src/home/homework-fscrypt.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <linux/fs.h>
   4 #include <openssl/evp.h>
   5 #include <openssl/sha.h>
   6 #include <sys/ioctl.h>
   7 #include <sys/xattr.h>
   8
   9 #include "errno-util.h"
  10 #include "fd-util.h"
  11 #include "hexdecoct.h"
  12 #include "homework-fscrypt.h"
  13 #include "homework-quota.h"
  14 #include "memory-util.h"
  15 #include "missing_keyctl.h"
  16 #include "missing_syscall.h"
  17 #include "mkdir.h"
  18 #include "nulstr-util.h"
  19 #include "openssl-util.h"
  20 #include "parse-util.h"
  21 #include "process-util.h"
  22 #include "random-util.h"
  23 #include "rm-rf.h"
  24 #include "stdio-util.h"
  25 #include "strv.h"
  26 #include "tmpfile-util.h"
  27 #include "user-util.h"
  28 #include "xattr-util.h"
  29
  30 static int fscrypt_upload_volume_key(
  31                 const uint8_t key_descriptor[static FS_KEY_DESCRIPTOR_SIZE],
  32                 const void *volume_key,
  33                 size_t volume_key_size,
  34                 key_serial_t where) {
  35
  36         _cleanup_free_ char *hex = NULL;
  37         const char *description;
  38         struct fscrypt_key key;
  39         key_serial_t serial;
  40
  41         assert(key_descriptor);
  42         assert(volume_key);
  43         assert(volume_key_size > 0);
  44
  45         if (volume_key_size > sizeof(key.raw))
  46                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Volume key too long.");
  47
  48         hex = hexmem(key_descriptor, FS_KEY_DESCRIPTOR_SIZE);
  49         if (!hex)
  50                 return log_oom();
  51
  52         description = strjoina("fscrypt:", hex);
  53
  54         key = (struct fscrypt_key) {
  55                 .size = volume_key_size,
  56         };
  57         memcpy(key.raw, volume_key, volume_key_size);
  58
  59         /* Upload to the kernel */
  60         serial = add_key("logon", description, &key, sizeof(key), where);
  61         explicit_bzero_safe(&key, sizeof(key));
  62
  63         if (serial < 0)
  64                 return log_error_errno(errno, "Failed to install master key in keyring: %m");
  65
  66         log_info("Uploaded encryption key to kernel.");
  67
  68         return 0;
  69 }
  70
  71 static void calculate_key_descriptor(
  72                 const void *key,
  73                 size_t key_size,
  74                 uint8_t ret_key_descriptor[static FS_KEY_DESCRIPTOR_SIZE]) {
  75
  76         uint8_t hashed[512 / 8] = {}, hashed2[512 / 8] = {};
  77
  78         /* Derive the key descriptor from the volume key via double SHA512, in order to be compatible with e4crypt */
  79
  80         assert_se(SHA512(key, key_size, hashed) == hashed);
  81         assert_se(SHA512(hashed, sizeof(hashed), hashed2) == hashed2);
  82
  83         assert_cc(sizeof(hashed2) >= FS_KEY_DESCRIPTOR_SIZE);
  84
  85         memcpy(ret_key_descriptor, hashed2, FS_KEY_DESCRIPTOR_SIZE);
  86 }
  87
  88 static int fscrypt_slot_try_one(
  89                 const char *password,
  90                 const void *salt, size_t salt_size,
  91                 const void *encrypted, size_t encrypted_size,
  92                 const uint8_t match_key_descriptor[static FS_KEY_DESCRIPTOR_SIZE],
  93                 void **ret_decrypted, size_t *ret_decrypted_size) {
  94
  95
  96         _cleanup_(EVP_CIPHER_CTX_freep) EVP_CIPHER_CTX *context = NULL;
  97         _cleanup_(erase_and_freep) void *decrypted = NULL;
  98         uint8_t key_descriptor[FS_KEY_DESCRIPTOR_SIZE];
  99         int decrypted_size_out1, decrypted_size_out2;
 100         uint8_t derived[512 / 8] = {};
 101         size_t decrypted_size;
 102         const EVP_CIPHER *cc;
 103         int r;
 104
 105         assert(password);
 106         assert(salt);
 107         assert(salt_size > 0);
 108         assert(encrypted);
 109         assert(encrypted_size > 0);
 110         assert(match_key_descriptor);
 111
 112         /* Our construction is like this:
 113          *
 114          *   1. In each key slot we store a salt value plus the encrypted volume key
 115          *
 116          *   2. Unlocking is via calculating PBKDF2-HMAC-SHA512 of the supplied password (in combination with
 117          *      the salt), then using the first 256 bit of the hash as key for decrypting the encrypted
 118          *      volume key in AES256 counter mode.
