eCryptfs

Merge lp://staging/~ecryptfs/ecryptfs/ecryptfs-utils into lp://staging/~mhlavink/ecryptfs/20090424

  1. ecryptfs-utils
  2. Merge into 20090424
Proposed by david
Status: Merged
Merge reported by: Dustin Kirkland 
Merged at revision: not available
Proposed branch: lp://staging/~ecryptfs/ecryptfs/ecryptfs-utils
Merge into: lp://staging/~mhlavink/ecryptfs/20090424
Diff against target: 5798 lines (+2544/-987)
72 files modified
README (+0/-5)
configure.ac (+4/-17)
debian/changelog (+311/-1)
debian/control (+49/-9)
debian/copyright (+10/-5)
debian/ecryptfs-utils.dirs (+0/-2)
debian/ecryptfs-utils.ecryptfs-utils-restore.upstart (+26/-0)
debian/ecryptfs-utils.ecryptfs-utils-save.upstart (+26/-0)
debian/ecryptfs-utils.install (+2/-1)
debian/ecryptfs-utils.postinst (+11/-35)
debian/libecryptfs0.shlibs (+1/-1)
debian/lintian/ecryptfs-utils (+13/-0)
debian/local/ecryptfs-utils.pam-auth-update (+3/-3)
debian/po/POTFILES.sh (+5/-0)
debian/po/ecryptfs-utils.pot (+407/-0)
debian/po/fr.po (+389/-0)
debian/rules (+38/-19)
doc/Makefile.am (+1/-2)
doc/ecryptfs-mount-private.txt (+1/-1)
doc/manpage/Makefile.am (+3/-0)
doc/manpage/ecryptfs-mount-private.1 (+2/-2)
doc/manpage/ecryptfs-rewrite-file.1 (+1/-1)
doc/manpage/ecryptfs-setup-private.1 (+2/-2)
doc/manpage/ecryptfs-setup-swap.1 (+29/-0)
doc/manpage/ecryptfs-stat.1 (+18/-0)
doc/manpage/ecryptfs.7 (+7/-135)
doc/manpage/mount.ecryptfs_private.1 (+1/-1)
doc/manpage/umount.ecryptfs.8 (+23/-0)
doc/manpage/umount.ecryptfs_private.1 (+1/-1)
doc/sourceforge_webpage/README (+0/-5)
lintian/ecryptfs-utils (+12/-0)
scripts/build-ubuntu.sh (+1/-1)
scripts/release.sh (+6/-2)
src/desktop/Makefile.am (+2/-1)
src/desktop/ecryptfs-record-passphrase (+6/-3)
src/include/ecryptfs.h (+5/-0)
src/key_mod/ecryptfs_key_mod_gpg.c (+5/-8)
src/key_mod/ecryptfs_key_mod_openssl.c (+28/-2)
src/key_mod/ecryptfs_key_mod_pkcs11_helper.c (+4/-3)
src/key_mod/ecryptfs_key_mod_tspi.c (+7/-3)
src/libecryptfs-swig/libecryptfs.i (+1/-1)
src/libecryptfs-swig/libecryptfs.py (+1/-1)
src/libecryptfs-swig/libecryptfs_wrap.c (+88/-47)
src/libecryptfs/cipher_list.c (+1/-1)
src/libecryptfs/cmd_ln_parser.c (+1/-1)
src/libecryptfs/decision_graph.c (+39/-13)
src/libecryptfs/key_management.c (+40/-102)
src/libecryptfs/libecryptfs.pc.in (+2/-2)
src/libecryptfs/main.c (+108/-30)
src/libecryptfs/module_mgr.c (+57/-11)
src/pam_ecryptfs/Makefile.am (+2/-2)
src/pam_ecryptfs/pam_ecryptfs.c (+66/-51)
src/python/ecryptfsapi.py (+82/-0)
src/utils/Makefile.am (+4/-3)
src/utils/ecryptfs-dot-private (+0/-34)
src/utils/ecryptfs-migrate-home (+195/-0)
src/utils/ecryptfs-mount-private (+8/-7)
src/utils/ecryptfs-rewrite-file (+29/-15)
src/utils/ecryptfs-setup-private (+125/-126)
src/utils/ecryptfs-setup-swap (+100/-89)
src/utils/ecryptfs-umount-private (+14/-16)
src/utils/ecryptfs_add_passphrase.c (+11/-7)
src/utils/ecryptfs_generate_tpm_key.c (+4/-1)
src/utils/ecryptfs_insert_wrapped_passphrase_into_keyring.c (+15/-5)
src/utils/ecryptfs_rewrap_passphrase.c (+0/-1)
src/utils/ecryptfs_unwrap_passphrase.c (+12/-3)
src/utils/ecryptfs_wrap_passphrase.c (+0/-1)
src/utils/io.c (+29/-12)
src/utils/manager.c (+1/-1)
src/utils/mount.ecryptfs.c (+13/-26)
src/utils/mount.ecryptfs_private.c (+32/-107)
src/utils/umount.ecryptfs.c (+4/-0)
To merge this branch: bzr merge lp://staging/~ecryptfs/ecryptfs/ecryptfs-utils
Reviewer Review Type Date Requested Status
Dustin Kirkland  (community) Needs Information
Review via email: mp+12512@code.staging.launchpad.net
To post a comment you must log in.
Revision history for this message
david (davidelizondo2006) wrote :

diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 2f0945d..056fed6 100644 (file)
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -476,6 +476,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
        struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
        struct dentry *lower_dir_dentry;

+ dget(lower_dentry);
        lower_dir_dentry = lock_parent(lower_dentry);
        rc = vfs_unlink(lower_dir_inode, lower_dentry);
        if (rc) {
@@ -489,6 +490,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
        d_drop(dentry);
 out_unlock:
        unlock_dir(lower_dir_dentry);
+ dput(lower_dentry);
        return rc;
 }

  test ......

http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git;a=blob;f=fs/ecryptfs/inode.c;h=2f0945d632970511ba189a0ef8595e918c10b693;hb=96a7b9c2f5df899f302ade45cf17ad753fe130fd

Revision history for this message
david (davidelizondo2006) wrote :

> diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
> index 2f0945d..056fed6 100644 (file)
> --- a/fs/ecryptfs/inode.c
> +++ b/fs/ecryptfs/inode.c
> @@ -476,6 +476,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> dentry *dentry)
> struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
> struct dentry *lower_dir_dentry;
>
> + dget(lower_dentry);
> lower_dir_dentry = lock_parent(lower_dentry);
> rc = vfs_unlink(lower_dir_inode, lower_dentry);
> if (rc) {
> @@ -489,6 +490,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> dentry *dentry)
> d_drop(dentry);
> out_unlock:
> unlock_dir(lower_dir_dentry);
> + dput(lower_dentry);
> return rc;
> }
>
> test ......
>
> http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git;a=blob;f=fs/ecry
> ptfs/inode.c;h=2f0945d632970511ba189a0ef8595e918c10b693;hb=96a7b9c2f5df899f302
> ade45cf17ad753fe130fd

Merge branch 'for-linus' of git://git./linux/kernel/git/ecryptfs/ecryptfs-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ecryptfs/ecryptfs-2.6:
  eCryptfs: Prevent lower dentry from going negative during unlink
  eCryptfs: Propagate vfs_read and vfs_write return codes
  eCryptfs: Validate global auth tok keys
  eCryptfs: Filename encryption only supports password auth tokens
  eCryptfs: Check for O_RDONLY lower inodes when opening lower files
  eCryptfs: Handle unrecognized tag 3 cipher codes
  ecryptfs: improved dependency checking and reporting
  eCryptfs: Fix lockdep-reported AB-BA mutex issue
  ecryptfs: Remove unneeded locking that triggers lockdep false positives

Revision history for this message
david (davidelizondo2006) wrote :
Download full text (98.9 KiB)

> > diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
> > index 2f0945d..056fed6 100644 (file)
> > --- a/fs/ecryptfs/inode.c
> > +++ b/fs/ecryptfs/inode.c
> > @@ -476,6 +476,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> > dentry *dentry)
> > struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
> > struct dentry *lower_dir_dentry;
> >
> > + dget(lower_dentry);
> > lower_dir_dentry = lock_parent(lower_dentry);
> > rc = vfs_unlink(lower_dir_inode, lower_dentry);
> > if (rc) {
> > @@ -489,6 +490,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> > dentry *dentry)
> > d_drop(dentry);
> > out_unlock:
> > unlock_dir(lower_dir_dentry);
> > + dput(lower_dentry);
> > return rc;
> > }
> >
> > test ......
> >
> > http://git.kernel.org/?p=linux/kernel/git/next/linux-
> next.git;a=blob;f=fs/ecry
> >
> ptfs/inode.c;h=2f0945d632970511ba189a0ef8595e918c10b693;hb=96a7b9c2f5df899f302
> > ade45cf17ad753fe130fd
>
>
> Merge branch 'for-linus' of git://git./linux/kernel/git/ecryptfs/ecryptfs-2.6
>
> * 'for-linus' of
> git://git.kernel.org/pub/scm/linux/kernel/git/ecryptfs/ecryptfs-2.6:
> eCryptfs: Prevent lower dentry from going negative during unlink
> eCryptfs: Propagate vfs_read and vfs_write return codes
> eCryptfs: Validate global auth tok keys
> eCryptfs: Filename encryption only supports password auth tokens
> eCryptfs: Check for O_RDONLY lower inodes when opening lower files
> eCryptfs: Handle unrecognized tag 3 cipher codes
> ecryptfs: improved dependency checking and reporting
> eCryptfs: Fix lockdep-reported AB-BA mutex issue
> ecryptfs: Remove unneeded locking that triggers lockdep false positives

1 config ECRYPT_FS
2 tristate "eCrypt filesystem layer support (EXPERIMENTAL)"
3 depends on EXPERIMENTAL && KEYS && NET
4 select CRYPTO_ECB
5 select CRYPTO_CBC
6 help
7 Encrypted filesystem that operates on the VFS layer. See
8 <file:Documentation/filesystems/ecryptfs.txt> to learn more about
9 eCryptfs. Userspace components are required and can be
10 obtained from <http://ecryptfs.sf.net>.
11
12 To compile this file system support as a module, choose M here: the
13 module will be called ecryptfs.

#######################################################################################
/**
2 * eCryptfs: Linux filesystem encryption layer
3 *
4 * Copyright (C) 1997-2004 Erez Zadok
5 * Copyright (C) 2001-2004 Stony Brook University
6 * Copyright (C) 2004-2007 International Business Machines Corp.
7 * Author(s): Michael A. Halcrow <email address hidden>
8 * Michael C. Thompson <email address hidden>
9 *
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License as
12 * published by the Free Software Foundation; either version 2 of the
13 * License, or (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of
17...

