Attachment 128120 Details for Bug 54828 – Add keyfile_contents blob to unlock options

[patch] Add keyfile_contents blob to unlock options

Add-keyfilecontents-blob-to-unlock-options.patch (text/plain), 4.42 KB, created by Thomas Gläßle on 2016-11-21 22:21:54 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Gläßle

Created: 2016-11-21 22:21:54 UTC

Size: 4.42 KB

patch

obsolete

>From 1427bf26a3a280909fe374252d90f088e0beb887 Mon Sep 17 00:00:00 2001
>From: =?UTF-8?q?Thomas=20Gl=C3=A4=C3=9Fle?= <t_glaessle@gmx.de>
>Date: Mon, 6 Jul 2015 19:50:58 +0200
>Subject: [PATCH] Add keyfile_contents blob to unlock options
>
>---
> src/udiskslinuxencrypted.c | 47 +++++++++++++++++++++++++++++++++++++++++-----
> 1 file changed, 42 insertions(+), 5 deletions(-)
>
>diff --git a/src/udiskslinuxencrypted.c b/src/udiskslinuxencrypted.c
>index fefcba5..05b5ead 100644
>--- a/src/udiskslinuxencrypted.c
>+++ b/src/udiskslinuxencrypted.c
>@@ -36,6 +36,7 @@
> #include "udisksdaemonutil.h"
> #include "udisksstate.h"
> #include "udiskslinuxdevice.h"
>+#include "udisksspawnedjob.h"
> 
> /**
>  * SECTION:udiskslinuxencrypted
>@@ -228,6 +229,30 @@ has_option (const gchar *options,
> 
> /* ---------------------------------------------------------------------------------------------------- */
> 
>+static gboolean
>+lookup_binary_blob(GVariant* dict, const gchar* name, GString** contents)
>+{
>+  GVariantIter *iter;
>+  guchar byte;
>+  gsize size = 0;
>+  gsize index = 0;
>+
>+  if (!g_variant_lookup (dict, name, "a(y)", &iter))
>+    return FALSE;
>+
>+  size = g_variant_iter_n_children (iter);
>+  *contents = g_string_sized_new (size);
>+  (*contents)->len = size;
>+
>+  while (g_variant_iter_loop (iter, "(y)", &byte))
>+    {
>+      (*contents)->str[index++] = byte;
>+    }
>+
>+  g_variant_iter_free (iter);
>+  return TRUE;
>+}
>+
> /* runs in thread dedicated to handling @invocation */
> static gboolean
> handle_unlock (UDisksEncrypted        *encrypted,
>@@ -254,7 +279,9 @@ handle_unlock (UDisksEncrypted        *encrypted,
>   gchar *crypttab_passphrase = NULL;
>   gchar *crypttab_options = NULL;
>   gchar *escaped_device = NULL;
>+  gboolean use_keyfile = FALSE;
>   gboolean read_only = FALSE;
>+  GString *effective_passphrase = NULL;
> 
>   object = udisks_daemon_util_dup_object (encrypted, &error);
>   if (object == NULL)
>@@ -368,10 +395,18 @@ handle_unlock (UDisksEncrypted        *encrypted,
>     name = g_strdup_printf ("luks-%s", udisks_block_get_id_uuid (block));
>   escaped_name = udisks_daemon_util_escape_and_quote (name);
> 
>+  if (lookup_binary_blob(options, "keyfile_contents", &effective_passphrase))
>+    {
>+      use_keyfile = TRUE;
>+    }
>   /* if available, use and prefer the /etc/crypttab passphrase */
>-  if (is_in_crypttab && crypttab_passphrase != NULL && strlen (crypttab_passphrase) > 0)
>+  else if (is_in_crypttab && crypttab_passphrase != NULL && strlen (crypttab_passphrase) > 0)
>     {
>-      passphrase = crypttab_passphrase;
>+      effective_passphrase = g_string_new (crypttab_passphrase);
>+    }
>+  else
>+    {
>+      effective_passphrase = g_string_new (passphrase);
>     }
> 
>   escaped_device = udisks_daemon_util_escape_and_quote (udisks_block_get_device (block));
>@@ -380,7 +415,7 @@ handle_unlock (UDisksEncrypted        *encrypted,
>   if (udisks_block_get_read_only (block))
>     read_only = TRUE;
> 
>-  if (!udisks_daemon_launch_spawned_job_sync (daemon,
>+  if (!udisks_daemon_launch_spawned_job_gstring_sync (daemon,
>                                               object,
>                                               "encrypted-unlock", caller_uid,
>                                               NULL, /* GCancellable */
>@@ -388,10 +423,11 @@ handle_unlock (UDisksEncrypted        *encrypted,
>                                               0,    /* uid_t run_as_euid */
>                                               NULL, /* gint *out_status */
>                                               &error_message,
>-                                              passphrase,  /* input_string */
>-                                              "cryptsetup luksOpen %s %s %s",
>+                                              effective_passphrase,  /* input_string */
>+                                              "cryptsetup luksOpen %s %s %s %s",
>                                               escaped_device,
>                                               escaped_name,
>+                                              use_keyfile ? "--key-file -" : "",
>                                               read_only ? "--readonly" : ""))
>     {
>       g_dbus_method_invocation_return_error (invocation,
>@@ -449,6 +485,7 @@ handle_unlock (UDisksEncrypted        *encrypted,
>   g_clear_object (&cleartext_device);
>   g_clear_object (&cleartext_object);
>   g_clear_object (&object);
>+  udisks_string_wipe_and_free(effective_passphrase);
> 
>   return TRUE; /* returning TRUE means that we handled the method invocation */
> }
>-- 
>2.10.2

Actions: View | Splinter Review

Attachments on bug 54828: 128116 | 128117 | 128118 | 128119 | 128120 | 128121 | 128122 | 128123 | 128139 | 128228 | 128229 | 128230 | 128231

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.