From 0dfbbf62fae3d4051dd5f0686835ac393f8a0247 Mon Sep 17 00:00:00 2001 From: Joseph Richey Date: Fri, 1 Sep 2017 00:56:44 -0700 Subject: [PATCH] cmd/fscrypt: Add explanations for keyring failures Now the user is persented with help when they try to access a keyring that isn't theirs or try to use fscrypt without a user keyring linked into the session keyring. --- cmd/fscrypt/errors.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/cmd/fscrypt/errors.go b/cmd/fscrypt/errors.go index 9731efc..81a6798 100644 --- a/cmd/fscrypt/errors.go +++ b/cmd/fscrypt/errors.go @@ -35,6 +35,7 @@ import ( "github.com/google/fscrypt/crypto" "github.com/google/fscrypt/filesystem" "github.com/google/fscrypt/metadata" + "github.com/google/fscrypt/security" "github.com/google/fscrypt/util" ) @@ -93,6 +94,14 @@ func getErrorSuggestions(err error) string { needs to be enabled for this filesystem. See the documentation on how to enable encryption on ext4 systems (and the risks of doing so).` + case security.ErrSessionUserKeying: + return `This is usually the result of a bad PAM configuration. + Either correct the problem in your PAM stack, enable + pam_keyinit.so, or run "keyctl link @u @s".` + case security.ErrAccessUserKeyring: + return fmt.Sprintf(`You can only use %s to access the user + keyring of another user if you are running as root.`, + shortDisplay(userFlag)) case actions.ErrBadConfigFile: return `Run "sudo fscrypt setup" to recreate the file.` case actions.ErrNoConfigFile: -- 2.39.5