Revision history for this message
david (davidelizondo2006) wrote :
Download full text (262.0 KiB)

> > > diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
> > > index 2f0945d..056fed6 100644 (file)
> > > --- a/fs/ecryptfs/inode.c
> > > +++ b/fs/ecryptfs/inode.c
> > > @@ -476,6 +476,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> > > dentry *dentry)
> > > struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
> > > struct dentry *lower_dir_dentry;
> > >
> > > + dget(lower_dentry);
> > > lower_dir_dentry = lock_parent(lower_dentry);
> > > rc = vfs_unlink(lower_dir_inode, lower_dentry);
> > > if (rc) {
> > > @@ -489,6 +490,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> > > dentry *dentry)
> > > d_drop(dentry);
> > > out_unlock:
> > > unlock_dir(lower_dir_dentry);
> > > + dput(lower_dentry);
> > > return rc;
> > > }
> > >
> > > test ......
> > >
> > > http://git.kernel.org/?p=linux/kernel/git/next/linux-
> > next.git;a=blob;f=fs/ecry
> > >
> >
> ptfs/inode.c;h=2f0945d632970511ba189a0ef8595e918c10b693;hb=96a7b9c2f5df899f302
> > > ade45cf17ad753fe130fd
> >
> >
> > Merge branch 'for-linus' of
> git://git./linux/kernel/git/ecryptfs/ecryptfs-2.6
> >
> > * 'for-linus' of
> > git://git.kernel.org/pub/scm/linux/kernel/git/ecryptfs/ecryptfs-2.6:
> > eCryptfs: Prevent lower dentry from going negative during unlink
> > eCryptfs: Propagate vfs_read and vfs_write return codes
> > eCryptfs: Validate global auth tok keys
> > eCryptfs: Filename encryption only supports password auth tokens
> > eCryptfs: Check for O_RDONLY lower inodes when opening lower files
> > eCryptfs: Handle unrecognized tag 3 cipher codes
> > ecryptfs: improved dependency checking and reporting
> > eCryptfs: Fix lockdep-reported AB-BA mutex issue
> > ecryptfs: Remove unneeded locking that triggers lockdep false positives
>
>
> 1 config ECRYPT_FS
> 2 tristate "eCrypt filesystem layer support (EXPERIMENTAL)"
> 3 depends on EXPERIMENTAL && KEYS && NET
> 4 select CRYPTO_ECB
> 5 select CRYPTO_CBC
> 6 help
> 7 Encrypted filesystem that operates on the VFS layer. See
> 8 <file:Documentation/filesystems/ecryptfs.txt> to learn more about
> 9 eCryptfs. Userspace components are required and can be
> 10 obtained from <http://ecryptfs.sf.net>.
> 11
> 12 To compile this file system support as a module, choose M here:
> the
> 13 module will be called ecryptfs.
>
> ##############################################################################
> #########
> /**
> 2 * eCryptfs: Linux filesystem encryption layer
> 3 *
> 4 * Copyright (C) 1997-2004 Erez Zadok
> 5 * Copyright (C) 2001-2004 Stony Brook University
> 6 * Copyright (C) 2004-2007 International Business Machines Corp.
> 7 * Author(s): Michael A. Halcrow <email address hidden>
> 8 * Michael C. Thompson <email address hidden>
> 9 *
> 10 * This program is free software; you can redistribute it and/or
> 11 * modify it under the terms of the GNU General Public License as
> 12 * published by the Free Software Foundation; either version 2 of the
> 13 * License, or (at your option) any later ve...

lp://staging/~ecryptfs/ecryptfs/ecryptfs-utils updated
462. By Dustin Kirkland 

open 82 for development

Signed-off-by: Dustin Kirkland <email address hidden>

463. By Dustin Kirkland 

src/utils/ecryptfs-setup-private: fix bug where setup-private
incorrectly assumed that the home/private dir ownerships should
be owned by USER:USER; instead, default to USER:GROUP, where
GROUP is the USER's primary group by default, LP: #445301

464. By Dustin Kirkland 

src/utils/ecryptfs-setup-private: fix typo, s/getext/gettext, LP: #456565

465. By Dustin Kirkland 

* src/utils/ecryptfs-setup-private, debian/control: LP: #456565
  - fix typo, s/getext/gettext
  - depend on gettext-base

466. By Dustin Kirkland 

src/utils/ecryptfs-setup-private: fix printing of error strings,
which was broken by the gettext integration, LP: #471725

467. By Dustin Kirkland 

  which was broken by the gettext integration, LP: #471725;
  in doing so, use $() in place of ``, use '' for gettext arguments,
  and wrap gettext in "", like this: foo="$(gettext 'blah blah')"

468. By Dustin Kirkland 

* debian/control: one package per line, helps tremendously when looking
  at diffs
* debian/copyright: Add new fields
* debian/ecryptfs-utils.postinst: minor set -e change

469. By Dustin Kirkland 

releasing version 82

470. By Dustin Kirkland 

add release instructions

Signed-off-by: Dustin Kirkland <email address hidden>

471. By Dustin Kirkland <kirkland@x200>

* libecryptfs/key_management.c, utils/mount.ecryptfs_private.c:
  - use the session keyring, rather than the user keyring, such that
    keys are automatically cleared on logout

472. By Dustin Kirkland <kirkland@x200>

src/pam_ecryptfs/pam_ecryptfs.c, src/utils/Makefile.am,
src/utils/ecryptfs-migrate-home: add a script and pam hooks to
support automatic migration to encrypted home directory

473. By Dustin Kirkland <kirkland@x200>

add uid arg to wrap_passphrase_if_necessary

474. By Dustin Kirkland <kirkland@x200>

revert -r471, not quite ready for this yet

475. By Dustin Kirkland <kirkland@x200>

move wrap_passphrase_if_necessary() definition up before first use

476. By Dustin Kirkland <kirkland@x200>

* src/utils/ecryptfs-migrate-home: clean up for merge
  - use $() rather than ``
  - drop set -u
  - use = and !=, and quote vars, rather than testing with -ne, -eq,
    for better shell portability
  - improve usage statement and error text

477. By Dustin Kirkland <kirkland@x200>

  - check if already encrypted
  - handle migration of multiple users on boot

478. By Dustin Kirkland <kirkland@x200>

fix all whitespace, use tabs for indents

479. By Dustin Kirkland <kirkland@x200>

use quotes around variables, rather than ${} (stylistic preference)

480. By Dustin Kirkland <kirkland@x200>

  - major simplification for immediate release
    + remove boot and user modes; only support administrator mode for
      security reasons and to avoid race conditions
    + other modes can be re-added, if necessary, and if security
      concerns can be addressed

481. By Dustin Kirkland <kirkland@x200>

src/utils/Makefile.am: install to /usr/sbin, since this is an
administrative utility

482. By Dustin Kirkland <kirkland@x200>

ensure running as root

483. By Dustin Kirkland <kirkland@x200>

revert sbin change, as it installed to /sbin instead of /usr/sbin

484. By Dustin Kirkland <kirkland@x200>

drop verbose option, always print useful info messages

485. By Dustin Kirkland <kirkland@x200>

call the user $USER_NAME rather than $USER_ID since id implies
number, and here we're deailing with names

486. By Dustin Kirkland <kirkland@x200>

no decimals on awk calculation

487. By Dustin Kirkland <kirkland@x200>

mktemp on the target user, not root

488. By Dustin Kirkland <kirkland@x200>

drop VERBOSE option, always print useful info messages

489. By Dustin Kirkland <kirkland@x200>

check that there is enough disk space available to do the migration

490. By Dustin Kirkland <kirkland@x200>

ensure the user's homedir group is correct

491. By Dustin Kirkland <kirkland@x200>

add critical instructions, user *must* login after the migration and
before the reboot, as their wrapped passphrase will be cleared on
reboot (possible we should use an init script to move these to
/var/tmp on reboot)

492. By Dustin Kirkland <kirkland@x200>

ensure permissions are set correctly

493. By Dustin Kirkland <kirkland@x200>

fix versioning

494. By Dustin Kirkland <kirkland@x200>

debian/ecryptfs-utils.upstart, debian/rules: try to protect migrating
users who don't login before the next reboot

495. By Dustin Kirkland <kirkland@x200>

* ecryptfs-utils.ecryptfs-utils-restore.upstart,
  ecryptfs-utils.ecryptfs-utils-save.upstart, rules:
  - try to protect migrating users who don't login before the next reboot

496. By Dustin Kirkland <kirkland@x200>

improve text at the end of the migration

497. By Dustin Kirkland <kirkland@x200>

src/desktop/ecryptfs-record-passphrase: improve text

Revision history for this message
Dustin Kirkland  (kirkland) wrote :

Is this branch still active at all?

