Ondrej Kozina b869822c8b opal: erase key cached in kernel when LR gets locked. ...

It affects only HW OPAL locking range KEK.

After unlocking opal locking range we cache the key in kernel
so that we do not have to pass the key again for locking the
range later (the OPAL std requires key for lock command).

Unfortunately the key remains cached in kernel even after we
lock the range on purpose during crypt_deactivate* or crypt_suspend.

This had 2 side effects:

1) key remained in system memory even though the LUKS device was
   inactive (and all keys should be erased from memory).

2) when system gets suspended the locking range got automatically
   unlocked later after system resume because the key caching is used
   primarly to automatically unlock locking ranges that got locked
   after system suspend (due to power cut off on storage device).

Since kernel does not directly support dropping cached keys we achieve
that by overwritting the original key structure with empty one.

2023-12-04 19:02:11 +00:00

..

hw_opal.c

opal: erase key cached in kernel when LR gets locked.

2023-12-04 19:02:11 +00:00

hw_opal.h

libcryptsetup: add OPAL type and params

2023-07-17 13:14:52 +02:00