 119          *
 120          *   3. Writing a password is similar: calculate PBKDF2-HMAC-SHA512 of the supplied password (in
 121          *      combination with the salt), then encrypt the volume key in AES256 counter mode with the
 122          *      resulting hash.
 123          */
 124
 125         if (PKCS5_PBKDF2_HMAC(
 126                             password, strlen(password),
 127                             salt, salt_size,
 128                             0xFFFF, EVP_sha512(),
 129                             sizeof(derived), derived) != 1) {
 130                 r = log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "PBKDF2 failed");
 131                 goto finish;
 132         }
 133
 134         context = EVP_CIPHER_CTX_new();
 135         if (!context) {
 136                 r = log_oom();
 137                 goto finish;
 138         }
 139
 140         /* We use AES256 in counter mode */
 141         assert_se(cc = EVP_aes_256_ctr());
 142
 143         /* We only use the first half of the derived key */
 144         assert(sizeof(derived) >= (size_t) EVP_CIPHER_key_length(cc));
 145
 146         if (EVP_DecryptInit_ex(context, cc, NULL, derived, NULL) != 1)  {
 147                 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initialize decryption context.");
 148                 goto finish;
 149         }
 150
 151         /* Flush out the derived key now, we don't need it anymore */
 152         explicit_bzero_safe(derived, sizeof(derived));
 153
 154         decrypted_size = encrypted_size + EVP_CIPHER_key_length(cc) * 2;
 155         decrypted = malloc(decrypted_size);
 156         if (!decrypted)
 157                 return log_oom();
 158
 159         if (EVP_DecryptUpdate(context, (uint8_t*) decrypted, &decrypted_size_out1, encrypted, encrypted_size) != 1)
 160                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to decrypt volume key.");
 161
 162         assert((size_t) decrypted_size_out1 <= decrypted_size);
 163
 164         if (EVP_DecryptFinal_ex(context, (uint8_t*) decrypted_size + decrypted_size_out1, &decrypted_size_out2) != 1)
 165                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to finish decryption of volume key.");
 166
 167         assert((size_t) decrypted_size_out1 + (size_t) decrypted_size_out2 < decrypted_size);
 168         decrypted_size = (size_t) decrypted_size_out1 + (size_t) decrypted_size_out2;
 169
 170         calculate_key_descriptor(decrypted, decrypted_size, key_descriptor);
 171
 172         if (memcmp(key_descriptor, match_key_descriptor, FS_KEY_DESCRIPTOR_SIZE) != 0)
 173                 return -ENOANO; /* don't log here */
 174
 175         r = fscrypt_upload_volume_key(key_descriptor, decrypted, decrypted_size, KEY_SPEC_THREAD_KEYRING);
 176         if (r < 0)
 177                 return r;
 178
 179         if (ret_decrypted)
 180                 *ret_decrypted = TAKE_PTR(decrypted);
 181         if (ret_decrypted_size)
 182                 *ret_decrypted_size = decrypted_size;
 183
 184         return 0;
 185
 186 finish:
 187         explicit_bzero_safe(derived, sizeof(derived));
 188         return r;
 189 }
 190
 191 static int fscrypt_slot_try_many(
 192                 char **passwords,
 193                 const void *salt, size_t salt_size,
 194                 const void *encrypted, size_t encrypted_size,
 195                 const uint8_t match_key_descriptor[static FS_KEY_DESCRIPTOR_SIZE],
 196                 void **ret_decrypted, size_t *ret_decrypted_size) {
 197
 198         char **i;
 199         int r;
 200
 201         STRV_FOREACH(i, passwords) {
 202                 r = fscrypt_slot_try_one(*i, salt, salt_size, encrypted, encrypted_size, match_key_descriptor, ret_decrypted, ret_decrypted_size);
 203                 if (r != -ENOANO)
 204                         return r;
 205         }
 206
 207         return -ENOANO;
 208 }
 209
 210 static int fscrypt_setup(
 211                 const PasswordCache *cache,
 212                 char **password,
 213                 HomeSetup *setup,
 214                 void **ret_volume_key,
 215                 size_t *ret_volume_key_size) {
 216
 217         _cleanup_free_ char *xattr_buf = NULL;
 218         const char *xa;
 219         int r;
 220
 221         assert(setup);
 222         assert(setup->root_fd >= 0);
 223
 224         r = flistxattr_malloc(setup->root_fd, &xattr_buf);
 225         if (r < 0)