review: Needs Information

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
1=== modified file 'README'
2--- README 2009-02-03 08:50:36 +0000
3+++ README 2010-02-17 20:48:18 +0000
4@@ -43,11 +43,6 @@
5 1.0 or higher)
6 - Finding its way into some distros
7 - Obtainable from <http://people.redhat.com/~dhowells/keyutils>
8- - libgcrypt
9- - Part of most distros; install the development package
10- - If you need to build from source, you probably will want these:
11- - <ftp://ftp.gnupg.org/gcrypt/libgpg-error>
12- - <ftp://ftp.gnupg.org/gcrypt/libgcrypt>
13
14
15 KERNEL BUILD OPTIONS
16
17=== modified file 'configure.ac'
18--- configure.ac 2009-04-21 23:25:42 +0000
19+++ configure.ac 2010-02-17 20:48:18 +0000
20@@ -10,7 +10,7 @@
21
22
23 AC_PREREQ(2.59)
24-AC_INIT([ecryptfs-utils],[74])
25+AC_INIT([ecryptfs-utils],[82])
26 AC_CANONICAL_HOST
27 AC_CANONICAL_TARGET
28 AM_INIT_AUTOMAKE([${PACKAGE_NAME}], [${PACKAGE_VERSION}])
29@@ -187,14 +187,6 @@
30 AC_HEADER_STDC
31 AC_CHECK_LIB([dl], [dlopen])
32
33-# Verify gcrypt
34-AC_MSG_CHECKING([for libgcrypt])
35-AM_PATH_LIBGCRYPT(,,[AC_MSG_ERROR([eCryptfs userspace tools require libgcrypt
36-You might find the package at:
37-http://directory.fsf.org/security/libgcrypt.html
38-])]
39-)
40-
41 # Verify keyutils version 1.0 or higher
42 if test -z "${KEYUTILS_LIBS}"; then
43 AC_ARG_VAR([KEYUTILS_CFLAGS], [C compiler flags for keyutils])
44@@ -327,7 +319,7 @@
45 AC_CHECK_LIB(
46 [pam_misc],
47 [pam_misc_setenv],
48- [PAM_LIBS="${TSPI_LIBS} -lpam_misc"],
49+ [PAM_LIBS="${PAM_LIBS} ${TSPI_LIBS} -lpam_misc"],
50 [AC_MSG_ERROR([Cannot find pam_misc])]
51 )
52 fi
53@@ -353,13 +345,8 @@
54 rootsbindir="\$(sbindir)"
55 fi
56
57-if test "${enable_nss}" == "yes" ; then
58- CRYPTO_CFLAGS=${NSS_CFLAGS}
59- CRYPTO_LIBS=${NSS_LIBS}
60-else
61- CRYPTO_CFLAGS=${LIBGCRYPT_CFLAGS}
62- CRYPTO_LIBS=${LIBGCRYPT_LIBS}
63-fi
64+CRYPTO_CFLAGS=${NSS_CFLAGS}
65+CRYPTO_LIBS=${NSS_LIBS}
66
67 AC_SUBST([pamdir])
68 AC_SUBST([pamlibdir])
69
70=== modified file 'debian/changelog'
71--- debian/changelog 2009-04-21 23:24:32 +0000
72+++ debian/changelog 2010-02-17 20:48:18 +0000
73@@ -1,4 +1,314 @@
74-ecryptfs-utils (74) unreleased; urgency=low
75+ecryptfs-utils (83) UNRELEASED; urgency=low
76+
77+ [ Yan Li <yan.i.li@intel.com> ]
78+ * src/pam_ecryptfs/pam_ecryptfs.c, src/utils/Makefile.am,
79+ src/utils/ecryptfs-migrate-home: add a script and pam hooks to
80+ support automatic migration to encrypted home directory
81+
82+ [ Dustin Kirkland ]
83+ * src/utils/ecryptfs-migrate-home: clean up for merge
84+ - use $() rather than ``
85+ - drop set -u
86+ - use = and !=, and quote vars, rather than testing with -ne, -eq,
87+ for better shell portability
88+ - improve usage statement and error text
89+ - check if already encrypted
90+ - handle migration of multiple users on boot
91+ - fix all whitespace, use tabs for indents
92+ - use quotes around variables, rather than ${} (stylistic preference)
93+ - major simplification for immediate release
94+ + remove boot and user modes; only support administrator mode for
95+ security reasons and to avoid race conditions
96+ + other modes can be re-added, if necessary, and if security
97+ concerns can be addressed
98+ - ensure running as root
99+ - drop VERBOSE option, always print useful info messages
100+ - call the user $USER_NAME rather than $USER_ID since id implies
101+ number, and here we're deailing with names
102+ - no decimals on awk calculation
103+ - mktemp on the target user, not root
104+ - check that there is enough disk space available to do the migration
105+ - ensure the user's homedir group is correct
106+ - add critical instructions, user *must* login after the migration and
107+ before the reboot, as their wrapped passphrase will be cleared on
108+ reboot (possible we should use an init script to move these to
109+ /var/tmp on reboot)
110+ - ensure permissions are set correctly
111+ - improve text at the end of the migration
112+ * ecryptfs-utils.ecryptfs-utils-restore.upstart,
113+ ecryptfs-utils.ecryptfs-utils-save.upstart, rules:
114+ - try to protect migrating users who don't login before the next reboot
115+ * src/desktop/ecryptfs-record-passphrase: improve text
116+
117+ -- Dustin Kirkland <kirkland@ubuntu.com> Sat, 06 Feb 2010 17:48:57 -0600
118+
119+ecryptfs-utils (82) released; urgency=low
120+
121+ * src/utils/ecryptfs-setup-private: fix bug where setup-private
122+ incorrectly assumed that the home/private dir ownerships should
123+ be owned by USER:USER; instead, default to USER:GROUP, where
124+ GROUP is the USER's primary group by default, LP: #445301
125+ * src/utils/ecryptfs-setup-private, debian/control: LP: #456565
126+ - fix typo, s/getext/gettext
127+ - depend on gettext-base
128+ * src/utils/ecryptfs-setup-private: fix printing of error strings,
129+ which was broken by the gettext integration, LP: #471725;
130+ in doing so, use $() in place of ``, use '' for gettext arguments,
131+ and wrap gettext in "", like this: foo="$(gettext 'blah blah')"
132+ * debian/control: one package per line, helps tremendously when looking
133+ at diffs
134+ * debian/copyright: Add new fields
135+ * debian/ecryptfs-utils.postinst: minor set -e change
136+
137+
138+ -- Dustin Kirkland <kirkland@ubuntu.com> Tue, 10 Nov 2009 11:31:25 -0600
139+
140+ecryptfs-utils (81) released; urgency=low
141+
142+ [ Michael Terry ]
143+ * src/utils/ecryptfs-setup=swap: clean up some error message reporting,
144+ LP: #430891, #430890
145+
146+ [ Dustin Kirkland ]
147+ * doc/manpage/ecryptfs.7: note the 64-char passphrase limit, LP: #386504
148+ * src/utils/ecryptfs-setup-private: minor documentation change
149+
150+ -- Dustin Kirkland <kirkland@ubuntu.com> Fri, 18 Sep 2009 18:46:07 -0500
151+
152+ecryptfs-utils (80) released; urgency=low
153+
154+ [ Evan Dandrea ]
155+ * src/utils/ecryptfs-setup-swap: allow for setting up encrpyted swap,
156+ without activating it immediately, necessary for livecd installations
157+
158+ -- Dustin Kirkland <kirkland@ubuntu.com> Wed, 19 Aug 2009 11:31:03 -0500
159+
160+ecryptfs-utils (79) released; urgency=low
161+
162+ [ Dustin Kirkland ]
163+ * debian/control: updated bzr and browser urls, bumped standards version
164+ * src/pam_ecryptfs/pam_ecryptfs.c: silence useless, oft-shown info
165+ message
166+ * src/utils/ecryptfs-mount-private, src/utils/ecryptfs-rewrite-file,
167+ src/utils/ecryptfs-setup-private, src/utils/ecryptfs-setup-swap,
168+ src/utils/ecryptfs-umount-private: use gettext for all string printing,
169+ such that we can internationalize ecryptfs
170+ * po/POTFILES.sh, po/ecryptfs-utils.pot, po/fr.po, rules: add po to the
171+ build system; for now, in the debian/ directory; this should be put in
172+ the upstream source tree eventually (but I need some help with the
173+ automake/autoconf integration)
174+ * ecryptfs-setup-swap: exit(0) if there's no swaps to encrypt, ensures
175+ that this script succeeds if there is no swap space that needs to be
176+ secured, or if the existing swap space is already secured
177+ * doc/manpage/ecryptfs-setup-swap.1, doc/manpage/ecryptfs-stat.1,
178+ doc/manpage/umount.ecryptfs.8, doc/manpage/Makefile.am: added manpagess
179+ * doc/manpage/ecryptfs.7: fix lintian warning
180+ * debian/lintian/ecryptfs-utils: added a lintian overrides file
181+ * debian/lintian/ecryptfs-utils, debian/ecryptfs-utils.install: add and
182+ install some proper lintian overrides
183+ * src/libecryptfs/module_mgr.c: fix typo, LP: #408437
184+
185+ [ Evan Dandrea ]
186+ * ecryptfs-setup-swap: support more than one encrypted swap device
187+
188+ [ Dorin Scutarașu ]
189+ * src/libecryptfs/key_management.c: fix null pointer deref, LP: #409565
190+
191+ -- Dustin Kirkland <kirkland@ubuntu.com> Mon, 17 Aug 2009 11:58:35 -0500
192+
193+ecryptfs-utils (78) released; urgency=low
194+
195+ [ James Westby ]
196+ * src/libecryptfs/main.c flockfile the filehandle after checking that
197+ we were able to successfully open it (LP: #403011)
198+ * debian/libecryptfs0.shlibs: bump shlibs dep to 77 since we added new
199+ symbols there
200+
201+ -- Dustin Kirkland <kirkland@ubuntu.com> Wed, 22 Jul 2009 11:28:20 -0500
202+
203+ecryptfs-utils (77) released; urgency=low
204+
205+ [ Dustin Kirkland ]
206+ * src/libecryptfs/key_management.c, src/pam_ecryptfs/pam_ecryptfs.c:
207+ revert the zombie code removal from pam_ecryptfs as it seems this
208+ bit is still needed; fix the source of the problem introduced in
209+ commit r407; check for non-zero return codes; this problem would
210+ manifest itself as a) unable to unlock screensaver, b) unable to
211+ switch users, c) unable to mount home folder on initial login;
212+ LP: #402222, #402029
213+ * src/utils/ecryptfs-umount-private: use for loop to loop over key
214+ ids on removal
