geli attach multiple providers
Allow attaching of multiple geli providers at once if they use same passphrase and keyfiles. This is helpful when the providers being attached are not used for boot, and therefore the existing code to first try the cached password when tasting the providers during boot does not apply. Multiple providers with the same passphrase and keyfiles can be attached at the same time during system start-up by adding the following to rc.conf: geli_groups="storage backup" geli_storage_flags="-k /etc/geli/storage.keys" geli_storage_devices="ada0 ada1" geli_backup_flags="-j /etc/geli/backup.passfile -k /etc/geli/backup.keys" geli_backup_devices="ada2 ada3" Reviewed by: wblock, delphij, jilles Approved by: sobomax (src), bcr (doc) Differential Revision: https://reviews.freebsd.org/D12644
This commit is contained in:
Ben Woods
parent
96fa53869c
commit
217df2da08
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=335673
@ -79,6 +79,8 @@ gbde_lockdir="/etc" # Where to look for gbde lockfiles
|
||||
# GELI disk encryption configuration.
|
||||
geli_devices="" # List of devices to automatically attach in addition to
|
||||
# GELI devices listed in /etc/fstab.
|
||||
geli_groups="" # List of groups containing devices to automatically
|
||||
# attach with the same keyfiles and passphrase
|
||||
geli_tries="" # Number of times to attempt attaching geli device.
|
||||
# If empty, kern.geom.eli.tries will be used.
|
||||
geli_default_flags="" # Default flags for geli(8).
|
||||
@ -90,6 +92,11 @@ geli_autodetach="YES" # Automatically detach on last close.
|
||||
#geli_da1_flags="-p -k /etc/geli/da1.keys"
|
||||
#geli_da1_autodetach="NO"
|
||||
#geli_mirror_home_flags="-k /etc/geli/home.keys"
|
||||
#geli_groups="storage backup"
|
||||
#geli_storage_flags="-k /etc/geli/storage.keys"
|
||||
#geli_storage_devices="ada0 ada1"
|
||||
#geli_backup_flags="-j /etc/geli/backup.passfile -k /etc/geli/backup.keys"
|
||||
#geli_backup_devices="ada2 ada3"
|
||||
|
||||
root_rw_mount="YES" # Set to NO to inhibit remounting root read-write.
|
||||
root_hold_delay="30" # Time to wait for root mount hold release.
|
||||
|
||||
@ -34,7 +34,7 @@
|
||||
|
||||
name="geli"
|
||||
desc="GELI disk encryption"
|
||||
start_precmd='[ -n "$(geli_make_list)" ]'
|
||||
start_precmd='[ -n "$(geli_make_list)" -o -n "${geli_groups}" ]'
|
||||
start_cmd="geli_start"
|
||||
stop_cmd="geli_stop"
|
||||
required_modules="geom_eli:g_eli"
|
||||
@ -72,12 +72,48 @@ geli_start()
|
||||
done
|
||||
fi
|
||||
done
|
||||
|
||||
for group in ${geli_groups}; do
|
||||
group_=`ltr ${group} '/-' '_'`
|
||||
|
||||
eval "flags=\${geli_${group_}_flags}"
|
||||
if [ -z "${flags}" ]; then
|
||||
flags=${geli_default_flags}
|
||||
fi
|
||||
|
||||
eval "providers=\${geli_${group_}_devices}"
|
||||
if [ -z "${providers}" ]; then
|
||||
echo "No devices listed in geli group ${group}."
|
||||
continue
|
||||
fi
|
||||
|
||||
if [ -e "/dev/${providers%% *}" -a ! -e "/dev/${providers%% *}.eli" ]; then
|
||||
echo "Configuring Disk Encryption for geli group ${group}, containing ${providers}."
|
||||
count=1
|
||||
while [ ${count} -le ${geli_tries} ]; do
|
||||
geli attach ${flags} ${providers}
|
||||
if [ -e "/dev/${providers%% *}.eli" ]; then
|
||||
break
|
||||
fi
|
||||
echo "Attach failed; attempt ${count} of ${geli_tries}."
|
||||
count=$((count+1))
|
||||
done
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
geli_stop()
|
||||
{
|
||||
devices=`geli_make_list`
|
||||
|
||||
for group in ${geli_groups}; do
|
||||
group_=`ltr ${group} '/-' '_'`
|
||||
|
||||
eval "providers=\${geli_${group_}_devices}"
|
||||
|
||||
devices="${devices} ${providers}"
|
||||
done
|
||||
|
||||
for provider in ${devices}; do
|
||||
if [ -e "/dev/${provider}.eli" ]; then
|
||||
umount "/dev/${provider}.eli" 2>/dev/null
|
||||
|
||||
@ -24,7 +24,7 @@
|
||||
.\"
|
||||
.\" $FreeBSD$
|
||||
.\"
|
||||
.Dd May 9, 2018
|
||||
.Dd June 27, 2018
|
||||
.Dt GELI 8
|
||||
.Os
|
||||
.Sh NAME
|
||||
@ -71,7 +71,7 @@ utility:
|
||||
.Op Fl n Ar keyno
|
||||
.Op Fl j Ar passfile
|
||||
.Op Fl k Ar keyfile
|
||||
.Ar prov
|
||||
.Ar prov ...
