2bf77a8fa4
Adds patches fixing the pinned thread keyring issue. Reinstate skipped gating tests due to missing crypto-check test utility. - Resolves: RHEL-193183
99 lines
4.0 KiB
Diff
99 lines
4.0 KiB
Diff
From bb5e8e9f0b34fb8135e948ce60d956c2af7d5c8d Mon Sep 17 00:00:00 2001
|
|
From: Ondrej Kozina <okozina@redhat.com>
|
|
Date: Fri, 19 Jun 2026 14:58:46 +0200
|
|
Subject: [PATCH 04/48] tests: revoke keys instead unlinking from thread
|
|
keyring.
|
|
|
|
With the intermediary thread keyring we can not simply unlink
|
|
key from thread keyring. Let's make it simple and invalidate the
|
|
key instead.
|
|
---
|
|
tests/api-test-2.c | 33 ++++++++++++++++-----------------
|
|
1 file changed, 16 insertions(+), 17 deletions(-)
|
|
|
|
diff --git a/tests/api-test-2.c b/tests/api-test-2.c
|
|
index 0523e11d..c41eb4dc 100644
|
|
--- a/tests/api-test-2.c
|
|
+++ b/tests/api-test-2.c
|
|
@@ -427,6 +427,11 @@ static key_serial_t keyctl_unlink(key_serial_t key, key_serial_t keyring)
|
|
return syscall(__NR_keyctl, KEYCTL_UNLINK, key, keyring);
|
|
}
|
|
|
|
+static key_serial_t keyctl_revoke(key_serial_t key)
|
|
+{
|
|
+ return syscall(__NR_keyctl, KEYCTL_REVOKE, key);
|
|
+}
|
|
+
|
|
static key_serial_t keyctl_link(key_serial_t key, key_serial_t keyring)
|
|
{
|
|
return syscall(__NR_keyctl, KEYCTL_LINK, key, keyring);
|
|
@@ -504,20 +509,14 @@ static int _drop_keyring_key_from_keyring_name(const char *key_description, key_
|
|
return keyctl_unlink(kid, keyring);
|
|
}
|
|
|
|
-static int _drop_keyring_key_from_keyring_type(struct crypt_device *_cd, int segment,
|
|
- key_serial_t keyring, const char* type)
|
|
+static int _revoke_keyring_key(struct crypt_device *_cd, int segment)
|
|
{
|
|
- key_serial_t kid = _kernel_key_by_segment_and_type(_cd, segment, type);
|
|
+ key_serial_t kid = _kernel_key_by_segment_and_type(_cd, segment, "logon");
|
|
|
|
if (kid < 0)
|
|
return -1;
|
|
|
|
- return keyctl_unlink(kid, keyring);
|
|
-}
|
|
-
|
|
-static int _drop_keyring_key(struct crypt_device *_cd, int segment)
|
|
-{
|
|
- return _drop_keyring_key_from_keyring_type(_cd, segment, KEY_SPEC_THREAD_KEYRING, "logon");
|
|
+ return keyctl_revoke(kid);
|
|
}
|
|
#endif
|
|
|
|
@@ -690,11 +689,11 @@ static void UseLuks2Device(void)
|
|
// repeat previous tests and check kernel keyring is released when not needed
|
|
if (t_dm_crypt_keyring_support()) {
|
|
OK_(crypt_activate_by_passphrase(cd, NULL, CRYPT_ANY_SLOT, KEY1, strlen(KEY1), 0));
|
|
- FAIL_(_drop_keyring_key(cd, 0), "");
|
|
+ FAIL_(_revoke_keyring_key(cd, 0), "");
|
|
OK_(crypt_activate_by_passphrase(cd, NULL, CRYPT_ANY_SLOT, KEY1, strlen(KEY1), CRYPT_ACTIVATE_KEYRING_KEY));
|
|
- OK_(_drop_keyring_key(cd, 0));
|
|
+ OK_(_revoke_keyring_key(cd, 0));
|
|
OK_(crypt_activate_by_passphrase(cd, CDEVICE_1, CRYPT_ANY_SLOT, KEY1, strlen(KEY1), 0));
|
|
- OK_(_drop_keyring_key(cd, 0));
|
|
+ OK_(_revoke_keyring_key(cd, 0));
|
|
FAIL_(crypt_activate_by_passphrase(cd, CDEVICE_1, CRYPT_ANY_SLOT, KEY1, strlen(KEY1), 0), "already open");
|
|
FAIL_(_volume_key_in_keyring(cd, 0), "");
|
|
OK_(crypt_activate_by_passphrase(cd, NULL, CRYPT_ANY_SLOT, KEY1, strlen(KEY1), 0));
|
|
@@ -704,11 +703,11 @@ static void UseLuks2Device(void)
|
|
if (!_fips_mode) {
|
|
/* keyslot 0 is PBKDF2, keyslot 1 is Argon2id */
|
|
EQ_(crypt_activate_by_passphrase(cd, NULL, 1, KEY2, strlen(KEY2), 0), 1);
|
|
- FAIL_(_drop_keyring_key(cd, 0), "");
|
|
+ FAIL_(_revoke_keyring_key(cd, 0), "");
|
|
EQ_(crypt_activate_by_passphrase(cd, NULL, 1, KEY2, strlen(KEY2), CRYPT_ACTIVATE_KEYRING_KEY), 1);
|
|
- OK_(_drop_keyring_key(cd, 0));
|
|
+ OK_(_revoke_keyring_key(cd, 0));
|
|
EQ_(crypt_activate_by_passphrase(cd, CDEVICE_1, 1, KEY2, strlen(KEY2), 0), 1);
|
|
- OK_(_drop_keyring_key(cd, 0));
|
|
+ OK_(_revoke_keyring_key(cd, 0));
|
|
FAIL_(crypt_activate_by_passphrase(cd, CDEVICE_1, 1, KEY2, strlen(KEY2), 0), "already open");
|
|
FAIL_(_volume_key_in_keyring(cd, 0), "");
|
|
EQ_(crypt_activate_by_passphrase(cd, NULL, 1, KEY2, strlen(KEY2), 0), 1);
|
|
@@ -1828,9 +1827,9 @@ static void ResizeDeviceLuks2(void)
|
|
OK_(crypt_activate_by_volume_key(cd, CDEVICE_1, key, key_size, 0));
|
|
// erase volume key from kernel keyring
|
|
if (t_dm_crypt_keyring_support())
|
|
- OK_(_drop_keyring_key(cd, 0));
|
|
+ OK_(_revoke_keyring_key(cd, 0));
|
|
else
|
|
- FAIL_(_drop_keyring_key(cd, 0), "key not found");
|
|
+ FAIL_(_revoke_keyring_key(cd, 0), "key not found");
|
|
// same size is ok
|
|
OK_(crypt_resize(cd, CDEVICE_1, 0));
|
|
// kernel fails to find the volume key in keyring
|
|
--
|
|
2.55.0
|
|
|