 226                 return log_error_errno(errno, "Failed to retrieve xattr list: %m");
 227
 228         NULSTR_FOREACH(xa, xattr_buf) {
 229                 _cleanup_free_ void *salt = NULL, *encrypted = NULL;
 230                 _cleanup_free_ char *value = NULL;
 231                 size_t salt_size, encrypted_size;
 232                 const char *nr, *e;
 233                 char **list;
 234                 int n;
 235
 236                 /* Check if this xattr has the format 'trusted.fscrypt_slot<nr>' where '<nr>' is a 32bit unsigned integer */
 237                 nr = startswith(xa, "trusted.fscrypt_slot");
 238                 if (!nr)
 239                         continue;
 240                 if (safe_atou32(nr, NULL) < 0)
 241                         continue;
 242
 243                 n = fgetxattr_malloc(setup->root_fd, xa, &value);
 244                 if (n == -ENODATA) /* deleted by now? */
 245                         continue;
 246                 if (n < 0)
 247                         return log_error_errno(n, "Failed to read %s xattr: %m", xa);
 248
 249                 e = memchr(value, ':', n);
 250                 if (!e)
 251                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "xattr %s lacks ':' separator: %m", xa);
 252
 253                 r = unbase64mem(value, e - value, &salt, &salt_size);
 254                 if (r < 0)
 255                         return log_error_errno(r, "Failed to decode salt of %s: %m", xa);
 256                 r = unbase64mem(e+1, n - (e - value) - 1, &encrypted, &encrypted_size);
 257                 if (r < 0)
 258                         return log_error_errno(r, "Failed to decode encrypted key of %s: %m", xa);
 259
 260                 r = -ENOANO;
 261                 FOREACH_POINTER(list, cache->pkcs11_passwords, cache->fido2_passwords, password) {
 262                         r = fscrypt_slot_try_many(
 263                                         list,
 264                                         salt, salt_size,
 265                                         encrypted, encrypted_size,
 266                                         setup->fscrypt_key_descriptor,
 267                                         ret_volume_key, ret_volume_key_size);
 268                         if (r != -ENOANO)
 269                                 break;
 270                 }
 271                 if (r < 0) {
 272                         if (r != -ENOANO)
 273                                 return r;
 274                 } else
 275                         return 0;
 276         }
 277
 278         return log_error_errno(SYNTHETIC_ERRNO(ENOKEY), "Failed to set up home directory with provided passwords.");
 279 }
 280
 281 int home_prepare_fscrypt(
 282                 UserRecord *h,
 283                 bool already_activated,
 284                 PasswordCache *cache,
 285                 HomeSetup *setup) {
 286
 287         _cleanup_(erase_and_freep) void *volume_key = NULL;
 288         struct fscrypt_policy policy = {};
 289         size_t volume_key_size = 0;
 290         const char *ip;
 291         int r;
 292
 293         assert(h);
 294         assert(setup);
 295         assert(user_record_storage(h) == USER_FSCRYPT);
 296
 297         assert_se(ip = user_record_image_path(h));
 298
 299         setup->root_fd = open(ip, O_RDONLY|O_CLOEXEC|O_DIRECTORY);
 300         if (setup->root_fd < 0)
 301                 return log_error_errno(errno, "Failed to open home directory: %m");
 302
 303         if (ioctl(setup->root_fd, FS_IOC_GET_ENCRYPTION_POLICY, &policy) < 0) {
 304                 if (errno == ENODATA)
 305                         return log_error_errno(errno, "Home directory %s is not encrypted.", ip);
 306                 if (ERRNO_IS_NOT_SUPPORTED(errno)) {
 307                         log_error_errno(errno, "File system does not support fscrypt: %m");
 308                         return -ENOLINK; /* make recognizable */
 309                 }
 310                 return log_error_errno(errno, "Failed to acquire encryption policy of %s: %m", ip);
 311         }
 312
 313         memcpy(setup->fscrypt_key_descriptor, policy.master_key_descriptor, FS_KEY_DESCRIPTOR_SIZE);
 314
 315         r = fscrypt_setup(
 316                         cache,
 317                         h->password,
 318                         setup,
 319                         &volume_key,
 320                         &volume_key_size);
