Respect option 'silent' on cryptsetup FIDO2 pin entry

Makes the silent flags behavior consistent between regular password
entry and FIDO2 pin entry.

diff --git a/man/crypttab.xml b/man/crypttab.xml
index c048cd64c2168d669071d68622cbda16a82ce195..e98151ca75bb8924ba15d20a2fbba3b4f4af4913 100644 (file)
--- a/man/crypttab.xml
+++ b/man/crypttab.xml
@@ -531,8 +531,9 @@
       <varlistentry>
         <term><option>silent</option></term>
 
-        <listitem><para>If the encryption password is read from console, no asterisks will be shown
-        while typing the password.</para></listitem>
+        <listitem><para>If an encryption password or security token PIN is
+        read from console, no asterisks will be shown while typing the pin or
+        password.</para></listitem>
       </varlistentry>
 
       <varlistentry>

diff --git a/src/cryptsetup/cryptsetup-fido2.c b/src/cryptsetup/cryptsetup-fido2.c
index 6e400e44e371660e6adf5153da11b337a31c9183..7e347f4bf059bca8a1796ad847765dfafcc491f1 100644 (file)
--- a/src/cryptsetup/cryptsetup-fido2.c
+++ b/src/cryptsetup/cryptsetup-fido2.c
@@ -26,9 +26,10 @@ int acquire_fido2_key(
                 bool headless,
                 Fido2EnrollFlags required,
                 void **ret_decrypted_key,
-                size_t *ret_decrypted_key_size) {
+                size_t *ret_decrypted_key_size,
+                bool silent) {
 
-        AskPasswordFlags flags = ASK_PASSWORD_PUSH_CACHE | ASK_PASSWORD_ACCEPT_CACHED;
+        AskPasswordFlags flags = ASK_PASSWORD_PUSH_CACHE | ASK_PASSWORD_ACCEPT_CACHED | (silent*ASK_PASSWORD_SILENT);
         _cleanup_strv_free_erase_ char **pins = NULL;
         _cleanup_free_ void *loaded_salt = NULL;
         const char *salt;

diff --git a/src/cryptsetup/cryptsetup-fido2.h b/src/cryptsetup/cryptsetup-fido2.h
index 76ec28b3b185acd8a8b5ef1e05f3ba78a0bbf2eb..a7623116816ac46bb53646e1707f06cd2be360c0 100644 (file)
--- a/src/cryptsetup/cryptsetup-fido2.h
+++ b/src/cryptsetup/cryptsetup-fido2.h
@@ -26,7 +26,8 @@ int acquire_fido2_key(
                 bool headless,
                 Fido2EnrollFlags required,
                 void **ret_decrypted_key,
-                size_t *ret_decrypted_key_size);
+                size_t *ret_decrypted_key_size,
+                bool silent);
 
 int find_fido2_auto_data(
                 struct crypt_device *cd,
@@ -56,7 +57,8 @@ static inline int acquire_fido2_key(
                 bool headless,
                 Fido2EnrollFlags required,
                 void **ret_decrypted_key,
-                size_t *ret_decrypted_key_size) {
+                size_t *ret_decrypted_key_size,
+                bool silent) {
 
         return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
                                "FIDO2 token support not available.");

diff --git a/src/cryptsetup/cryptsetup.c b/src/cryptsetup/cryptsetup.c
index f0826c47e56ab6159f1a4287cce3754a883a973c..024909f7334b07f970b4358d2bc45b09c6f676f9 100644 (file)
--- a/src/cryptsetup/cryptsetup.c
+++ b/src/cryptsetup/cryptsetup.c
@@ -809,7 +809,8 @@ static int attach_luks_or_plain_or_bitlk_by_fido2(
                                 until,
                                 arg_headless,
                                 required,
-                                &decrypted_key, &decrypted_key_size);
+                                &decrypted_key, &decrypted_key_size,
+                                arg_silent);
                 if (r >= 0)
                         break;
                 if (r != -EAGAIN) /* EAGAIN means: token not found */