From 7847ab8270efab472b7b6a4bf9a57f5b83cb7212 Mon Sep 17 00:00:00 2001
From: "Joe Richey joerichey@google.com" <joerichey@google.com>
Date: Tue, 17 Oct 2017 18:10:54 -0700
Subject: fmt almost done

---
 cmd/fscrypt/commands.go | 200 -------------------------------------
 cmd/fscrypt/flags.go    |  73 +++++---------
 cmd/fscrypt/fscrypt.go  | 257 +++++++++++++++++++++++++++++++++++++++++-------
 cmd/fscrypt/keys.go     |  29 +++---
 cmd/fscrypt/prompt.go   |  50 +++++-----
 cmd/fscrypt/setup.go    |   4 +-
 cmd/fscrypt/status.go   |  12 ++-
 7 files changed, 288 insertions(+), 337 deletions(-)

(limited to 'cmd/fscrypt')

diff --git a/cmd/fscrypt/commands.go b/cmd/fscrypt/commands.go
index bbfcf2b..b29435a 100644
--- a/cmd/fscrypt/commands.go
+++ b/cmd/fscrypt/commands.go
@@ -408,79 +408,6 @@ func unlockPath(path string) error {
 // 	Action: destoryMetadataAction,
 // }
 
-// func destoryMetadataAction(c *cli.Context) error {
-// 	switch c.NArg() {
-// 	case 0:
-// 		switch {
-// 		case protectorFlag.Value != "":
-// 			// Case (1) - protector destroy
-// 			protector, err := getProtectorFromFlag(protectorFlag.Value, nil)
-// 			if err != nil {
-// 				return newExitError(c, err)
-// 			}
-
-// 			prompt := fmt.Sprintf("Destroy protector %s on %q?",
-// 				protector.Descriptor(), protector.Context.Mount.Path)
-// 			warning := "All files protected only with this protector will be lost!!"
-// 			if err := askConfirmation(prompt, false, warning); err != nil {
-// 				return newExitError(c, err)
-// 			}
-// 			if err := protector.Destroy(); err != nil {
-// 				return newExitError(c, err)
-// 			}
-
-// 			fmt.Fprintf(c.App.Writer, "Protector %s deleted from filesystem %q.\n",
-// 				protector.Descriptor(), protector.Context.Mount.Path)
-// 		case policyFlag.Value != "":
-// 			// Case (2) - policy destroy
-// 			policy, err := getPolicyFromFlag(policyFlag.Value, nil)
-// 			if err != nil {
-// 				return newExitError(c, err)
-// 			}
-
-// 			prompt := fmt.Sprintf("Destroy policy %s on %q?",
-// 				policy.Descriptor(), policy.Context.Mount.Path)
-// 			warning := "All files using this policy will be lost!!"
-// 			if err := askConfirmation(prompt, false, warning); err != nil {
-// 				return newExitError(c, err)
-// 			}
-// 			if err := policy.Destroy(); err != nil {
-// 				return newExitError(c, err)
-// 			}
-
-// 			fmt.Fprintf(c.App.Writer, "Policy %s deleted from filesystem %q.\n",
-// 				policy.Descriptor(), policy.Context.Mount.Path)
-// 		default:
-// 			message := fmt.Sprintf("Must specify one of: %s, %s, or %s",
-// 				mountpointArg,
-// 				shortDisplay(protectorFlag),
-// 				shortDisplay(policyFlag))
-// 			return &usageError{c, message}
-// 		}
-// 	case 1:
-// 		// Case (3) - mountpoint destroy
-// 		path := c.Args().Get(0)
-// 		ctx, err := actions.NewContextFromMountpoint(path, nil)
-// 		if err != nil {
-// 			return newExitError(c, err)
-// 		}
-
-// 		prompt := fmt.Sprintf("Destroy all the metadata on %q?", ctx.Mount.Path)
-// 		warning := "All the encrypted files on this filesystem will be lost!!"
-// 		if err := askConfirmation(prompt, false, warning); err != nil {
-// 			return newExitError(c, err)
-// 		}
-// 		if err := ctx.Mount.RemoveAllMetadata(); err != nil {
-// 			return newExitError(c, err)
-// 		}
-
-// 		fmt.Fprintf(c.App.Writer, "All metadata on %q deleted.\n", ctx.Mount.Path)
-// 	default:
-// 		return expectedArgsErr(c, 1, true)
-// 	}
-// 	return nil
-// }
-
 // var changePassphrase = cli.Command{
 // 	Name:      "change-passphrase",
 // 	ArgsUsage: shortDisplay(protectorFlag),
@@ -492,31 +419,6 @@ func unlockPath(path string) error {
 // 	Action: changePassphraseAction,
 // }
 
-// func changePassphraseAction(c *cli.Context) error {
-// 	if c.NArg() != 0 {
-// 		return expectedArgsErr(c, 0, false)
-// 	}
-// 	if err := checkRequiredFlags(c, []*stringFlag{protectorFlag}); err != nil {
-// 		return err
-// 	}
-
-// 	protector, err := getProtectorFromFlag(protectorFlag.Value, nil)
-// 	if err != nil {
-// 		return newExitError(c, err)
-// 	}
-// 	if err := protector.Unlock(oldExistingKeyFn); err != nil {
-// 		return newExitError(c, err)
-// 	}
-// 	defer protector.Lock()
-// 	if err := protector.Rewrap(newCreateKeyFn); err != nil {
-// 		return newExitError(c, err)
-// 	}
-
-// 	fmt.Fprintf(c.App.Writer, "Passphrase for protector %s successfully changed.\n",
-// 		protector.Descriptor())
-// 	return nil
-// }
-
 // var addProtectorToPolicy = cli.Command{
 // 	Name:      "add-protector-to-policy",
 // 	ArgsUsage: fmt.Sprintf("%s %s", shortDisplay(protectorFlag), shortDisplay(policyFlag)),
@@ -530,49 +432,6 @@ func unlockPath(path string) error {
 // 	Action: addProtectorAction,
 // }
 
