cryptsetup: drop "headless" bool, make it a flag in AskPasswordFlags instead
This bool controls whether we should interactively ask for a password, which is pretty much what the ask_password-api.c APIs are about. Hence, just make the bool a flag in AskPasswordFlags enum, and use it everywhere. This still catches the flag early in upper levels of the codebase, exactly as before, but if the flag is still present in the lower layers it's also handled there and results in ENOEXEC if seen. This is mostly an excercise in simplifying our ridiculously long function call parameter lists a bit.
This commit is contained in:
Lennart Poettering
@@ -101,7 +101,6 @@ static uint32_t arg_tpm2_pcr_mask = UINT32_MAX;
|
||||
static char *arg_tpm2_signature = NULL;
|
||||
static bool arg_tpm2_pin = false;
|
||||
static char *arg_tpm2_pcrlock = NULL;
|
||||
static bool arg_headless = false;
|
||||
static usec_t arg_token_timeout_usec = 30*USEC_PER_SEC;
|
||||
static unsigned arg_tpm2_measure_pcr = UINT_MAX; /* This and the following field is about measuring the unlocked volume key to the local TPM */
|
||||
static char **arg_tpm2_measure_banks = NULL;
|
||||
@@ -504,9 +503,9 @@ static int parse_one_option(const char *option) {
|
||||
return 0;
|
||||
}
|
||||
|
||||
arg_headless = r;
|
||||
SET_FLAG(arg_ask_password_flags, ASK_PASSWORD_HEADLESS, r);
|
||||
} else if (streq(option, "headless"))
|
||||
arg_headless = true;
|
||||
arg_ask_password_flags |= ASK_PASSWORD_HEADLESS;
|
||||
|
||||
else if ((val = startswith(option, "token-timeout="))) {
|
||||
|
||||
@@ -807,7 +806,7 @@ static int get_password(
|
||||
assert(src);
|
||||
assert(ret);
|
||||
|
||||
if (arg_headless)
|
||||
if (FLAGS_SET(arg_ask_password_flags, ASK_PASSWORD_HEADLESS))
|
||||
return log_error_errno(SYNTHETIC_ERRNO(ENOPKG), "Password querying disabled via 'headless' option.");
|
||||
|
||||
friendly = friendly_disk_name(src, vol);
|
||||
@@ -1266,7 +1265,6 @@ static int crypt_activate_by_token_pin_ask_password(
|
||||
const char *name,
|
||||
const char *type,
|
||||
usec_t until,
|
||||
bool headless,
|
||||
void *userdata,
|
||||
uint32_t activation_flags,
|
||||
const char *message,
|
||||
@@ -1296,7 +1294,7 @@ static int crypt_activate_by_token_pin_ask_password(
|
||||
return r;
|
||||
}
|
||||
|
||||
if (headless)
|
||||
if (FLAGS_SET(arg_ask_password_flags, ASK_PASSWORD_HEADLESS))
|
||||
return log_error_errno(SYNTHETIC_ERRNO(ENOPKG), "PIN querying disabled via 'headless' option. Use the '$PIN' environment variable.");
|
||||
|
||||
for (;;) {
|
||||
@@ -1333,7 +1331,6 @@ static int attach_luks2_by_fido2_via_plugin(
|
||||
struct crypt_device *cd,
|
||||
const char *name,
|
||||
usec_t until,
|
||||
bool headless,
|
||||
void *userdata,
|
||||
uint32_t activation_flags) {
|
||||
|
||||
@@ -1342,7 +1339,6 @@ static int attach_luks2_by_fido2_via_plugin(
|
||||
name,
|
||||
"systemd-fido2",
|
||||
until,
|
||||
headless,
|
||||
userdata,
|
||||
activation_flags,
|
||||
"Please enter security token PIN:",
|
||||
@@ -1397,7 +1393,7 @@ static int attach_luks_or_plain_or_bitlk_by_fido2(
|
||||
|
||||
for (;;) {
|
||||
if (use_libcryptsetup_plugin && !arg_fido2_cid) {
|
||||
r = attach_luks2_by_fido2_via_plugin(cd, name, until, arg_headless, arg_fido2_device, flags);
|
||||
r = attach_luks2_by_fido2_via_plugin(cd, name, until, arg_fido2_device, flags);
|
||||
if (IN_SET(r, -ENOTUNIQ, -ENXIO, -ENOENT))
|
||||
