mirror of
git://git.gnupg.org/gnupg.git
synced 2024-11-11 21:48:50 +01:00
f7968db30b
* g13/g13.c (aSuspend, aResume): New. (opts): Add commands --suspend and --resume. (main): Implement dummy command aUmount. Implement commands aResume and aSuspend. * g13/sh-cmd.c (cmd_suspend): New. (cmd_resume): New. (register_commands): Add commands RESUME and SUSPEND. * g13/server.c (cmd_suspend): New. (cmd_resume): New. (register_commands): Add commands RESUME and SUSPEND. * g13/be-dmcrypt.c (be_dmcrypt_suspend_container): New. (be_dmcrypt_resume_container): New. * g13/backend.c (be_suspend_container): New. (be_resume_container): New. * g13/suspend.c, g13/suspend.h: New. * g13/mount.c (parse_header, read_keyblob_prefix, read_keyblob) (decrypt_keyblob, g13_is_container): Move to ... * g13/keyblob.c: new file. (keyblob_read): Rename to g13_keyblob_read and make global. (keyblob_decrypt): Rename to g13_keyblob_decrypt and make global. * g13/sh-dmcrypt.c (check_blockdev): Add arg expect_busy. (sh_dmcrypt_suspend_container): New. (sh_dmcrypt_resume_container): New. * g13/call-syshelp.c (call_syshelp_run_suspend): New. (call_syshelp_run_resume): New. -- The --suspend command can be used before a hibernate operation to make the encrypted partition inaccessible and wipe the key from the memory. Before --suspend is called a sync(1) should be run to make sure that their are no dirty buffers (dmsetup, as called by g13, actually does this for you but it does not harm to do it anyway. After the partition has been suspended a echo 3 >proc/sys/vm/drop_caches required to flush all caches which may still have content from the encrypted partition. The --resume command reverses the effect of the suspend but to do this it needs to decrypt again. Now, if the .gnupg directory lives on the encrypted partition this will be problematic because due to the suspend all processes accessing data on the encrypted partition will be put into an uninterruptible sleep (ps(1) shows a state of 'D'). This needs to be avoided. A workaround is to have a separate GnuPG home directory (say, "~/.gnupg-fallback") with only the public keys required to decrypt the partition along with a properly setup conf files. A GNUPGHOME=$(pwd)/.gnupg-fallback g13 --resume should then be able to resume the encrypted partition using the private key stored on a smartcard. The implementation is pretty basic right now but useful to me. Signed-off-by: Werner Koch <wk@gnupg.org> |
||
|---|---|---|
| .. | ||
| backend.c | ||
| backend.h | ||
| be-dmcrypt.c | ||
| be-dmcrypt.h | ||
| be-encfs.c | ||
| be-encfs.h | ||
| be-truecrypt.c | ||
| be-truecrypt.h | ||
| call-syshelp.c | ||
| call-syshelp.h | ||
| ChangeLog-2011 | ||
| create.c | ||
| create.h | ||
| encfs-1.5_annotate.diff | ||
| encfs-1.7.3_annotate.diff | ||
| g13-common.c | ||
| g13-common.h | ||
| g13-syshelp.c | ||
| g13-syshelp.h | ||
| g13.c | ||
| g13.h | ||
| g13tuple.c | ||
| g13tuple.h | ||
| keyblob.c | ||
| keyblob.h | ||
| Makefile.am | ||
| mount.c | ||
| mount.h | ||
| mountinfo.c | ||
| mountinfo.h | ||
| runner.c | ||
| runner.h | ||
| server.c | ||
| server.h | ||
| sh-blockdev.c | ||
| sh-cmd.c | ||
| sh-dmcrypt.c | ||
| suspend.c | ||
| suspend.h | ||
| t-g13tuple.c | ||