215+ * src/utils/mount.ecryptfs_private.c: return non-zero on unmount failure
216+ due to open sessions; handle this in ecryptfs-umount-private too; make
217+ the flock() blocking; use /dev/shm for counter; add an iterator to the
218+ counter file to prevent users from DoS'ing one another from accessing
219+ their encrypted directories, LP: #402745
220+ * debian/ecryptfs-utils.postinst: move /tmp counters to /dev/shm
221+ * configure.ac: link against pam, silence shlib warning
222+ * src/include/ecryptfs.h, src/libecryptfs/main.c,
223+ src/pam_ecryptfs/pam_ecryptfs.c, src/utils/Makefile.am,
224+ src/utils/mount.ecryptfs_private.c: move two functions from
225+ mount.ecryptfs_private to libecryptfs, namely is_mounted() and
226+ fetch_private_mnt(); use these in both pam_ecryptfs and
227+ mount.ecryptfs_private; also move PRIVATE to ECRYPTFS_PRIVATE in
228+ the ecryptfs.h headers; this will allow us to short-circuit some of the
229+ costly key-loading code on pam_auth if the private dir is already
230+ mounted, speeding up some subsequent authentications significantly,
231+ LP: #402748
232+ * doc/ecryptfs-mount-private.txt: removed the "$" to make copy-n-paste
233+ more user friendly
234+ * src/utils/ecryptfs-setup-private: when encrypting home, put the
235+ .ecryptfs and .Private data in /home/.ecryptfs rather than /var/lib,
236+ as users are forgetting to backup /var/lib, and are often putting
237+ /home on a separate partition; furthermore, this gives users a place
238+ to access their encrypted data for backup, rather than hiding the
239+ data below $HOME, LP: #371719
240+
241+ [ Tyler Hicks ]
242+ * src/libecryptfs/cipher_list.c, src/libecryptfs/module_mgr.c:
243+ add blowfish/56-bytes to the list of ciphers we officially support,
244+ LP: #402790
245+
246+ -- Dustin Kirkland <kirkland@ubuntu.com> Tue, 21 Jul 2009 23:57:33 -0500
247+
248+ecryptfs-utils (76) released; urgency=low
249+
250+ [ Dustin Kirkland ]
251+ * src/utils/ecryptfs-setup-swap: switch from vol_id to blkid,
252+ LP: #376486
253+ * debian/ecryptfs-utils.postinst, src/utils/ecryptfs-setup-private:
254+ don't echo mount passphrase if running in bootstrap mode; prune
255+ potential leakages from install log, LP: #383650
256+ * SECURITY UPDATE: mount passphrase recorded in install log (LP: #383650).
257+ - debian/ecryptfs-utils.postinst: prune private information from
258+ installer log
259+ - src/utils/ecryptfs-setup-private: don't echo passphrase if running in
260+ bootstrap mode
261+ - CVE-2009-1296
262+ * src/utils/ecryptfs-setup-private: make some of the lanuage more readable,
263+ (thanks, anrxc)
264+ * README, configure.ac, debian/control, debian/rules,
265+ doc/sourceforge_webpage/README, src/libecryptfs-swig/libecryptfs.py,
266+ src/libecryptfs-swig/libecryptfs_wrap.c,
267+ src/libecryptfs/key_management.c, src/libecryptfs/libecryptfs.pc.in,
268+ src/libecryptfs/main.c, src/pam_ecryptfs/Makefile.am,
269+ src/utils/manager.c, src/utils/mount.ecryptfs.c: move build from gcrypt
270+ to nss (this change has been pending for some time)
271+ * src/utils/ecryptfs-dot-private: dropped, was too hacky
272+ * ecryptfs-mount-private.1, ecryptfs-setup-private.1: align the
273+ documentation and implementation of the wrapping-independent feature,
274+ LP: #383746
275+ * src/utils/ecryptfs-umount-private: use keyctl list @u, since keyctl show
276+ stopped working, LP: #400484, #395082
277+ * src/utils/mount.ecryptfs_private.c: fix counter file locking; solves
278+ a longstanding bug about "random" umount caused by cronjobs, LP: #358573
279+
280+ [ Michal Hlavinka (edits by Dustin Kirkland) ]
281+ * doc/manpage/ecryptfs-mount-private.1,
282+ doc/manpage/ecryptfs-rewrite-file.1,
283+ doc/manpage/ecryptfs-setup-private.1, doc/manpage/ecryptfs.7,
284+ doc/manpage/mount.ecryptfs_private.1,
285+ doc/manpage/umount.ecryptfs_private.1: documentation updated to note
286+ possible ecryptfs group membership requirements; Fix ecrypfs.7 man
287+ page and key_mod_openssl's error message; fix typo
288+ * src/libecryptfs/decision_graph.c: put a finite limit (5 tries) on
289+ interactive input; fix memory leaks when asking questions
290+ * src/libecryptfs/module_mgr.c: Don't error out with EINVAL when
291+ verbosity=0 and some options are missing.
292+ * src/utils/umount.ecryptfs.c: no error for missing key when removing it
293+ * src/libecryptfs-swig/libecryptfs.i: fix compile werror, cast char*
294+ * src/utils/ecryptfs_add_passphrase.c: fix/test/use return codes;
295+ return nonzero for --fnek when not supported but used
296+ * src/include/ecryptfs.h, src/key_mod/ecryptfs_key_mod_openssl.c,
297+ src/libecryptfs/module_mgr.c: refuse mounting with too small rsa
298+ key (key_mod_openssl)
299+ * src/utils/ecryptfs_insert_wrapped_passphrase_into_keyring.c: fix return
300+ codes
301+ * src/utils/ecryptfs-rewrite-file: polish output
302+ * src/libecryptfs/key_management.c: inform about full keyring; insert fnek
303+ sig into keyring if fnek support check fails; don't fail if key already
304+ exists in keyring
305+ * src/utils/ecryptfs-setup-private: if the ecryptfs group exists, restrict
306+ ecryptfs-setup-private to members of this group
307+ * src/pam_ecryptfs/pam_ecryptfs.c: dynamically load ecryptfs module by
308+ checking ecryptfs version
309+ * src/libecryptfs/decision_graph.c, src/utils/io.c,
310+ src/utils/mount.ecryptfs.c: fix EOF handling, LP: #371587
311+ * src/desktop/Makefile.am: make desktop files trusted, LP: #371426
312+
313+ [ Dustin Kirkland and Daniel Baumann ]
314+ * debian/control, debian/copyright, debian/ecryptfs-utils.dirs,
315+ debian/ecryptfs-utils.install, debian/ecryptfs-utils.postinst,
316+ debian/rules, ecryptfs-utils.pam-auth-update: sync Ubuntu's
317+ packaging with Debian; drop dpatch, drop libssl build dep, clean
318+ up extraneous debhelper bits, match cflags; remaining diff is only
319+ ecryptfs-utils.prerm
320+
321+ [ Arfrever Frehtes Taifersar Arahesis ]
322+ * key_mod/ecryptfs_key_mod_gpg.c,
323+ key_mod/ecryptfs_key_mod_pkcs11_helper.c,
324+ libecryptfs/key_management.c, utils/ecryptfs_unwrap_passphrase.c:
325+ Fix warnings, initialize a few variables, drop unused ones
326+
327+ [ David Hicks ]
328+ * src/lib/key_management.c: fix stray semicolon that prevents .ecryptfsrc
329+ files from working properly, LP: #372709
330+
331+ [ Michael Rooney ]
332+ * src/python/ecryptfsapi.py: added python api
333+
334+ -- Dustin Kirkland <kirkland@ubuntu.com> Mon, 20 Jul 2009 12:12:30 -0500
335+
336+ecryptfs-utils (75) released; urgency=low
337+
338+ [ Dustin Kirkland ]
339+ * debian/rules: drop hackery that moves stuff /usr/share/ecryptfs-utils
340+ * src/utils/mount.ecryptfs_private.c: update inline documentation
341+ * debian/changelog, src/libecryptfs/cmd_ln_parser.c,
342+ src/libecryptfs/key_management.c, src/pam_ecryptfs/pam_ecryptfs.c,
343+ src/utils/ecryptfs_add_passphrase.c,
344+ src/utils/ecryptfs_insert_wrapped_passphrase_into_keyring.c,
345+ src/utils/ecryptfs_rewrap_passphrase.c,
346+ src/utils/ecryptfs_unwrap_passphrase.c,
347+ src/utils/ecryptfs_wrap_passphrase.c: silence some useless logging,
348+ LP: #313330
349+ * include/ecryptfs.h, libecryptfs/key_management.c,
350+ utils/ecryptfs_insert_wrapped_passphrase_into_keyring.c,
351+ utils/ecryptfs_unwrap_passphrase.c: if the file to unwrap is
352+ unspecified, try to use the default ~/.ecryptfs/wrapped-passphrase
353+ before bailing out, LP: #359997
354+ * src/utils/ecryptfs-setup-private: unix_chkpwd is not always present
355+ (eg, gentoo), LP: #332341
356+
357+ [ Tyler Hicks ]
358+ * doc/manpage/ecryptfs.7: ecryptfs_encrypted_view option desription
359+ was wrong LP: #328761
360+
361+ [ Michal Hlavinka ]
362+ * decision_graph.c: fix uninitialized return code
363+ * mount.ecryptfs.c: don't pass verbosity option to kernel
364+
365+ [ anrxc & Dustin Kirkland ]
366+ * doc/Makefile.am, src/desktop/Makefile.am: fix automake installation from
367+ /usr/share to /usr/share/ecryptfs-utils
368+
369+ [ Daniel Baumann & Dustin Kirkland ]
370+ * debian/rules, debian/control: sync differences between Debian & Ubuntu's
371+ packaging
372+
373+ [ Arfrever Frehtes Taifersar Arahesis ]
374+ * src/key_mod/ecryptfs_key_mod_gpg.c,
375+ src/key_mod/ecryptfs_key_mod_pkcs11_helper.c: fix implicit declations
376+
377+ [ Frédéric Guihéry ]
378+ * key_mod/ecryptfs_key_mod_tspi.c, utils/ecryptfs_generate_tpm_key.c:
379+ the SRK password should be set to 20 bytes of NULL (wellknown
380+ password), in order for different tools to request key protection
381+ with the Storage Root Key
382+
383+ -- Dustin Kirkland <kirkland@ubuntu.com> Fri, 01 May 2009 15:07:38 -0500
384+
385+ecryptfs-utils (74) released; urgency=low
386
387 [ Michal Hlavinka ]
388 * Changes for RH/Fedora release
389
390=== modified file 'debian/control'
391--- debian/control 2009-02-18 21:30:21 +0000
