From 17bb1e2fddd915f1cf387b3443f2bb41f8051460 Mon Sep 17 00:00:00 2001 From: Ondrej Kozina Date: Thu, 11 Feb 2021 11:15:20 +0100 Subject: [PATCH] Do not upload vk in keyring for cipher_null segment. It does not make sense to upload volume keys in kernel keyring if segment cipher is cipher_null. The real volume_key is thrown away and replaced with empty key anyway. --- lib/luks2/luks2_token.c | 9 ++++++++- lib/setup.c | 19 +++++++++++++++---- 2 files changed, 23 insertions(+), 5 deletions(-) diff --git a/lib/luks2/luks2_token.c b/lib/luks2/luks2_token.c index 1e340451..80b6c0f4 100644 --- a/lib/luks2/luks2_token.c +++ b/lib/luks2/luks2_token.c @@ -383,6 +383,7 @@ int LUKS2_token_open_and_activate(struct crypt_device *cd, uint32_t flags, void *usrptr) { + bool use_keyring; int keyslot, r; char *buffer; size_t buffer_len; @@ -404,7 +405,13 @@ int LUKS2_token_open_and_activate(struct crypt_device *cd, keyslot = r; - if ((name || (flags & CRYPT_ACTIVATE_KEYRING_KEY)) && crypt_use_keyring_for_vk(cd)) { + if (!crypt_use_keyring_for_vk(cd)) + use_keyring = false; + else + use_keyring = ((name && !crypt_is_cipher_null(crypt_get_cipher(cd))) || + (flags & CRYPT_ACTIVATE_KEYRING_KEY)); + + if (use_keyring) { if (!(r = LUKS2_volume_key_load_in_keyring_by_keyslot(cd, hdr, vk, keyslot))) flags |= CRYPT_ACTIVATE_KEYRING_KEY; } diff --git a/lib/setup.c b/lib/setup.c index 084c6457..488ecc9b 100644 --- a/lib/setup.c +++ b/lib/setup.c @@ -3887,6 +3887,7 @@ static int _open_and_activate(struct crypt_device *cd, size_t passphrase_size, uint32_t flags) { + bool use_keyring; int r; struct volume_key *vk = NULL; @@ -3898,8 +3899,13 @@ static int _open_and_activate(struct crypt_device *cd, return r; keyslot = r; - if ((name || (flags & CRYPT_ACTIVATE_KEYRING_KEY)) && - crypt_use_keyring_for_vk(cd)) { + if (!crypt_use_keyring_for_vk(cd)) + use_keyring = false; + else + use_keyring = ((name && !crypt_is_cipher_null(crypt_get_cipher(cd))) || + (flags & CRYPT_ACTIVATE_KEYRING_KEY)); + + if (use_keyring) { r = LUKS2_volume_key_load_in_keyring_by_keyslot(cd, &cd->u.luks2.hdr, vk, keyslot); if (r < 0) @@ -4282,6 +4288,7 @@ int crypt_activate_by_volume_key(struct crypt_device *cd, size_t volume_key_size, uint32_t flags) { + bool use_keyring; struct volume_key *vk = NULL; int r; @@ -4357,8 +4364,12 @@ int crypt_activate_by_volume_key(struct crypt_device *cd, if (r > 0) r = 0; - if (!r && (name || (flags & CRYPT_ACTIVATE_KEYRING_KEY)) && - crypt_use_keyring_for_vk(cd)) { + if (!crypt_use_keyring_for_vk(cd)) + use_keyring = false; + else + use_keyring = (name && !crypt_is_cipher_null(crypt_get_cipher(cd))) || (flags & CRYPT_ACTIVATE_KEYRING_KEY); + + if (!r && use_keyring) { r = LUKS2_key_description_by_segment(cd, &cd->u.luks2.hdr, vk, CRYPT_DEFAULT_SEGMENT); if (!r)