aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-03-09Merge pull request #281 from ebiggers/pam_fscrypt-updatesJoseph Richey
pam_fscrypt: eliminate unnecessary options and improve documentation
2021-03-08README: improve PAM configuration documentation (again)Eric Biggers
Make some more corrections: - pam-config-framework isn't actually Ubuntu-specific but actually applies to Debian and any Debian derivative. - The pam-config-framework file is indeed installed by `make install`, just not into the correct location. - On Debian (and Debian derivatives), the PAM configuration isn't actually part of the 'fscrypt' package but rather 'libpam-fscrypt'. - Clarify where to add the pam_fscrypt.so session hook.
2021-03-08README: make it clear that pam_fscrypt also handles lockingEric Biggers
There are several mentions of pam_fscrypt handling unlocking directories. Make sure to mention locking alongside this.
2021-03-08pam_fscrypt: make "lock_policies" the default behaviorEric Biggers
All pam_fscrypt configuration guides that I'm aware of say to use the "lock_policies" option for the pam_fscrypt.so session hook. The Debian/Ubuntu pam-config-framework config file has it too. Make locking the default behavior, since this is what everyone wants. Existing configuration files that contain the "lock_policies" option will continue to work, but that option won't do anything anymore. (We could add an option "unlock_only" to restore the old default behavior, but it's not clear that it would be useful. So for simplicity, leave it out for now.)
2021-03-08pam_fscrypt: decide cache dropping behavior automaticallyEric Biggers
Configuring whether pam_fscrypt drops caches or not isn't really something the user should have to do, and it's also irrelevant for v2 encryption policies (the default on newer systems). It's better to have pam_fscrypt automatically decide whether it needs to drop caches or not. Do this by making pam_fscrypt check whether any encryption policy keys are being removed from a user keyring (rather than from a filesystem keyring). If so, it drops caches; otherwise it doesn't. This supersedes the "drop_caches" option, which won't do anything anymore.
2021-03-03pam_fscrypt/config: prioritise over other session modulesRobert McQueen
Services launched by systemd user sessions on Debian / Ubuntu systems are often not able to access the home directory, because there is no guarantee / requirement that pam_fscrypt is sequenced before pam_systemd. Although this pam-config mechanism is Debian-specific, the config file is provided here upstream and unmodified in Debian. Raising the priority here so that it's always ordered ahead of pam_systemd will solve issues such as https://github.com/google/fscrypt/issues/270, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964951 and https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1889416. After a survey of pam-config files available in Debian bullseye, the value of 100 was chosen as it appears after most other plugins that could be involved in more explicit homedir configuration (eg pam_mount at 128) but before those which seem unlikely to work without a home directory (eg pam_ssh at 64).
2021-02-02ci.yml: always run apt-get updateEric Biggers
In GitHub Workflows, apparently running 'apt-get update' before 'apt-get install' is sometimes needed, and it doesn't hurt to always do it.
2021-01-25Avoid using the word "whitelist"Eric Biggers
2021-01-19cmd/fscrypt: fix missing protector error formatAlastair Hughes
Update #272
2020-11-30bash-completion: add completion scriptHenry-Joseph Audéoud
2020-11-26README: Fix badge imageJoe Richey
Workflow names are case-sensitive Signed-off-by: Joe Richey <joerichey@google.com>
2020-11-26Switch from Travis CI to GitHub ActionsEric Biggers
travis-ci.org is being shut down, so switch to GitHub Actions. It should be mostly equivalent, but I did drop functionality in a couple cases: - Publishing release binaries. I don't think providing Linux binaries is useful, since people build their own anyway. So I left this out. - Build and testing on ppc64le. GitHub Actions only natively supports x86. I tried uraimo/run-on-arch-action, which uses Docker and QEMU user-mode emulation, but the fscrypt tests can't be run because QEMU user-mode emulation doesn't support all the needed system calls.
2020-11-26cli-tests: force processes spawned by 'expect' to have 80 column-outputEric Biggers
Otherwise the cli tests fail when executed from GitHub Actions.
2020-11-09README.md: add table of contentsEric Biggers
2020-11-07travis.yml: upgrade to Ubuntu 20.04 and enable cli testsEric Biggers
Now that Travis CI supports a version of Ubuntu that has a kernel that supports v2 encryption policies, upgrade to it and enable the cli tests.
2020-11-07cmd/fscrypt: fix race condition in getPassphraseKey()Eric Biggers
Set the terminal to raw mode *before* printing the prompt. Otherwise the user (or the automated test) might enter the passphrase before the terminal gets put into raw mode. This is needed for some of the CLI tests to pass reliably in Travis CI.
2020-11-07cli-tests/common.sh: fix _user_do()Eric Biggers
Apparently, on some distros 'su' doesn't preserve $PATH. So, manually export it in the command. Also, ensure that the shell stays as bash. This is needed for some of the CLI tests to pass in Travis CI.