-// func addProtectorAction(c *cli.Context) error {
-// 	if c.NArg() != 0 {
-// 		return expectedArgsErr(c, 0, false)
-// 	}
-// 	if err := checkRequiredFlags(c, []*stringFlag{protectorFlag, policyFlag}); err != nil {
-// 		return err
-// 	}
-
-// 	protector, err := getProtectorFromFlag(protectorFlag.Value, nil)
-// 	if err != nil {
-// 		return newExitError(c, err)
-// 	}
-// 	policy, err := getPolicyFromFlag(policyFlag.Value, protector.Context.TargetUser)
-// 	if err != nil {
-// 		return newExitError(c, err)
-// 	}
-// 	// Sanity check before unlocking everything
-// 	if err := policy.AddProtector(protector); errors.Cause(err) != actions.ErrLocked {
-// 		return newExitError(c, err)
-// 	}
-
-// 	prompt := fmt.Sprintf("Protect policy %s with protector %s?",
-// 		policy.Descriptor(), protector.Descriptor())
-// 	warning := "All files using this policy will be accessible with this protector!!"
-// 	if err := askConfirmation(prompt, true, warning); err != nil {
-// 		return newExitError(c, err)
-// 	}
-
-// 	if err := protector.Unlock(existingKeyFn); err != nil {
-// 		return newExitError(c, err)
-// 	}
-// 	if err := policy.Unlock(optionFn, existingKeyFn); err != nil {
-// 		return newExitError(c, err)
-// 	}
-// 	if err := policy.AddProtector(protector); err != nil {
-// 		return newExitError(c, err)
-// 	}
-
-// 	fmt.Fprintf(c.App.Writer, "Protector %s now protecting policy %s.\n",
-// 		protector.Descriptor(), policy.Descriptor())
-// 	return nil
-// }
-
 // var removeProtectorFromPolicy = cli.Command{
 // 	Name:      "remove-protector-from-policy",
 // 	ArgsUsage: fmt.Sprintf("%s %s", shortDisplay(protectorFlag), shortDisplay(policyFlag)),
@@ -587,40 +446,6 @@ func unlockPath(path string) error {
 // 	Action: removeProtectorAction,
 // }
 
