2 # SPDX-License-Identifier: GPL-2.0
3 # Copyright 2019 Google LLC
7 # Test adding a key to a filesystem's fscrypt keyring via an
8 # "fscrypt-provisioning" keyring key. This is an alternative to the normal
9 # method where the raw key is given directly.
12 seqres=$RESULT_DIR/$seq
13 echo "QA output created by $seq"
17 status=1 # failure is the default!
18 trap "_cleanup; exit \$status" 0 1 2 3 15
26 # get standard environment, filters and checks
31 # remove previous $seqres.full before test
34 # real QA test starts here
36 _require_scratch_encryption -v 2
37 _require_command "$KEYCTL_PROG" keyctl
40 _scratch_mkfs_encrypted &>> $seqres.full
42 _require_add_enckey_by_key_id $SCRATCH_MNT
44 test_with_policy_version()
47 local dir=$SCRATCH_MNT/dir
51 echo "# =========================="
52 echo "# Test with policy version $vers"
53 echo "# =========================="
57 local keytype=$FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR
58 local keyspec=$TEST_KEY_DESCRIPTOR
59 local add_enckey_args="-d $TEST_KEY_DESCRIPTOR"
62 local keytype=$FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER
63 local keyspec=$TEST_KEY_IDENTIFIER
64 local add_enckey_args=""
67 _fail "Unknown policy version: $vers"
71 # First add the key in the regular way (raw key given directly), create
72 # an encrypted file with some contents, and remove the key. After this,
73 # the encrypted file should no longer be readable.
75 echo -e "\n# Adding key to filesystem"
76 _add_enckey $SCRATCH_MNT "$TEST_RAW_KEY" $add_enckey_args
78 echo -e "\n# Creating encrypted file"
80 _set_encpolicy $dir $keyspec
81 echo "contents" > $dir/file
83 echo -e "\n# Removing key from filesystem"
84 _rm_enckey $SCRATCH_MNT $keyspec
85 cat $dir/file |& _filter_scratch
87 # Now we should be able to add the key back via an fscrypt-provisioning
88 # key which contains the raw key, instead of providing the raw key
89 # directly. After this, the encrypted file should be readable again.
91 echo -e "\n# Adding fscrypt-provisioning key"
92 keyid=$(_add_fscrypt_provisioning_key $keyspec $keytype "$TEST_RAW_KEY")
94 echo -e "\n# Adding key to filesystem via fscrypt-provisioning key"
95 $XFS_IO_PROG -c "add_enckey -k $keyid $add_enckey_args" $SCRATCH_MNT
97 echo -e "\n# Reading encrypted file"
100 echo -e "\n# Cleaning up"
102 _scratch_cycle_mount # Clear all keys
105 # Test with both v1 and v2 encryption policies.
106 test_with_policy_version 1
107 test_with_policy_version 2
109 # Now test that invalid fscrypt-provisioning keys can't be created, that
110 # fscrypt-provisioning keys can't be read back by userspace, and that the
111 # filesystem only accepts properly matching fscrypt-provisioning keys.
113 echo "# ================"
114 echo "# Validation tests"
115 echo "# ================"
117 echo -e "\n# Adding an invalid fscrypt-provisioning key fails"
118 echo "# ... bad type"
119 _add_fscrypt_provisioning_key desc 0 "$TEST_RAW_KEY"
120 echo "# ... bad type"
121 _add_fscrypt_provisioning_key desc 10000 "$TEST_RAW_KEY"
122 echo "# ... raw key too small"
123 _add_fscrypt_provisioning_key desc $FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR ""
124 echo "# ... raw key too large"
125 _add_fscrypt_provisioning_key desc $FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR \
126 "$TEST_RAW_KEY$TEST_RAW_KEY"
128 echo -e "\n# keyctl_read() doesn't work on fscrypt-provisioning keys"
129 keyid=$(_add_fscrypt_provisioning_key desc $FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR \
131 $KEYCTL_PROG read $keyid
132 $KEYCTL_PROG unlink $keyid @s
134 echo -e "\n# Only keys with the correct fscrypt_provisioning_key_payload::type field can be added"
135 echo "# ... keyring key is v1, filesystem wants v2 key"
136 keyid=$(_add_fscrypt_provisioning_key desc $FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR \
138 $XFS_IO_PROG -c "add_enckey -k $keyid" $SCRATCH_MNT
139 $KEYCTL_PROG unlink $keyid @s
141 echo "# ... keyring key is v2, filesystem wants v1 key"
142 keyid=$(_add_fscrypt_provisioning_key desc $FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER \
144 $XFS_IO_PROG -c "add_enckey -k $keyid -d $TEST_KEY_DESCRIPTOR" $SCRATCH_MNT
145 $KEYCTL_PROG unlink $keyid @s
147 echo -e "\n# Only keys of type fscrypt-provisioning can be added"
148 keyid=$(head -c 64 /dev/urandom | $KEYCTL_PROG padd logon foo:desc @s)
149 $XFS_IO_PROG -c "add_enckey -k $keyid" $SCRATCH_MNT
150 $KEYCTL_PROG unlink $keyid @s