#include "pwquality-util.h"
#include "strv.h"
+int load_volume_key_password(
+ struct crypt_device *cd,
+ const char *cd_node,
+ void *ret_vk,
+ size_t *ret_vks) {
+
+ _cleanup_(erase_and_freep) char *envpw = NULL;
+ int r;
+
+ assert_se(cd);
+ assert_se(cd_node);
+ assert_se(ret_vk);
+ assert_se(ret_vks);
+
+ r = getenv_steal_erase("PASSWORD", &envpw);
+ if (r < 0)
+ return log_error_errno(r, "Failed to acquire password from environment: %m");
+ if (r > 0) {
+ r = crypt_volume_key_get(
+ cd,
+ CRYPT_ANY_SLOT,
+ ret_vk,
+ ret_vks,
+ envpw,
+ strlen(envpw));
+ if (r < 0)
+ return log_error_errno(r, "Password from environment variable $PASSWORD did not work.");
+ } else {
+ AskPasswordFlags ask_password_flags = ASK_PASSWORD_PUSH_CACHE|ASK_PASSWORD_ACCEPT_CACHED;
+ _cleanup_free_ char *question = NULL, *disk_path = NULL;
+ unsigned i = 5;
+ const char *id;
+
+ question = strjoin("Please enter current passphrase for disk ", cd_node, ":");
+ if (!question)
+ return log_oom();
+
+ disk_path = cescape(cd_node);
+ if (!disk_path)
+ return log_oom();
+
+ id = strjoina("cryptsetup:", disk_path);
+
+ for (;;) {
+ _cleanup_strv_free_erase_ char **passwords = NULL;
+
+ if (--i == 0)
+ return log_error_errno(SYNTHETIC_ERRNO(ENOKEY),
+ "Too many attempts, giving up:");
+
+ r = ask_password_auto(
+ question, "drive-harddisk", id, "cryptenroll", "cryptenroll.passphrase", USEC_INFINITY,
+ ask_password_flags,
+ &passwords);
+ if (r < 0)
+ return log_error_errno(r, "Failed to query password: %m");
+
+ r = -EPERM;
+ STRV_FOREACH(p, passwords) {
+ r = crypt_volume_key_get(
+ cd,
+ CRYPT_ANY_SLOT,
+ ret_vk,
+ ret_vks,
+ *p,
+ strlen(*p));
+ if (r >= 0)
+ break;
+ }
+ if (r >= 0)
+ break;
+
+ log_error_errno(r, "Password not correct, please try again.");
+ ask_password_flags &= ~ASK_PASSWORD_ACCEPT_CACHED;
+ }
+ }
+
+ return r;
+}
+
int enroll_password(
struct crypt_device *cd,
const void *volume_key,
static EnrollType arg_enroll_type = _ENROLL_TYPE_INVALID;
static char *arg_unlock_keyfile = NULL;
+static UnlockType arg_unlock_type = UNLOCK_PASSWORD;
+static char *arg_unlock_fido2_device = NULL;
static char *arg_pkcs11_token_uri = NULL;
static char *arg_fido2_device = NULL;
static char *arg_tpm2_device = NULL;
assert_cc(sizeof(arg_wipe_slots_mask) * 8 >= _ENROLL_TYPE_MAX);
STATIC_DESTRUCTOR_REGISTER(arg_unlock_keyfile, freep);
+STATIC_DESTRUCTOR_REGISTER(arg_unlock_fido2_device, freep);
STATIC_DESTRUCTOR_REGISTER(arg_pkcs11_token_uri, freep);
STATIC_DESTRUCTOR_REGISTER(arg_fido2_device, freep);
STATIC_DESTRUCTOR_REGISTER(arg_tpm2_device, freep);
" --recovery-key Enroll a recovery key\n"
" --unlock-key-file=PATH\n"
" Use a file to unlock the volume\n"
+ " --unlock-fido2-device=PATH\n"
+ " Use a FIDO2 device to unlock the volume\n"
" --pkcs11-token-uri=URI\n"
" Specify PKCS#11 security token URI\n"
" --fido2-credential-algorithm=STRING\n"
ARG_PASSWORD,
ARG_RECOVERY_KEY,
ARG_UNLOCK_KEYFILE,
+ ARG_UNLOCK_FIDO2_DEVICE,
ARG_PKCS11_TOKEN_URI,
ARG_FIDO2_DEVICE,
ARG_TPM2_DEVICE,
