From ec85cc8f987647c2b264c1f95dadda0f71c3d991 Mon Sep 17 00:00:00 2001
From: Eric Biggers <ebiggers@google.com>
Date: Tue, 17 Mar 2020 21:10:58 -0700
Subject: Create /etc/fscrypt.conf with policy_version 2 on kernel v5.4+

v2 encryption policies are now recommended, due to various security and
usability advantages over v1 policies.  Many people have been running
into the usability problems with v1, so it's desirable to get people
onto v2 without having to manually opt-in.

Therefore, when 'fscrypt setup' creates /etc/fscrypt.conf, enable
policy_version 2 automatically if the kernel supports it.

I decided to go with this solution over the policy_version "auto" I
suggested originally because this way is simpler, it can still be
changed to "auto" later if desired, and "auto" might require changing
how we parse the config file (since currently the config file is mapped
directly to a protobuf where policy_version is an 'int' and is shared
with EncryptionOptions).

Resolves https://github.com/google/fscrypt/issues/182
---
 util/util.go | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

(limited to 'util/util.go')

diff --git a/util/util.go b/util/util.go
index 97ee33c..d97a7ae 100644
--- a/util/util.go
+++ b/util/util.go
@@ -25,10 +25,14 @@ package util
 
 import (
 	"bufio"
+	"fmt"
+	"log"
 	"os"
 	"os/user"
 	"strconv"
 	"unsafe"
+
+	"golang.org/x/sys/unix"
 )
 
 // Ptr converts a Go byte array to a pointer to the start of the array.
@@ -126,3 +130,22 @@ func EffectiveUser() (*user.User, error) {
 func IsUserRoot() bool {
 	return os.Geteuid() == 0
 }
+
+// IsKernelVersionAtLeast returns true if the Linux kernel version is at least
+// major.minor. If something goes wrong it assumes false.
+func IsKernelVersionAtLeast(major, minor int) bool {
+	var uname unix.Utsname
+	if err := unix.Uname(&uname); err != nil {
+		log.Printf("Uname failed [%v], assuming old kernel", err)
+		return false
+	}
+	release := string(uname.Release[:])
+	log.Printf("Kernel version is %s", release)
+	var actualMajor, actualMinor int
+	if n, _ := fmt.Sscanf(release, "%d.%d", &actualMajor, &actualMinor); n != 2 {
+		log.Printf("Unrecognized uname format %q, assuming old kernel", release)
+		return false
+	}
+	return actualMajor > major ||
+		(actualMajor == major && actualMinor >= minor)
+}
-- 
cgit v1.2.3