2020-11-07cmd/fscrypt: fix isDirUnlockedHeuristic() on latest kernelsEric Biggers
On an "incompletely locked" directory, isDirUnlockedHeuristic() is supposed to return true, but on Linux v5.10-rc1 and later it returns false since now creating a subdirectory fails rather than succeeds. This change was intentional, so make isDirUnlockedHeuristic() apply a second heuristic too: also return true if any filenames in the directory don't appear to be valid no-key names. This fixes cli-tests/t_v1_encrypt on Linux v5.10-rc1 and later.
2020-10-15Travis-ci: added support for ppc64le (#257)sanjaymsh
2020-08-09Fix nil error issue, Resolves https://github.com/google/fscrypt/issues/242bitcodr
2020-08-07README.md: recommend 'sudo make install PREFIX=/usr' on Ubuntu (#244)Eric Biggers
Ubuntu's PAM configuration framework only recognizes files in /usr, not /usr/local. So for installs from source, unfortunately we have to recommend installing to /usr, despite this not being conventional. Resolves https://github.com/google/fscrypt/issues/240
2020-06-13Release version v0.2.9 (#238)v0.2.9Eric Biggers
2020-06-13Merge pull request #237 from ebiggers/t_v1_policy_fixEric Biggers
Adjust status message for v1 policies unlocked by another user and fix cli-tests/t_v1_policy
2020-06-13cmd/fscrypt: adjust status message for v1-encrypted dirsEric Biggers
When 'fscrypt status DIR' detects that a v1-encrypted directory is still usable but its key seems to be absent, it shows the status as "Unlocked: Partially (incompletely locked)". But actually it can also be the case that the directory is unlocked by another user. Adjust the status message accordingly. This commit also fixes cli-tests/t_v1_policy.
2020-06-13cli-tests/t_v1_policy: clean up user keyrings at end of testEric Biggers
The test user's user keyring is still linked into root's user keyring at the end of the test. This is making the test flaky, as there is a failure that only occurs the first time it is run. Fix the test to restore the initial state. This makes it consistently fail (to be fixed by the next commit).
2020-06-02Merge pull request #235 from ebiggers/32bit-fixEric Biggers
* cmd/fscrypt: fix 32-bit build * travis.yml: build 32-bit binary
2020-06-02cmd/fscrypt: fix 32-bit buildEric Biggers
statfs.Bsize actually has platform-dependent type, despite the Go documentation listing it as int64. Fix the build for 32-bit platforms by casting it to int64. Resolves https://github.com/google/fscrypt/issues/233
2020-06-02travis.yml: build 32-bit binaryEric Biggers
Don't let people check in code that breaks 32-bit builds. Update https://github.com/google/fscrypt/issues/233
2020-05-20Release version v0.2.8 (#230)v0.2.8Eric Biggers
2020-05-14cmd/fscrypt: fix up path formatting in ErrDirNotEmpty suggestion (#229)Eric Biggers
Use %q, in case the paths contain whitespace. Also clean the directory path to remove trailing slashes before appending the ".new" suffix.
2020-05-13cmd/fscrypt: link to guide when interactively creating login protector (#225)Eric Biggers
Update https://github.com/google/fscrypt/issues/220
2020-05-13README.md: try to disambiguate "fscrypt" (#226)Eric Biggers
Explicitly mention that "fscrypt" here means the userspace tool, not the kernel part. Also write `fscrypt` in code font to emphasize this.
2020-05-13README.md: further improve the "encryption not enabled" section (#227)Eric Biggers
2020-05-13README.md: fix typo "nrounds" => "rounds" (#228)Eric Biggers
Update https://github.com/google/fscrypt/issues/220
2020-05-12README.md: improve documentation for login protectors (#223)Eric Biggers
Update https://github.com/google/fscrypt/issues/220
2020-05-10Declare instead of define variable in header file. (#224)Shuai Wang
This fixes link error with gcc 10 which defaults to -fno-common
2020-05-09Merge pull request #219 from ebiggers/improve-errorsEric Biggers
Improve error messages and suggestions
2020-05-09cmd/fscrypt: improve errorsEric Biggers
In checkEncryptable(), check whether the directory is already encrypted before checking whether it's empty. Also improve the error message for when a directory is nonempty. Finally, translate keyring.ErrKeyAddedByOtherUsers and keyring.ErrKeyFilesOpen into errors which include the directory.
2020-05-09cmd/fscrypt: remove ErrMaxPassphraseEric Biggers
This isn't actually a valid error since crypto.NewKeyFromReader() handles re-allocating the buffer to a larger size if it fills up.
