security-and-privacy/gnupg
security-and-privacy/gnupg
1
0
Fork 0
mirror of git://git.gnupg.org/gnupg.git synced 2025-07-03 22:56:33 +02:00
Code Activity

g13: Add commands --suspend and --remove.

Browse source 
* g13/g13.c (aSuspend, aResume): New.
(opts): Add commands --suspend and --resume.
(main): Implement dummy command aUmount.  Implement commands aResume
and aSuspend.
* g13/sh-cmd.c (cmd_suspend): New.
(cmd_resume): New.
(register_commands): Add commands RESUME and SUSPEND.
* g13/server.c (cmd_suspend): New.
(cmd_resume): New.
(register_commands): Add commands RESUME and SUSPEND.
* g13/be-dmcrypt.c (be_dmcrypt_suspend_container): New.
(be_dmcrypt_resume_container): New.
* g13/backend.c (be_suspend_container): New.
(be_resume_container): New.
* g13/suspend.c, g13/suspend.h: New.
* g13/mount.c (parse_header, read_keyblob_prefix, read_keyblob)
(decrypt_keyblob, g13_is_container): Move to ...
* g13/keyblob.c: new file.
(keyblob_read): Rename to g13_keyblob_read and make global.
(keyblob_decrypt): Rename to g13_keyblob_decrypt and make global.
* g13/sh-dmcrypt.c (check_blockdev): Add arg expect_busy.
(sh_dmcrypt_suspend_container): New.
(sh_dmcrypt_resume_container): New.
* g13/call-syshelp.c (call_syshelp_run_suspend): New.
(call_syshelp_run_resume): New.
--

The --suspend command can be used before a hibernate operation to make
the encrypted partition inaccessible and wipe the key from the memory.
Before --suspend is called a sync(1) should be run to make sure that
their are no dirty buffers (dmsetup, as called by g13, actually does
this for you but it does not harm to do it anyway.  After the
partition has been suspended a

  echo 3 >proc/sys/vm/drop_caches

required to flush all caches which may still have content from the
encrypted partition.

The --resume command reverses the effect of the suspend but to do this
it needs to decrypt again.  Now, if the .gnupg directory lives on the
encrypted partition this will be problematic because due to the
suspend all processes accessing data on the encrypted partition will
be put into an uninterruptible sleep (ps(1) shows a state of 'D').
This needs to be avoided.  A workaround is to have a separate GnuPG
home directory (say, "~/.gnupg-fallback") with only the public keys
required to decrypt the partition along with a properly setup
conf files.  A

  GNUPGHOME=$(pwd)/.gnupg-fallback g13 --resume

should then be able to resume the encrypted partition using the
private key stored on a smartcard.

The implementation is pretty basic right now but useful to me.

Signed-off-by: Werner Koch <wk@gnupg.org>
This commit is contained in:
Werner Koch 2016-02-23 14:32:46 +01:00
parent f26867928c
commit f7968db30b
No known key found for this signature in database
GPG key ID: E3FDFF218E45B72B
18 changed files with 1029 additions and 210 deletions
Download patch file Download diff file Expand all files Collapse all files