|
||||
.Nm
|
||||
.Cm detach
|
||||
.Op Fl fl
|
||||
@ -192,8 +192,7 @@ entered via prompt or read from one or more passfiles; a keyfile read from
|
||||
one or more files.
|
||||
.It
|
||||
Allows encryption of the root partition.
|
||||
The user will be asked for the
|
||||
passphrase before the root file system is mounted.
|
||||
The user is asked for the passphrase before the root filesystem is mounted.
|
||||
.It
|
||||
Strengthens the passphrase component of the User Key with:
|
||||
.Rs
|
||||
@ -217,12 +216,12 @@ so that if a user has to quickly destroy key material,
|
||||
it is possible to get the data back by restoring keys from
|
||||
backup.
|
||||
.It
|
||||
Providers can be configured to automatically detach on last close
|
||||
(so users do not have to remember to detach providers after unmounting
|
||||
the file systems).
|
||||
Providers can be configured to automatically detach on last close,
|
||||
so users do not have to remember to detach providers after unmounting
|
||||
the filesystems.
|
||||
.It
|
||||
Allows attaching a provider with a random, one-time Master Key -
|
||||
useful for swap partitions and temporary file systems.
|
||||
Allows attaching a provider with a random, one-time Master Key,
|
||||
which is useful for swap partitions and temporary filesystems.
|
||||
.It
|
||||
Allows verification of data integrity (data authentication).
|
||||
.It
|
||||
@ -380,17 +379,23 @@ This option is helpful when creating a provider that may be used by older
|
||||
versions.
|
||||
Consult the
|
||||
.Sx HISTORY
|
||||
section to find which metadata version is supported by which FreeBSD version.
|
||||
section to find which metadata version is supported by which
|
||||
.Fx
|
||||
version.
|
||||
Note that using an older version of metadata may limit the number of
|
||||
features available.
|
||||
.El
|
||||
.It Cm attach
|
||||
Attach the given provider.
|
||||
The encrypted Master Key will be loaded from the metadata and decrypted
|
||||
using the given passphrase/keyfile and a new GEOM provider will be created
|
||||
using the given provider's name with an
|
||||
Attach the given providers.
|
||||
The encrypted Master Keys are loaded from the metadata and decrypted
|
||||
using the given passphrase/keyfile and new GEOM providers are created
|
||||
using the specified provider names.
|
||||
A
|
||||
.Qq .eli
|
||||
suffix.
|
||||
suffix is added to the user specified provider names.
|
||||
Multiple providers can only be attached with a single
|
||||
.Cm attach
|
||||
command if they all have the same passphrase and keyfiles.
|
||||
.Pp
|
||||
Additional options include:
|
||||
.Bl -tag -width ".Fl j Ar passfile"
|
||||
@ -398,11 +403,11 @@ Additional options include:
|
||||
Do a dry-run decryption.
|
||||
This is useful to verify passphrase and keyfile without decrypting the device.
|
||||
.It Fl d
|
||||
If specified, a decrypted provider will be detached automatically on last close.
|
||||
This can help with scarce memory so the user does not have to remember to detach the
|
||||
provider after unmounting the file system.
|
||||
It only works when the provider was opened for writing, so it will not work if
|
||||
the file system on the provider is mounted read-only.
|
||||
If specified, the decrypted providers are detached automatically on last close,
|
||||
so the user does not have to remember to detach
|
||||
providers after unmounting the filesystems.
|
||||
This only works when providers were opened for writing, and will not work if
|
||||
the filesystems on the providers were mounted read-only.
|
||||
Probably a better choice is the
|
||||
.Fl l
|
||||
option for the
|
||||
@ -419,6 +424,7 @@ For more information see the description of the
|
||||
option for the
|
||||
.Cm init
|
||||
subcommand.
|
||||
The same passfiles are used for all listed providers.
|
||||
.It Fl k Ar keyfile
|
||||
Specifies a file which contains the keyfile component of the User Key
|
||||
(or part of it).
|
||||
@ -427,14 +433,15 @@ For more information see the description of the
|
||||
option for the
|
||||
.Cm init
|
||||
subcommand.
|
||||
The same keyfiles are used for all listed providers.
|
||||
.It Fl p
|
||||
Do not use a passphrase as a component of the User Key.
|
||||
Do not use a passphrase as a component of the User Keys.
|
||||
Cannot be combined with the
|
||||
.Fl j
|
||||
option.
|
||||
.It Fl r
|
||||
Attach read-only provider.
|
||||
It will not be opened for writing.
|
||||
Attach read-only providers.
|
||||
They are not opened for writing.
|
||||
.El
|
||||
.It Cm detach
|
||||
Detach the given providers, which means remove the devfs entry
|
||||
@ -445,14 +452,15 @@ Additional options include:
|
||||
.It Fl f
|
||||
Force detach - detach even if the provider is open.
|
||||
.It Fl l
|
||||
Mark provider to detach on last close.
|
||||
Mark provider to detach on last close, after the last filesystem has been
|
||||
unmounted.
