korg/e2fsprogs
0
0
Fork 0
mirror of https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git synced 2024-11-23 18:14:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

e4crypt: if salt is explicitly provided to add_key, then use it

Browse Source 
Providing -S and a path to 'add_key' previously exhibited an
unintuitive behavior: instead of using the salt explicitly provided by
the user, e4crypt would use the salt obtained via
EXT4_IOC_GET_ENCRYPTION_PWSALT on the path. This was because
set_policy() was still called with NULL as salt.

With this change we now remember the explicitly provided salt (if any)
and use it as argument for set_policy().

Eventually

e4crypt add_key -S s:my-spicy-salt /foo

will now actually use 'my-spicy-salt' and not something else as salt
for the policy set on /foo.

Signed-off-by: Florian Schmaus <flo@geekplace.eu>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
This commit is contained in:
Florian Schmaus 2020-07-07 10:27:30 +02:00 committed by Theodore Ts'o
parent a2292f8a51
commit 30e3dfb330
2 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
misc/e4crypt.8.in
View File

@ -48,7 +48,9 @@ values are 4, 8, 16, and 32.
If one or more directory paths are specified, e4crypt will try to
set the policy of those directories to use the key just added by the
.B add_key
command.
command. If a salt was explicitly specified, then it will be used
to derive the encryption key of those directories. Otherwise a
directory-specific default salt will be used.
.TP
.B e4crypt get_policy \fIpath\fR ...
Print the policy for the directories specified on the command line.

18
misc/e4crypt.c
View File

@ -26,6 +26,7 @@
#include <getopt.h>
#include <dirent.h>
#include <errno.h>
#include <stdbool.h>
#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
@ -652,6 +653,7 @@ static void do_help(int argc, char **argv, const struct cmd_desc *cmd);
static void do_add_key(int argc, char **argv, const struct cmd_desc *cmd)
{
struct salt *salt;
bool explicit_salt = false;
char *keyring = NULL;
int i, opt, pad = 4;
unsigned j;
@ -666,8 +668,13 @@ static void do_add_key(int argc, char **argv, const struct cmd_desc *cmd)
pad = atoi(optarg);
break;
case 'S':
if (explicit_salt) {
fputs("May only provide -S once\n", stderr);
exit(1);
}
/* Salt value for passphrase. */
parse_salt(optarg, 0);
explicit_salt = true;
break;
case 'v':
options |= OPT_VERBOSE;
@ -692,8 +699,9 @@ static void do_add_key(int argc, char **argv, const struct cmd_desc *cmd)
exit(1);
}
validate_paths(argc, argv, optind);
for (i = optind; i < argc; i++)
parse_salt(argv[i], PARSE_FLAGS_FORCE_FN);
if (!explicit_salt)
for (i = optind; i < argc; i++)
parse_salt(argv[i], PARSE_FLAGS_FORCE_FN);
printf("Enter passphrase (echo disabled): ");
get_passphrase(in_passphrase, sizeof(in_passphrase));
for (j = 0, salt = salt_list; j < num_salt; j++, salt++) {
@ -702,8 +710,10 @@ static void do_add_key(int argc, char **argv, const struct cmd_desc *cmd)
generate_key_ref_str(salt);
insert_key_into_keyring(keyring, salt);
}
if (optind != argc)
set_policy(NULL, pad, argc, argv, optind);
if (optind != argc) {
salt = explicit_salt ? salt_list : NULL;
set_policy(salt, pad, argc, argv, optind);
}
clear_secrets();
exit(0);
}