Skip to content

Commit a140682

Browse files
mostlikeleemostlikelee
committed
review comments
1 parent 4d1ff60 commit a140682

File tree

2 files changed

+121
-12
lines changed

2 files changed

+121
-12
lines changed

‎orbit/pkg/luks/luks_linux.go

Lines changed: 29 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,13 @@ const (
3030
infoSuccessTitle = "Encryption key escrow"
3131
infoSuccessText = "Key escrowed successfully."
3232
maxKeySlots = 8
33+
userKeySlot = 0 // Key slot 0 is assumed to be the location of the user's passphrase
3334
)
3435

3536
var ErrKeySlotFull = regexp.MustCompile(`Key slot \d+ is full`)
3637

3738
func (lr *LuksRunner) Run(oc *fleet.OrbitConfig) error {
38-
ctx, cancel := context.WithCancel(context.Background())
39-
defer cancel()
39+
ctx := context.Background()
4040

4141
if !oc.Notifications.RunDiskEncryptionEscrow {
4242
return nil
@@ -65,28 +65,38 @@ func (lr *LuksRunner) Run(oc *fleet.OrbitConfig) error {
6565
}
6666

6767
if err := lr.escrower.SendLinuxKeyEscrowResponse(response); err != nil {
68+
// If sending the response fails, remove the key slot
69+
if keyslot != nil {
70+
if err := removeKeySlot(ctx, devicePath, *keyslot); err != nil {
71+
log.Error().Err(err).Msg("failed to remove key slot")
72+
}
73+
}
74+
75+
// Show error in dialog
6876
if err := lr.infoPrompt(ctx, infoFailedTitle, infoFailedText); err != nil {
69-
log.Debug().Err(err).Msg("failed to show failed escrow key dialog")
77+
log.Info().Err(err).Msg("failed to show failed escrow key dialog")
7078
}
79+
7180
return fmt.Errorf("escrower escrowKey err: %w", err)
7281
}
7382

7483
if response.Err != "" {
7584
if err := lr.infoPrompt(ctx, infoFailedTitle, response.Err); err != nil {
76-
log.Debug().Err(err).Msg("failed to show failed escrow key dialog")
85+
log.Info().Err(err).Msg("failed to show response error dialog")
7786
}
7887
return fmt.Errorf("error getting linux escrow key: %s", response.Err)
7988
}
8089

8190
// Show success dialog
8291
if err := lr.infoPrompt(ctx, infoSuccessTitle, infoSuccessText); err != nil {
83-
log.Debug().Err(err).Msg("failed to show success escrow key dialog")
92+
log.Info().Err(err).Msg("failed to show success escrow key dialog")
8493
}
8594

8695
return nil
8796
}
8897

8998
func (lr *LuksRunner) getEscrowKey(ctx context.Context, devicePath string) ([]byte, *uint, error) {
99+
// AESXTSPlain64Cipher is the default cipher used by ubuntu/kubuntu/fedora
90100
device := luksdevice.New(luksdevice.AESXTSPlain64Cipher)
91101

92102
// Prompt user for existing LUKS passphrase
@@ -133,16 +143,16 @@ func (lr *LuksRunner) getEscrowKey(ctx context.Context, devicePath string) ([]by
133143
return nil, nil, fmt.Errorf("Failed to generate random passphrase: %w", err)
134144
}
135145

136-
// Create a new key slot, error if all key slots are full
137-
// keySlot 0 is assumed to be the user's passphrase
138-
// so we start at 1
139-
var keySlot uint = 1
146+
// Create a new key slot and error if all key slots are full
147+
// Start at slot 1 as keySlot 0 is assumed to be the location of
148+
// the user's passphrase
149+
var keySlot uint = userKeySlot + 1
140150
for {
141151
if keySlot == maxKeySlots {
142152
return nil, nil, errors.New("all LUKS key slots are full")
143153
}
144154

145-
userKey := encryption.NewKey(0, passphrase)
155+
userKey := encryption.NewKey(userKeySlot, passphrase)
146156
escrowKey := encryption.NewKey(int(keySlot), escrowPassphrase)
147157