392+++ debian/control 2010-02-17 20:48:18 +0000
393@@ -1,19 +1,47 @@
394 Source: ecryptfs-utils
395 Section: misc
396 Priority: optional
397-Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss@lists.ubuntu.com>
398+Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
399 XSBC-Original-Maintainer: Daniel Baumann <daniel@debian.org>
400-Build-Depends: debhelper (>= 7), dpatch, autotools-dev, autoconf, automake, libtool, libgcrypt11-dev, libgpg-error-dev, libgpgme11-dev, libkeyutils-dev, libopencryptoki-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc], libpam0g-dev, libpkcs11-helper1-dev, libssl-dev, libtspi-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc], pkg-config, python-dev, swig
401-Standards-Version: 3.8.0
402+Build-Depends:
403+ debhelper (>= 7),
404+ autotools-dev,
405+ autoconf,
406+ automake,
407+ libtool,
408+ libgcrypt11-dev,
409+ libgpg-error-dev,
410+ libgpgme11-dev,
411+ libkeyutils-dev,
412+ libnss3-dev,
413+ libopencryptoki-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc],
414+ libpam0g-dev,
415+ libpkcs11-helper1-dev,
416+ libtspi-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc],
417+ pkg-config,
418+ python-dev,
419+ swig
420+Standards-Version: 3.8.3
421 Homepage: https://launchpad.net/ecryptfs
422-Vcs-Browser: http://git.debian.net/?p=debian/ecryptfs-utils.git
423-Vcs-Git: git://git.debian.net/git/debian/ecryptfs-utils.git
424+Vcs-Bzr: https://code.launchpad.net/~ecryptfs/ecryptfs/ecryptfs-utils
425+Vcs-Browser: http://bazaar.launchpad.net/~ecryptfs/ecryptfs/ecryptfs-utils/files
426
427 Package: ecryptfs-utils
428 Section: misc
429 Architecture: any
430-Depends: ${shlibs:Depends}, ${misc:Depends}, libpam-runtime (>= 1.0.1-2ubuntu1), keyutils, libnss3-1d
431-Suggests: opencryptoki, cryptsetup
432+Depends:
433+ ${misc:Depends},
434+ ${shlibs:Depends},
435+ keyutils,
436+ libnss3-1d,
437+ libpam-runtime (>= 1.0.1-6),
438+ gettext-base
439+Recommends:
440+ lsof,
441+ rsync
442+Suggests:
443+ cryptsetup,
444+ opencryptoki
445 Description: ecryptfs cryptographic filesystem (utilities)
446 eCryptfs is a POSIX-compliant enterprise-class stacked cryptographic filesystem
447 for Linux.
448@@ -33,7 +61,9 @@
449 Package: libecryptfs0
450 Section: libs
451 Architecture: any
452-Depends: ${shlibs:Depends}, ${misc:Depends}
453+Depends:
454+ ${misc:Depends},
455+ ${shlibs:Depends}
456 Description: ecryptfs cryptographic filesystem (library)
457 eCryptfs is a POSIX-compliant enterprise-class stacked cryptographic filesystem
458 for Linux.
459@@ -43,7 +73,17 @@
460 Package: libecryptfs-dev
461 Section: libdevel
462 Architecture: any
463-Depends: libecryptfs0 (= ${binary:Version}), libgcrypt11-dev, libgpg-error-dev, libgpgme11-dev, libkeyutils-dev, libopencryptoki-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc], libpam0g-dev, libpkcs11-helper1-dev, libtspi-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc]
464+Depends:
465+ ${misc:Depends},
466+ libecryptfs0 (= ${binary:Version}),
467+ libgcrypt11-dev,
468+ libgpg-error-dev,
469+ libgpgme11-dev,
470+ libkeyutils-dev,
471+ libopencryptoki-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc],
472+ libpam0g-dev,
473+ libpkcs11-helper1-dev,
474+ libtspi-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc]
475 Description: ecryptfs cryptographic filesystem (development)
476 eCryptfs is a POSIX-compliant enterprise-class stacked cryptographic filesystem
477 for Linux.
478
479=== modified file 'debian/copyright'
480--- debian/copyright 2009-02-13 15:57:24 +0000
481+++ debian/copyright 2010-02-17 20:48:18 +0000
482@@ -1,11 +1,16 @@
483 Authors:
484 Phillip Hellewell <hacker@byu.net>
485- Michael A. Halcrow <mhalcrow@us.ibm.com>
486- Dustin Kirkland <kirkland@ubuntu.com>
487-Download: https://launchpad.net/ecryptfs/trunk
488+ Michael A. Halcrow <mike@halcrow.us>
489+ Dustin Kirkland <kirkland@canonical.com>
490+ Tyler Hicks <tyhicks@linux.vnet.ibm.com>
491+
492+Upstream-Contact: Dustin Kirkland <kirkland@canonical.com>
493+Upstream-Homepage: https://launchpad.net/ecryptfs
494
495 Files: *
496-Copyright: 2004-2008 International Business Machines Corp.
497+Copyright:
498+ (C) 2004-2009 International Business Machines Corp.
499+ (C) 2008-2009 Canonical, Ltd.
500 License: GPL-2+
501 This program is free software; you can redistribute it and/or
502 modify it under the terms of the GNU General Public License
503@@ -46,7 +51,7 @@
504 can be found in /usr/share/common-licenses/GPL-2 file.
505
506 Files: debian/*
507-Copyright: (C) 2007-2008 Daniel Baumann <daniel@debian.org>
508+Copyright: (C) 2007-2009 Daniel Baumann <daniel@debian.org>
509 License: GPL-2+
510 This program is free software; you can redistribute it and/or
511 modify it under the terms of the GNU General Public License
512
513=== removed file 'debian/ecryptfs-utils.dirs'
514--- debian/ecryptfs-utils.dirs 2009-03-24 21:15:49 +0000
515+++ debian/ecryptfs-utils.dirs 1970-01-01 00:00:00 +0000
516@@ -1,2 +0,0 @@
517-usr/share/pam-configs
518-usr/share/ecryptfs-utils
519
520=== added file 'debian/ecryptfs-utils.ecryptfs-utils-restore.upstart'
521--- debian/ecryptfs-utils.ecryptfs-utils-restore.upstart 1970-01-01 00:00:00 +0000
522+++ debian/ecryptfs-utils.ecryptfs-utils-restore.upstart 2010-02-17 20:48:18 +0000
523@@ -0,0 +1,26 @@
524+# eCryptfs restore
525+description "eCryptfs"
526+author "Dustin Kirkland <kirkland@canonical.com>"
527+
528+start on runlevel [2345]
529+task
530+
531+# This task is necessary in support of ecryptfs-migrate-home.
532+#
533+# The administrator is strongly advised that the migrated user must
534+# log in before reboot in order for the migration to take effect, as
535+# the data in /dev/shm will be lost.
536+#
537+# The code below moves the /dev/shm data to /var/tmp to persist across
538+# boots and prevent users from locking themselves out of their system,
539+# however, it's slightly less secure, as these files should not be written
540+# to disk, if possible.
541+
542+script
543+ for i in /var/tmp/.ecryptfs-*; do
544+ u=$(echo "$i" | sed "s:^/var/tmp/.ecryptfs-::")
545+ if [ "$(stat -c %U $i)" = "$u" ]; then
546+ mv -n "$i" /dev/shm
547+ fi
548+ done
549+end script
550
551=== added file 'debian/ecryptfs-utils.ecryptfs-utils-save.upstart'
552--- debian/ecryptfs-utils.ecryptfs-utils-save.upstart 1970-01-01 00:00:00 +0000
553+++ debian/ecryptfs-utils.ecryptfs-utils-save.upstart 2010-02-17 20:48:18 +0000
554@@ -0,0 +1,26 @@
555+# eCryptfs save
556+description "eCryptfs"
557+author "Dustin Kirkland <kirkland@canonical.com>"
558+
559+start on runlevel [!2345]
560+task
561+
562+# This task is necessary in support of ecryptfs-migrate-home.
563+#
564+# The administrator is strongly advised that the migrated user must
565+# log in before reboot in order for the migration to take effect, as
566+# the data in /dev/shm will be lost.
567+#
568+# The code below moves the /dev/shm data to /var/tmp to persist across
569+# boots and prevent users from locking themselves out of their system,
570+# however, it's slightly less secure, as these files should not be written
571+# to disk, if possible.
572+
573+script
574+ for i in /dev/shm/.ecryptfs-*; do
575+ u=$(echo "$i" | sed "s:^/dev/shm/.ecryptfs-::")
576+ if [ "$(stat -c %U $i)" = "$u" ]; then
577+ mv -n "$i" /var/tmp
578+ fi
579+ done
580+end script
581
582=== modified file 'debian/ecryptfs-utils.install'
583--- debian/ecryptfs-utils.install 2009-02-13 15:57:24 +0000
584+++ debian/ecryptfs-utils.install 2010-02-17 20:48:18 +0000
585@@ -3,5 +3,6 @@
586 /usr/bin
587 /usr/lib/ecryptfs
588 /usr/share/doc
589+/usr/share/ecryptfs-utils
590 /usr/share/man
591-/usr/share/pam-configs/ecryptfs-utils
592+../../debian/lintian/ecryptfs-utils usr/share/lintian/overrides
593
594=== modified file 'debian/ecryptfs-utils.postinst'
595--- debian/ecryptfs-utils.postinst 2009-02-13 15:57:24 +0000
596+++ debian/ecryptfs-utils.postinst 2010-02-17 20:48:18 +0000
597@@ -1,44 +1,20 @@
598-#!/bin/sh -e
599-
600-auth=0c1295085dca124e6ba5a3cea7993c22
601-account=9f04221fe44762047894adeb96ffd069
602-session=2e9a42f2a3b6573891ff9e6bf0c31c9e
603-password=4cf59ec48caad2a06ea2e183d8bc007a
604-
605-force=
606-if dpkg --compare-versions "$2" lt-nl 53-1ubuntu6; then
607- # If we're upgrading from an older ecryptfs-utils,
608- # and the pam configuration precisely matches that
609- # which was written by auth-client-config, we can
610- # safely force the pam-auth-update.
611- force=--force
612- for type in auth account session password
613- do
614- sum="$(md5sum /etc/pam.d/common-$type 2>/dev/null | awk '{ print $1 }')"
615- [ "$sum" = "$(eval echo \$$type)" ] || force=
616- done
617-fi
618-pam-auth-update --package $force
619-
620-#DEBHELPER#
621-
622-exit 0
623 #!/bin/sh
624
625 set -e
626
627 case "${1}" in
628 configure)
629- # Basically, if a user chooses to encrypt their entire home