|
||||
If this option is specified, the provider will not be detached
|
||||
while it is open, but will be automatically detached when it is closed for the
|
||||
last time even if it was only opened for reading.
|
||||
.El
|
||||
.It Cm onetime
|
||||
Attach the given providers with a random, one-time (ephemeral) Master Key.
|
||||
The command can be used to encrypt swap partitions or temporary file systems.
|
||||
The command can be used to encrypt swap partitions or temporary filesystems.
|
||||
.Pp
|
||||
Additional options include:
|
||||
.Bl -tag -width ".Fl a Ar sectorsize"
|
||||
@ -467,10 +475,10 @@ For more information, see the description of the
|
||||
.Cm init
|
||||
subcommand.
|
||||
.It Fl d
|
||||
Detach on last close.
|
||||
Note: this option is not usable for temporary file systems as the provider will
|
||||
be detached after creating the file system on it.
|
||||
It still can (and should be) used for swap partitions.
|
||||
Detach on last close, after the last filesystem has been unmounted.
|
||||
Note: this option is not usable for temporary filesystems as the provider is
|
||||
detached after the filesystem has been created.
|
||||
It still can, and should, be used for swap partitions.
|
||||
For more information, see the description of the
|
||||
.Cm attach
|
||||
subcommand.
|
||||
@ -643,17 +651,17 @@ and
|
||||
.El
|
||||
.It Cm suspend
|
||||
Suspend device by waiting for all inflight requests to finish, clearing all
|
||||
sensitive information (like the Master Key and Data Keys) from kernel memory,
|
||||
sensitive information such as the Master Key and Data Keys from kernel memory,
|
||||
and blocking all further I/O requests until the
|
||||
.Cm resume
|
||||
subcommand is executed.
|
||||
This functionality is useful for laptops: when one wants to suspend a
|
||||
laptop, one does not want to leave an encrypted device attached.
|
||||
Instead of closing all files and directories opened from a file system located
|
||||
on an encrypted device, unmounting the file system, and detaching the device,
|
||||
the
|
||||
This functionality is useful for laptops.
|
||||
Suspending a laptop should not leave an encrypted device attached.
|
||||
The
|
||||
.Cm suspend
|
||||
subcommand can be used.
|
||||
subcommand can be used rather than closing all files and directories from
|
||||
filesystems on the encrypted device, unmounting the filesystem, and
|
||||
detaching the device.
|
||||
Any access to the encrypted device will be blocked until the Master Key is
|
||||
reloaded through the
|
||||
.Cm resume
|
||||
@ -664,8 +672,8 @@ The
|
||||
subcommand does not work with devices created with the
|
||||
.Cm onetime
|
||||
subcommand.
|
||||
Please note that sensitive data might still be present in memory after
|
||||
suspending an encrypted device due to the file system cache, etc.
|
||||
Please note that sensitive data might still be present in memory locations
|
||||
such as the filesystem cache after suspending an encrypted device.
|
||||
.Pp
|
||||
Additional options include:
|
||||
.Bl -tag -width ".Fl a"
|
||||
@ -678,23 +686,23 @@ devices.
|
||||
Resume previously suspended device.
|
||||
The caller must ensure that executing this subcommand does not access the
|
||||
suspended device, leading to a deadlock.
|
||||
For example suspending a device which contains the file system where the
|
||||
For example, suspending a device which contains the filesystem where the
|
||||
.Nm
|
||||
utility is stored is bad idea.
|
||||
utility is stored is a bad idea.
|
||||
.Pp
|
||||
Additional options include:
|
||||
.Bl -tag -width ".Fl j Ar passfile"
|
||||
.It Fl j Ar passfile
|
||||
Specifies a file which contains the passphrase component of the User Key
|
||||
(or part of it).
|
||||
Specifies a file which contains the passphrase component of the User Key,
|
||||
or part of it.
|
||||
For more information see the description of the
|
||||
.Fl J
|
||||
option for the
|
||||
.Cm init
|
||||
subcommand.
|
||||
.It Fl k Ar keyfile
|
||||
Specifies a file which contains the keyfile component of the User Key
|
||||
(or part of it).
|
||||
Specifies a file which contains the keyfile component of the User Key,
|
||||
or part of it.
|
||||
For more information see the description of the
|
||||
.Fl K
|
||||
option for the
|
||||
@ -810,18 +818,17 @@ If set to 3, the
|
||||
maximum amount of debug information is printed.
|
||||
.It Va kern.geom.eli.tries : No 3
|
||||
Number of times a user is asked for the passphrase.
|
||||
This is only used for providers which are attached on boot
|
||||
(before the root file system is mounted).
|
||||
This is only used for providers which are attached on boot,
|
||||
before the root filesystem is mounted.
|
||||
If set to 0, attaching providers on boot will be disabled.
|
||||
This variable should be set in
|
||||
.Pa /boot/loader.conf .
|
||||
.It Va kern.geom.eli.overwrites : No 5
|
||||
Specifies how many times the Master Key will be overwritten
|
||||
Specifies how many times the Master Key is overwritten
|
||||
with random values when it is destroyed.
|
||||
After this operation it is filled with zeros.
