kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Generate crypttab and cryptsetup commands for AES type keys only

Browse Source 
The commands 'zkey crypttab' and 'zkey cryptsetup' should only operate on
AES-type keys, but not on HMAC keys.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2024-03-11 15:15:07 +01:00
committed by Jan Höppner
parent e14e0aa858
commit 8e74293c2d
3 changed files with 19 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
zkey/keystore.c
View File

@@ -950,6 +950,12 @@ static int _keystore_match_key_type_property(struct properties *properties,
type = _keystore_get_key_type(properties);
if (strcasecmp(type, key_type) == 0)
rc = 1;
else if (strcasecmp(key_type, KEY_TYPE_FILTER_AES) == 0 &&
is_aes_key_type(type))
rc = 1;
else if (strcasecmp(key_type, KEY_TYPE_FILTER_HMAC) == 0 &&
is_hmac_key_type(type))
rc = 1;
free(type);
return rc;
@@ -1020,6 +1026,9 @@ typedef int (*process_key_t)(struct keystore *keystore,
* NULL means no APQN filter.
* @param[in] volume_type If not NULL, specifies the volume type.
* @param[in] key_type The key type. NULL means no key type filter.
* In addition to the KEY_TYPE_nnn types, the special
* filter types KEY_TYPE_FILTER_nnn can be specified.
* This matches to the respective group of key types.
* @param[in] local if true, only local keys are processed
* @param[in] kms_bound if true, only KMS-bound keys are processed
* @param[in] process_func the callback function called for a matching key
@@ -4968,7 +4977,8 @@ int keystore_cryptsetup(struct keystore *keystore, const char *volume_filter,
info.process_func = _keystore_process_cryptsetup;
rc = _keystore_process_filtered(keystore, NULL, volume_filter, NULL,
volume_type, NULL, false, false,
volume_type, KEY_TYPE_FILTER_AES,
false, false,
_keystore_process_crypt, &info);
str_list_free_string_array(info.volume_filter);
@@ -5029,7 +5039,8 @@ int keystore_crypttab(struct keystore *keystore, const char *volume_filter,
info.process_func = _keystore_process_crypttab;
rc = _keystore_process_filtered(keystore, NULL, volume_filter, NULL,
volume_type, NULL, false, false,
volume_type, KEY_TYPE_FILTER_AES,
false, false,
_keystore_process_crypt, &info);
str_list_free_string_array(info.volume_filter);

3
zkey/keystore.h
View File

@@ -47,6 +47,9 @@ struct keystore {
#define PROP_NAME_KMS_XTS_KEY2_ID "kms-xts-key2-id"
#define PROP_NAME_KMS_XTS_KEY2_LABEL "kms-xts-key2-label"
#define KEY_TYPE_FILTER_AES "AES"
#define KEY_TYPE_FILTER_HMAC "HMAC"
struct keystore *keystore_new(const char *directory,
struct kms_info *kms_info, bool verbose);

6
zkey/zkey.1
View File

@@ -709,8 +709,8 @@ then created as a local key.
Use the
.B crypttab
command to generate crypttab entries using the \fBplain\fP or \fBLUKS2\fP
\fBdm\-crypt\fP mode for volumes that are associated with secure keys contained
in the secure key repository. Specify the
\fBdm\-crypt\fP mode for volumes that are associated with secure AES keys
contained in the secure key repository. Specify the
.B \-\-volumes
option to limit the list
of volumes where crypttab entries are generated for. You can use wildcards.
@@ -763,7 +763,7 @@ Use the
.B cryptsetup
command to generate \fBcryptsetup plainOpen\fP, \fBcryptsetup luksOpen\fP, or
\fBcryptsetup luksFormat\fP commands for volumes that are associated with
secure keys contained in the secure key repository. Specify the
secure AES keys contained in the secure key repository. Specify the
.B \-\-volumes
option to limit the list
of volumes where cryptsetup commands are generated for. You can use wildcards.