 321         if (r < 0)
 322                 return r;
 323
 324         /* Also install the access key in the user's own keyring */
 325
 326         if (uid_is_valid(h->uid)) {
 327                 r = safe_fork("(sd-addkey)", FORK_RESET_SIGNALS|FORK_CLOSE_ALL_FDS|FORK_DEATHSIG|FORK_LOG|FORK_WAIT, NULL);
 328                 if (r < 0)
 329                         return log_error_errno(r, "Failed install encryption key in user's keyring: %m");
 330                 if (r == 0) {
 331                         gid_t gid;
 332
 333                         /* Child */
 334
 335                         gid = user_record_gid(h);
 336                         if (setresgid(gid, gid, gid) < 0) {
 337                                 log_error_errno(errno, "Failed to change GID to " GID_FMT ": %m", gid);
 338                                 _exit(EXIT_FAILURE);
 339                         }
 340
 341                         if (setgroups(0, NULL) < 0) {
 342                                 log_error_errno(errno, "Failed to reset auxiliary groups list: %m");
 343                                 _exit(EXIT_FAILURE);
 344                         }
 345
 346                         if (setresuid(h->uid, h->uid, h->uid) < 0) {
 347                                 log_error_errno(errno, "Failed to change UID to " UID_FMT ": %m", h->uid);
 348                                 _exit(EXIT_FAILURE);
 349                         }
 350
 351                         r = fscrypt_upload_volume_key(
 352                                         setup->fscrypt_key_descriptor,
 353                                         volume_key,
 354                                         volume_key_size,
 355                                         KEY_SPEC_USER_KEYRING);
 356                         if (r < 0)
 357                                 _exit(EXIT_FAILURE);
 358
 359                         _exit(EXIT_SUCCESS);
 360                 }
 361         }
 362
 363         return 0;
 364 }
 365
 366 static int fscrypt_slot_set(
 367                 int root_fd,
 368                 const void *volume_key,
 369                 size_t volume_key_size,
 370                 const char *password,
 371                 uint32_t nr) {
 372
 373         _cleanup_free_ char *salt_base64 = NULL, *encrypted_base64 = NULL, *joined = NULL;
 374         char label[STRLEN("trusted.fscrypt_slot") + DECIMAL_STR_MAX(nr) + 1];
 375         _cleanup_(EVP_CIPHER_CTX_freep) EVP_CIPHER_CTX *context = NULL;
 376         int r, encrypted_size_out1, encrypted_size_out2;
 377         uint8_t salt[64], derived[512 / 8] = {};
 378         _cleanup_free_ void *encrypted = NULL;
 379         const EVP_CIPHER *cc;
 380         size_t encrypted_size;
 381
 382         r = genuine_random_bytes(salt, sizeof(salt), RANDOM_BLOCK);
 383         if (r < 0)
 384                 return log_error_errno(r, "Failed to generate salt: %m");
 385
 386         if (PKCS5_PBKDF2_HMAC(
 387                             password, strlen(password),
 388                             salt, sizeof(salt),
 389                             0xFFFF, EVP_sha512(),
 390                             sizeof(derived), derived) != 1) {
 391                 r = log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "PBKDF2 failed");
 392                 goto finish;
 393         }
 394
 395         context = EVP_CIPHER_CTX_new();
 396         if (!context) {
 397                 r = log_oom();
 398                 goto finish;
 399         }
 400
 401         /* We use AES256 in counter mode */
 402         cc = EVP_aes_256_ctr();
 403
 404         /* We only use the first half of the derived key */
 405         assert(sizeof(derived) >= (size_t) EVP_CIPHER_key_length(cc));
 406
 407         if (EVP_EncryptInit_ex(context, cc, NULL, derived, NULL) != 1)  {
 408                 r = log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to initialize encryption context.");
 409                 goto finish;
 410         }
 411
 412         /* Flush out the derived key now, we don't need it anymore */
 413         explicit_bzero_safe(derived, sizeof(derived));
 414
 415         encrypted_size = volume_key_size + EVP_CIPHER_key_length(cc) * 2;
 416         encrypted = malloc(encrypted_size);
 417         if (!encrypted)
 418                 return log_oom();
 419
 420         if (EVP_EncryptUpdate(context, (uint8_t*) encrypted, &encrypted_size_out1, volume_key, volume_key_size) != 1)