{ "password", no_argument, NULL, ARG_PASSWORD },
{ "recovery-key", no_argument, NULL, ARG_RECOVERY_KEY },
{ "unlock-key-file", required_argument, NULL, ARG_UNLOCK_KEYFILE },
+ { "unlock-fido2-device", required_argument, NULL, ARG_UNLOCK_FIDO2_DEVICE },
{ "pkcs11-token-uri", required_argument, NULL, ARG_PKCS11_TOKEN_URI },
{ "fido2-credential-algorithm", required_argument, NULL, ARG_FIDO2_CRED_ALG },
{ "fido2-device", required_argument, NULL, ARG_FIDO2_DEVICE },
break;
case ARG_UNLOCK_KEYFILE:
+ if (arg_unlock_type != UNLOCK_PASSWORD)
+ return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+ "Multiple unlock methods specified at once, refusing.");
+
r = parse_path_argument(optarg, /* suppress_root= */ true, &arg_unlock_keyfile);
if (r < 0)
return r;
+
+ arg_unlock_type = UNLOCK_KEYFILE;
break;
+ case ARG_UNLOCK_FIDO2_DEVICE: {
+ _cleanup_free_ char *device = NULL;
+
+ if (arg_unlock_type != UNLOCK_PASSWORD)
+ return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+ "Multiple unlock methods specified at once, refusing.");
+
+ assert(!arg_unlock_fido2_device);
+
+ if (!streq(optarg, "auto")) {
+ device = strdup(optarg);
+ if (!device)
+ return log_oom();
+ }
+
+ arg_unlock_type = UNLOCK_FIDO2;
+ arg_unlock_fido2_device = TAKE_PTR(device);
+ break;
+ }
+
case ARG_PKCS11_TOKEN_URI: {
_cleanup_free_ char *uri = NULL;
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"Multiple operations specified at once, refusing.");
- if (streq(optarg, "auto")) {
- r = fido2_find_device_auto(&device);
- if (r < 0)
- return r;
- } else {
+ if (!streq(optarg, "auto")) {
device = strdup(optarg);
if (!device)
return log_oom();
}
}
+ if ((arg_enroll_type == ENROLL_FIDO2 && arg_unlock_type == UNLOCK_FIDO2)
+ && !(arg_fido2_device && arg_unlock_fido2_device))
+ return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+ "When both enrolling and unlocking with FIDO2 tokens, automatic discovery is unsupported. "
+ "Please specify device paths for enrolling and unlocking respectively.");
+
+ if (arg_enroll_type == ENROLL_FIDO2 && !arg_fido2_device) {
+ r = fido2_find_device_auto(&arg_fido2_device);
+ if (r < 0)
+ return r;
+ }
+
if (optind >= argc)
return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
"No block device node specified, refusing.");
return 0;
}
+static int load_volume_key_keyfile(
+ struct crypt_device *cd,
+ void *ret_vk,
+ size_t *ret_vks) {
+
+ _cleanup_(erase_and_freep) char *password = NULL;
+ size_t password_len;
+ int r;
+
+ assert_se(cd);
+ assert_se(ret_vk);
+ assert_se(ret_vks);
+
+ r = read_full_file_full(
+ AT_FDCWD,
+ arg_unlock_keyfile,
+ 0,
+ SIZE_MAX,
+ READ_FULL_FILE_SECURE|READ_FULL_FILE_WARN_WORLD_READABLE|READ_FULL_FILE_CONNECT_SOCKET,
+ NULL,
+ &password,
+ &password_len);
+ if (r < 0)
+ return log_error_errno(r, "Reading keyfile %s failed: %m", arg_unlock_keyfile);
+
+ r = crypt_volume_key_get(
+ cd,
+ CRYPT_ANY_SLOT,
+ ret_vk,
+ ret_vks,
+ password,
+ password_len);
+ if (r < 0)
+ return log_error_errno(r, "Unlocking via keyfile failed: %m");