-// func removeProtectorAction(c *cli.Context) error {
-// 	if c.NArg() != 0 {
-// 		return expectedArgsErr(c, 0, false)
-// 	}
-// 	if err := checkRequiredFlags(c, []*stringFlag{protectorFlag, policyFlag}); err != nil {
-// 		return err
-// 	}
-
-// 	// We do not need to unlock anything for this operation
-// 	protector, err := getProtectorFromFlag(protectorFlag.Value, nil)
-// 	if err != nil {
-// 		return newExitError(c, err)
-// 	}
-// 	policy, err := getPolicyFromFlag(policyFlag.Value, protector.Context.TargetUser)
-// 	if err != nil {
-// 		return newExitError(c, err)
-// 	}
-
-// 	prompt := fmt.Sprintf("Stop protecting policy %s with protector %s?",
-// 		policy.Descriptor(), protector.Descriptor())
-// 	warning := "All files using this policy will NO LONGER be accessible with this protector!!"
-// 	if err := askConfirmation(prompt, false, warning); err != nil {
-// 		return newExitError(c, err)
-// 	}
-
-// 	if err := policy.RemoveProtector(protector); err != nil {
-// 		return newExitError(c, err)
-// 	}
-
-// 	fmt.Fprintf(c.App.Writer, "Protector %s no longer protecting policy %s.\n",
-// 		protector.Descriptor(), policy.Descriptor())
-// 	return nil
-// }
-
 // var dumpMetadata = cli.Command{
 // 	Name:      "dump",
 // 	ArgsUsage: fmt.Sprintf("[%s | %s]", shortDisplay(protectorFlag), shortDisplay(policyFlag)),
@@ -635,28 +460,3 @@ func unlockPath(path string) error {
 // 	Flags:  []cli.Flag{protectorFlag, policyFlag},
 // 	Action: dumpMetadataAction,
 // }
-
-// func dumpMetadataAction(c *cli.Context) error {
-// 	switch {
-// 	case protectorFlag.Value != "":
-// 		// Case (1) - protector print
-// 		protector, err := getProtectorFromFlag(protectorFlag.Value, nil)
-// 		if err != nil {
-// 			return newExitError(c, err)
-// 		}
-// 		fmt.Fprintln(c.App.Writer, protector)
-// 	case policyFlag.Value != "":
-// 		// Case (2) - policy print
-// 		policy, err := getPolicyFromFlag(policyFlag.Value, nil)
-// 		if err != nil {
-// 			return newExitError(c, err)
-// 		}
-// 		fmt.Fprintln(c.App.Writer, policy)
-// 	default:
-// 		message := fmt.Sprintf("Must specify one of: %s or %s",
-// 			shortDisplay(protectorFlag),
-// 			shortDisplay(policyFlag))
-// 		return &usageError{c, message}
-// 	}
-// 	return nil
-// }
diff --git a/cmd/fscrypt/flags.go b/cmd/fscrypt/flags.go
index 5983053..084fa19 100644
--- a/cmd/fscrypt/flags.go
+++ b/cmd/fscrypt/flags.go
@@ -37,23 +37,18 @@ import (
 // Bool flags: used to switch some behavior on or off
 var (
 	legacyFlag = &cmd.BoolFlag{
-		Name: "legacy",
-		Usage: `Allow for support of older kernels with ext4 (before
-			v4.8) and F2FS (before v4.6) filesystems.`,
+		Name:    "legacy",
+		Usage:   `Configure fscrypt to support older kernels.`,
 		Default: true,
 	}
 	skipUnlockFlag = &cmd.BoolFlag{
-		Name: "skip-unlock",
-		Usage: `Leave the directory in a locked state after setup.
-			"fscrypt unlock" will need to be run in order to use the
-			directory.`,
+		Name:  "skip-unlock",
+		Usage: "Leave the directory in a locked state after setup.",
 	}
 	dropCachesFlag = &cmd.BoolFlag{
 		Name: "drop-caches",
 		Usage: `After purging the keys from the keyring, drop the
-			associated caches for the purge to take effect. Without
-			this flag, cached encrypted files may still have their
-			plaintext visible. Requires root privileges.`,
+			associated caches for the purge to take effect.`,
 		Default: true,
 	}
 )
@@ -62,78 +57,62 @@ var (
 var (
 	timeTargetFlag = &cmd.DurationFlag{
 		Name:    "time",
-		ArgName: "TIME",
+		ArgName: "time",
 		Usage: `Set the global options so that passphrase hashing takes
-			TIME long. TIME should be formatted as a sequence of
-			decimal numbers, each with optional fraction and a unit
-			suffix, such as "300ms", "1.5s" or "2h45m". Valid time
-			units are "ms", "s", "m", and "h".`,
+			<time> long.`,
 		Default: 1 * time.Second,
 	}
 	sourceFlag = &cmd.StringFlag{
 		Name:    "source",
-		ArgName: "SOURCE",
-		Usage: fmt.Sprintf(`New protectors will have type SOURCE. SOURCE
-			can be one of pam_passphrase, custom_passphrase, or
-			raw_key. If not specified, the user will be prompted for
-			the source, with a default pulled from %s.`,
-			actions.ConfigFileLocation),
+		ArgName: "source",
+		Usage: `New protectors will have type <source> (one of
+			pam_passphrase, custom_passphrase, or raw_key).`,
 	}
 	nameFlag = &cmd.StringFlag{
 		Name:    "name",
-		ArgName: "PROTECTOR_NAME",
-		Usage: `New custom_passphrase and raw_key protectors will be
-			named PROTECTOR_NAME. If not specified, the user will be
-			prompted for a name.`,
+		ArgName: "name",
+		Usage:   "Use <name> as the name for a new protector.",
 	}
 	keyFileFlag = &cmd.StringFlag{
 		Name:    "key",
-		ArgName: "FILE",
-		Usage: `Use the contents of FILE as the wrapping key when
-			creating or unlocking raw_key protectors. FILE should be
-			formatted as raw binary and should be exactly 32 bytes
-			long.`,
+		ArgName: "path",
+		Usage:   "Use the file at <path> as the protector key.",
 	}
 	userFlag = &cmd.StringFlag{
 		Name:    "user",
-		ArgName: "USERNAME",
-		Usage: `Specifiy which user should be used for login passphrases
+		ArgName: "username",
+		Usage: `Specify which user should be used for login passphrases
 			or to which user's keyring keys should be provisioned.`,
 	}
-	mountpointIDArg = "MOUNTPOINT:ID"
+	mountpointIDArg = usedMountpointArg.ArgName + ":id"
 	protectorFlag   = &cmd.StringFlag{
 		Name:    "protector",
 		ArgName: mountpointIDArg,
-		Usage: `Specify an existing protector on filesystem MOUNTPOINT
-			with protector descriptor ID which should be used in the
-			command.`,
+		Usage: fmt.Sprintf(`An existing protector on %s with hexadecimal
+			id <id>.`, usedMountpointArg),
 	}
 	unlockWithFlag = &cmd.StringFlag{
 		Name:    "unlock-with",
 		ArgName: mountpointIDArg,
-		Usage: `Specify an existing protector on filesystem MOUNTPOINT
-			with protector descriptor ID which should be used to
-			unlock a policy (usually specified with --policy). This
-			flag is only useful if a policy is protected with
-			multiple protectors. If not specified, the user will be
-			prompted for a protector.`,
+		Usage: fmt.Sprintf(`The protector that should be used to unlock
+			the policy specified with %s.`, policyFlag),
 	}
 	policyFlag = &cmd.StringFlag{
 		Name:    "policy",
 		ArgName: mountpointIDArg,
-		Usage: `Specify an existing policy on filesystem MOUNTPOINT with
-			key descriptor ID which should be used in the command.`,
+		Usage: fmt.Sprintf(`An existing policy on %s with hexadecimal id
+			<id>.`, usedMountpointArg),
 	}
 )
 
-// The first group is optional and corresponds to the mountpoint. The second
-// group is required and corresponds to the descriptor.
+// The first group corresponds to the mountpoint string. The second group
+// corresponds to the hexideciamal descriptor.
 var idFlagRegex = regexp.MustCompile("^([[:print:]]+):([[:alnum:]]+)$")
 
 func matchMetadataFlag(flagValue string) (mountpoint, descriptor string, err error) {
 	matches := idFlagRegex.FindStringSubmatch(flagValue)
 	if matches == nil {
-		return "", "", fmt.Errorf("flag value %q does not have format %s",
+		return "", "", fmt.Errorf("flag value %q does not have format %q",
 			flagValue, mountpointIDArg)
 	}
 	log.Printf("parsed flag: mountpoint=%q descriptor=%s", matches[1], matches[2])
diff --git a/cmd/fscrypt/fscrypt.go b/cmd/fscrypt/fscrypt.go
index 63b2cbc..2054193 100644
--- a/cmd/fscrypt/fscrypt.go
+++ b/cmd/fscrypt/fscrypt.go
@@ -63,12 +63,12 @@ var baseFlags = []cmd.Flag{cmd.VerboseFlag, cmd.QuietFlag, cmd.HelpFlag}
 var fscryptCommand = cmd.Command{
 	Title: "manage linux filesystem encryption",
 	UsageLines: []string{
-		fmt.Sprintf("<command> [arguments] [command options] [%s | %s]",
+		fmt.Sprintf("<command> [arguments] [options] [%s|%s]",
 			cmd.VerboseFlag, cmd.QuietFlag),
 		cmd.VersionUsage,
 	},
 	SubCommands: []*cmd.Command{setupCommand, encryptCommand, unlockCommand,
-		purgeCommand, statusCommand, metadataCommand, cmd.VersionCommand}, Flags:   baseFlags,
+		purgeCommand, statusCommand, metadataCommand, cmd.VersionCommand}, Flags: baseFlags,
 	ManPage: &cmd.ManPage{Name: "fscrypt", Section: 8},
 }
 
