678d62e7b0
Adds patches fixing the pinned thread keyring issue. Reinstate skipped gating tests due to missing crypto-check test utility. - Resolves: RHEL-193162
89 lines
2.7 KiB
Diff
89 lines
2.7 KiB
Diff
From e6573494f0feee971c8079d2697a2d925c3799a0 Mon Sep 17 00:00:00 2001
|
|
From: Ondrej Kozina <okozina@redhat.com>
|
|
Date: Thu, 25 Jun 2026 15:35:07 +0200
|
|
Subject: [PATCH 07/48] tests: verify intermediary keyring cleanup after
|
|
crypt_free().
|
|
|
|
Add API-level test that checks both the intermediary keyring and
|
|
VK logon key are unlinked from the thread keyring after
|
|
crypt_free(). Unlike the compat-test2 checks (which verify after
|
|
process exit), this runs in-process where the thread keyring is
|
|
still alive.
|
|
|
|
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
---
|
|
tests/api-test-2.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++
|
|
1 file changed, 48 insertions(+)
|
|
|
|
diff --git a/tests/api-test-2.c b/tests/api-test-2.c
|
|
index 3ef0adca..a6b82d18 100644
|
|
--- a/tests/api-test-2.c
|
|
+++ b/tests/api-test-2.c
|
|
@@ -520,6 +520,36 @@ static int _revoke_keyring_key(struct crypt_device *_cd, int segment)
|
|
|
|
return keyctl_revoke(kid);
|
|
}
|
|
+
|
|
+static long keyctl_describe(key_serial_t id, char *buffer, size_t buflen)
|
|
+{
|
|
+ return syscall(__NR_keyctl, KEYCTL_DESCRIBE, id, buffer, buflen);
|
|
+}
|
|
+
|
|
+static int _intermediary_keyring_in_thread_keyring(const char *uuid)
|
|
+{
|
|
+ key_serial_t keys[64];
|
|
+ char rdesc[256], prefix[20];
|
|
+ long r;
|
|
+ int i, count;
|
|
+
|
|
+ r = snprintf(prefix, sizeof(prefix), "cryptsetup-%.8s", uuid);
|
|
+ if (r < 0 || (size_t)r > sizeof(prefix) - 1)
|
|
+ return -1;
|
|
+
|
|
+ r = keyctl_read(KEY_SPEC_THREAD_KEYRING, (char *)keys, sizeof(keys));
|
|
+ if (r < 0)
|
|
+ return -1;
|
|
+
|
|
+ count = r / sizeof(key_serial_t);
|
|
+ for (i = 0; i < count; i++) {
|
|
+ r = keyctl_describe(keys[i], rdesc, sizeof(rdesc));
|
|
+ if (r > 0 && (size_t)r <= sizeof(rdesc) && strstr(rdesc, prefix))
|
|
+ return 0;
|
|
+ }
|
|
+
|
|
+ return -1;
|
|
+}
|
|
#endif
|
|
|
|
static void _cleanup(void)
|
|
@@ -736,8 +766,26 @@ static void UseLuks2Device(void)
|
|
key[1] = ~key[1];
|
|
FAIL_(crypt_volume_key_verify(cd, key, key_size), "key mismatch");
|
|
FAIL_(crypt_activate_by_volume_key(cd, CDEVICE_1, key, key_size, 0), "key mismatch");
|
|
+ CRYPT_FREE(cd);
|
|
|
|
+#if KERNEL_KEYRING
|
|
+ OK_(crypt_init(&cd, DEVICE_1));
|
|
+ OK_(crypt_load(cd, CRYPT_LUKS2, NULL));
|
|
+ if (t_dm_crypt_keyring_support()) {
|
|
+ OK_(crypt_activate_by_passphrase(cd, CDEVICE_1, CRYPT_ANY_SLOT, KEY1, strlen(KEY1), 0));
|
|
+ OK_(_intermediary_keyring_in_thread_keyring(DEVICE_1_UUID));
|
|
+ OK_(_volume_key_in_keyring(cd, 0));
|
|
+ }
|
|
+ // All keys uploaded via current device context must be freed.
|
|
CRYPT_FREE(cd);
|
|
+ if (t_dm_crypt_keyring_support()) {
|
|
+ FAIL_(_intermediary_keyring_in_thread_keyring(DEVICE_1_UUID), "intermediary keyring not cleaned up");
|
|
+ FAIL_(_kernel_key_by_segment_uuid_and_type(DEVICE_1_UUID, 0, "logon"), "VK not cleaned up");
|
|
+ }
|
|
+ OK_(crypt_init_by_name(&cd, CDEVICE_1));
|
|
+ OK_(crypt_deactivate(cd, CDEVICE_1));
|
|
+ CRYPT_FREE(cd);
|
|
+#endif
|
|
}
|
|
|
|
static void SuspendDevice(void)
|
|
--
|
|
2.55.0
|
|
|