 421                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to encrypt volume key.");
 422
 423         assert((size_t) encrypted_size_out1 <= encrypted_size);
 424
 425         if (EVP_EncryptFinal_ex(context, (uint8_t*) encrypted_size + encrypted_size_out1, &encrypted_size_out2) != 1)
 426                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Failed to finish encryption of volume key.");
 427
 428         assert((size_t) encrypted_size_out1 + (size_t) encrypted_size_out2 < encrypted_size);
 429         encrypted_size = (size_t) encrypted_size_out1 + (size_t) encrypted_size_out2;
 430
 431         r = base64mem(salt, sizeof(salt), &salt_base64);
 432         if (r < 0)
 433                 return log_oom();
 434
 435         r = base64mem(encrypted, encrypted_size, &encrypted_base64);
 436         if (r < 0)
 437                 return log_oom();
 438
 439         joined = strjoin(salt_base64, ":", encrypted_base64);
 440         if (!joined)
 441                 return log_oom();
 442
 443         xsprintf(label, "trusted.fscrypt_slot%" PRIu32, nr);
 444         if (fsetxattr(root_fd, label, joined, strlen(joined), 0) < 0)
 445                 return log_error_errno(errno, "Failed to write xattr %s: %m", label);
 446
 447         log_info("Written key slot %s.", label);
 448
 449         return 0;
 450
 451 finish:
 452         explicit_bzero_safe(derived, sizeof(derived));
 453         return r;
 454 }
 455
 456 int home_create_fscrypt(
 457                 UserRecord *h,
 458                 char **effective_passwords,
 459                 UserRecord **ret_home) {
 460
 461         _cleanup_(rm_rf_physical_and_freep) char *temporary = NULL;
 462         _cleanup_(user_record_unrefp) UserRecord *new_home = NULL;
 463         _cleanup_(erase_and_freep) void *volume_key = NULL;
 464         struct fscrypt_policy policy = {};
 465         size_t volume_key_size = 512 / 8;
 466         _cleanup_close_ int root_fd = -1;
 467         _cleanup_free_ char *d = NULL;
 468         uint32_t nr = 0;
 469         const char *ip;
 470         char **i;
 471         int r;
 472
 473         assert(h);
 474         assert(user_record_storage(h) == USER_FSCRYPT);
 475         assert(ret_home);
 476
 477         assert_se(ip = user_record_image_path(h));
 478
 479         r = tempfn_random(ip, "homework", &d);
 480         if (r < 0)
 481                 return log_error_errno(r, "Failed to allocate temporary directory: %m");
 482
 483         (void) mkdir_parents(d, 0755);
 484
 485         if (mkdir(d, 0700) < 0)
 486                 return log_error_errno(errno, "Failed to create temporary home directory %s: %m", d);
 487
 488         temporary = TAKE_PTR(d); /* Needs to be destroyed now */
 489
 490         root_fd = open(temporary, O_RDONLY|O_CLOEXEC|O_DIRECTORY|O_NOFOLLOW);
 491         if (root_fd < 0)
 492                 return log_error_errno(errno, "Failed to open temporary home directory: %m");
 493
 494         if (ioctl(root_fd, FS_IOC_GET_ENCRYPTION_POLICY, &policy) < 0) {
 495                 if (ERRNO_IS_NOT_SUPPORTED(errno)) {
 496                         log_error_errno(errno, "File system does not support fscrypt: %m");
 497                         return -ENOLINK; /* make recognizable */
 498                 }
 499                 if (errno != ENODATA)
 500                         return log_error_errno(errno, "Failed to get fscrypt policy of directory: %m");
 501         } else
 502                 return log_error_errno(SYNTHETIC_ERRNO(EBUSY), "Parent of %s already encrypted, refusing.", d);
 503
 504         volume_key = malloc(volume_key_size);
 505         if (!volume_key)
 506                 return log_oom();
 507
 508         r = genuine_random_bytes(volume_key, volume_key_size, RANDOM_BLOCK);
 509         if (r < 0)
 510                 return log_error_errno(r, "Failed to acquire volume key: %m");
 511
 512         log_info("Generated volume key of size %zu.", volume_key_size);
 513
 514         policy = (struct fscrypt_policy) {
 515                 .contents_encryption_mode = FS_ENCRYPTION_MODE_AES_256_XTS,
 516                 .filenames_encryption_mode = FS_ENCRYPTION_MODE_AES_256_CTS,
 517                 .flags = FS_POLICY_FLAGS_PAD_32,
 518         };
 519
 520         calculate_key_descriptor(volume_key, volume_key_size, policy.master_key_descriptor);
 521