|
||||
.It Va kern.geom.eli.visible_passphrase : No 0
|
||||
If set to 1, the passphrase entered on boot (before the root
|
||||
file system is mounted) will be visible.
|
||||
If set to 1, the passphrase entered on boot will be visible.
|
||||
This alternative should be used with caution as the entered
|
||||
passphrase can be logged and exposed via
|
||||
.Xr dmesg 8 .
|
||||
@ -860,7 +867,7 @@ Exit status is 0 on success, and 1 if the command fails.
|
||||
Initialize a provider which is going to be encrypted with a
|
||||
passphrase and random data from a file on the user's pen drive.
|
||||
Use 4kB sector size.
|
||||
Attach the provider, create a file system, and mount it.
|
||||
Attach the provider, create a filesystem, and mount it.
|
||||
Do the work.
|
||||
Unmount the provider and detach it:
|
||||
.Bd -literal -offset indent
|
||||
@ -915,7 +922,7 @@ Encrypted swap partition setup:
|
||||
.Ed
|
||||
.Pp
|
||||
The example below shows how to configure two providers which will be attached
|
||||
on boot (before the root file system is mounted).
|
||||
on boot, before the root filesystem is mounted.
|
||||
One of them is using passphrase and three keyfile parts and the other is
|
||||
using only a keyfile in one part:
|
||||
.Bd -literal -offset indent
|
||||
@ -993,7 +1000,7 @@ geli: Cannot read metadata from /dev/da0: Invalid argument.
|
||||
Enter passphrase:
|
||||
.Ed
|
||||
.Pp
|
||||
If an encrypted file system is extended, it is necessary to relocate and
|
||||
If an encrypted filesystem is extended, it is necessary to relocate and
|
||||
update the metadata:
|
||||
.Bd -literal -offset indent
|
||||
# gpart create -s GPT ada0
|
||||
|
||||
@ -62,6 +62,13 @@ uint32_t version = G_ELI_VERSION;
|
||||
|
||||
#define GELI_BACKUP_DIR "/var/backups/"
|
||||
#define GELI_ENC_ALGO "aes"
|
||||
#define BUFSIZE 1024
|
||||
|
||||
/*
|
||||
* Passphrase cached when attaching multiple providers, in order to be more
|
||||
* user-friendly if they are using the same passphrase.
|
||||
*/
|
||||
static char cached_passphrase[BUFSIZE] = "";
|
||||
|
||||
static void eli_main(struct gctl_req *req, unsigned flags);
|
||||
static void eli_init(struct gctl_req *req);
|
||||
@ -86,7 +93,7 @@ static int eli_backup_create(struct gctl_req *req, const char *prov,
|
||||
*
|
||||
* init [-bdgPTv] [-a aalgo] [-B backupfile] [-e ealgo] [-i iterations] [-l keylen] [-J newpassfile] [-K newkeyfile] [-s sectorsize] [-V version] prov
|
||||
* label - alias for 'init'
|
||||
* attach [-Cdprv] [-n keyno] [-j passfile] [-k keyfile] prov
|
||||
* attach [-Cdprv] [-n keyno] [-j passfile] [-k keyfile] prov ...
|
||||
* detach [-fl] prov ...
|
||||
* stop - alias for 'detach'
|
||||
* onetime [-d] [-a aalgo] [-e ealgo] [-l keylen] prov
|
||||
@ -154,7 +161,7 @@ struct g_command class_commands[] = {
|
||||
{ 'r', "readonly", NULL, G_TYPE_BOOL },
|
||||
G_OPT_SENTINEL
|
||||
},
|
||||
"[-Cdprv] [-n keyno] [-j passfile] [-k keyfile] prov"
|
||||
"[-Cdprv] [-n keyno] [-j passfile] [-k keyfile] prov ..."