@@ -108,7 +108,7 @@ var encryptCommand = &cmd.Command{
 	Arguments:    []*cmd.Argument{directoryToEncryptArg},
 	InheritFlags: true,
 	Flags: []cmd.Flag{sourceFlag, nameFlag, protectorFlag, policyFlag,
-		keyFileFlag, userFlag, skipUnlockFlag},
+		unlockWithFlag, keyFileFlag, userFlag, skipUnlockFlag},
 	ManPage: &cmd.ManPage{Name: "fscrypt-encrypt", Section: 8},
 	Action:  encryptAction,
 }
@@ -140,7 +140,7 @@ var unlockCommand = &cmd.Command{
 	UsageLines:   []string{"???"}, // TODO(joerichey)
 	Arguments:    []*cmd.Argument{encryptedPathArg},
 	InheritFlags: true,
-	Flags:        []cmd.Flag{protectorFlag, policyFlag, keyFileFlag, userFlag},
+	Flags:        []cmd.Flag{unlockWithFlag, keyFileFlag, userFlag},
 	ManPage:      &cmd.ManPage{Name: "fscrypt-unlock", Section: 8},
 	Action:       unlockAction,
 }
@@ -220,7 +220,7 @@ var statusCommand = &cmd.Command{
 	Name:       "status",
 	Title:      "get the status of the system or a path",
 	UsageLines: []string{"", usedMountpointArg.String(), encryptedPathArg.String()},
-	Arguments: []*cmd.Argument{usedMountpointArg, encryptedPathArg},
+	Arguments:  []*cmd.Argument{usedMountpointArg, encryptedPathArg},
 	Flags:      []cmd.Flag{cmd.VerboseFlag, cmd.HelpFlag},
 	ManPage:    &cmd.ManPage{Name: "fscrypt-status", Section: 8},
 	Action:     statusAction,
@@ -254,10 +254,10 @@ func statusAction(c *cmd.Context) error {
 var metadataCommand = &cmd.Command{
 	Name:  "metadata",
 	Title: "manipulate fscrypt metadata directly",
-	UsageLines: []string{fmt.Sprintf("<command> [command options] [%s] [%s]",
+	UsageLines: []string{fmt.Sprintf("<command> [options] [%s] [%s]",
 		protectorFlag, policyFlag)},
-	SubCommands: []*cmd.Command{createCommand}, // destroyCommand, changeCommand,
-	// addProtectorCommand, removeProtectorCommand, dumpCommand},
+	SubCommands: []*cmd.Command{createCommand, destroyCommand, changeCommand,
+		addProtectorCommand, removeProtectorCommand, dumpCommand},
 	InheritFlags: true,
 	Flags:        []cmd.Flag{protectorFlag, policyFlag},
 	ManPage:      &cmd.ManPage{Name: "fscrypt-metadata", Section: 8},
@@ -268,7 +268,7 @@ var createCommand = &cmd.Command{
 	Title: "manually create metadata on a filesystem",
 	UsageLines: []string{
 		fmt.Sprintf("protector %s", usedMountpointArg),
-		fmt.Sprintf("policy %s, %s", usedMountpointArg, protectorFlag),
+		fmt.Sprintf("policy    %s %s", usedMountpointArg, protectorFlag),
 	},
 	SubCommands: []*cmd.Command{createProtectorCommand, createPolicyCommand},
 	Arguments:   []*cmd.Argument{usedMountpointArg},
@@ -363,66 +363,73 @@ func createPolicyAction(c *cmd.Context) error {
 }
 
 var destroyCommand = &cmd.Command{
-	Name: "destroy",
+	Name:  "destroy",
 	Title: "directly delete an existing protector or policy",
 	UsageLines: []string{
 		fmt.Sprintf("%s [%s]", protectorFlag, cmd.ForceFlag),
 		fmt.Sprintf("%s [%s]", policyFlag, cmd.ForceFlag),
 		fmt.Sprintf("%s [%s]", usedMountpointArg, cmd.ForceFlag),
 	},
-	Arguments: []*cmd.Argument{usedMountpointArg},
+	Arguments:    []*cmd.Argument{usedMountpointArg},
 	InheritFlags: true,
-	Flags: []cmd.Flag{cmd.ForceFlag},
-	Action: destroyAction,
+	Flags:        []cmd.Flag{cmd.ForceFlag},
+	Action:       destroyAction,
 }
 
-func destoryAction(c *cmd.Context) error {
+func destroyAction(c *cmd.Context) error {
+	if err := cmd.CheckExpectedArgs(c, 1, true); err != nil {
+		return err
+	}
+	hasProtector := protectorFlag.Value != ""
+	hasPolicy := policyFlag.Value != ""
+	hasMount := len(c.Args) == 1
+	if (hasProtector && hasPolicy) || (hasPolicy && hasMount) || (hasMount && hasProtector) {
+		return cmd.UsageError(fmt.Sprintf("Multiple of %s, %s, %s provided",
+			protectorFlag, policyFlag, usedMountpointArg))
+	}
+
 	switch {
-	case protectorFlag.Value != "":
-		if len(c.Args) != 0 {
-			break
-		}
+	case hasProtector:
 		// Case (1) - protector destroy
 		protector, err := getProtectorFromFlag(protectorFlag.Value, nil)
 		if err != nil {
-			return newExitError(c, err)
+			return err
 		}
 
 		prompt := fmt.Sprintf("Destroy protector %s on %q?",
 			protector.Descriptor(), protector.Context.Mount.Path)
 		warning := "All files protected only with this protector will be lost!!"
-		if err := askConfirmation(prompt, false, warning); err != nil {
-			return newExitError(c, err)
+		if err = cmd.AskConfirmation(prompt, warning, false); err != nil {
+			return err
 		}
-		if err := protector.Destroy(); err != nil {
-			return newExitError(c, err)
+		if err = protector.Destroy(); err != nil {
+			return err
 		}
 
