kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Only allow to set a dummy passphrase for AES-type keys

Browse Source 
Although HMAC keys can be associated to volumes of type 'LUKS2', the dummy
passphrase can only be set to AES-type keys, i.e. to keys that encrypt the
volume.

Reject trying to set a dummy passphrase for an HMAC key with a volume type
of 'LUKS2'.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2024-03-11 13:44:38 +01:00
committed by Jan Höppner
parent 0047fc162e
commit ddf30feb89
2 changed files with 21 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
zkey/keystore.c
View File

@@ -1727,7 +1727,7 @@ static int _keystore_set_passphrase(struct keystore *keystore,
struct properties *properties,
bool prompt)
{
char *volume_type;
char *volume_type, *key_type;
int rc;
if (_keystore_passphrase_file_exists((struct key_filenames *)filenames)
@@ -1756,6 +1756,19 @@ static int _keystore_set_passphrase(struct keystore *keystore,
}
free(volume_type);
key_type = _keystore_get_key_type(properties);
if (key_type == NULL) {
pr_verbose(keystore, "No key type available");
return -EINVAL;
}
if (!is_aes_key_type(key_type)) {
warnx("The LUKS2 dummy passphrase can only be set for AES-type "
"keys");
free(key_type);
return -EINVAL;
}
free(key_type);
if (passphrase_file != NULL) {
rc = copy_file(passphrase_file, filenames->pass_filename, 0);
if (rc != 0) {