|
||||
},
|
||||
{ "detach", 0, NULL,
|
||||
{
|
||||
@ -275,8 +282,6 @@ struct g_command class_commands[] = {
|
||||
|
||||
static int verbose = 0;
|
||||
|
||||
#define BUFSIZE 1024
|
||||
|
||||
static int
|
||||
eli_protect(struct gctl_req *req)
|
||||
{
|
||||
@ -411,7 +416,7 @@ eli_genkey_files(struct gctl_req *req, bool new, const char *type,
|
||||
passbufsize) {
|
||||
gctl_error(req,
|
||||
"Passphrase in %s too long.", file);
|
||||
bzero(buf, sizeof(buf));
|
||||
explicit_bzero(buf, sizeof(buf));
|
||||
return (-1);
|
||||
}
|
||||
if (p != NULL)
|
||||
@ -421,7 +426,7 @@ eli_genkey_files(struct gctl_req *req, bool new, const char *type,
|
||||
error = errno;
|
||||
if (strcmp(file, "-") != 0)
|
||||
close(fd);
|
||||
bzero(buf, sizeof(buf));
|
||||
explicit_bzero(buf, sizeof(buf));
|
||||
if (done == -1) {
|
||||
gctl_error(req, "Cannot read %s %s: %s.",
|
||||
type, file, strerror(error));
|
||||
@ -442,7 +447,7 @@ eli_genkey_passphrase_prompt(struct gctl_req *req, bool new, char *passbuf,
|
||||
new ? "Enter new passphrase: " : "Enter passphrase: ",
|
||||
passbuf, passbufsize, RPP_ECHO_OFF | RPP_REQUIRE_TTY);
|
||||
if (p == NULL) {
|
||||
bzero(passbuf, passbufsize);
|
||||
explicit_bzero(passbuf, passbufsize);
|
||||
gctl_error(req, "Cannot read passphrase: %s.",
|
||||
strerror(errno));
|
||||
return (-1);
|
||||
@ -455,7 +460,7 @@ eli_genkey_passphrase_prompt(struct gctl_req *req, bool new, char *passbuf,
|
||||
tmpbuf, sizeof(tmpbuf),
|
||||
RPP_ECHO_OFF | RPP_REQUIRE_TTY);
|
||||
if (p == NULL) {
|
||||
bzero(passbuf, passbufsize);
|
||||
explicit_bzero(passbuf, passbufsize);
|
||||
gctl_error(req,
|
||||
"Cannot read passphrase: %s.",
|
||||
strerror(errno));
|
||||
@ -463,11 +468,11 @@ eli_genkey_passphrase_prompt(struct gctl_req *req, bool new, char *passbuf,
|
||||
}
|
||||
|
||||
if (strcmp(passbuf, tmpbuf) != 0) {
|
||||
bzero(passbuf, passbufsize);
|
||||
explicit_bzero(passbuf, passbufsize);
|
||||
fprintf(stderr, "They didn't match.\n");
|
||||
continue;
|
||||
}
|
||||
bzero(tmpbuf, sizeof(tmpbuf));
|
||||
explicit_bzero(tmpbuf, sizeof(tmpbuf));
|
||||
}
|
||||
return (0);
|
||||
}
|
||||
@ -482,6 +487,10 @@ eli_genkey_passphrase(struct gctl_req *req, struct g_eli_metadata *md, bool new,
|
||||
bool nopassphrase;
|
||||
int nfiles;
|
||||
|
||||
/*
|
||||
* Return error if the 'do not use passphrase' flag was given but a
|
||||
* passfile was provided.
|
||||
*/
|
||||
nopassphrase =
|
||||
gctl_get_int(req, new ? "nonewpassphrase" : "nopassphrase");
|
||||
if (nopassphrase) {
|
||||
@ -494,20 +503,32 @@ eli_genkey_passphrase(struct gctl_req *req, struct g_eli_metadata *md, bool new,
|
||||
return (0);
|
||||
}
|
||||
|
||||
/*
|
||||
* Return error if using a provider which does not require a passphrase
|
||||
* but the 'do not use passphrase' flag was not given.
|
||||
*/
|
||||
if (!new && md->md_iterations == -1) {
|
||||
gctl_error(req, "Missing -p flag.");
|
||||
return (-1);
|
||||
}
|
||||
passbuf[0] = '\0';
|
||||
nfiles = eli_genkey_files(req, new, "passfile", NULL, passbuf,
|
||||
sizeof(passbuf));
|
||||
if (nfiles == -1)
|
||||
return (-1);
|
||||
else if (nfiles == 0) {
|
||||
if (eli_genkey_passphrase_prompt(req, new, passbuf,
|
||||
sizeof(passbuf)) == -1) {
|
||||
|
||||
/* Use cached passphrase if defined. */
|
||||
if (strlen(cached_passphrase) > 0) {
|
||||
strlcpy(passbuf, cached_passphrase, sizeof(passbuf));
|
||||
} else {
|
||||
nfiles = eli_genkey_files(req, new, "passfile", NULL, passbuf,
|
||||
sizeof(passbuf));
|
||||
if (nfiles == -1) {
|
||||
return (-1);
|
||||
} else if (nfiles == 0) {
|
||||
if (eli_genkey_passphrase_prompt(req, new, passbuf,
|
||||
sizeof(passbuf)) == -1) {
|
||||
return (-1);
|
||||
}
|
||||
}
|
||||
/* Cache the passphrase for other providers. */
|
||||
strlcpy(cached_passphrase, passbuf, sizeof(cached_passphrase));
|
||||
}
|
||||
/*
|
||||
* Field md_iterations equal to -1 means "choose some sane
|
||||
@ -537,9 +558,9 @@ eli_genkey_passphrase(struct gctl_req *req, struct g_eli_metadata *md, bool new,
