When generating crypttab entries for LUKS2 volumes, allow to
specify common passphrase options like --key-file, --keyfile-offset,
--keyfile-size and --tries and pass those to the generated crypttab
entries.
Note that not all distributions support the keyfile-offset and
keyfile-size options in crypttab entries.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For some device driver SysFS attributes, values read may not be
acceptable input values for that attribute.
An example would be the group of qeth VNICC attributes that return "n/a"
when VNICC setup is not supported, but only accept "0" and "1" as valid
values that can be written to it.
This leads to errors such as the following when data for such attributes
is imported:
# chzdev f500 --import test.conf
Importing configuration data from test.conf
QETH device 0.0.f500:0.0.f501:0.0.f502 configure failed
Error: Invalid value for qeth attribute: vnicc/flooding=n/a (*)
Acceptable values:
- Integers in the range 0 - 1
Use 'chzdev qeth --help-attribute vnicc/flooding' for more information
Note: You can use --force to override safety checks (*)
To fix this, change chzdev's --export function to skip any attribute
value that is not acceptable for that attribute.
Fixes: e831269e74 ("zdev: Add support for VNIC Characteristics")
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Remove 'hash=plain' option for plain type entries, add 'none luks'
for LUKS type entries.
Note that the format of a crypttab entry is distribution specific.
On some distributions only the first 2 fields are required, the
remaining are optional, on other distributions all 4 fields are
required. With this patch correct crypttab entries are generated
for all distributions.
Closes: https://github.com/ibm-s390-tools/s390-tools/pull/55
Fixes: https://github.com/ibm-s390-tools/s390-tools/issues/57
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
With libcryptsetup version 2.1 a new debug level was introduced
to log the JSON structures when adding key slots, digests, etc
into the LUKS2 header.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Messages from libcryptsetup for logging level CRYPT_LOG_DEBUG
do not include an EOL.
Prior to libcryptsetup version 2.1 debug messages were not printed
through the log callback, but using printf directly within
libcryptsetup. Now they are also printed through the log callback,
but without an EOL terminating the text.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
For zkey-cryptsetup commands reencipher and setkey, use the
same password-based key derivation function (PBKDF) when
creating unbound key-sots that the key slot uses, which was
unlocked through the specified passphrase. That way the
unlocked key slots created by these commands inherit the
PBKDF from the existing key slot.
This feature requires libcryptsetup version 2.1 or later.
If an older libcryptsetup version is available at compile
time, then PBKDF2 is used for newly created unbound key slots.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The output of lsof command is sometimes too long and makes it difficult
to search in runtime.out. Move the output to a separate file.
Signed-off-by: Sa Liu <saliu@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Running lscpumf -i as regular user causes a warning when trying to
disply sampling buffer sizes. The root cause is in the cpumf_helper
that returns "0,0" instead of a list reference "[0,0]".
This happened when running as regular user because the sampling buffer
size sysfs attribute is not readable for them.
Remove the shortcut and always return a list reference.
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
LUKS2 encrypted volumes use Argon2i as default password based key
derivation function (PBKDF). Argon2i is a so-called memory-hard
function. It requires a certain amount of physical memory to make
dictionary attacks more costly.
Unfortunately, when multiple encrypted volumes are unlocked
automatically during system startup via /etc/crypttab, the use of
Argon2i will most likely cause an out-of-memory error in systemd.
To avoid the out-of-memory error, use PBKDF2 instead. Because PAES
uses secure keys as volume keys, the security of the key derivation
function used to derive the key to encrypt the volume key in the LUKS
key slots is of less relevance. Thus it is safe to use a weaker key
derivation function.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
LUKS2 encrypted volumes use Argon2i as default password based key
derivation function (PBKDF). Argon2i is a so-called memory-hard
function. It requires a certain amount of physical memory to make
dictionary attacks more costly.
Unfortunately, when multiple encrypted volumes are unlocked
automatically during system startup via /etc/crypttab, the use of
Argon2i will most likely cause an out-of-memory error in systemd.
To avoid the out-of-memory error, use PBKDF2 instead. Because PAES
uses secure keys as volume keys, the security of the key derivation
function used to derive the key to encrypt the volume key in the LUKS
key slots is of less relevance. Thus it is safe to use a weaker key
derivation function.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
When a user that is in the zkeyadm group, but is not the owner
of the key file changes a key in the zkey repository, then
error "Operation not permitted" occurs. This is due to a superfluous
call to chmod on the key file. When key files are changed then the
permissions of that file are retained anyway.
Also fix a typo in the error message when chmod fails.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Enable zdsfs to access datasets that were created after zdsfs was
mounted without the need to remount zdsfs.
This is done by re-reading the VTOC with every readdir system call.
To ensure a consistent VTOC state the DASD device is reserved for
every VTOC read and released afterwards.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Added some explanations about the columns shown with the
lszcrypt verbose output.
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Show how to use util_rec_set_indent() and util_rec_print_separator()
in util_rec_example.c
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
In wide format the header is separated from the rest of the
records by a separator line. Add support to print such a
separator line also between some records.
