SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

cryptsetup: allow customizing cache behavior

Browse Source 
The new "password-cache" option allows customizing behavior of the
ask-password module in regards to caching credentials in the kernel
keyring. There are 3 possible values for this option:
  * read-only - look for credentials in kernel keyring before asking
  * on - same as read-only, but also save credentials input by user
  * off - disable keyring credential cache

Currently the cache is forced upon the user and this can cause issues.
For example, if user wants to attach two volumes with two different
FIDO2 tokens in a quick succession, the attachment operation for the
second volume will use the PIN cached from the first FIDO2 token, which
of course will fail and since tokens are only attempted once, this will
cause fallback to a password prompt.
This commit is contained in:
Kamil Szczęk
2024-06-27 13:00:49 +02:00
committed by Luca Boccassi
parent 53b6c99018
commit fd8ed7f26b
5 changed files with 67 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/crypttab.xml
+20
View File
@@ -673,6 +673,26 @@
<xi:include href="version-info.xml" xpointer="v249"/></listitem>
</varlistentry>
<varlistentry>
<term><option>password-cache=yes|no|read-only</option></term>
<listitem><para>Controls whether to use cache for passwords or security token PINs.
Takes a boolean or the special string <literal>read-only</literal>. Defaults to
<literal>yes</literal>.</para>
<para>If set to <literal>read-only</literal>, the kernel keyring is checked for a
password/PIN before requesting one interactively. If set to <literal>yes</literal>,
in addition to checking the keyring, any password/PIN entered interactively is cached
in the keyring with a 2.5-minute timeout before being purged.</para>
<para>Note that this option is not permitted for PKCS#11 security tokens. The reasoning
behind this is that PKCS#11 security tokens are usually configured to lock after being
supplied an invalid PIN multiple times, so using the cache might inadvertently lock the
token.</para>
<xi:include href="version-info.xml" xpointer="v257"/></listitem>
</varlistentry>
<varlistentry>
<term><option>pkcs11-uri=</option></term>