 522         r = fscrypt_upload_volume_key(policy.master_key_descriptor, volume_key, volume_key_size, KEY_SPEC_THREAD_KEYRING);
 523         if (r < 0)
 524                 return r;
 525
 526         log_info("Uploaded volume key to kernel.");
 527
 528         if (ioctl(root_fd, FS_IOC_SET_ENCRYPTION_POLICY, &policy) < 0)
 529                 return log_error_errno(errno, "Failed to set fscrypt policy on directory: %m");
 530
 531         log_info("Encryption policy set.");
 532
 533         STRV_FOREACH(i, effective_passwords) {
 534                 r = fscrypt_slot_set(root_fd, volume_key, volume_key_size, *i, nr);
 535                 if (r < 0)
 536                         return r;
 537
 538                 nr++;
 539         }
 540
 541         (void) home_update_quota_classic(h, temporary);
 542
 543         r = home_populate(h, root_fd);
 544         if (r < 0)
 545                 return r;
 546
 547         r = home_sync_and_statfs(root_fd, NULL);
 548         if (r < 0)
 549                 return r;
 550
 551         r = user_record_clone(h, USER_RECORD_LOAD_MASK_SECRET, &new_home);
 552         if (r < 0)
 553                 return log_error_errno(r, "Failed to clone record: %m");
 554
 555         r = user_record_add_binding(
 556                         new_home,
 557                         USER_FSCRYPT,
 558                         ip,
 559                         SD_ID128_NULL,
 560                         SD_ID128_NULL,
 561                         SD_ID128_NULL,
 562                         NULL,
 563                         NULL,
 564                         UINT64_MAX,
 565                         NULL,
 566                         NULL,
 567                         h->uid,
 568                         (gid_t) h->uid);
 569         if (r < 0)
 570                 return log_error_errno(r, "Failed to add binding to record: %m");
 571
 572         if (rename(temporary, ip) < 0)
 573                 return log_error_errno(errno, "Failed to rename %s to %s: %m", temporary, ip);
 574
 575         temporary = mfree(temporary);
 576
 577         log_info("Everything completed.");
 578
 579         *ret_home = TAKE_PTR(new_home);
 580         return 0;
 581 }
 582
 583 int home_passwd_fscrypt(
 584                 UserRecord *h,
 585                 HomeSetup *setup,
 586                 PasswordCache *cache,               /* the passwords acquired via PKCS#11/FIDO2 security tokens */
 587                 char **effective_passwords          /* new passwords */) {
 588
 589         _cleanup_(erase_and_freep) void *volume_key = NULL;
 590         _cleanup_free_ char *xattr_buf = NULL;
 591         size_t volume_key_size = 0;
 592         uint32_t slot = 0;
 593         const char *xa;
 594         char **p;
 595         int r;
 596
 597         assert(h);
 598         assert(user_record_storage(h) == USER_FSCRYPT);
 599         assert(setup);
 600
 601         r = fscrypt_setup(
 602                         cache,
 603                         h->password,
 604                         setup,
 605                         &volume_key,
 606                         &volume_key_size);
 607         if (r < 0)
 608                 return r;
 609
 610         STRV_FOREACH(p, effective_passwords) {
 611                 r = fscrypt_slot_set(setup->root_fd, volume_key, volume_key_size, *p, slot);
 612                 if (r < 0)
 613                         return r;
 614
 615                 slot++;
 616         }
 617
 618         r = flistxattr_malloc(setup->root_fd, &xattr_buf);
 619         if (r < 0)
 620                 return log_error_errno(errno, "Failed to retrieve xattr list: %m");
 621
 622         NULSTR_FOREACH(xa, xattr_buf) {
 623                 const char *nr;
 624                 uint32_t z;
 625
 626                 /* Check if this xattr has the format 'trusted.fscrypt_slot<nr>' where '<nr>' is a 32bit unsigned integer */
 627                 nr = startswith(xa, "trusted.fscrypt_slot");
 628                 if (!nr)
 629                         continue;
 630                 if (safe_atou32(nr, &z) < 0)
 631                         continue;
 632
 633                 if (z < slot)
 634                         continue;
 635
 636                 if (fremovexattr(setup->root_fd, xa) < 0)
 637
 638                         if (errno != ENODATA)
 639                                 log_warning_errno(errno, "Failed to remove xattr %s: %m", xa);
 640         }
 641
 642         return 0;
 643 }