148158
if err := device.AddKey(ctx, devicePath, userKey, escrowKey); err != nil {
@@ -286,3 +296,12 @@ func getSaltforKeySlot(ctx context.Context, devicePath string, keySlot uint) (st
286296

287297
return slot.KDF.Salt, nil
288298
}
299+
300+
func removeKeySlot(ctx context.Context, devicePath string, keySlot uint) error {
301+
cmd := exec.CommandContext(ctx, "cryptsetup", "luksKillSlot", devicePath, fmt.Sprintf("%d", keySlot))
302+
if err := cmd.Run(); err != nil {
303+
return fmt.Errorf("Failed to run cryptsetup luksKillSlot: %w", err)
304+
}
305+
306+
return nil
307+
}

‎orbit/pkg/lvm/lvm_test.go

Lines changed: 92 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ import (
88
)
99

1010
// sample from real LUKS encrypted Ubuntu disk
11-
var testJson = `{
11+
var testJsonUbuntu = `{
1212
"blockdevices": [
1313
{
1414
"name": "loop0",
@@ -213,14 +213,104 @@ var testJson = `{
213213
]
214214
}`
215215

216+
var testJsonFedora = `{
217+
"blockdevices": [
218+
{
219+
"name": "sr0",
220+
"maj:min": "11:0",
221+
"rm": true,
222+
"size": "2.1G",
223+
"ro": false,
224+
"type": "rom",
225+
"mountpoints": [
226+
"/run/media/luk/Fedora-WS-Live-40-1-14"
227+
]
228+
},{
229+
"name": "zram0",
230+
"maj:min": "252:0",
231+
"rm": false,
232+
"size": "1.9G",
233+
"ro": false,
234+
"type": "disk",
235+
"mountpoints": [
236+
"[SWAP]"
237+
]
238+
},{
239+
"name": "nvme0n1",
240+
"maj:min": "259:0",
241+
"rm": false,
242+
"size": "20G",
243+
"ro": false,
244+
"type": "disk",
245+
"mountpoints": [
246+
null
247+
],
248+
"children": [
249+
{
250+
"name": "nvme0n1p1",
251+
"maj:min": "259:1",
252+
"rm": false,
253+
"size": "600M",
254+
"ro": false,
255+
"type": "part",
256+
"mountpoints": [
257+
"/boot/efi"
258+
]
259+
},{
260+
"name": "nvme0n1p2",
261+
"maj:min": "259:2",
262+
"rm": false,
263+
"size": "1G",
264+
"ro": false,
265+
"type": "part",
266+
"mountpoints": [
267+
"/boot"
268+
]
269+
},{
270+
"name": "nvme0n1p3",
271+
"maj:min": "259:3",
272+
"rm": false,
273+
"size": "18.4G",
274+
"ro": false,
275+
"type": "part",
276+
"mountpoints": [
277+
null
278+
],
279+
"children": [
280+
{
281+
"name": "luks-21fc9b67-752e-42fb-83bb-8c92864382e9",
282+
"maj:min": "253:0",
283+
"rm": false,
284+
"size": "18.4G",
285+
"ro": false,
286+
"type": "crypt",
287+
"mountpoints": [
288+
"/home", "/"
289+
]
290+
}
291+
]
292+
}
293+
]
294+
}
295+
]
296+
}`
297+
216298
func TestFindRootDisk(t *testing.T) {
217299
var input bytes.Buffer
218-
_, err := input.WriteString(testJson)
300+
_, err := input.WriteString(testJsonUbuntu)
219301
assert.NoError(t, err)
220302

221303
output, err := rootDiskFromJson(input)
222304
assert.NoError(t, err)
223305
assert.Equal(t, "/dev/nvme0n1p3", output)
306+
307+
input = bytes.Buffer{}
308+
_, err = input.WriteString(testJsonFedora)
309+
assert.NoError(t, err)
310+
311+
output, err = rootDiskFromJson(input)
312+
assert.NoError(t, err)
313+
assert.Equal(t, "/dev/nvme0n1p3", output)
224314
}
225315

226316
func TestErrorNoMountPoint(t *testing.T) {

0 commit comments

Comments
 (0)