blob: 2dda5d7651dcfb915b8ee6a555f32dac808dcb69 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
|
#! /bin/bash
# SPDX-License-Identifier: GPL-2.0
# Copyright 2019 Google LLC
#
# FS QA Test No. 593
#
# Test adding a key to a filesystem's fscrypt keyring via an
# "fscrypt-provisioning" keyring key. This is an alternative to the normal
# method where the raw key is given directly.
#
. ./common/preamble
_begin_fstest auto quick encrypt
# Import common functions.
. ./common/filter
. ./common/encrypt
# real QA test starts here
_supported_fs generic
_require_scratch_encryption -v 2
_require_command "$KEYCTL_PROG" keyctl
_init_session_keyring
_scratch_mkfs_encrypted &>> $seqres.full
_scratch_mount
_require_add_enckey_by_key_id $SCRATCH_MNT
test_with_policy_version()
{
local vers=$1
local dir=$SCRATCH_MNT/dir
local keyid
echo
echo "# =========================="
echo "# Test with policy version $vers"
echo "# =========================="
case $vers in
1)
local keytype=$FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR
local keyspec=$TEST_KEY_DESCRIPTOR
local add_enckey_args="-d $TEST_KEY_DESCRIPTOR"
;;
2)
local keytype=$FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER
local keyspec=$TEST_KEY_IDENTIFIER
local add_enckey_args=""
;;
*)
_fail "Unknown policy version: $vers"
;;
esac
# First add the key in the regular way (raw key given directly), create
# an encrypted file with some contents, and remove the key. After this,
# the encrypted file should no longer be readable.
echo -e "\n# Adding key to filesystem"
_add_enckey $SCRATCH_MNT "$TEST_RAW_KEY" $add_enckey_args
echo -e "\n# Creating encrypted file"
mkdir $dir
_set_encpolicy $dir $keyspec
echo "contents" > $dir/file
echo -e "\n# Removing key from filesystem"
_rm_enckey $SCRATCH_MNT $keyspec
cat $dir/file |& _filter_scratch
# Now we should be able to add the key back via an fscrypt-provisioning
# key which contains the raw key, instead of providing the raw key
# directly. After this, the encrypted file should be readable again.
echo -e "\n# Adding fscrypt-provisioning key"
keyid=$(_add_fscrypt_provisioning_key $keyspec $keytype "$TEST_RAW_KEY")
echo -e "\n# Adding key to filesystem via fscrypt-provisioning key"
$XFS_IO_PROG -c "add_enckey -k $keyid $add_enckey_args" $SCRATCH_MNT
echo -e "\n# Reading encrypted file"
cat $dir/file
echo -e "\n# Cleaning up"
rm -rf $dir
_scratch_cycle_mount # Clear all keys
}
# Test with both v1 and v2 encryption policies.
test_with_policy_version 1
test_with_policy_version 2
# Now test that invalid fscrypt-provisioning keys can't be created, that
# fscrypt-provisioning keys can't be read back by userspace, and that the
# filesystem only accepts properly matching fscrypt-provisioning keys.
echo
echo "# ================"
echo "# Validation tests"
echo "# ================"
echo -e "\n# Adding an invalid fscrypt-provisioning key fails"
echo "# ... bad type"
_add_fscrypt_provisioning_key desc 0 "$TEST_RAW_KEY"
echo "# ... bad type"
_add_fscrypt_provisioning_key desc 10000 "$TEST_RAW_KEY"
echo "# ... raw key too small"
_add_fscrypt_provisioning_key desc $FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR ""
echo "# ... raw key too large"
_add_fscrypt_provisioning_key desc $FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR \
"$TEST_RAW_KEY$TEST_RAW_KEY"
echo -e "\n# keyctl_read() doesn't work on fscrypt-provisioning keys"
keyid=$(_add_fscrypt_provisioning_key desc $FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR \
"$TEST_RAW_KEY")
$KEYCTL_PROG read $keyid
$KEYCTL_PROG unlink $keyid $TEST_KEYRING_ID
echo -e "\n# Only keys with the correct fscrypt_provisioning_key_payload::type field can be added"
echo "# ... keyring key is v1, filesystem wants v2 key"
keyid=$(_add_fscrypt_provisioning_key desc $FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR \
"$TEST_RAW_KEY")
$XFS_IO_PROG -c "add_enckey -k $keyid" $SCRATCH_MNT
$KEYCTL_PROG unlink $keyid $TEST_KEYRING_ID
echo "# ... keyring key is v2, filesystem wants v1 key"
keyid=$(_add_fscrypt_provisioning_key desc $FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER \
"$TEST_RAW_KEY")
$XFS_IO_PROG -c "add_enckey -k $keyid -d $TEST_KEY_DESCRIPTOR" $SCRATCH_MNT
$KEYCTL_PROG unlink $keyid $TEST_KEYRING_ID
echo -e "\n# Only keys of type fscrypt-provisioning can be added"
keyid=$(head -c 64 /dev/urandom | \
$KEYCTL_PROG padd logon foo:desc $TEST_KEYRING_ID)
$XFS_IO_PROG -c "add_enckey -k $keyid" $SCRATCH_MNT
$KEYCTL_PROG unlink $keyid $TEST_KEYRING_ID
# success, all done
status=0
exit
|
