SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FIDO2: ask and record whether user presence was used to lock the volume

Browse Source 
In some cases user presence might not be required to get _a_
secret out of a FIDO2 device, but it might be required to
the get actual secret that was used to lock the volume.
Record whether we used it in the LUKS header JSON metadata.
Let the cryptenroll user ask for the feature, but bail out if it is
required by the token and the user disabled it.
Enabled by default.
This commit is contained in:
Luca Boccassi
2021-05-07 21:36:27 +01:00
committed by Luca Boccassi
parent cde2f8605e
commit 06f087192d
9 changed files with 85 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cryptsetup/cryptsetup.c
+2 -2
View File
@@ -769,9 +769,9 @@ static int attach_luks_or_plain_or_bitlk_by_fido2(
if (r < 0)
return r;
if (FLAGS_SET(required, FIDO2ENROLL_PIN) && arg_headless)
if (FLAGS_SET(required, FIDO2ENROLL_PIN | FIDO2ENROLL_UP) && arg_headless)
return log_error_errno(SYNTHETIC_ERRNO(ENOPKG),
"A PIN is required to unlock this volume, but the 'headless' parameter was set.");
"Local verification is required to unlock this volume, but the 'headless' parameter was set.");
rp_id = discovered_rp_id;
key_data = discovered_salt;