kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Can't set a sector size for HMAC keys on LUKS2 volumes

Browse Source 
You can only set a sector size for an HMAC key of a volume of type
INTEGTRITY. For combined integrity protection with encryption, the
sector size of a LUKS2 volume must be set on the AES key, but can
not be set on the HMAC key.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Finn Callies <fcallies@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2024-03-11 14:57:02 +01:00
committed by Jan Höppner
parent 355700d606
commit e14e0aa858
2 changed files with 53 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
zkey/keystore.c
View File

@@ -277,10 +277,17 @@ static int _keystore_set_file_permission(struct keystore *keystore,
* Checks if the sector size is power of two and in range 512 - 4096 bytes.
*
* @param[in] sector_size the sector size
* @param[in] key_type the type of the key, or NULL if the sector size is
* to be checked independent of the key type.
* @param[in] volume_type the type of associated volume, or NULL if the
* sector size is to be checked independent of the
* volume type.
*
* @returns 1 if the sector size is valid, 0 otherwise
*/
static int _keystore_valid_sector_size(size_t sector_size)
static int _keystore_valid_sector_size(size_t sector_size,
const char *key_type,
const char *volume_type)
{
if (sector_size == 0)
return 1;
@@ -288,6 +295,15 @@ static int _keystore_valid_sector_size(size_t sector_size)
return 0;
if (sector_size & (sector_size - 1))
return 0;
/* Can not set the sector size for volume type LUKS2 on a HMAC key */
if (sector_size != 0 &&
key_type != NULL &&
is_hmac_key_type(key_type) &&
volume_type != NULL &&
strcasecmp(volume_type, VOLUME_TYPE_LUKS2) == 0)
return 0;
return 1;
}
@@ -1963,7 +1979,7 @@ static int _keystore_create_info_props(struct keystore *keystore,
if (rc != 0)
goto out;
if (!_keystore_valid_sector_size(sector_size)) {
if (!_keystore_valid_sector_size(sector_size, key_type, volume_type)) {
warnx("Invalid sector-size specified");
rc = -EINVAL;
goto out;
@@ -2815,7 +2831,10 @@ int keystore_change_key(struct keystore *keystore, const char *name,
}
if (sector_size >= 0) {
if (!_keystore_valid_sector_size(sector_size)) {
if (!_keystore_valid_sector_size(sector_size, key_type,
volume_type != NULL ?
volume_type :
old_volume_type)) {
warnx("Invalid sector-size specified");
rc = -EINVAL;
goto out;
@@ -2875,6 +2894,19 @@ int keystore_change_key(struct keystore *keystore, const char *name,
passphrase_upd = &null_ptr;
}
/*
* Reset sector-size to zero if changed to anything but
* INTEGTRITY on a HMAC key.
*/
if (strcasecmp(volume_type, VOLUME_TYPE_INTEGRITY) != 0 &&
is_hmac_key_type(key_type)) {
sector_size = 0;
rc = properties_set(key_props, PROP_NAME_SECTOR_SIZE,
"0");
if (rc != 0)
goto out;
}
}
if (gen_passphrase || passphrase_file != NULL) {
@@ -5969,7 +6001,8 @@ static int _keystore_refresh_kms_key(struct keystore *keystore,
}
if (sector_size >= 0) {
if (!_keystore_valid_sector_size(sector_size)) {
if (!_keystore_valid_sector_size(sector_size, key_type,
volume_type)) {
warnx("Invalid sector-size specified");
rc = -EINVAL;
goto out;

16
zkey/zkey.1
View File

@@ -1388,6 +1388,10 @@ This option is only used for secure keys contained in the secure key repository.
Specifies the sector size in bytes used with \fBdm\-crypt\fP. It must be a power
of two and in the range of 512 to 4096 bytes. If omitted, the system default
sector size is used.
You can only set a sector size for an HMAC key of a volume of type
\fBintegrity\fP. For an HMAC key that is used for combined encryption and
integrity protection (volume type \fBluks2\fP), set the sector size for the
corresponding AES key instead.
This option is only used for secure keys contained in the secure key repository.
.TP
.BR \-t ", " \-\-volume\-type\~\fItype\fP
@@ -1564,6 +1568,10 @@ This option is only used for secure keys contained in the secure key repository.
Specifies the sector size in bytes used with \fBdm\-crypt\fP or
\fBdm\-integrity\fP. It must be a power of two and in the range of 512 to 4096
bytes. If omitted, the system default sector size is used.
You can only set a sector size for an HMAC key of a volume of type
\fBintegrity\fP. For an HMAC key that is used for combined encryption and
integrity protection (volume type \fBluks2\fP), set the sector size for the
corresponding AES key instead.
This option is only used for secure keys contained in the secure key repository.
.TP
.BR \-t ", " \-\-volume\-type\~\fItype\fP
@@ -1737,6 +1745,10 @@ This option is only used for secure keys contained in the secure key repository.
Specifies the sector size in bytes used with \fBdm\-crypt\fP or
\fBdm\-integrity\fP. It must be a power of two and in the range of 512 to 4096
ytes. Specify \fI0\fP to set the sector size to the system default.
You can only set a sector size for an HMAC key of a volume of type
\fBintegrity\fP. For an HMAC key that is used for combined encryption and
integrity protection (volume type \fBluks2\fP), set the sector size for the
corresponding AES key instead.
This option is only used for secure keys contained in the secure key repository.
.TP
.BR \-t ", " \-\-volume\-type\~\fItype\fP
@@ -2247,6 +2259,10 @@ Both keys must use the \fBluks2\fP volume type.
Specifies the sector size in bytes used with \fBdm\-crypt\fP or
\fBdm\-integrity\fP. It must be a power of two and in the range of 512 to 4096
bytes. If omitted, the system default sector size is used.
You can only set a sector size for an HMAC key of a volume of type
\fBintegrity\fP. For an HMAC key that is used for combined encryption and
integrity protection (volume type \fBluks2\fP), set the sector size for the
corresponding AES key instead.
.TP
.BR \-t ", " \-\-volume\-type\~\fItype\fP
Specifies the volume type of the associated volumes used with \fBdm\-crypt\fP or