SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cryptenroll,cryptsetup: clean up unlock credential for TPM2 + FIDO2

Browse Source 
Let's make sure that when cryptenroll asks for the TPM2 or FIDO2 token
PIN it uses cryptenroll.* credential namespace, and cryptsetup uses
cryptsetup.*.
This commit is contained in:
Lennart Poettering
2024-02-20 16:50:00 +01:00
parent a96c284f10
commit b3a635841a
7 changed files with 56 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/shared/cryptsetup-tpm2.c
+12 -6
View File
@@ -12,7 +12,12 @@
#include "sha256.h"
#include "tpm2-util.h"
static int get_pin(usec_t until, AskPasswordFlags ask_password_flags, bool headless, char **ret_pin_str) {
static int get_pin(
usec_t until,
bool headless,
const char *askpw_credential,
AskPasswordFlags askpw_flags,
char **ret_pin_str) {
_cleanup_(erase_and_freep) char *pin_str = NULL;
_cleanup_strv_free_erase_ char **pin = NULL;
int r;
@@ -29,18 +34,18 @@ static int get_pin(usec_t until, AskPasswordFlags ask_password_flags, bool headl
"PIN querying disabled via 'headless' option. "
"Use the '$PIN' environment variable.");
static const AskPasswordRequest req = {
AskPasswordRequest req = {
.message = "Please enter TPM2 PIN:",
.icon = "drive-harddisk",
.keyring = "tpm2-pin",
.credential = "cryptsetup.tpm2-pin",
.credential = askpw_credential,
};
pin = strv_free_erase(pin);
r = ask_password_auto(
&req,
until,
ask_password_flags,
askpw_flags,
&pin);
if (r < 0)
return log_error_errno(r, "Failed to ask for user pin: %m");
@@ -77,7 +82,8 @@ int acquire_tpm2_key(
TPM2Flags flags,
usec_t until,
bool headless,
AskPasswordFlags ask_password_flags,
const char *askpw_credential,
AskPasswordFlags askpw_flags,
struct iovec *ret_decrypted_key) {
_cleanup_(json_variant_unrefp) JsonVariant *signature_json = NULL;
@@ -173,7 +179,7 @@ int acquire_tpm2_key(
if (i <= 0)
return -EACCES;
r = get_pin(until, ask_password_flags, headless, &pin_str);
r = get_pin(until, headless, askpw_credential, askpw_flags, &pin_str);
if (r < 0)
return r;