2 # SPDX-License-Identifier: GPL-2.0
3 # Copyright 2019 Google LLC
5 # FS QA Test No. generic/581
7 # Test non-root use of the fscrypt filesystem-level encryption keyring
8 # and v2 encryption policies.
12 seqres=$RESULT_DIR/$seq
13 echo "QA output created by $seq"
18 status=1 # failure is the default!
19 trap "_cleanup; exit \$status" 0 1 2 3 15
26 if [ -n "$orig_maxkeys" ]; then
27 echo "$orig_maxkeys" > /proc/sys/kernel/keys/maxkeys
31 # get standard environment, filters and checks
36 # remove previous $seqres.full before test
39 # real QA test starts here
43 _require_scratch_encryption -v 2
45 _scratch_mkfs_encrypted &>> $seqres.full
52 raw_key+="\\x$(printf "%02x" $i)"
54 keydesc="0000111122223333"
55 keyid="69b2f6edeee720cce0577937eb8a6751"
56 chmod 777 $SCRATCH_MNT
60 echo "# Setting v1 policy as regular user (should succeed)"
61 _user_do_set_encpolicy $dir $keydesc
63 echo "# Getting v1 policy as regular user (should succeed)"
64 _user_do_get_encpolicy $dir | _filter_scratch
66 echo "# Adding v1 policy key as regular user (should fail with EACCES)"
67 _user_do_add_enckey $SCRATCH_MNT "$raw_key" -d $keydesc
73 echo "# Setting v2 policy as regular user without key already added (should fail with ENOKEY)"
74 _user_do_set_encpolicy $dir $keyid |& _filter_scratch
76 echo "# Adding v2 policy key as regular user (should succeed)"
77 _user_do_add_enckey $SCRATCH_MNT "$raw_key"
79 echo "# Setting v2 policy as regular user with key added (should succeed)"
80 _user_do_set_encpolicy $dir $keyid
82 echo "# Getting v2 policy as regular user (should succeed)"
83 _user_do_get_encpolicy $dir | _filter_scratch
85 echo "# Creating encrypted file as regular user (should succeed)"
86 _user_do "echo contents > $dir/file"
88 echo "# Removing v2 policy key as regular user (should succeed)"
89 _user_do_rm_enckey $SCRATCH_MNT $keyid
91 _scratch_cycle_mount # Clear all keys
93 # Wait for any invalidated keys to be garbage-collected.
95 while grep -E -q '^[0-9a-f]+ [^ ]*i[^ ]*' /proc/keys; do
96 if ((++i >= 20)); then
97 echo "Timed out waiting for invalidated keys to be GC'ed" >> $seqres.full
103 # Set the user key quota to the fsgqa user's current number of keys plus 5.
104 orig_keys=$(_user_do "awk '/^[[:space:]]*$(id -u fsgqa):/{print \$4}' /proc/key-users | cut -d/ -f1")
106 echo "orig_keys=$orig_keys" >> $seqres.full
107 orig_maxkeys=$(</proc/sys/kernel/keys/maxkeys)
109 echo $((orig_keys + keys_to_add)) > /proc/sys/kernel/keys/maxkeys
112 echo "# Testing user key quota"
113 for i in `seq $((keys_to_add + 1))`; do
114 rand_raw_key=$(_generate_raw_encryption_key)
115 _user_do_add_enckey $SCRATCH_MNT "$rand_raw_key" \
116 | sed 's/ with identifier .*$//'
119 # Restore the original key quota.
120 echo "$orig_maxkeys" > /proc/sys/kernel/keys/maxkeys
124 _user_do "mkdir $dir"
125 _scratch_cycle_mount # Clear all keys
127 # Test multiple users adding the same key.
128 echo "# Adding key as root"
129 _add_enckey $SCRATCH_MNT "$raw_key"
130 echo "# Getting key status as regular user"
131 _user_do_enckey_status $SCRATCH_MNT $keyid
132 echo "# Removing key only added by another user (should fail with ENOKEY)"
133 _user_do_rm_enckey $SCRATCH_MNT $keyid
134 echo "# Setting v2 encryption policy with key only added by another user (should fail with ENOKEY)"
135 _user_do_set_encpolicy $dir $keyid |& _filter_scratch
136 echo "# Adding second user of key"
137 _user_do_add_enckey $SCRATCH_MNT "$raw_key"
138 echo "# Getting key status as regular user"
139 _user_do_enckey_status $SCRATCH_MNT $keyid
140 echo "# Setting v2 encryption policy as regular user"
141 _user_do_set_encpolicy $dir $keyid
142 echo "# Removing this user's claim to the key"
143 _user_do_rm_enckey $SCRATCH_MNT $keyid
144 echo "# Getting key status as regular user"
145 _user_do_enckey_status $SCRATCH_MNT $keyid
146 echo "# Adding back second user of key"
147 _user_do_add_enckey $SCRATCH_MNT "$raw_key"
148 echo "# Remove key for \"all users\", as regular user (should fail with EACCES)"
149 _user_do_rm_enckey $SCRATCH_MNT $keyid -a |& _filter_scratch
150 _enckey_status $SCRATCH_MNT $keyid
151 echo "# Remove key for \"all users\", as root"
152 _rm_enckey $SCRATCH_MNT $keyid -a
153 _enckey_status $SCRATCH_MNT $keyid