cmd/snap-bootstrap: unlock save partition with protector key #14622
Conversation
| if len(slots) != 0 { | ||
| const allowRecovery = false | ||
| options := activateVolOpts(allowRecovery) | ||
| options.PassphraseTries = 0 |
There was a problem hiding this comment.
This should be part of activateVolOpts maybe.
| sb_plainkey.SetProtectorKeys(key) | ||
| defer sb_plainkey.SetProtectorKeys() | ||
|
|
||
| if err := sbActivateVolumeWithKeyData(mapperName, encdev, nil, options); err != nil { |
There was a problem hiding this comment.
For the nil we should maybe use a const. This is the auth requester I think.
| unlockRes.UnlockMethod = UnlockedWithKey | ||
| return unlockRes, nil | ||
| } | ||
|
|
||
| // UnlockEncryptedVolumeUsingKey unlocks an existing volume using the provided key. | ||
| func UnlockEncryptedVolumeUsingKey(disk disks.Disk, name string, key []byte) (UnlockResult, error) { |
There was a problem hiding this comment.
We should see if this is still needed. Maybe we can remove this function.
| @@ -129,6 +130,62 @@ func UnlockVolumeUsingSealedKeyIfEncrypted(disk disks.Disk, name string, sealedE | |||
| return res, err | |||
| } | |||
|
|
|||
| func UnlockEncryptedVolumeUsingProtectorKey(disk disks.Disk, name string, key []byte) (UnlockResult, error) { | |||
There was a problem hiding this comment.
I did not write doc here.
There was a problem hiding this comment.
And by the way, this is basically UnlockEncryptedVolumeUsingKey with some modifications.
| return unlockRes, fmt.Errorf("cannot list slots in partition save partition: %v", err) | ||
| } | ||
|
|
||
| if len(slots) != 0 { |
There was a problem hiding this comment.
I have just realized this is not the right test at this point. Because we do not yet create "plainkey" tokens. So that means we should just try first activating as a protector key, and if that does not work try it as a key.
However the test that there are no "slots" can be used to skip the try as protector key first.
There was a problem hiding this comment.
Allowing that will also allow use to decide to switch to token vs files based on the version of the OS during installation. Which could be a way out for the missing features of cryptsetup.
pedronis
force-pushed
the
fde-manager-features
branch
from
fcc5e2e
to
24018ee
Compare
valentindavid
force-pushed
the
valentindavid/plainkey-unlocking
branch
from
3b9f37f
to
b80df6d
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## fde-manager-features #14622 +/- ##
========================================================
- Coverage 78.87% 78.84% -0.03%
========================================================
Files 1092 1092
Lines 147404 147453 +49
========================================================
- Hits 116270 116265 -5
- Misses 23886 23938 +52
- Partials 7248 7250 +2
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
Related: SNAPDENG-34064