-		fmt.Fprintf(c.App.Writer, "Protector %s deleted from filesystem %q.\n",
+		fmt.Fprintf(cmd.Output, "Protector %s deleted from filesystem %q.\n",
 			protector.Descriptor(), protector.Context.Mount.Path)
-	case policyFlag.Value != "":
-		if len(c.Args) != 0 {
-			break
-		}
+		return nil
+	case hasPolicy:
 		// Case (2) - policy destroy
 		policy, err := getPolicyFromFlag(policyFlag.Value, nil)
 		if err != nil {
-			return newExitError(c, err)
+			return err
 		}
 
 		prompt := fmt.Sprintf("Destroy policy %s on %q?",
 			policy.Descriptor(), policy.Context.Mount.Path)
-		warning := "All files using this policy will be lost!!"
-		if err := askConfirmation(prompt, false, warning); err != nil {
-			return newExitError(c, err)
+		warning := "All files and directories using this policy will be lost!"
+		if err = cmd.AskConfirmation(prompt, warning, false); err != nil {
+			return err
 		}
-		if err := policy.Destroy(); err != nil {
-			return newExitError(c, err)
+		if err = policy.Destroy(); err != nil {
+			return err
 		}
 
-		fmt.Fprintf(c.App.Writer, "Policy %s deleted from filesystem %q.\n",
+		fmt.Fprintf(cmd.Output, "Policy %s deleted from filesystem %q.\n",
 			policy.Descriptor(), policy.Context.Mount.Path)
-	case len(c.Args) == 1:
+		return nil
+	case hasMount:
 		// Case (3) - mountpoint destroy
 		ctx, err := actions.NewContextFromMountpoint(c.Args[0], nil)
 		if err != nil {
@@ -440,8 +447,182 @@ func destoryAction(c *cmd.Context) error {
 
 		fmt.Fprintf(cmd.Output, "All metadata on %q deleted.\n", ctx.Mount.Path)
 		return nil
+	default:
+		return cmd.UsageError(fmt.Sprintf("None of %s, %s, %s provided",
+			protectorFlag, policyFlag, usedMountpointArg))
 	}
-	return cmd.UsageError(fmt.Sprintf("Must specify exactly one of: %s, %s, or %s",
-		usedMountpointArg, protectorFlag, policyFlag))
 }
 
