|
|
Release: v0.2.3
|
|
|
|
travis: Fix travis bug
|
|
|
|
Makefile: bump protoc to most recent version
|
|
|
|
|
|
travis: Upload encrypted API key
|
|
|
|
Minor fixes and cleanup
|
|
Running "go vet -shadow ./..." finds all places where a variable might
be incorrectly or unnecessarily shadowed. This fixes some of them.
|
|
|
|
docs: Update CONTRIBUTING.md and README.md
|
|
PR #85 failed to update the documentation. This is now fixed with some
additional cleanup.
|
|
Complete the new Build System
|
|
This change rewrites .travis.yml to use many build stages/jobs. This
allows our build to run faster, as almost all jobs run in containers.
Stage 1: Run on all pushes to all branches
- Job Build: just runs "make" to make sure everything is OK
Stage 2: Run on all PRs and pushes to master
- Job Lint: Makes sure dep, "make gen", "make format", and "make lint"
are all happy.
- Job Build 1: Make sure "go get" and "make" will work. This job will
later run unit tests.
- Job Build 2: Same as Job Build 1, except with another go version.
- Job Integeration: Run integration tests (needs sudo, so needs VM)
Stage 3: Run on releases (if other stages pass)
- Job Deploy: Publishes amd64 binaries to GitHub.
|
|
This change is a complete rewrite of fscrypt's Makefile.
The new build rules can be roughly divided into secions:
Build - bin/fscrypt and bin/pam_fscrypt
Linting - gen (for .proto files), format, lint
Test - test, test-{setup|teardown}, coverage.out
Install - install, uninstall, install-{bin|pam}
Tools - tools and other bin/* needed for the other rules
As before, "make" builds the binary and pam_module, while "make all"
builds and tests everything (except for integration tests), and "make
clean" removes any generated files.
Also note that this new build system:
- Doesn't require input_fail.py
- Properly falis on linter errors
- Builds everything into the bin/ directory (customizable)
- Builds all the vendored tools
|
|
Ideally, we would just use "golint ./..." to check all our our source
files for lint error. However, this does not work because it will
include all packages in the vendor directory. The pull request at:
https://github.com/golang/lint/pull/325
fixes this issue, so we will use it until the PR has been merged.
|
|
This change vendors the source for all our build, formatting, and
linting tools. Generated by running "dep ensure".
|
|
This change ot Gopkg.toml will make it easier to build the linting and
formatting tools. Vendoring their source also makes sure that updates to
these tools do not break the build.
|
|
This change updates dependancies to be consistent with Gopkg.toml.
This change was generated by running "dep ensure".
|
|
fscrypt directly depends on 5 repositories (8 packages). This change
adds those dependancies to Gopkg.toml, so that they can be properly
versioned. Note that the golang.org/x repositories do not use semver.
|
|
The tests added in this change are trivial, but they make sure that
every package has a non-zero number of tests. This is important for
eventually increasing test coverage.
|
|
Our current build tags set off the linter. We will later add in more
comprehensive build tags that will be properly formatted.
|
|
Move to x/crypto/argon2
|
|
|
|
Now that Argon2 is simply and implementation detail of the `crypto`
package, and no a build dependancy, we don't need it in Travis or in the
documenation for building fscrypt.
|
|
Use the golang library for the hashing function instead of the reference
C implementation. This removes the dependancy on libargon2. As we are no
longer doing our own error checking, we also eliminate those tests.
|