|
||||
pkcs5v2_genkey(dkey, sizeof(dkey), md->md_salt,
|
||||
sizeof(md->md_salt), passbuf, md->md_iterations);
|
||||
g_eli_crypto_hmac_update(ctxp, dkey, sizeof(dkey));
|
||||
bzero(dkey, sizeof(dkey));
|
||||
explicit_bzero(dkey, sizeof(dkey));
|
||||
}
|
||||
bzero(passbuf, sizeof(passbuf));
|
||||
explicit_bzero(passbuf, sizeof(passbuf));
|
||||
|
||||
return (0);
|
||||
}
|
||||
@ -645,13 +666,13 @@ eli_metadata_store(struct gctl_req *req, const char *prov,
|
||||
if (fd == -1) {
|
||||
gctl_error(req, "Cannot open %s: %s.", prov,
|
||||
strerror(errno));
|
||||
bzero(sector, sizeof(sector));
|
||||
explicit_bzero(sector, sizeof(sector));
|
||||
return (-1);
|
||||
}
|
||||
if (write(fd, sector, sizeof(sector)) != sizeof(sector)) {
|
||||
gctl_error(req, "Cannot write metadata to %s: %s.",
|
||||
prov, strerror(errno));
|
||||
bzero(sector, sizeof(sector));
|
||||
explicit_bzero(sector, sizeof(sector));
|
||||
close(fd);
|
||||
return (-1);
|
||||
}
|
||||
@ -662,11 +683,11 @@ eli_metadata_store(struct gctl_req *req, const char *prov,
|
||||
if (error != 0) {
|
||||
gctl_error(req, "Cannot write metadata to %s: %s.",
|
||||
prov, strerror(errno));
|
||||
bzero(sector, sizeof(sector));
|
||||
explicit_bzero(sector, sizeof(sector));
|
||||
return (-1);
|
||||
}
|
||||
}
|
||||
bzero(sector, sizeof(sector));
|
||||
explicit_bzero(sector, sizeof(sector));
|
||||
return (0);
|
||||
}
|
||||
|
||||
@ -697,7 +718,7 @@ eli_init(struct gctl_req *req)
|
||||
return;
|
||||
}
|
||||
|
||||
bzero(&md, sizeof(md));
|
||||
explicit_bzero(&md, sizeof(md));
|
||||
strlcpy(md.md_magic, G_ELI_MAGIC, sizeof(md.md_magic));
|
||||
val = gctl_get_intmax(req, "mdversion");
|
||||
if (val == -1) {
|
||||
@ -828,25 +849,25 @@ eli_init(struct gctl_req *req)
|
||||
|
||||
/* Generate user key. */
|
||||
if (eli_genkey(req, &md, key, true) == NULL) {
|
||||
bzero(key, sizeof(key));
|
||||
bzero(&md, sizeof(md));
|
||||
explicit_bzero(key, sizeof(key));
|
||||
explicit_bzero(&md, sizeof(md));
|
||||
return;
|
||||
}
|
||||
|
||||
/* Encrypt the first and the only Master Key. */
|
||||
error = g_eli_mkey_encrypt(md.md_ealgo, key, md.md_keylen, md.md_mkeys);
|
||||
bzero(key, sizeof(key));
|
||||
explicit_bzero(key, sizeof(key));
|
||||
if (error != 0) {
|
||||
bzero(&md, sizeof(md));
|
||||
explicit_bzero(&md, sizeof(md));
|
||||
gctl_error(req, "Cannot encrypt Master Key: %s.",
|
||||
strerror(error));
|
||||
return;
|
||||
}
|
||||
|
||||
eli_metadata_encode(&md, sector);
|
||||
bzero(&md, sizeof(md));
|
||||
explicit_bzero(&md, sizeof(md));
|
||||
error = g_metadata_store(prov, sector, sizeof(sector));
|
||||
bzero(sector, sizeof(sector));
|
||||
explicit_bzero(sector, sizeof(sector));
|
||||
if (error != 0) {
|
||||
gctl_error(req, "Cannot store metadata on %s: %s.", prov,
|
||||
strerror(error));
|
||||
@ -886,38 +907,75 @@ static void
|
||||
eli_attach(struct gctl_req *req)
|
||||
{
|
||||
struct g_eli_metadata md;
|
||||
unsigned char key[G_ELI_USERKEYLEN];
|
||||
struct gctl_req *r;
|
||||
const char *prov;
|
||||
off_t mediasize;
|
||||
int nargs;
|
||||
int i, nargs, nparams, param;
|
||||
const int one = 1;
|
||||
|
||||
nargs = gctl_get_int(req, "nargs");
|
||||
if (nargs != 1) {
|
||||
gctl_error(req, "Invalid number of arguments.");
|
||||
return;
|
||||
}
|
||||
prov = gctl_get_ascii(req, "arg0");
|
||||
|
||||
if (eli_metadata_read(req, prov, &md) == -1)
|
||||
return;
|
||||
|
||||
mediasize = g_get_mediasize(prov);
|
||||
if (md.md_provsize != (uint64_t)mediasize) {
|
||||
gctl_error(req, "Provider size mismatch.");
|
||||
if (nargs == 0) {
|
||||
gctl_error(req, "Too few arguments.");
|
||||
return;
|
||||
}
|
||||
|
||||
if (eli_genkey(req, &md, key, false) == NULL) {
|
||||
bzero(key, sizeof(key));
|
||||
return;
|
||||
unsigned char key[G_ELI_USERKEYLEN];
|
||||
|
||||
/*
|
||||
* Determine number of parameters in the parent geom request before the
|
||||
* nargs parameter and list of providers.