+var changeCommand = &cmd.Command{
+	Name:         "change-passphrase",
+	Title:        "change the passphrase for a protector",
+	UsageLines:   []string{protectorFlag.String()},
+	InheritFlags: true,
+	Flags:        []cmd.Flag{protectorFlag},
+	Action:       changeAction,
+}
+
+func changeAction(c *cmd.Context) error {
+	if err := cmd.CheckExpectedArgs(c, 0, false); err != nil {
+		return err
+	}
+	if err := cmd.CheckRequiredFlags([]*cmd.StringFlag{protectorFlag}); err != nil {
+		return err
+	}
+
+	protector, err := getProtectorFromFlag(protectorFlag.Value, nil)
+	if err != nil {
+		return err
+	}
+	if err := protector.Unlock(oldExistingKeyFn); err != nil {
+		return err
+	}
+	defer protector.Lock()
+	if err := protector.Rewrap(newCreateKeyFn); err != nil {
+		return err
+	}
+
+	fmt.Fprintf(cmd.Output, "Passphrase for protector %s successfully changed.\n",
+		protector.Descriptor())
+	return nil
+}
+
+var addProtectorCommand = &cmd.Command{
+	Name:  "add-protector-to-policy",
+	Title: "start protecting a policy with a protector",
+	UsageLines: []string{fmt.Sprintf("%s [%s] %s [%s]", protectorFlag,
+		keyFileFlag, policyFlag, unlockWithFlag)},
+	InheritFlags: true,
+	Flags:        []cmd.Flag{keyFileFlag, unlockWithFlag},
+	Action:       addProtectorAction,
+}
+
+func addProtectorAction(c *cmd.Context) error {
+	if err := cmd.CheckExpectedArgs(c, 0, false); err != nil {
+		return err
+	}
+	err := cmd.CheckRequiredFlags([]*cmd.StringFlag{protectorFlag, policyFlag})
+	if err != nil {
+		return err
+	}
+
+	protector, err := getProtectorFromFlag(protectorFlag.Value, nil)
+	if err != nil {
+		return err
+	}
+	policy, err := getPolicyFromFlag(policyFlag.Value, protector.Context.TargetUser)
+	if err != nil {
+		return err
+	}
+	// Sanity check before unlocking everything
+	if err := policy.AddProtector(protector); errors.Cause(err) != actions.ErrLocked {
+		return err
+	}
+
+	prompt := fmt.Sprintf("Protect policy %s with protector %s?",
+		policy.Descriptor(), protector.Descriptor())
+	warning := "All files using this policy will be accessible with this protector!"
+	if err := cmd.AskConfirmation(prompt, warning, true); err != nil {
+		return err
+	}
+
+	if err := protector.Unlock(existingKeyFn); err != nil {
+		return err
+	}
+	if err := policy.Unlock(optionFn, existingKeyFn); err != nil {
+		return err
+	}
+	if err := policy.AddProtector(protector); err != nil {
+		return err
+	}
+
+	fmt.Fprintf(cmd.Output, "Protector %s now protecting policy %s.\n",
+		protector.Descriptor(), policy.Descriptor())
+	return nil
+}
+
+var removeProtectorCommand = &cmd.Command{
+	Name:  "remove-protector-from-policy",
+	Title: "stop protecting a policy with a protector",
+	UsageLines: []string{fmt.Sprintf("%s %s [%s]", protectorFlag,
+		policyFlag, cmd.ForceFlag)},
+	InheritFlags: true,
+	Flags:        []cmd.Flag{keyFileFlag, unlockWithFlag},
+	Action:       removeProtectorAction,
+}
+
+func removeProtectorAction(c *cmd.Context) error {
+	if err := cmd.CheckExpectedArgs(c, 0, false); err != nil {
+		return err
+	}
+	err := cmd.CheckRequiredFlags([]*cmd.StringFlag{protectorFlag, policyFlag})
+	if err != nil {
+		return err
+	}
+
+	// We do not need to unlock anything for this operation
+	protector, err := getProtectorFromFlag(protectorFlag.Value, nil)
+	if err != nil {
+		return err
+	}
+	policy, err := getPolicyFromFlag(policyFlag.Value, protector.Context.TargetUser)
+	if err != nil {
+		return err
+	}
+
+	prompt := fmt.Sprintf("Stop protecting policy %s with protector %s?",
+		policy.Descriptor(), protector.Descriptor())
+	warning := "All files using this policy will NOT BE ACCESSIBLE with this protector!"
+	if err := cmd.AskConfirmation(prompt, warning, false); err != nil {
+		return err
+	}
+	if err := policy.RemoveProtector(protector); err != nil {
+		return err
+	}
+
+	fmt.Fprintf(cmd.Output, "Protector %s no longer protecting policy %s.\n",
+		protector.Descriptor(), policy.Descriptor())
+	return nil
+}
+
+var dumpCommand = &cmd.Command{
+	Name:       "dump",
+	Title:      "display debug info about protectors and policies",
+	UsageLines: []string{protectorFlag.String(), policyFlag.String()},
+	Flags:      []cmd.Flag{protectorFlag, policyFlag, cmd.VerboseFlag, cmd.HelpFlag},
+	Action:     dumpAction,
+}
+
+func dumpAction(c *cmd.Context) error {
+	if err := cmd.CheckExpectedArgs(c, 0, false); err != nil {
+		return err
+	}
+	hasProtector := protectorFlag.Value != ""
+	hasPolicy := policyFlag.Value != ""
+	if hasProtector && hasPolicy {
+		return cmd.UsageError(fmt.Sprintf("Multiple of %s, %s provided",
+			protectorFlag, policyFlag))
+	}
+
+	switch {
+	case hasProtector:
+		// Case (1) - protector dump
+		protector, err := getProtectorFromFlag(protectorFlag.Value, nil)
+		if err != nil {
+			return err
+		}
+		fmt.Fprintln(cmd.Output, protector)
+		return nil
+	case hasPolicy:
+		// Case (2) - policy dump
+		policy, err := getPolicyFromFlag(policyFlag.Value, nil)
+		if err != nil {
+			return err
+		}
+		fmt.Fprintln(cmd.Output, policy)
+		return nil
+	default:
+		return cmd.UsageError(fmt.Sprintf("None of %s, %s provided",
+			protectorFlag, policyFlag))
+	}
+}
diff --git a/cmd/fscrypt/keys.go b/cmd/fscrypt/keys.go
index 872ca2a..ec02148 100644
--- a/cmd/fscrypt/keys.go
+++ b/cmd/fscrypt/keys.go
@@ -31,9 +31,11 @@ import (
 	"golang.org/x/crypto/ssh/terminal"
 
 	"github.com/google/fscrypt/actions"
+	"github.com/google/fscrypt/cmd"
 	"github.com/google/fscrypt/crypto"
 	"github.com/google/fscrypt/metadata"
 	"github.com/google/fscrypt/pam"
+	"github.com/google/fscrypt/util"
 )
 
 // The file descriptor for standard input
@@ -71,7 +73,7 @@ func (p passphraseReader) Read(buf []byte) (int, error) {
 		case '\r', '\n':
 			return position, io.EOF
 		case 3, 4:
-			return position, ErrCanceled
+			return position, cmd.ErrCanceled
 		case 8, 127:
 			if position > 0 {
 				position--
@@ -86,9 +88,7 @@ func (p passphraseReader) Read(buf []byte) (int, error) {
 // passphrase into a key. If we are not reading from a terminal, just read into
 // the passphrase into the key normally.
 func getPassphraseKey(prompt string) (*crypto.Key, error) {
-	if !quietFlag.Value {
-		fmt.Print(prompt)
-	}
+	fmt.Fprint(cmd.Output, prompt)
 
 	// Only disable echo if stdin is actually a terminal.
 	if terminal.IsTerminal(stdinFd) {
@@ -116,7 +116,7 @@ func makeKeyFunc(supportRetry, shouldConfirm bool, prefix string) actions.KeyFun
 				panic("this KeyFunc does not support retrying")
 			}
 			// Don't retry for non-interactive sessions
-			if quietFlag.Value {
+			if cmd.QuietFlag.Value {
 				return nil, ErrWrongKey
 			}
 			fmt.Println("Incorrect Passphrase")
@@ -124,8 +124,8 @@ func makeKeyFunc(supportRetry, shouldConfirm bool, prefix string) actions.KeyFun
 