630- # directory, we're going to need someplace to put their
631- # ~/.ecryptfs directory that's available prior to mounting their
632- # home directory. Classic chicken/egg bootstrapping.
633-
634- if [ ! -d /var/lib/ecryptfs ]
635- then
636- mkdir -p /var/lib/ecryptfs
637- chmod 1777 /var/lib/ecryptfs
638- fi
639+ [ -e /var/log/installer/syslog ] && sed -i '/user-setup: YOU SHOULD RECORD THIS/,+2 d' /var/log/installer/syslog
640+ pam-auth-update --package
641+ # Try to migrate encrypted Private counters from /tmp to /dev/shm, if sane
642+ for i in $(ls /home); do
643+ if [ -f "/tmp/ecryptfs-$i-Private" ] && [ ! -e "/dev/shm/ecryptfs-$i-Private" ]; then
644+ o=$(stat -c %U "/tmp/ecryptfs-$i-Private")
645+ if [ $i = $o ]; then
646+ mv -f /tmp/ecryptfs-$i-Private /dev/shm
647+ fi
648+ fi
649+ done
650 ;;
651
652 abort-upgrade|abort-remove|abort-deconfigure)
653
654=== modified file 'debian/libecryptfs0.shlibs'
655--- debian/libecryptfs0.shlibs 2009-02-13 15:57:24 +0000
656+++ debian/libecryptfs0.shlibs 2010-02-17 20:48:18 +0000
657@@ -1,1 +1,1 @@
658-libecryptfs 0 libecryptfs0 (>= 48)
659+libecryptfs 0 libecryptfs0 (>= 77)
660
661=== added directory 'debian/lintian'
662=== renamed file 'debian/ecryptfs-utils.lintian-overides' => 'debian/lintian/ecryptfs-utils'
663--- debian/ecryptfs-utils.lintian-overides 2009-02-13 15:57:24 +0000
664+++ debian/lintian/ecryptfs-utils 2010-02-17 20:48:18 +0000
665@@ -1,1 +1,14 @@
666+# This setuid is required for encrypted-home and encrypted-private;
667+# Other distros or sysadmins could perhaps make it 4750, and create
668+# an ecryptfs group, adding permitted users to this group (though
669+# we're not doing this in Ubuntu).
670 ecryptfs-utils: setuid-binary sbin/mount.ecryptfs_private 4755 root/root
671+
672+# The *.desktop files need to be executable
673+ecryptfs-utils: executable-not-elf-or-script ./usr/share/ecryptfs-utils/ecryptfs-mount-private.desktop
674+ecryptfs-utils: executable-not-elf-or-script ./usr/share/ecryptfs-utils/ecryptfs-setup-private.desktop
675+ecryptfs-utils: executable-not-elf-or-script ./usr/share/ecryptfs-utils/ecryptfs-record-passphrase
676+
677+# We're not creating these files, but rather moving them, and the utilities
678+# that use them provide the necessary owernship checks
679+ecryptfs-utils: possibly-insecure-handling-of-tmp-files-in-maintainer-script postinst:9
680
681=== added directory 'debian/local'
682=== renamed file 'debian/ecryptfs-utils.pam-auth-update' => 'debian/local/ecryptfs-utils.pam-auth-update'
683--- debian/ecryptfs-utils.pam-auth-update 2009-02-13 15:57:24 +0000
684+++ debian/local/ecryptfs-utils.pam-auth-update 2010-02-17 20:48:18 +0000
685@@ -3,10 +3,10 @@
686 Priority: 0
687 Auth-Type: Additional
688 Auth-Final:
689- optional pam_ecryptfs.so unwrap
690+ optional pam_ecryptfs.so unwrap
691 Session-Type: Additional
692 Session-Final:
693- optional pam_ecryptfs.so unwrap
694+ optional pam_ecryptfs.so unwrap
695 Password-Type: Additional
696 Password-Final:
697- optional pam_ecryptfs.so
698+ optional pam_ecryptfs.so
699
700=== added directory 'debian/po'
701=== added file 'debian/po/POTFILES.sh'
702--- debian/po/POTFILES.sh 1970-01-01 00:00:00 +0000
703+++ debian/po/POTFILES.sh 2010-02-17 20:48:18 +0000
704@@ -0,0 +1,5 @@
705+src/utils/ecryptfs-mount-private
706+src/utils/ecryptfs-rewrite-file
707+src/utils/ecryptfs-setup-private
708+src/utils/ecryptfs-setup-swap
709+src/utils/ecryptfs-umount-private
710
711=== added file 'debian/po/ecryptfs-utils.pot'
712--- debian/po/ecryptfs-utils.pot 1970-01-01 00:00:00 +0000
713+++ debian/po/ecryptfs-utils.pot 2010-02-17 20:48:18 +0000
714@@ -0,0 +1,407 @@
715+# SOME DESCRIPTIVE TITLE.
716+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
717+# This file is distributed under the same license as the PACKAGE package.
718+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
719+#
720+#, fuzzy
721+msgid ""
722+msgstr ""
723+"Project-Id-Version: PACKAGE VERSION\n"
724+"Report-Msgid-Bugs-To: \n"
725+"POT-Creation-Date: 2009-07-23 18:15-0500\n"
726+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
727+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
728+"Language-Team: LANGUAGE <LL@li.org>\n"
729+"MIME-Version: 1.0\n"
730+"Content-Type: text/plain; charset=CHARSET\n"
731+"Content-Transfer-Encoding: 8bit\n"
732+
733+#: src/utils/ecryptfs-mount-private:19
734+msgid "Enter your login passphrase:"
735+msgstr ""
736+
737+#: src/utils/ecryptfs-mount-private:24
738+msgid "Enter your wrapping passphrase:"
739+msgstr ""
740+
741+#: src/utils/ecryptfs-mount-private:49 src/utils/ecryptfs-mount-private:55
742+#: src/utils/ecryptfs-mount-private:60 src/utils/ecryptfs-rewrite-file:24
743+#: src/utils/ecryptfs-setup-private:84 src/utils/ecryptfs-setup-private:264
744+#: src/utils/ecryptfs-setup-private:272 src/utils/ecryptfs-setup-private:282
745+#: src/utils/ecryptfs-setup-private:313 src/utils/ecryptfs-setup-swap:25
746+msgid "ERROR:"
747+msgstr ""
748+
749+#: src/utils/ecryptfs-mount-private:49
750+msgid "Your passphrase is incorrect"
751+msgstr ""
752+
753+#: src/utils/ecryptfs-mount-private:55 src/utils/ecryptfs-setup-private:289
754+msgid "Too many incorrect password attempts, exiting"
755+msgstr ""
756+
757+#: src/utils/ecryptfs-mount-private:60
758+msgid "Encrypted private directory is not setup properly"
759+msgstr ""
760+
761+#: src/utils/ecryptfs-mount-private:65 src/utils/ecryptfs-mount-private:66
762+#: src/utils/ecryptfs-rewrite-file:30 src/utils/ecryptfs-setup-private:276
763+#: src/utils/ecryptfs-setup-private:344 src/utils/ecryptfs-setup-private:349
764+#: src/utils/ecryptfs-setup-swap:30 src/utils/ecryptfs-umount-private:21
765+#: src/utils/ecryptfs-umount-private:22
766+msgid "INFO:"
767+msgstr ""
768+
769+#: src/utils/ecryptfs-mount-private:65
770+msgid "Your private directory has been mounted."
771+msgstr ""
772+
773+#: src/utils/ecryptfs-mount-private:66 src/utils/ecryptfs-umount-private:22
774+msgid "To see this change in your current shell:"
775+msgstr ""
776+
777+#: src/utils/ecryptfs-rewrite-file:23
778+msgid "[FAILED]"
779+msgstr ""
780+
781+#: src/utils/ecryptfs-rewrite-file:30
782+msgid "Rewriting"
783+msgstr ""
784+
785+#: src/utils/ecryptfs-rewrite-file:32
786+msgid "File does not exist"
787+msgstr ""
788+
789+#: src/utils/ecryptfs-rewrite-file:36
790+msgid "[EXCLUDED]"
791+msgstr ""
792+
793+#: src/utils/ecryptfs-rewrite-file:43
794+msgid "Could not create tempdir"
795+msgstr ""
796+
797+#: src/utils/ecryptfs-rewrite-file:47 src/utils/ecryptfs-rewrite-file:52
798+#: src/utils/ecryptfs-rewrite-file:66
799+msgid "Could not rename"
800+msgstr ""
801+
802+#: src/utils/ecryptfs-rewrite-file:57
803+msgid "Could not create tempfile"
804+msgstr ""
805+
806+#: src/utils/ecryptfs-rewrite-file:61
807+msgid "Could not copy"
808+msgstr ""
809+
810+#: src/utils/ecryptfs-rewrite-file:70
811+msgid "[OK]"
812+msgstr ""
813+
814+#: src/utils/ecryptfs-rewrite-file:73
815+msgid "rewrites succeeded"
816+msgstr ""
817+
818+#: src/utils/ecryptfs-setup-private:14
819+msgid "Enter your login passphrase"
820+msgstr ""
821+
822+#: src/utils/ecryptfs-setup-private:104
823+msgid "Can't get ecryptfs version, ecryptfs kernel module not loaded?"
824+msgstr ""
825+
826+#: src/utils/ecryptfs-setup-private:131
827+msgid "Enter your wrapping passphrase"
828+msgstr ""
829+
830+#: src/utils/ecryptfs-setup-private:155
831+msgid "You must be root to bootstrap encrypt a home directory"
832+msgstr ""
833+
834+#: src/utils/ecryptfs-setup-private:178 src/utils/ecryptfs-setup-private:183
835+msgid "ERROR: "
836+msgstr ""
837+
838+#: src/utils/ecryptfs-setup-private:178
839+msgid "You must provide a username"
840+msgstr ""
841+
842+#: src/utils/ecryptfs-setup-private:183 src/utils/ecryptfs-setup-private:191
843+msgid "User does not exist"
844+msgstr ""
845+
846+#: src/utils/ecryptfs-setup-private:197
847+msgid "User needs to be a member of ecryptfs group"
848+msgstr ""
849+
850+#: src/utils/ecryptfs-setup-private:204
851+msgid "User home directory does not exist"
852+msgstr ""
853+
854+#: src/utils/ecryptfs-setup-private:223
855+msgid "wrapped-passphrase file already exists, use --force to overwrite."
856+msgstr ""
857+
858+#: src/utils/ecryptfs-setup-private:226
859+msgid "file already exists, use --force to overwrite."
860+msgstr ""
861+
862+#: src/utils/ecryptfs-setup-private:230 src/utils/ecryptfs-setup-private:231
863+msgid "is already mounted"
864+msgstr ""
865+
866+#: src/utils/ecryptfs-setup-private:238 src/utils/ecryptfs-setup-private:242
867+msgid "must be empty before proceeding"
868+msgstr ""
869+
870+#: src/utils/ecryptfs-setup-private:264
871+msgid "Wrapping passphrases must match"
872+msgstr ""
873+
874+#: src/utils/ecryptfs-setup-private:272
875+msgid "You must provide a login passphrase"
876+msgstr ""
877+
