From d0b9e2c995beb13c70a1549923df482ff773f09b Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Sun, 19 Dec 2021 22:17:20 -0600 Subject: filesystem: avoid accessing irrelevant filesystems Forbid 'fscrypt setup' on filesystems that aren't expected to support encryption (other than the root filesystem), and skip looking for fscrypt metadata directories on such filesystems. This has two benefits. First, it avoids the printing of annoying warnings like: pam_fscrypt[75038]: stat /run/user/0/.fscrypt: permission denied pam_fscrypt[75038]: stat /run/user/0/.fscrypt/policies: permission denied pam_fscrypt[75038]: stat /run/user/0/.fscrypt/protectors: permission denied pam_fscrypt[75038]: stat /sys/firmware/efi/efivars/.fscrypt: invalid argument pam_fscrypt[75038]: stat /sys/firmware/efi/efivars/.fscrypt/policies: invalid argument pam_fscrypt[75038]: stat /sys/firmware/efi/efivars/.fscrypt/protectors: invalid argument pam_fscrypt[75038]: stat /sys/fs/pstore/.fscrypt: permission denied pam_fscrypt[75038]: stat /sys/fs/pstore/.fscrypt/policies: permission denied pam_fscrypt[75038]: stat /sys/fs/pstore/.fscrypt/protectors: permission denied Second, it avoids long delays or side effects on some filesystems. To do this, introduce an allowlist of filesystem types that fscrypt will recognize. I wanted to avoid doing this, since this list will need to be updated in the future, but I don't see a better solution. --- filesystem/filesystem_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'filesystem/filesystem_test.go') diff --git a/filesystem/filesystem_test.go b/filesystem/filesystem_test.go index 9b534bd..92726b2 100644 --- a/filesystem/filesystem_test.go +++ b/filesystem/filesystem_test.go @@ -324,7 +324,7 @@ func getTwoSetupMounts(t *testing.T) (realMnt, fakeMnt *Mount, err error) { if err = os.MkdirAll(fakeMountpoint, basePermissions); err != nil { return } - fakeMnt = &Mount{Path: fakeMountpoint} + fakeMnt = &Mount{Path: fakeMountpoint, FilesystemType: realMnt.FilesystemType} err = fakeMnt.Setup() return } -- cgit v1.2.3