 		switch info.Source() {
 		case metadata.SourceType_pam_passphrase:
-			prompt := fmt.Sprintf("Enter %slogin passphrase for %s: ",
-				prefix, formatUsername(info.UID()))
+			username := util.GetUser(int(info.UID())).Username
+			prompt := fmt.Sprintf("Enter %s%s: ", prefix, formatInfo(info))
 			key, err := getPassphraseKey(prompt)
 			if err != nil {
 				return nil, err
@@ -134,13 +134,7 @@ func makeKeyFunc(supportRetry, shouldConfirm bool, prefix string) actions.KeyFun
 			// To confirm, check that the passphrase is the user's
 			// login passphrase.
 			if shouldConfirm {
-				username, err := usernameFromID(info.UID())
-				if err != nil {
-					key.Wipe()
-					return nil, err
-				}
-
-				err = pam.IsUserLoginToken(username, key, quietFlag.Value)
+				err = pam.IsUserLoginToken(username, key, cmd.QuietFlag.Value)
 				if err != nil {
 					key.Wipe()
 					return nil, err
@@ -149,8 +143,7 @@ func makeKeyFunc(supportRetry, shouldConfirm bool, prefix string) actions.KeyFun
 			return key, nil
 
 		case metadata.SourceType_custom_passphrase:
-			prompt := fmt.Sprintf("Enter %scustom passphrase for protector %q: ",
-				prefix, info.Name())
+			prompt := fmt.Sprintf("Enter %s%s: ", prefix, formatInfo(info))
 			key, err := getPassphraseKey(prompt)
 			if err != nil {
 				return nil, err
@@ -158,7 +151,7 @@ func makeKeyFunc(supportRetry, shouldConfirm bool, prefix string) actions.KeyFun
 
 			// To confirm, make sure the user types the same
 			// passphrase in again.
-			if shouldConfirm && !quietFlag.Value {
+			if shouldConfirm && !cmd.QuietFlag.Value {
 				key2, err := getPassphraseKey("Confirm passphrase: ")
 				if err != nil {
 					key.Wipe()
@@ -178,7 +171,7 @@ func makeKeyFunc(supportRetry, shouldConfirm bool, prefix string) actions.KeyFun
 			if prefix != "" {
 				return nil, ErrNotPassphrase
 			}
-			prompt := fmt.Sprintf("Enter key file for protector %q: ", info.Name())
+			prompt := fmt.Sprintf("Enter path to %s: ", formatInfo(info))
 			// Raw keys use a file containing the key data.
 			file, err := promptForKeyFile(prompt)
 			if err != nil {
diff --git a/cmd/fscrypt/prompt.go b/cmd/fscrypt/prompt.go
index 57d0fc7..c9b3147 100644
--- a/cmd/fscrypt/prompt.go
+++ b/cmd/fscrypt/prompt.go
@@ -26,6 +26,7 @@ import (
 	"strconv"
 
 	"github.com/google/fscrypt/actions"
+	"github.com/google/fscrypt/cmd"
 	"github.com/google/fscrypt/metadata"
 	"github.com/google/fscrypt/util"
 )
@@ -41,11 +42,11 @@ var sourceDescriptions = map[metadata.SourceType]string{
 func formatInfo(data actions.ProtectorInfo) string {
 	switch data.Source() {
 	case metadata.SourceType_pam_passphrase:
-		return "login protector for " + formatUsername(data.UID())
+		return "login passphrase for " + util.GetUser(int(data.UID())).Username
 	case metadata.SourceType_custom_passphrase:
-		return fmt.Sprintf("custom protector %q", data.Name())
+		return fmt.Sprintf("custom passphrase for protector %q", data.Name())
 	case metadata.SourceType_raw_key:
-		return fmt.Sprintf("raw key protector %q", data.Name())
+		return fmt.Sprintf("raw key for protector %q", data.Name())
 	default:
 		panic(ErrInvalidSource)
 	}
@@ -59,13 +60,13 @@ func promptForName(ctx *actions.Context) (string, error) {
 	}
 
 	// Don't ask for a name if we do not need it
-	if quietFlag.Value || ctx.Config.Source == metadata.SourceType_pam_passphrase {
+	if cmd.QuietFlag.Value || ctx.Config.Source == metadata.SourceType_pam_passphrase {
 		return "", nil
 	}
 
 	for {
-		fmt.Print("Enter a name for the new protector: ")
-		name, err := util.ReadLine()
+		fmt.Fprint(cmd.Output, "Enter a name for the new protector: ")
+		name, err := cmd.ReadLine()
 		if err != nil {
 			return "", err
 		}
@@ -88,23 +89,18 @@ func promptForSource(ctx *actions.Context) error {
 		return nil
 	}
 
-	// Just use the default in quiet mode
-	if quietFlag.Value {
-		return nil
-	}
-
 	// We print all the sources with their number, description, and name.
-	fmt.Println("Your data can be protected with one of the following sources:")
+	fmt.Fprintln(cmd.Output, "Your data can be protected with one of the following sources:")
 	for idx := 1; idx < len(metadata.SourceType_value); idx++ {
 		source := metadata.SourceType(idx)
 		description := sourceDescriptions[source]
-		fmt.Printf("%d - %s (%s)\n", idx, description, source)
+		fmt.Fprintf(cmd.Output, "%d - %s (%s)\n", idx, description, source)
 	}
 
 	for {
-		fmt.Printf("Enter the source number for the new protector [%d - %s]: ",
+		fmt.Fprintf(cmd.Output, "Enter the source number for the new protector [%d - %s]: ",
 			ctx.Config.Source, ctx.Config.Source)
-		input, err := util.ReadLine()
+		input, err := cmd.ReadLine()
 		if err != nil {
 			return err
 		}
@@ -114,7 +110,7 @@ func promptForSource(ctx *actions.Context) error {
 			return nil
 		}
 