878+#: src/utils/ecryptfs-setup-private:276
879+msgid "Skipping password verification"
880+msgstr ""
881+
882+#: src/utils/ecryptfs-setup-private:298
883+msgid "Enter your mount passphrase [leave blank to generate one]: "
884+msgstr ""
885+
886+#: src/utils/ecryptfs-setup-private:308
887+msgid "Enter your mount passphrase (again): "
888+msgstr ""
889+
890+#: src/utils/ecryptfs-setup-private:313
891+msgid "Mount passphrases do not match"
892+msgstr ""
893+
894+#: src/utils/ecryptfs-setup-private:321
895+msgid "Too many incorrect passphrase attempts, exiting"
896+msgstr ""
897+
898+#: src/utils/ecryptfs-setup-private:327
899+msgid ""
900+"YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION."
901+msgstr ""
902+
903+#: src/utils/ecryptfs-setup-private:329
904+msgid "THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME."
905+msgstr ""
906+
907+#: src/utils/ecryptfs-setup-private:336
908+msgid "Could not create crypt directory"
909+msgstr ""
910+
911+#: src/utils/ecryptfs-setup-private:337
912+msgid "Could not create mount directory"
913+msgstr ""
914+
915+#: src/utils/ecryptfs-setup-private:344
916+msgid "will not be mounted on login"
917+msgstr ""
918+
919+#: src/utils/ecryptfs-setup-private:346
920+msgid "Could not setup ecryptfs auto-mount"
921+msgstr ""
922+
923+#: src/utils/ecryptfs-setup-private:349
924+msgid "will not be unmounted on logout"
925+msgstr ""
926+
927+#: src/utils/ecryptfs-setup-private:351
928+msgid "Could not setup ecryptfs auto-umount"
929+msgstr ""
930+
931+#: src/utils/ecryptfs-setup-private:355
932+msgid "Could not remove ecryptfs wrapping-independent"
933+msgstr ""
934+
935+#: src/utils/ecryptfs-setup-private:357
936+msgid "Could not setup ecryptfs wrapping-independent"
937+msgstr ""
938+
939+#: src/utils/ecryptfs-setup-private:365
940+msgid "Could not backup existing data"
941+msgstr ""
942+
943+#: src/utils/ecryptfs-setup-private:381
944+msgid "Could not wrap passphrase"
945+msgstr ""
946+
947+#: src/utils/ecryptfs-setup-private:389
948+msgid "Could not add passphrase to the current keyring"
949+msgstr ""
950+
951+#: src/utils/ecryptfs-setup-private:393
952+msgid "Could not obtain the key signature"
953+msgstr ""
954+
955+#: src/utils/ecryptfs-setup-private:396
956+msgid "Could not create signature file"
957+msgstr ""
958+
959+#: src/utils/ecryptfs-setup-private:399
960+msgid "Could not create mountpoint file"
961+msgstr ""
962+
963+#: src/utils/ecryptfs-setup-private:403
964+msgid "Done configuring."
965+msgstr ""
966+
967+#: src/utils/ecryptfs-setup-private:433
968+msgid "Testing mount/write/umount/read..."
969+msgstr ""
970+
971+#: src/utils/ecryptfs-setup-private:434
972+msgid "Could not mount private ecryptfs directory"
973+msgstr ""
974+
975+#: src/utils/ecryptfs-setup-private:435
976+msgid "Could not create empty file"
977+msgstr ""
978+
979+#: src/utils/ecryptfs-setup-private:436
980+msgid "Could not generate random data"
981+msgstr ""
982+
983+#: src/utils/ecryptfs-setup-private:437
984+msgid "Could not write encrypted file"
985+msgstr ""
986+
987+#: src/utils/ecryptfs-setup-private:438
988+msgid "Could not read encrypted file"
989+msgstr ""
990+
991+#: src/utils/ecryptfs-setup-private:439
992+msgid "Could not unmount private ecryptfs directory"
993+msgstr ""
994+
995+#: src/utils/ecryptfs-setup-private:440
996+msgid "Could not mount private ecryptfs directory (2)"
997+msgstr ""
998+
999+#: src/utils/ecryptfs-setup-private:441
1000+msgid "Could not read encrypted file (2)"
1001+msgstr ""
1002+
1003+#: src/utils/ecryptfs-setup-private:445
1004+msgid "Could not unmount private ecryptfs directory (2)"
1005+msgstr ""
1006+
1007+#: src/utils/ecryptfs-setup-private:447
1008+msgid "Testing failed."
1009+msgstr ""
1010+
1011+#: src/utils/ecryptfs-setup-private:449
1012+msgid "Testing succeeded."
1013+msgstr ""
1014+
1015+#: src/utils/ecryptfs-setup-private:453
1016+msgid "Logout, and log back in to begin using your encrypted directory."
1017+msgstr ""
1018+
1019+#: src/utils/ecryptfs-setup-swap:34
1020+msgid "WARNING:"
1021+msgstr ""
1022+
1023+#: src/utils/ecryptfs-setup-swap:39
1024+msgid "Usage:"
1025+msgstr ""
1026+
1027+#: src/utils/ecryptfs-setup-swap:60
1028+msgid "Please install"
1029+msgstr ""
1030+
1031+#: src/utils/ecryptfs-setup-swap:63
1032+msgid "This program must be run with 'sudo', or as root"
1033+msgstr ""
1034+
1035+#: src/utils/ecryptfs-setup-swap:70
1036+msgid "You do not currently have any swap space defined."
1037+msgstr ""
1038+
1039+#: src/utils/ecryptfs-setup-swap:72
1040+msgid "You can create a swap file by doing:"
1041+msgstr ""
1042+
1043+#: src/utils/ecryptfs-setup-swap:77
1044+msgid "And then re-run"
1045+msgstr ""
1046+
1047+#: src/utils/ecryptfs-setup-swap:81
1048+msgid "You have more than one swap space defined."
1049+msgstr ""
1050+
1051+#: src/utils/ecryptfs-setup-swap:82
1052+msgid "only supports setting up a single swap space"
1053+msgstr ""
1054+
1055+#: src/utils/ecryptfs-setup-swap:89
1056+msgid "does not appear to be swap space"
1057+msgstr ""
1058+
1059+#: src/utils/ecryptfs-setup-swap:94
1060+msgid "already appears to be encrypted."
1061+msgstr ""
1062+
1063+#: src/utils/ecryptfs-setup-swap:103
1064+msgid "already has an entry in /etc/crypttab."
1065+msgstr ""
1066+
1067+#: src/utils/ecryptfs-setup-swap:107
1068+msgid "already has an entry in /etc/fstab."
1069+msgstr ""
1070+
1071+#: src/utils/ecryptfs-setup-swap:113
1072+msgid "There appears to be a cryptswap entry in /etc/cryptab; aborting."
1073+msgstr ""
1074+
1075+#: src/utils/ecryptfs-setup-swap:118
1076+msgid "There appears to be a cryptswap entry in /etc/fstab; aborting."
1077+msgstr ""
1078+
1079+#: src/utils/ecryptfs-setup-swap:124
1080+msgid "Commented out your unencrypted swap from /etc/fstab"
1081+msgstr ""
1082+
1083+#: src/utils/ecryptfs-setup-swap:126
1084+msgid "Your swap space isn't currently listed in /etc/fstab"
1085+msgstr ""
1086+
1087+#: src/utils/ecryptfs-setup-swap:134
1088+msgid ""
1089+"An encrypted swap is required to help ensure that encrypted files are not "
1090+"leaked to disk in an unencrypted format."
1091+msgstr ""
1092+
1093+#: src/utils/ecryptfs-setup-swap:136
1094+msgid ""
1095+"HOWEVER, THE SWAP ENCRYPTION CONFIGURATION PRODUCED BY THIS PROGRAM WILL "
1096+"BREAK HIBERNATE/RESUME ON THIS SYSTEM!"
1097+msgstr ""
1098+
1099+#: src/utils/ecryptfs-setup-swap:138
1100+msgid "NOTE: Your suspend/resume capabilities will not be affected."
1101+msgstr ""
1102+
1103+#: src/utils/ecryptfs-setup-swap:140
1104+msgid "Do you want to proceed with encrypting your swap?"
1105+msgstr ""
1106+
1107+#: src/utils/ecryptfs-setup-swap:145
1108+msgid "Aborting."
1109+msgstr ""
1110+
1111+#: src/utils/ecryptfs-setup-swap:153
1112+msgid "Setting up swap:"
1113+msgstr ""
1114+
1115+#: src/utils/ecryptfs-setup-swap:170
1116+msgid "Successfully setup encrypted swap!"
1117+msgstr ""
1118+
1119+#: src/utils/ecryptfs-umount-private:21
1120+msgid "Your private directory has been unmounted."
1121+msgstr ""
1122
1123=== added file 'debian/po/fr.po'
1124--- debian/po/fr.po 1970-01-01 00:00:00 +0000
1125+++ debian/po/fr.po 2010-02-17 20:48:18 +0000
1126@@ -0,0 +1,389 @@
1127+#: src/utils/ecryptfs-mount-private:19
1128+msgid "Enter your login passphrase:"
1129+msgstr ""
1130+
1131+#: src/utils/ecryptfs-mount-private:24
1132+msgid "Enter your wrapping passphrase:"
1133+msgstr ""
1134+
1135+#: src/utils/ecryptfs-mount-private:49 src/utils/ecryptfs-mount-private:55
1136+#: src/utils/ecryptfs-mount-private:60 src/utils/ecryptfs-rewrite-file:24
1137+#: src/utils/ecryptfs-setup-private:84 src/utils/ecryptfs-setup-private:264
1138+#: src/utils/ecryptfs-setup-private:272 src/utils/ecryptfs-setup-private:282
1139+#: src/utils/ecryptfs-setup-private:313 src/utils/ecryptfs-setup-swap:25
1140+msgid "ERROR:"
1141+msgstr ""
1142+
1143+#: src/utils/ecryptfs-mount-private:49
1144+msgid "Your passphrase is incorrect"
1145+msgstr ""
1146+
1147+#: src/utils/ecryptfs-mount-private:55 src/utils/ecryptfs-setup-private:289
1148+msgid "Too many incorrect password attempts, exiting"
1149+msgstr ""
1150+
1151+#: src/utils/ecryptfs-mount-private:60
1152+msgid "Encrypted private directory is not setup properly"
1153+msgstr ""
1154+
1155+#: src/utils/ecryptfs-mount-private:65 src/utils/ecryptfs-mount-private:66
1156+#: src/utils/ecryptfs-rewrite-file:30 src/utils/ecryptfs-setup-private:276
1157+#: src/utils/ecryptfs-setup-private:344 src/utils/ecryptfs-setup-private:349
1158+#: src/utils/ecryptfs-setup-swap:30 src/utils/ecryptfs-umount-private:21
1159+#: src/utils/ecryptfs-umount-private:22
1160+msgid "INFO:"
1161+msgstr ""
1162+
1163+#: src/utils/ecryptfs-mount-private:65
1164+msgid "Your private directory has been mounted."
1165+msgstr ""
1166+
1167+#: src/utils/ecryptfs-mount-private:66 src/utils/ecryptfs-umount-private:22
1168+msgid "To see this change in your current shell:"