return log_debug_errno(SYNTHETIC_ERRNO(EAGAIN),
|
||||
"Automatic FIDO2 metadata discovery was not possible because missing or not unique, falling back to traditional unlocking.");
|
||||
@@ -1413,7 +1409,6 @@ static int attach_luks_or_plain_or_bitlk_by_fido2(
|
||||
key_file, arg_keyfile_size, arg_keyfile_offset,
|
||||
key_data, key_data_size,
|
||||
until,
|
||||
arg_headless,
|
||||
required,
|
||||
"cryptsetup.fido2-pin",
|
||||
arg_ask_password_flags,
|
||||
@@ -1426,7 +1421,6 @@ static int attach_luks_or_plain_or_bitlk_by_fido2(
|
||||
friendly,
|
||||
arg_fido2_device,
|
||||
until,
|
||||
arg_headless,
|
||||
"cryptsetup.fido2-pin",
|
||||
arg_ask_password_flags,
|
||||
&decrypted_key,
|
||||
@@ -1491,7 +1485,6 @@ static int attach_luks2_by_pkcs11_via_plugin(
|
||||
const char *name,
|
||||
const char *friendly_name,
|
||||
usec_t until,
|
||||
bool headless,
|
||||
const char *askpw_credential,
|
||||
uint32_t flags) {
|
||||
|
||||
@@ -1504,7 +1497,6 @@ static int attach_luks2_by_pkcs11_via_plugin(
|
||||
systemd_pkcs11_plugin_params params = {
|
||||
.friendly_name = friendly_name,
|
||||
.until = until,
|
||||
.headless = headless,
|
||||
.askpw_credential = askpw_credential,
|
||||
.askpw_flags = arg_ask_password_flags,
|
||||
};
|
||||
@@ -1574,7 +1566,6 @@ static int attach_luks_or_plain_or_bitlk_by_pkcs11(
|
||||
name,
|
||||
friendly,
|
||||
until,
|
||||
arg_headless,
|
||||
"cryptsetup.pkcs11-pin",
|
||||
flags);
|
||||
else {
|
||||
@@ -1585,7 +1576,7 @@ static int attach_luks_or_plain_or_bitlk_by_pkcs11(
|
||||
key_file, arg_keyfile_size, arg_keyfile_offset,
|
||||
key_data, key_data_size,
|
||||
until,
|
||||
arg_headless,
|
||||
arg_ask_password_flags,
|
||||
&decrypted_key, &decrypted_key_size);
|
||||
if (r >= 0)
|
||||
break;
|
||||
@@ -1710,7 +1701,6 @@ static int attach_luks2_by_tpm2_via_plugin(
|
||||
struct crypt_device *cd,
|
||||
const char *name,
|
||||
usec_t until,
|
||||
bool headless,
|
||||
uint32_t flags) {
|
||||
|
||||
#if HAVE_LIBCRYPTSETUP_PLUGINS
|
||||
@@ -1730,7 +1720,6 @@ static int attach_luks2_by_tpm2_via_plugin(
|
||||
name,
|
||||
"systemd-tpm2",
|
||||
until,
|
||||
headless,
|
||||
¶ms,
|
||||
flags,
|
||||
"Please enter TPM2 PIN:",
|
||||
@@ -1786,7 +1775,6 @@ static int attach_luks_or_plain_or_bitlk_by_tpm2(
|
||||
/* pcrlock_nv= */ NULL,
|
||||
arg_tpm2_pin ? TPM2_FLAGS_USE_PIN : 0,
|
||||
until,
|
||||
arg_headless,
|
||||
"cryptsetup.tpm2-pin",
|
||||
arg_ask_password_flags,
|
||||
&decrypted_key);
|
||||
@@ -1802,7 +1790,7 @@ static int attach_luks_or_plain_or_bitlk_by_tpm2(
|
||||
return -EAGAIN; /* Mangle error code: let's make any form of TPM2 failure non-fatal. */
|
||||
}
|
||||
} else {
|
||||
r = attach_luks2_by_tpm2_via_plugin(cd, name, until, arg_headless, flags);
|
||||
r = attach_luks2_by_tpm2_via_plugin(cd, name, until, flags);
|
||||
if (r >= 0)
|
||||
return 0;
|
||||
/* EAGAIN means: no tpm2 chip found
|
||||
@@ -1885,7 +1873,6 @@ static int attach_luks_or_plain_or_bitlk_by_tpm2(
|
||||
&pcrlock_nv,
|
||||
tpm2_flags,
|
||||
until,
|
||||
arg_headless,
|
||||
"cryptsetup.tpm2-pin",
|
||||
arg_ask_password_flags,
|
||||
&decrypted_key);
|
||||
@@ -2406,7 +2393,6 @@ static int run(int argc, char *argv[]) {
|
||||
volume,
|
||||
/* type= */ NULL,
|
||||
until,
|
||||
arg_headless,
|
||||
/* userdata= */ NULL,
|
||||
flags,
|
||||
"Please enter LUKS2 token PIN:",
|
||||
|
||||
Reference in New Issue
Block a user