+
+ return r;
+}
+
static int prepare_luks(
struct crypt_device **ret_cd,
void **ret_volume_key,
size_t *ret_volume_key_size) {
_cleanup_(crypt_freep) struct crypt_device *cd = NULL;
- _cleanup_(erase_and_freep) char *envpw = NULL;
_cleanup_(erase_and_freep) void *vk = NULL;
size_t vks;
int r;
if (!vk)
return log_oom();
- if (arg_unlock_keyfile) {
- _cleanup_(erase_and_freep) char *password = NULL;
- size_t password_len;
-
- r = read_full_file_full(
- AT_FDCWD,
- arg_unlock_keyfile,
- 0,
- SIZE_MAX,
- READ_FULL_FILE_SECURE|READ_FULL_FILE_WARN_WORLD_READABLE|READ_FULL_FILE_CONNECT_SOCKET,
- NULL,
- &password,
- &password_len);
- if (r < 0)
- return log_error_errno(r, "Reading keyfile %s failed: %m", arg_unlock_keyfile);
-
- r = crypt_volume_key_get(
- cd,
- CRYPT_ANY_SLOT,
- vk,
- &vks,
- password,
- password_len);
- if (r < 0)
- return log_error_errno(r, "Unlocking via keyfile failed: %m");
+ switch (arg_unlock_type) {
- goto out;
- }
+ case UNLOCK_KEYFILE:
+ r = load_volume_key_keyfile(cd, vk, &vks);
+ break;
- r = getenv_steal_erase("PASSWORD", &envpw);
- if (r < 0)
- return log_error_errno(r, "Failed to acquire password from environment: %m");
- if (r > 0) {
- r = crypt_volume_key_get(
- cd,
- CRYPT_ANY_SLOT,
- vk,
- &vks,
- envpw,
- strlen(envpw));
- if (r < 0)
- return log_error_errno(r, "Password from environment variable $PASSWORD did not work.");
- } else {
- AskPasswordFlags ask_password_flags = ASK_PASSWORD_PUSH_CACHE|ASK_PASSWORD_ACCEPT_CACHED;
- _cleanup_free_ char *question = NULL, *disk_path = NULL;
- unsigned i = 5;
- const char *id;
-
- question = strjoin("Please enter current passphrase for disk ", arg_node, ":");
- if (!question)
- return log_oom();
-
- disk_path = cescape(arg_node);
- if (!disk_path)
- return log_oom();
-
- id = strjoina("cryptsetup:", disk_path);
-
- for (;;) {
- _cleanup_strv_free_erase_ char **passwords = NULL;
-
- if (--i == 0)
- return log_error_errno(SYNTHETIC_ERRNO(ENOKEY),
- "Too many attempts, giving up:");
-
- r = ask_password_auto(
- question, "drive-harddisk", id, "cryptenroll", "cryptenroll.passphrase", USEC_INFINITY,
- ask_password_flags,
- &passwords);
- if (r < 0)
- return log_error_errno(r, "Failed to query password: %m");
-
- r = -EPERM;
- STRV_FOREACH(p, passwords) {
- r = crypt_volume_key_get(
- cd,
- CRYPT_ANY_SLOT,
- vk,
- &vks,
- *p,
- strlen(*p));
- if (r >= 0)
- break;
- }
- if (r >= 0)
- break;
+ case UNLOCK_FIDO2:
+ r = load_volume_key_fido2(cd, arg_node, arg_unlock_fido2_device, vk, &vks);
+ break;
- log_error_errno(r, "Password not correct, please try again.");
- ask_password_flags &= ~ASK_PASSWORD_ACCEPT_CACHED;
- }
+ case UNLOCK_PASSWORD:
+ r = load_volume_key_password(cd, arg_node, vk, &vks);
+ break;
+
+ default:
+ return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "Unknown LUKS unlock method");
}
-out:
+ if (r < 0)
+ return r;
+
*ret_cd = TAKE_PTR(cd);
*ret_volume_key = TAKE_PTR(vk);
*ret_volume_key_size = vks;
projects / thirdparty / systemd.git / commitdiff