|
||||
*/
|
||||
nparams = req->narg - nargs - 1;
|
||||
|
||||
/* Create new child geom request for each provider and issue to kernel */
|
||||
for (i = 0; i < nargs; i++) {
|
||||
r = gctl_get_handle();
|
||||
|
||||
/* Copy each parameter from the parent request to the child request */
|
||||
for (param = 0; param < nparams; param++) {
|
||||
gctl_ro_param(r, req->arg[param].name, req->arg[param].len, req->arg[param].value);
|
||||
}
|
||||
|
||||
/* Add a single provider to the parameter list of the child */
|
||||
gctl_ro_param(r, "nargs", sizeof(one), &one);
|
||||
prov = gctl_get_ascii(req, "arg%d", i);
|
||||
gctl_ro_param(r, "arg0", -1, prov);
|
||||
|
||||
if (eli_metadata_read(r, prov, &md) == -1)
|
||||
return;
|
||||
|
||||
mediasize = g_get_mediasize(prov);
|
||||
if (md.md_provsize != (uint64_t)mediasize) {
|
||||
gctl_error(r, "Provider size mismatch.");
|
||||
return;
|
||||
}
|
||||
|
||||
if (eli_genkey(r, &md, key, false) == NULL) {
|
||||
explicit_bzero(key, sizeof(key));
|
||||
return;
|
||||
}
|
||||
|
||||
gctl_ro_param(r, "key", sizeof(key), key);
|
||||
|
||||
if (gctl_issue(r) == NULL) {
|
||||
if (verbose)
|
||||
printf("Attached to %s.\n", prov);
|
||||
}
|
||||
|
||||
/* Print error for this request, and set parent request error message */
|
||||
if (r->error != NULL && r->error[0] != '\0') {
|
||||
warnx("%s", r->error);
|
||||
gctl_error(req, "At least one provider failed to attach.");
|
||||
}
|
||||
|
||||
gctl_free(r);
|
||||
|
||||
/* Clear the derived key */
|
||||
explicit_bzero(key, sizeof(key));
|
||||
}
|
||||
|
||||
gctl_ro_param(req, "key", sizeof(key), key);
|
||||
if (gctl_issue(req) == NULL) {
|
||||
if (verbose)
|
||||
printf("Attached to %s.\n", prov);
|
||||
}
|
||||
bzero(key, sizeof(key));
|
||||
/* Clear the cached passphrase */
|
||||
explicit_bzero(cached_passphrase, sizeof(cached_passphrase));
|
||||
}
|
||||
|
||||
static void
|
||||
@ -989,7 +1047,7 @@ eli_configure_detached(struct gctl_req *req, const char *prov, int boot,
|
||||
|
||||
if (changed)
|
||||
eli_metadata_store(req, prov, &md);
|
||||
bzero(&md, sizeof(md));
|
||||
explicit_bzero(&md, sizeof(md));
|
||||
}
|
||||
|
||||
static void
|
||||
@ -1090,7 +1148,7 @@ eli_setkey_attached(struct gctl_req *req, struct g_eli_metadata *md)
|
||||
|
||||
/* Generate key for Master Key encryption. */
|
||||
if (eli_genkey(req, md, key, true) == NULL) {
|
||||
bzero(key, sizeof(key));
|
||||
explicit_bzero(key, sizeof(key));
|
||||
return;
|
||||
}
|
||||
/*
|
||||
@ -1105,7 +1163,7 @@ eli_setkey_attached(struct gctl_req *req, struct g_eli_metadata *md)
|
||||
|
||||
gctl_ro_param(req, "key", sizeof(key), key);
|
||||
gctl_issue(req);
|
||||
bzero(key, sizeof(key));
|
||||
explicit_bzero(key, sizeof(key));
|
||||
}
|
||||
|
||||
static void
|
||||
@ -1125,15 +1183,15 @@ eli_setkey_detached(struct gctl_req *req, const char *prov,
|
||||
|
||||
/* Generate key for Master Key decryption. */
|
||||
if (eli_genkey(req, md, key, false) == NULL) {
|
||||
bzero(key, sizeof(key));
|
||||
explicit_bzero(key, sizeof(key));
|
||||
return;
|
||||
}
|
||||
|
||||
/* Decrypt Master Key. */
|
||||
error = g_eli_mkey_decrypt_any(md, key, mkey, &nkey);
|
||||
bzero(key, sizeof(key));
|
||||
explicit_bzero(key, sizeof(key));
|
||||
if (error != 0) {
|
||||
bzero(md, sizeof(*md));
|
||||
explicit_bzero(md, sizeof(*md));
|
||||
if (error == -1)
|
||||
gctl_error(req, "Wrong key for %s.", prov);
|
||||
else /* if (error > 0) */ {
|
||||
@ -1179,20 +1237,20 @@ eli_setkey_detached(struct gctl_req *req, const char *prov,
|
||||
md->md_keys |= (1 << nkey);
|
||||
|
||||
bcopy(mkey, mkeydst, sizeof(mkey));
|
||||
bzero(mkey, sizeof(mkey));
|
||||
explicit_bzero(mkey, sizeof(mkey));
|
||||
|
||||
/* Generate key for Master Key encryption. */
|
||||
if (eli_genkey(req, md, key, true) == NULL) {
