From 6ebd5a54eae2dfb16b66da649e75848fe6030b7f Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Thu, 23 Dec 2021 11:39:08 -0600 Subject: cmd/fscrypt: don't load protector in remove-protector-from-policy Make remove-protector-from-policy work even if the protector cannot be loaded (for example, due to having been deleted already). Fixes https://github.com/google/fscrypt/issues/258 Fixes https://github.com/google/fscrypt/issues/272 --- actions/policy.go | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) (limited to 'actions/policy.go') diff --git a/actions/policy.go b/actions/policy.go index 6c48117..7204380 100644 --- a/actions/policy.go +++ b/actions/policy.go @@ -461,14 +461,15 @@ func (policy *Policy) AddProtector(protector *Protector) error { } // RemoveProtector updates the data that is wrapping the Policy Key so that the -// provided Protector is no longer protecting the specified Policy. If an error -// is returned, no data has been changed. Note that no protector links are +// protector with the given descriptor is no longer protecting the specified +// Policy. If an error is returned, no data has been changed. Note that the +// protector itself won't be removed, nor will a link to the protector be // removed (in the case where the protector and policy are on different -// filesystems). The policy and protector can be locked or unlocked. -func (policy *Policy) RemoveProtector(protector *Protector) error { - idx, ok := policy.findWrappedKeyIndex(protector.Descriptor()) +// filesystems). The policy can be locked or unlocked. +func (policy *Policy) RemoveProtector(protectorDescriptor string) error { + idx, ok := policy.findWrappedKeyIndex(protectorDescriptor) if !ok { - return &ErrNotProtected{policy.Descriptor(), protector.Descriptor()} + return &ErrNotProtected{policy.Descriptor(), protectorDescriptor} } if len(policy.data.WrappedPolicyKeys) == 1 { -- cgit v1.2.3