Add function util_rec_print_separator() that prints the
separator line for wide format only. For other formats this
is a NOP.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Functions rec_print_xxx allows to print records in
different formats. Add support to optionally indent
the output by a specific number of characters.
The indention is set using a new function util_rec_set_indent().
The default indention is zero, thus existing applications
will behave the same as before.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Acked-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
The cmsfs_write function only writes a single record in line mode
and returns the number of bytes it consumed from the input buffer.
This is valid behaviour as the write system call can always return
with a partial write. But there are tools that ignore the return
value of the write and just assume that a single write call is
sufficient to write many lines aka records on the cmsfs filesystem.
Enhance the cmsfs_write function to loop until all lines from the
input buffer have been consumed.
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
GCC8 shows the following compile warning:
cmsfs-fuse.c: In function ‘convert_text’:
cmsfs-fuse.c:2558:19: warning: passing argument 2 to restrict-qualified
parameter aliases with argument 4 [-Wrestrict]
rc = iconv(conv, &data_ptr, &in_count, &data_ptr, &out_count);
^~~~~~~~~ ~~~~~~~~~
Fix this by using a separate buffer for iconv. The buffer size depends on
the record format: variable-length records have a maximum length of
MAX_RECORD_LEN (plus 1 byte for linefeed), while fixed-length records
could be larger in theory. This patch takes that into account for the iconv
buffer, but the rest of the code currently cannot handle fixed-length records
larger than MAX_RECORD_LEN.
Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com>
Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Commit aefc8cd3ff ("libutil/libu2s: Move strlcpy() implementation to
libutils") added a dependency to libutil. This is not necessary and
could potentially lead to parallel build errors. Remove the dependency.
Fixes: aefc8cd3ff ("libutil/libu2s: Move strlcpy() implementation to libutils")
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
There are several reasons why an operation might fail. Either the
running kernel, the PCI function itself, or the hypervisor lacks support
for a certain operation. In such cases the kernel returns either with
EIO or EOPNOTSUPP.
The corresponding warning, however, just says the file couldn't be
closed. Display a warning for EIO and EOPNOTSUPP to tell the user about
the missing support.
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make the error message when the CCA library is missing more
user friendly. Also display an URL where the CCA package
can be downloaded.
The CCA library is used for the REENCIPHER commands of
zkey and zkey-cryptsetup and must be installed separately
as part of the IBM CCA Host Libraries and Tools package.
This packages is not provided by the distributors, but must
be downloaded from an IBM web page and installed separately.
Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Get rid of the following GCC8 compile warning by using different buffers
for input/output:
In file included from vmdump_convert.cpp:13:
vm_dump.h: In member function ‘void VMDump::ebcAsc(char*, size_t)
const’:
vm_dump.h:145:26: warning: passing argument 2 to restrict-qualified
parameter aliases with argument 4 [-Wrestrict]
iconv(ebcdicAsciiConv, &inout, &len, &inout, &len);
^~~~~~ ~~~~~~
vm_dump.h:145:34: warning: passing argument 3 to restrict-qualified
parameter aliases with argument 5 [-Wrestrict]
iconv(ebcdicAsciiConv, &inout, &len, &inout, &len);
^~~~ ~~~~
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Get rid of the following GCC8 compile warning by using different buffers
for input/output:
qethqoat.c: In function ‘ebctoasc’:
qethqoat.c:51:30: warning: passing argument 2 to restrict-qualified
parameter aliases with argument 4 [-Wrestrict]
iconv(l_iconv_ebcdic_ascii, &inout, &len, &inout, &len);
^~~~~~ ~~~~~~
qethqoat.c:51:38: warning: passing argument 3 to restrict-qualified
parameter aliases with argument 5 [-Wrestrict]
iconv(l_iconv_ebcdic_ascii, &inout, &len, &inout, &len);
^~~~ ~~~~
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make sure there are two different buffers passed to iconv() to get rid
of the following GCC8 compile warning:
helper.c: In function ‘ht_ebcdic_to_ascii’:
helper.c:103:30: warning: passing argument 2 to restrict-qualified
parameter aliases with argument 4 [-Wrestrict]
iconv(l_iconv_ebcdic_ascii, &inout, &len, &inout, &len);
^~~~~~ ~~~~~~
helper.c:103:38: warning: passing argument 3 to restrict-qualified
parameter aliases with argument 5 [-Wrestrict]
iconv(l_iconv_ebcdic_ascii, &inout, &len, &inout, &len);
^~~~ ~~~~
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Commit 851f685993 ("Makefile: Add dependency between libvmcp and
libutil to fix -j builds") introduced the following regression
$ make clean
CLEAN /home2/holzheu/src/s390-tools
...
CLEAN libccw
CC libutil/util_base.o
CC libutil/util_path.o
For the "clean" target the new library dependency triggers a build
of libutil.
So remove the dependency again.
To fix the parallel build issue, no longer build the examples with
"make all" and add a new target "examples" that can now be used for building
the example programs.
