kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Perform KMS login before making any permanent changes to a key

Browse Source 
A KMS login may prompt the user for its credentials. Users may abort that
prompt by Cntl-C. Do not make any permanent changes to a key before the
KMS login, because those changes can not be undone when the user has
aborted during KMS login, leaving the key in a potentially inconsistent
state.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2025-10-20 08:54:51 +02:00
committed by Jan Höppner
parent cef50c2140
commit 8be51ad454
1 changed files with 21 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zkey/keystore.c
+21 -12
View File
@@ -2580,6 +2580,11 @@ int keystore_change_key(struct keystore *keystore, const char *name,
}
kms_bound = _keystore_is_kms_bound_key(key_props, NULL);
if (kms_bound) {
rc = perform_kms_login(keystore->kms_info, keystore->verbose);
if (rc != 0)
goto out;
}
if (description != NULL) {
rc = properties_set(key_props, PROP_NAME_DESCRIPTION,
@@ -2794,6 +2799,7 @@ int keystore_rename_key(struct keystore *keystore, const char *name,
struct properties *key_props = NULL;
bool reenc_exists = false;
bool pass_exists = false;
bool kms_bound;
char *msg;
int rc;
@@ -2817,6 +2823,20 @@ int keystore_rename_key(struct keystore *keystore, const char *name,
if (rc != 0)
goto out;
key_props = properties_new();
rc = properties_load(key_props, file_names.info_filename, 1);
if (rc != 0) {
warnx("Key '%s' does not exist or is invalid", name);
goto out;
}
kms_bound = _keystore_is_kms_bound_key(key_props, NULL);
if (kms_bound) {
rc = perform_kms_login(keystore->kms_info, keystore->verbose);
if (rc != 0)
goto out;
}
if (rename(file_names.skey_filename, new_names.skey_filename) != 0) {
rc = -errno;
pr_verbose(keystore, "Failed to rename '%s': %s",
@@ -2850,18 +2870,7 @@ int keystore_rename_key(struct keystore *keystore, const char *name,
}
}
key_props = properties_new();
rc = properties_load(key_props, new_names.info_filename, 1);
if (rc != 0) {
warnx("Key '%s' does not exist or is invalid", newname);
goto out_rename_info;
}
if (_keystore_is_kms_bound_key(key_props, NULL)) {
rc = perform_kms_login(keystore->kms_info, keystore->verbose);
if (rc != 0)
goto out_rename_info;
if (kms_bound) {
rc = set_kms_key_properties(keystore->kms_info, key_props,
newname, NULL, NULL, NULL, NULL,
NULL, keystore->verbose);