From 584e785f5c8ca8ca836dbacfd3fc937ba4347585 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Mon, 8 Jun 2026 13:32:43 +0200 Subject: [PATCH] zkey: Adjust the error message when calculating the KVP fails MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 'paes' and 'phmac' kernel ciphers and the respective kernel modules are no longer used for calculating the key verification pattern. Instead, the 'pkey' kernel module and its sub modules is used now. In case the 'pkey' kernel module is not available, an appropriate error message is already printed by open_pkey_device() when opening the device. Reviewed-by: Finn Callies Signed-off-by: Ingo Franzki Signed-off-by: Jan Höppner --- zkey/keystore.c | 20 -------------------- zkey/kms.c | 6 ------ zkey/zkey-cryptsetup.c | 24 ------------------------ zkey/zkey.c | 6 ------ 4 files changed, 56 deletions(-) diff --git a/zkey/keystore.c b/zkey/keystore.c index 3ec9e121..50021f50 100644 --- a/zkey/keystore.c +++ b/zkey/keystore.c @@ -2101,10 +2101,6 @@ static int _keystore_create_info_file(struct keystore *keystore, if (rc != 0) { warnx("Failed to generate the key verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module '%s' is loaded and " - "that the '%s' cipher is available", - is_aes_key_type(key_type) ? "paes_s390" : "phmac_s390", - is_aes_key_type(key_type) ? "paes" : "phmac"); remove(filenames->pass_filename); goto out; } @@ -2400,10 +2396,6 @@ int keystore_generate_key_kms(struct keystore *keystore, const char *name, if (rc != 0) { warnx("Failed to generate the key verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module '%s' is loaded and " - "that the '%s' cipher is available", - is_aes_key_type(key_type) ? "paes_s390" : "phmac_s390", - is_aes_key_type(key_type) ? "paes" : "phmac"); goto out_free_props; } @@ -3913,12 +3905,6 @@ static int _keystore_process_reencipher(struct keystore *keystore, warnx("Failed to generate the key verification pattern " "for key '%s': %s", file_names->skey_filename, strerror(-rc)); - warnx("Make sure that kernel module '%s' is loaded and " - "that the '%s' cipher is available", - is_aes_key(secure_key, secure_key_size) ? - "paes_s390" : "phmac_s390", - is_aes_key(secure_key, secure_key_size) ? - "paes" : "phmac"); goto out; } @@ -6170,12 +6156,6 @@ prompt_alt_name: if (rc != 0) { warnx("Failed to generate the key verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module '%s' is loaded and " - "that the '%s' cipher is available", - is_aes_key(secure_key, secure_key_size) ? - "paes_s390" : "phmac_s390", - is_aes_key(secure_key, secure_key_size) ? - "paes" : "phmac"); fatal_err = true; goto out_remove; } diff --git a/zkey/kms.c b/zkey/kms.c index 05e50198..abd3520f 100644 --- a/zkey/kms.c +++ b/zkey/kms.c @@ -3451,12 +3451,6 @@ int refresh_kms_key(struct kms_info *kms_info, struct properties *key_props, if (rc != 0) { warnx("Failed to generate the verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module '%s' is loaded and " - "that the '%s' cipher is available", - is_aes_key(key_blob, key_blob_size) ? - "paes_s390" : "phmac_s390", - is_aes_key(key_blob, key_blob_size) ? - "paes" : "phmac"); goto out; } diff --git a/zkey/zkey-cryptsetup.c b/zkey/zkey-cryptsetup.c index e09afb46..1eed4946 100644 --- a/zkey/zkey-cryptsetup.c +++ b/zkey/zkey-cryptsetup.c @@ -1974,8 +1974,6 @@ static int reencipher_prepare(int token) if (rc != 0) { warnx("Failed to generate the verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module 'paes_s390' is loaded and " - "that the 'paes' cipher is available"); goto out; } @@ -1991,9 +1989,6 @@ static int reencipher_prepare(int token) if (rc != 0) { warnx("Failed to generate the verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module 'phmac_s390' is " - "loaded and that the 'phmac' cipher is " - "available"); goto out; } @@ -2188,8 +2183,6 @@ static int reencipher_complete(int token) if (rc != 0) { warnx("Failed to generate the verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module 'paes_s390' is loaded and " - "that the 'paes' cipher is available"); goto out; } @@ -2208,9 +2201,6 @@ static int reencipher_complete(int token) if (rc != 0) { warnx("Failed to generate the verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module 'phmac_s390' is " - "loaded and that the 'phmac' cipher is " - "available"); goto out; } @@ -2530,8 +2520,6 @@ static int command_setvp(void) if (rc != 0) { warnx("Failed to generate the verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module 'paes_s390' is loaded and " - "that the 'paes' cipher is available"); goto out; } @@ -2546,8 +2534,6 @@ static int command_setvp(void) if (rc != 0) { warnx("Failed to generate the verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module 'phmac_s390' is " - "loaded and that the 'phmac' cipher is available"); goto out; } } @@ -2701,8 +2687,6 @@ static int command_setkey(void) if (rc != 0) { warnx("Failed to generate the verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module 'paes_s390' is loaded and " - "that the 'paes' cipher is available"); goto out; } @@ -2715,9 +2699,6 @@ static int command_setkey(void) if (rc != 0) { warnx("Failed to generate the verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module 'phmac_s390' is " - "loaded and that the 'phmac' cipher is " - "available"); goto out; } } @@ -2985,8 +2966,6 @@ static int command_convert(void) if (rc != 0) { warnx("Failed to generate the verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module 'paes_s390' is loaded and " - "that the 'paes' cipher is available"); goto out; } @@ -3000,9 +2979,6 @@ static int command_convert(void) if (rc != 0) { warnx("Failed to generate the verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module 'phmac_s390' is " - "loaded and that the 'phmac' cipher is " - "available"); goto out; } } diff --git a/zkey/zkey.c b/zkey/zkey.c index ae05ad2f..a2b94789 100644 --- a/zkey/zkey.c +++ b/zkey/zkey.c @@ -2503,12 +2503,6 @@ static int command_validate_file(void) if (rc != 0) { warnx("Failed to generate the verification pattern: %s", strerror(-rc)); - warnx("Make sure that kernel module '%s' is loaded and " - "that the '%s' cipher is available", - is_aes_key(secure_key, secure_key_size) ? - "paes_s390" : "phmac_s390", - is_aes_key(secure_key, secure_key_size) ? - "paes" : "phmac"); rc = EXIT_FAILURE; goto out; }