Fixes: 851f685993 ("Makefile: Add dependency between libvmcp and libutil to fix -j builds")
Signed-off-by: Michael Holzheu <holzheu@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Most bootloaders use the BootLoaderSpec "title" field to name the entries
in their boot menu. The zipl bootloader used the "version" field instead,
since it was wrongly assumed that the zipl boot menu didn't support names
that contained spaces, which are usually present in a BLS "title" field.
But this is not the case, names with space characters are supported by the
IPL and is just a constraint of the section heading in the zipl.conf file.
So to be consistent with all the other bootloaders, use the "title" field
also on zipl when populating the boot menu entries from BLS files.
Closes: https://github.com/ibm-s390-tools/s390-tools/pull/47
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reviewed-by: Stefan Haberland sth@linux.ibm.com
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use util_strlcpy() to copy log data correctly and get rid of the
following GCC8 compile warning:
zpcictl.c: In function ‘sclp_issue_action’:
zpcictl.c:312:3: warning: ‘strncpy’ specified bound 4054 equals
destination size [-Wstringop-truncation]
strncpy(report.data.log_data, sdata, sizeof(report.data.log_data));
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use util_strlcpy() to copy strings correctly and get rid of the
following GCC8 compile warning:
In function ‘hmcdrv_parse_line’,
inlined from ‘hmcdrv_cache_dir’ at hmcdrvfs.c:981:11:
hmcdrvfs.c:862:4: warning: ‘strncpy’ specified bound 192 equals
destination size [-Wstringop-truncation]
strncpy(symlink, arrow + 4, HMCDRV_FUSE_MAXPATH);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
By using util_strlcpy() and correctly copying strings we can get rid of
the following GCC8 compile warnings:
In function ‘path_to_ds_name.constprop’,
inlined from ‘zdsfs_readdir’ at zdsfs.c:282:2:
zdsfs.c:78:2: warning: ‘strncpy’ specified bound 45 equals destination
size [-Wstringop-truncation]
strncpy(normds, path, size);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
In function ‘path_to_ds_name.constprop’,
inlined from ‘zdsfs_open’ at zdsfs.c:339:2:
zdsfs.c:78:2: warning: ‘strncpy’ specified bound 45 equals destination
size [-Wstringop-truncation]
strncpy(normds, path, size);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
In function ‘path_to_member_name.constprop’,
inlined from ‘zdsfs_open’ at zdsfs.c:372:3:
zdsfs.c:94:3: warning: ‘strncpy’ specified bound 45 equals destination
size [-Wstringop-truncation]
strncpy(normds, path, size);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
In function ‘path_to_ds_name.constprop’,
inlined from ‘zdsfs_getxattr’ at zdsfs.c:527:2:
zdsfs.c:78:2: warning: ‘strncpy’ specified bound 45 equals destination
size [-Wstringop-truncation]
strncpy(normds, path, size);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
In function ‘path_to_member_name.constprop’,
inlined from ‘zdsfs_getxattr’ at zdsfs.c:547:4:
zdsfs.c:94:3: warning: ‘strncpy’ specified bound 45 equals destination
size [-Wstringop-truncation]
strncpy(normds, path, size);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
In function ‘path_to_ds_name.constprop’,
inlined from ‘zdsfs_getattr.part.1’ at zdsfs.c:134:2,
inlined from ‘zdsfs_getattr’:
zdsfs.c:78:2: warning: ‘strncpy’ specified bound 45 equals destination
size [-Wstringop-truncation]
strncpy(normds, path, size);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
In function ‘path_to_member_name.constprop’,
inlined from ‘zdsfs_getattr.part.1’ at zdsfs.c:164:3,
inlined from ‘zdsfs_getattr’:
zdsfs.c:94:3: warning: ‘strncpy’ specified bound 45 equals destination
size [-Wstringop-truncation]
strncpy(normds, path, size);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Use the more robust util_strlcpy() to copy strings instead of strncpy().
This fixes the following GCC8 compile warnings:
qethqoat.c: In function ‘main’:
qethqoat.c:616:2: warning: ‘strncpy’ specified bound 16 equals
destination size [-Wstringop-truncation]
strncpy(ifr.ifr_name, opts.ifname, IFNAMSIZ);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
Make sure strings are copied correctly by using util_strlcpy().
Also, rename the NIC_{OWNER,NAME}_LEN definitions to *_SIZE to make it
more clear that the terminating null byte ('\0') is included in this
buffer size. Using *_LEN would mean only the number of characters in the
string fit in.
Furthermore, use these definitions rather than sizeof().
This fixes the following GCC8 compile warning:
nic.c: In function ‘nic_data_get’:
nic.c:58:2: warning: ‘strncpy’ specified bound 9 equals destination size
[-Wstringop-truncation]
strncpy(data.owner, argv[11], sizeof(data.owner));
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
nic.c:59:2: warning: ‘strncpy’ specified bound 9 equals destination size
[-Wstringop-truncation]
strncpy(data.name, argv[12], sizeof(data.name));
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