241
g13/sh-dmcrypt.c
View file

@ -72,10 +72,13 @@
#endif
/* Check whether the block device DEVNAME is used by device mapper.
Returns: 0 if the device is good and not yet used by DM. */
/*
* Check whether the block device DEVNAME is used by device mapper.
* If EXPECT_BUSY is set no error message is printed if the device is
* busy. Returns: 0 if the device is good and not yet used by DM.
*/
static gpg_error_t
check_blockdev (const char *devname)
check_blockdev (const char *devname, int expect_busy)
{
gpg_error_t err;
struct stat sb;
@ -147,8 +150,10 @@ check_blockdev (const char *devname)
if (xmajor == devmajor && xminor == devminor)
{
log_error ("device '%s' (%u:%u) already used by device mapper\n",
devname, devmajor, devminor);
if (!expect_busy)
log_error ("device '%s' (%u:%u)"
" already in use by device mapper\n",
devname, devmajor, devminor);
err = gpg_error (GPG_ERR_EBUSY);
goto leave;
}
@ -290,7 +295,7 @@ sh_dmcrypt_create_container (ctrl_t ctrl, const char *devname, estream_t devfp)
}
/* Check that the device is not used by device mapper. */
err = check_blockdev (devname);
err = check_blockdev (devname, 0);
if (err)
goto leave;
@ -525,7 +530,7 @@ sh_dmcrypt_create_container (ctrl_t ctrl, const char *devname, estream_t devfp)
}
/* Mount a DM-Crypt congtainer on device DEVNAME taking keys and other
/* Mount a DM-Crypt container on device DEVNAME taking keys and other
* meta data from KEYBLOB. */
gpg_error_t
sh_dmcrypt_mount_container (ctrl_t ctrl, const char *devname,
@ -549,7 +554,7 @@ sh_dmcrypt_mount_container (ctrl_t ctrl, const char *devname,
g13_syshelp_i_know_what_i_am_doing ();
/* Check that the device is not yet used by device mapper. */
err = check_blockdev (devname);
err = check_blockdev (devname, 0);
if (err)
goto leave;
@ -716,3 +721,223 @@ sh_dmcrypt_mount_container (ctrl_t ctrl, const char *devname,
xfree (result);
return err;
}
/* Suspend a DM-Crypt container on device DEVNAME and wipe the keys. */
gpg_error_t
sh_dmcrypt_suspend_container (ctrl_t ctrl, const char *devname)
{
gpg_error_t err;
char *targetname_abs = NULL;
const char *targetname;
char *result = NULL;
if (!ctrl->devti)
return gpg_error (GPG_ERR_INV_ARG);
g13_syshelp_i_know_what_i_am_doing ();
/* Check that the device is used by device mapper. */
err = check_blockdev (devname, 1);
if (gpg_err_code (err) != GPG_ERR_EBUSY)
{
log_error ("device '%s' is not used by the device mapper: %s\n",
devname, gpg_strerror (err));
goto leave;
}
/* Fixme: Check that this is really a g13 partition. */
/* Device mapper needs a name for the device: Take it from the label
or use "0". */
targetname_abs = strconcat ("/dev/mapper/",
"g13-", ctrl->client.uname, "-",
ctrl->devti->label? ctrl->devti->label : "0",
NULL);
if (!targetname_abs)
{
err = gpg_error_from_syserror ();
goto leave;
}
targetname = strrchr (targetname_abs, '/');
if (!targetname)
BUG ();
targetname++;
/* Send the suspend command. */
{
const char *argv[3];
argv[0] = "suspend";
argv[1] = targetname;
argv[2] = NULL;
log_debug ("now running \"dmsetup suspend %s\"\n", targetname);
err = gnupg_exec_tool ("/sbin/dmsetup", argv, NULL, &result, NULL);
}
if (err)
{
log_error ("error running \"dmsetup suspend %s\": %s\n",
targetname, gpg_strerror (err));
goto leave;
}
if (result && *result)
log_debug ("dmsetup result: %s\n", result);
xfree (result);
result = NULL;
/* Send the wipe key command. */
{
const char *argv[5];
argv[0] = "message";
argv[1] = targetname;
argv[2] = "0";
argv[3] = "key wipe";
argv[4] = NULL;
log_debug ("now running \"dmsetup message %s 0 key wipe\"\n", targetname);
err = gnupg_exec_tool ("/sbin/dmsetup", argv, NULL, &result, NULL);
}
if (err)
{
log_error ("error running \"dmsetup message %s 0 key wipe\": %s\n",
targetname, gpg_strerror (err));
goto leave;
}
if (result && *result)
log_debug ("dmsetup result: %s\n", result);
xfree (result);
result = NULL;
leave:
xfree (targetname_abs);
xfree (result);
return err;
}
/* Resume a DM-Crypt container on device DEVNAME taking keys and other
* meta data from KEYBLOB. */
gpg_error_t
sh_dmcrypt_resume_container (ctrl_t ctrl, const char *devname,
tupledesc_t keyblob)
{
gpg_error_t err;
char *targetname_abs = NULL;
const char *targetname;
char hexkey[8+16*2+1]; /* 8 is used to prepend "key set ". */
char *table = NULL;
char *result = NULL;
size_t n;
const char *s;
const char *algostr;
size_t algostrlen;
if (!ctrl->devti)
return gpg_error (GPG_ERR_INV_ARG);
g13_syshelp_i_know_what_i_am_doing ();
/* Check that the device is used by device mapper. */
err = check_blockdev (devname, 1);
if (gpg_err_code (err) != GPG_ERR_EBUSY)
{
log_error ("device '%s' is not used by the device mapper: %s\n",
devname, gpg_strerror (err));
goto leave;
}
/* Device mapper needs a name for the device: Take it from the label
or use "0". */
targetname_abs = strconcat ("/dev/mapper/",
"g13-", ctrl->client.uname, "-",
ctrl->devti->label? ctrl->devti->label : "0",
NULL);
if (!targetname_abs)
{
err = gpg_error_from_syserror ();
goto leave;
}
targetname = strrchr (targetname_abs, '/');
if (!targetname)
BUG ();
targetname++;
/* Get the algorithm string. */
algostr = find_tuple (keyblob, KEYBLOB_TAG_ALGOSTR, &algostrlen);
if (!algostr || algostrlen > 100)
{
log_error ("algo string not found in keyblob or too long\n");
err = gpg_error (GPG_ERR_INV_DATA);
goto leave;
}
/* Get the key. */
s = find_tuple (keyblob, KEYBLOB_TAG_ENCKEY, &n);
if (!s || n != 16)
{
if (!s)
log_error ("no key found in keyblob\n");
else
log_error ("unexpected size of key (%zu)\n", n);
err = gpg_error (GPG_ERR_INV_KEYLEN);
goto leave;
}
strcpy (hexkey, "key set ");
bin2hex (s, 16, hexkey+8);
/* Send the key */
{
const char *argv[4];
argv[0] = "message";
argv[1] = targetname;
argv[2] = "0";
argv[3] = NULL;
log_debug ("now running \"dmsetup message %s 0 [key set]\"\n", targetname);
err = gnupg_exec_tool ("/sbin/dmsetup", argv, hexkey, &result, NULL);
}
wipememory (hexkey, sizeof hexkey);
if (err)
{
log_error ("error running \"dmsetup message %s 0 [key set]\": %s\n",
devname, gpg_strerror (err));
goto leave;
}
if (result && *result)
log_debug ("dmsetup result: %s\n", result);
xfree (result);
result = NULL;
/* Send the resume command. */
{
const char *argv[3];
argv[0] = "resume";
argv[1] = targetname;
argv[2] = NULL;
log_debug ("now running \"dmsetup resume %s\"\n", targetname);
err = gnupg_exec_tool ("/sbin/dmsetup", argv, NULL, &result, NULL);
}
if (err)
{
log_error ("error running \"dmsetup resume %s\": %s\n",
targetname, gpg_strerror (err));
goto leave;
}
if (result && *result)
log_debug ("dmsetup result: %s\n", result);
xfree (result);
result = NULL;
leave:
wipememory (hexkey, sizeof hexkey);
if (table)
{
wipememory (table, strlen (table));
xfree (table);
}
xfree (targetname_abs);
xfree (result);
return err;
}