-		// Check for a valid index, reprompt if invalid.
+		// Check for a valid index, prompt again if invalid.
 		index, err := strconv.Atoi(input)
 		if err == nil && index >= 1 && index < len(metadata.SourceType_value) {
 			ctx.Config.Source = metadata.SourceType(index)
@@ -130,14 +126,14 @@ func promptForKeyFile(prompt string) (*os.File, error) {
 	if keyFileFlag.Value != "" {
 		return os.Open(keyFileFlag.Value)
 	}
-	if quietFlag.Value {
+	if cmd.QuietFlag.Value {
 		return nil, ErrSpecifyKeyFile
 	}
 
 	// Prompt for a valid path until we get a file we can open.
 	for {
-		fmt.Print(prompt)
-		filename, err := util.ReadLine()
+		fmt.Fprint(cmd.Output, prompt)
+		filename, err := cmd.ReadLine()
 		if err != nil {
 			return nil, err
 		}
@@ -145,7 +141,7 @@ func promptForKeyFile(prompt string) (*os.File, error) {
 		if err == nil {
 			return file, nil
 		}
-		fmt.Println(err)
+		fmt.Fprintln(cmd.Output, err)
 	}
 
 }
@@ -155,7 +151,7 @@ func promptForKeyFile(prompt string) (*os.File, error) {
 // from, that protector is automatically selected.
 func promptForProtector(options []*actions.ProtectorOption) (int, error) {
 	numOptions := len(options)
-	log.Printf("selecting from %s", pluralize(numOptions, "protector"))
+	log.Printf("selecting from %s", cmd.Pluralize(numOptions, "protector"))
 
 	// Get the number of load errors.
 	numLoadErrors := 0
@@ -172,12 +168,12 @@ func promptForProtector(options []*actions.ProtectorOption) (int, error) {
 	if numOptions == 1 {
 		return 0, nil
 	}
-	if quietFlag.Value {
+	if cmd.QuietFlag.Value {
 		return 0, ErrSpecifyProtector
 	}
 
 	// List all of the protector options which did not have a load error.
-	fmt.Println("The available protectors are: ")
+	fmt.Fprintln(cmd.Output, "The available protectors are: ")
 	for idx, option := range options {
 		if option.LoadError != nil {
 			continue
@@ -187,16 +183,16 @@ func promptForProtector(options []*actions.ProtectorOption) (int, error) {
 		if option.LinkedMount != nil {
 			description += fmt.Sprintf(" (linked protector on %q)", option.LinkedMount.Path)
 		}
-		fmt.Println(description)
+		fmt.Fprintln(cmd.Output, description)
 	}
 
 	if numLoadErrors > 0 {
-		fmt.Print(wrapText("NOTE: %d of the %d protectors failed to load. "+loadHelpText, 0))
+		fmt.Fprintln(cmd.Output, "NOTE: %d of the %d protectors failed to load. "+loadHelpText)
 	}
 
 	for {
-		fmt.Print("Enter the number of protector to use: ")
-		input, err := util.ReadLine()
+		fmt.Fprint(cmd.Output, "Enter the number of protector to use: ")
+		input, err := cmd.ReadLine()
 		if err != nil {
 			return 0, err
 		}
diff --git a/cmd/fscrypt/setup.go b/cmd/fscrypt/setup.go
index 63f0c51..a421783 100644
--- a/cmd/fscrypt/setup.go
+++ b/cmd/fscrypt/setup.go
@@ -70,8 +70,8 @@ func setupFilesystem(path string) error {
 		return err
 	}
 
-	fmt.Fprintf(Output, "Metadata directories created at %q.\n", ctx.Mount.BaseDir())
-	fmt.Fprintf(Output, "Filesystem %q (%s) ready for use with %s encryption.\n",
+	fmt.Fprintf(cmd.Output, "Metadata directories created at %q.\n", ctx.Mount.BaseDir())
+	fmt.Fprintf(cmd.Output, "Filesystem %q (%s) ready for use with %s encryption.\n",
 		ctx.Mount.Path, ctx.Mount.Device, ctx.Mount.Filesystem)
 	return nil
 }
diff --git a/cmd/fscrypt/status.go b/cmd/fscrypt/status.go
index 87799a8..e9c2d8d 100644
--- a/cmd/fscrypt/status.go
+++ b/cmd/fscrypt/status.go
@@ -38,7 +38,7 @@ import (
 // Creates a writer which correctly aligns tabs with the specified header.
 // Must call Flush() when done.
 func makeTableWriter(w io.Writer, header string) *tabwriter.Writer {
-	tableWriter := tabwriter.NewWriter(w, 0, indentLength, indentLength, ' ', 0)
+	tableWriter := tabwriter.NewWriter(cmd.Output, 0, cmd.TabWidth, cmd.TabWidth, ' ', 0)
 	fmt.Fprintln(tableWriter, header)
 	return tableWriter
 }
@@ -140,8 +140,10 @@ func writeFilesystemStatus(ctx *actions.Context) error {
 		return err
 	}
 
-	fmt.Fprintf(w, "%s filesystem %q has %s and %s\n\n", ctx.Mount.Filesystem, ctx.Mount.Path,
-		pluralize(len(options), "protector"), pluralize(len(policyDescriptors), "policy"))
+	fmt.Fprintf(cmd.Output, "%s filesystem %q has %s and %s\n\n",
+		ctx.Mount.Filesystem, ctx.Mount.Path,
+		cmd.Pluralize(len(options), "protector"),
+		cmd.Pluralize(len(policyDescriptors), "policy"))
 
 	if len(options) > 0 {
 		writeOptions(options)
@@ -183,7 +185,7 @@ func writePathStatus(path string) error {
 	fmt.Fprintln(cmd.Output)
 
 	options := policy.ProtectorOptions()
-	fmt.Fprintf(cmd.Output, "Protected with %s:\n", pluralize(len(options), "protector"))
-	writeOptions(cmd.Output, options)
+	fmt.Fprintf(cmd.Output, "Protected with %s:\n", cmd.Pluralize(len(options), "protector"))
+	writeOptions(options)
 	return nil
 }
-- 
cgit v1.3