2020-05-09filesystem: improve errorsEric Biggers
Introduce filesystem.ErrEncryptionNotEnabled and filesystem.ErrEncryptionNotSupported which include the Mount as context, and translate the corresponding metadata/ errors into them. Then make these errors show much better suggestions. Also replace lots of other filesystem/ errors with either custom types or with unnamed one-off errors that include more context. Fix backwards wrapping in lots of cases. Finally, don't include the mountpoint in places where it's not useful, like OS-level errors that already include the path.
2020-05-09metadata: improve errorsEric Biggers
ErrBadOwners: Rename to ErrDirectoryNotOwned for clarity, move it from cmd/fscrypt/ to metadata/ where it better belongs, and improve the message. ErrEncrypted: Rename to ErrAlreadyEncrypted for clarity, and include the path. ErrNotEncrypted: Include the path. ErrBadEncryptionOptions: Include the path and bad options. ErrEncryptionNotSupported: ErrEncryptionNotEnabled: Don't wrap with "get encryption policy %s", in preparation for wrapping these with filesystem-level context instead. Also avoid mixing together the error handling for the "get policy" and "set policy" ioctls. Make it very clear how we're handling the errors from each ioctl.
2020-05-09keyring: improve errorsEric Biggers
ErrAccessUserKeyring: Include the user, and fix the backwards wrapping. ErrSessionUserKeyring: Include the user. ErrKeyAdd: ErrKeyRemove: ErrKeySearch: ErrLinkUserKeyring: Replace these with one-off unnamed errors because they are never checked for, and this makes it easier for the callers to provide better messages, e.g. fixing the backwards wrapping.
2020-05-09crypto: improve errorsEric Biggers
ErrKeyLock: Rename to ErrMlockUlimit for clarity. ErrGetrandomFail: ErrKeyAlloc: ErrKeyFree: ErrNegativeLength: Replace these with one-off unnamed errors because these were all returned in only one place and were never checked for. Also these were all either wrapped backwards or discarded an underlying error, so fix that too.
2020-05-09actions/policy: improve errorsEric Biggers
ErrMissingPolicyMetadata: Include the mount, directory path, and metadata path. Also move the explanation into actions/ since it doesn't refer to any CLI command. ErrPolicyMetadataMismatch: Include a lot more information. Also start checking for consistency of the policy key descriptors, not just the encryption options. Add a test for this. ErrDifferentFilesystem: Include the mountpoints. ErrOnlyProtector: Clarify the message and include the protector descriptor. ErrAlreadyProtected: ErrNotProtected: Include the policy and protector descriptors. ErrAccessDeniedPossiblyV2: Make it slightly clearer what failed. Also move the explanation into actions/ since it doesn't refer to any CLI command.
2020-05-09actions/protector: improve errorsEric Biggers
ErrProtectorName: Rename to ErrLoginProtectorName for clarity, and include the name and user. ErrMissingProtectorName: Include the correct protector source. ErrDuplicateName: Rename to ErrProtectorNameExists for clarity, and remove a level of wrapping by including the name directly. ErrDuplicateUID: Rename to ErrLoginProtectorExists for clarity, and remove a level of wrapping by including the user directly.
2020-05-09actions/config: improve config file related errorsEric Biggers
ErrBadConfig: Fix backwards wrapping, include the bad config, and make it clear that this is an internal error. ErrBadConfigFile: Fix backwards wrapping, include the config file location, and adjust the suggestion slightly. ErrConfigFileExists: Include the config file location. ErrNoConfigFile: Include the config file location, and adjust the suggestion slightly.
2020-05-09cmd/fscrypt: make wrapText() support code blocksEric Biggers
Allow the input text to contain "code blocks" denoted by lines beginning with ">", e.g.: Foo bar baz: > echo foo > echo bar Instead of squashing these lines together, preserve the line breaks between them and add indentation, e.g.: Foo bar baz: echo foo echo bar
2020-05-09Merge pull request #217 from ebiggers/detect-incomplete-v1-lockingEric Biggers
Try to detect incomplete locking of v1-encrypted directory
2020-05-09Try to detect incomplete locking of v1-encrypted directoryEric Biggers
'fscrypt lock' on a v1-encrypted directory doesn't warn about in-use files, as the kernel doesn't provide a way to easily detect it. Instead, implement a heuristic where we check whether a subdirectory can be created. If yes, then the directory must not be fully locked. Make both 'fscrypt lock' and 'fscrypt status' use this heuristic. Resolves https://github.com/google/fscrypt/issues/215
2020-05-09keyring/user_keyring: switch to KEYCTL_UNLINKEric Biggers
KEYCTL_INVALIDATE has complicated semantics: it doesn't remove the key from the keyring right away but rather marks it as being invalidated, and then removes it asynchronously. This nondeterministically breaks the heuristic I'm implementing to detect v1-encrypted directories being incompletely locked. Instead, switch to KEYCTL_UNLINK, which has simpler semantics. Note that Android uses KEYCTL_UNLINK too.
generated by cgit v1.2.3 (git 2.25.1) at 2026-05-10 18:40:55 +0000