|
||||
bzero(key, sizeof(key));
|
||||
bzero(md, sizeof(*md));
|
||||
explicit_bzero(key, sizeof(key));
|
||||
explicit_bzero(md, sizeof(*md));
|
||||
return;
|
||||
}
|
||||
|
||||
/* Encrypt the Master-Key with the new key. */
|
||||
error = g_eli_mkey_encrypt(md->md_ealgo, key, md->md_keylen, mkeydst);
|
||||
bzero(key, sizeof(key));
|
||||
explicit_bzero(key, sizeof(key));
|
||||
if (error != 0) {
|
||||
bzero(md, sizeof(*md));
|
||||
explicit_bzero(md, sizeof(*md));
|
||||
gctl_error(req, "Cannot encrypt Master Key: %s.",
|
||||
strerror(error));
|
||||
return;
|
||||
@ -1200,7 +1258,7 @@ eli_setkey_detached(struct gctl_req *req, const char *prov,
|
||||
|
||||
/* Store metadata with fresh key. */
|
||||
eli_metadata_store(req, prov, md);
|
||||
bzero(md, sizeof(*md));
|
||||
explicit_bzero(md, sizeof(*md));
|
||||
}
|
||||
|
||||
static void
|
||||
@ -1281,7 +1339,7 @@ eli_delkey_detached(struct gctl_req *req, const char *prov)
|
||||
}
|
||||
|
||||
eli_metadata_store(req, prov, &md);
|
||||
bzero(&md, sizeof(md));
|
||||
explicit_bzero(&md, sizeof(md));
|
||||
}
|
||||
|
||||
static void
|
||||
@ -1329,7 +1387,7 @@ eli_resume(struct gctl_req *req)
|
||||
}
|
||||
|
||||
if (eli_genkey(req, &md, key, false) == NULL) {
|
||||
bzero(key, sizeof(key));
|
||||
explicit_bzero(key, sizeof(key));
|
||||
return;
|
||||
}
|
||||
|
||||
@ -1338,7 +1396,7 @@ eli_resume(struct gctl_req *req)
|
||||
if (verbose)
|
||||
printf("Resumed %s.\n", prov);
|
||||
}
|
||||
bzero(key, sizeof(key));
|
||||
explicit_bzero(key, sizeof(key));
|
||||
}
|
||||
|
||||
static int
|
||||
@ -1508,7 +1566,7 @@ eli_backup_create(struct gctl_req *req, const char *prov, const char *file)
|
||||
ret = 0;
|
||||
out:
|
||||
if (sector != NULL) {
|
||||
bzero(sector, secsize);
|
||||
explicit_bzero(sector, secsize);
|
||||
free(sector);
|
||||
}
|
||||
return (ret);
|
||||
@ -1672,7 +1730,7 @@ eli_resize(struct gctl_req *req)
|
||||
if (provfd != -1)
|
||||
(void)g_close(provfd);
|
||||
if (sector != NULL) {
|
||||
bzero(sector, secsize);
|
||||
explicit_bzero(sector, secsize);
|
||||
free(sector);
|
||||
}
|
||||
}
|
||||
|
||||
@ -24,7 +24,7 @@
|
||||
.\"
|
||||
.\" $FreeBSD$
|
||||
.\"
|
||||
.Dd April 21, 2018
|
||||
.Dd June 27, 2018
|
||||
.Dt RC.CONF 5
|
||||
.Os
|
||||
.Sh NAME
|
||||
@ -2011,6 +2011,13 @@ List of devices to automatically attach on boot.
|
||||
Note that .eli devices from
|
||||
.Pa /etc/fstab
|
||||
are automatically appended to this list.
|
||||
.It Va geli_groups
|
||||
.Pq Vt str
|
||||
List of groups containing devices to automatically attach on boot with the same
|
||||
keyfiles and passphrase.
|
||||
This must be accompanied with a corresponding
|
||||
.Va geli_ Ns Ao Ar group Ac Ns Va _devices
|
||||
variable.
|
||||
.It Va geli_tries
|
||||
.Pq Vt int
|
||||
Number of times user is asked for the pass-phrase.
|
||||
@ -2022,8 +2029,10 @@ sysctl variable.
|
||||
Default flags to use by
|
||||
.Xr geli 8
|
||||
when configuring disk encryption.
|
||||
Flags can be configured for every device separately by defining
|
||||
Flags can be configured for every device separately by defining the
|
||||
.Va geli_ Ns Ao Ar device Ac Ns Va _flags
|
||||
variable, and for every group separately by defining the
|
||||
.Va geli_ Ns Ao Ar group Ac Ns Va _flags
|
||||
variable.
|
||||
.It Va geli_autodetach
|
||||
.Pq Vt str
|
||||
@ -2031,7 +2040,7 @@ Specifies if GELI devices should be marked for detach on last close after
|
||||
file systems are mounted.
|
||||
Default is
|
||||
.Dq Li YES .
|
||||
This can be changed for every device separately by defining
|
||||
This can be changed for every device separately by defining the
|
||||
.Va geli_ Ns Ao Ar device Ac Ns Va _autodetach
|
||||
variable.
|
||||
.It Va root_rw_mount
|
||||
|
||||
Loading…
Reference in New Issue
Block a user