1169+msgstr ""
1170+
1171+#: src/utils/ecryptfs-rewrite-file:23
1172+msgid "[FAILED]"
1173+msgstr ""
1174+
1175+#: src/utils/ecryptfs-rewrite-file:30
1176+msgid "Rewriting"
1177+msgstr ""
1178+
1179+#: src/utils/ecryptfs-rewrite-file:32
1180+msgid "File does not exist"
1181+msgstr ""
1182+
1183+#: src/utils/ecryptfs-rewrite-file:36
1184+msgid "[EXCLUDED]"
1185+msgstr ""
1186+
1187+#: src/utils/ecryptfs-rewrite-file:43
1188+msgid "Could not create tempdir"
1189+msgstr ""
1190+
1191+#: src/utils/ecryptfs-rewrite-file:47 src/utils/ecryptfs-rewrite-file:52
1192+#: src/utils/ecryptfs-rewrite-file:66
1193+msgid "Could not rename"
1194+msgstr ""
1195+
1196+#: src/utils/ecryptfs-rewrite-file:57
1197+msgid "Could not create tempfile"
1198+msgstr ""
1199+
1200+#: src/utils/ecryptfs-rewrite-file:61
1201+msgid "Could not copy"
1202+msgstr ""
1203+
1204+#: src/utils/ecryptfs-rewrite-file:70
1205+msgid "[OK]"
1206+msgstr ""
1207+
1208+#: src/utils/ecryptfs-rewrite-file:73
1209+msgid "rewrites succeeded"
1210+msgstr ""
1211+
1212+#: src/utils/ecryptfs-setup-private:14
1213+msgid "Enter your login passphrase"
1214+msgstr ""
1215+
1216+#: src/utils/ecryptfs-setup-private:104
1217+msgid "Can't get ecryptfs version, ecryptfs kernel module not loaded?"
1218+msgstr ""
1219+
1220+#: src/utils/ecryptfs-setup-private:131
1221+msgid "Enter your wrapping passphrase"
1222+msgstr ""
1223+
1224+#: src/utils/ecryptfs-setup-private:155
1225+msgid "You must be root to bootstrap encrypt a home directory"
1226+msgstr ""
1227+
1228+#: src/utils/ecryptfs-setup-private:178 src/utils/ecryptfs-setup-private:183
1229+msgid "ERROR: "
1230+msgstr ""
1231+
1232+#: src/utils/ecryptfs-setup-private:178
1233+msgid "You must provide a username"
1234+msgstr ""
1235+
1236+#: src/utils/ecryptfs-setup-private:183 src/utils/ecryptfs-setup-private:191
1237+msgid "User does not exist"
1238+msgstr ""
1239+
1240+#: src/utils/ecryptfs-setup-private:197
1241+msgid "User needs to be a member of ecryptfs group"
1242+msgstr ""
1243+
1244+#: src/utils/ecryptfs-setup-private:204
1245+msgid "User home directory does not exist"
1246+msgstr ""
1247+
1248+#: src/utils/ecryptfs-setup-private:223
1249+msgid "wrapped-passphrase file already exists, use --force to overwrite."
1250+msgstr ""
1251+
1252+#: src/utils/ecryptfs-setup-private:226
1253+msgid "file already exists, use --force to overwrite."
1254+msgstr ""
1255+
1256+#: src/utils/ecryptfs-setup-private:230 src/utils/ecryptfs-setup-private:231
1257+msgid "is already mounted"
1258+msgstr ""
1259+
1260+#: src/utils/ecryptfs-setup-private:238 src/utils/ecryptfs-setup-private:242
1261+msgid "must be empty before proceeding"
1262+msgstr ""
1263+
1264+#: src/utils/ecryptfs-setup-private:264
1265+msgid "Wrapping passphrases must match"
1266+msgstr ""
1267+
1268+#: src/utils/ecryptfs-setup-private:272
1269+msgid "You must provide a login passphrase"
1270+msgstr ""
1271+
1272+#: src/utils/ecryptfs-setup-private:276
1273+msgid "Skipping password verification"
1274+msgstr ""
1275+
1276+#: src/utils/ecryptfs-setup-private:298
1277+msgid "Enter your mount passphrase [leave blank to generate one]: "
1278+msgstr ""
1279+
1280+#: src/utils/ecryptfs-setup-private:308
1281+msgid "Enter your mount passphrase (again): "
1282+msgstr ""
1283+
1284+#: src/utils/ecryptfs-setup-private:313
1285+msgid "Mount passphrases do not match"
1286+msgstr ""
1287+
1288+#: src/utils/ecryptfs-setup-private:321
1289+msgid "Too many incorrect passphrase attempts, exiting"
1290+msgstr ""
1291+
1292+#: src/utils/ecryptfs-setup-private:327
1293+msgid ""
1294+"YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION."
1295+msgstr ""
1296+
1297+#: src/utils/ecryptfs-setup-private:329
1298+msgid "THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME."
1299+msgstr ""
1300+
1301+#: src/utils/ecryptfs-setup-private:336
1302+msgid "Could not create crypt directory"
1303+msgstr ""
1304+
1305+#: src/utils/ecryptfs-setup-private:337
1306+msgid "Could not create mount directory"
1307+msgstr ""
1308+
1309+#: src/utils/ecryptfs-setup-private:344
1310+msgid "will not be mounted on login"
1311+msgstr ""
1312+
1313+#: src/utils/ecryptfs-setup-private:346
1314+msgid "Could not setup ecryptfs auto-mount"
1315+msgstr ""
1316+
1317+#: src/utils/ecryptfs-setup-private:349
1318+msgid "will not be unmounted on logout"
1319+msgstr ""
1320+
1321+#: src/utils/ecryptfs-setup-private:351
1322+msgid "Could not setup ecryptfs auto-umount"
1323+msgstr ""
1324+
1325+#: src/utils/ecryptfs-setup-private:355
1326+msgid "Could not remove ecryptfs wrapping-independent"
1327+msgstr ""
1328+
1329+#: src/utils/ecryptfs-setup-private:357
1330+msgid "Could not setup ecryptfs wrapping-independent"
1331+msgstr ""
1332+
1333+#: src/utils/ecryptfs-setup-private:365
1334+msgid "Could not backup existing data"
1335+msgstr ""
1336+
1337+#: src/utils/ecryptfs-setup-private:381
1338+msgid "Could not wrap passphrase"
1339+msgstr ""
1340+
1341+#: src/utils/ecryptfs-setup-private:389
1342+msgid "Could not add passphrase to the current keyring"
1343+msgstr ""
1344+
1345+#: src/utils/ecryptfs-setup-private:393
1346+msgid "Could not obtain the key signature"
1347+msgstr ""
1348+
1349+#: src/utils/ecryptfs-setup-private:396
1350+msgid "Could not create signature file"
1351+msgstr ""
1352+
1353+#: src/utils/ecryptfs-setup-private:399
1354+msgid "Could not create mountpoint file"
1355+msgstr ""
1356+
1357+#: src/utils/ecryptfs-setup-private:403
1358+msgid "Done configuring."
1359+msgstr ""
1360+
1361+#: src/utils/ecryptfs-setup-private:433
1362+msgid "Testing mount/write/umount/read..."
1363+msgstr ""
1364+
1365+#: src/utils/ecryptfs-setup-private:434
1366+msgid "Could not mount private ecryptfs directory"
1367+msgstr ""
1368+
1369+#: src/utils/ecryptfs-setup-private:435
1370+msgid "Could not create empty file"
1371+msgstr ""
1372+
1373+#: src/utils/ecryptfs-setup-private:436
1374+msgid "Could not generate random data"
1375+msgstr ""
1376+
1377+#: src/utils/ecryptfs-setup-private:437
1378+msgid "Could not write encrypted file"
1379+msgstr ""
1380+
1381+#: src/utils/ecryptfs-setup-private:438
1382+msgid "Could not read encrypted file"
1383+msgstr ""
1384+
1385+#: src/utils/ecryptfs-setup-private:439
1386+msgid "Could not unmount private ecryptfs directory"
1387+msgstr ""
1388+
1389+#: src/utils/ecryptfs-setup-private:440
1390+msgid "Could not mount private ecryptfs directory (2)"
1391+msgstr ""
1392+
1393+#: src/utils/ecryptfs-setup-private:441
1394+msgid "Could not read encrypted file (2)"
1395+msgstr ""
1396+
1397+#: src/utils/ecryptfs-setup-private:445
1398+msgid "Could not unmount private ecryptfs directory (2)"
1399+msgstr ""
1400+
1401+#: src/utils/ecryptfs-setup-private:447
1402+msgid "Testing failed."
1403+msgstr ""
1404+
1405+#: src/utils/ecryptfs-setup-private:449
1406+msgid "Testing succeeded."
1407+msgstr ""
1408+
1409+#: src/utils/ecryptfs-setup-private:453
1410+msgid "Logout, and log back in to begin using your encrypted directory."
1411+msgstr ""
1412+
1413+#: src/utils/ecryptfs-setup-swap:34
1414+msgid "WARNING:"
1415+msgstr ""
1416+
1417+#: src/utils/ecryptfs-setup-swap:39
1418+msgid "Usage:"
1419+msgstr ""
1420+
1421+#: src/utils/ecryptfs-setup-swap:60
1422+msgid "Please install"
1423+msgstr ""
1424+
1425+#: src/utils/ecryptfs-setup-swap:63
1426+msgid "This program must be run with 'sudo', or as root"
1427+msgstr ""
1428+
1429+#: src/utils/ecryptfs-setup-swap:70
1430+msgid "You do not currently have any swap space defined."
1431+msgstr ""
1432+
1433+#: src/utils/ecryptfs-setup-swap:72
1434+msgid "You can create a swap file by doing:"
1435+msgstr ""
1436+
1437+#: src/utils/ecryptfs-setup-swap:77
1438+msgid "And then re-run"
1439+msgstr ""
1440+
1441+#: src/utils/ecryptfs-setup-swap:81
1442+msgid "You have more than one swap space defined."
1443+msgstr ""
1444+
1445+#: src/utils/ecryptfs-setup-swap:82
1446+msgid "only supports setting up a single swap space"
1447+msgstr ""
1448+
1449+#: src/utils/ecryptfs-setup-swap:89
1450+msgid "does not appear to be swap space"
1451+msgstr ""
1452+
1453+#: src/utils/ecryptfs-setup-swap:94
1454+msgid "already appears to be encrypted."
1455+msgstr ""
1456+
1457+#: src/utils/ecryptfs-setup-swap:103
1458+msgid "already has an entry in /etc/crypttab."
1459+msgstr ""
1460+
1461+#: src/utils/ecryptfs-setup-swap:107
1462+msgid "already has an entry in /etc/fstab."
1463+msgstr ""
1464+
1465+#: src/utils/ecryptfs-setup-swap:113
1466+msgid "There appears to be a cryptswap entry in /etc/cryptab; aborting."
1467+msgstr ""
1468+
1469+#: src/utils/ecryptfs-setup-swap:118
1470+msgid "There appears to be a cryptswap entry in /etc/fstab; aborting."
1471+msgstr ""
1472+
1473+#: src/utils/ecryptfs-setup-swap:124
1474+msgid "Commented out your unencrypted swap from /etc/fstab"
1475+msgstr ""
1476+
1477+#: src/utils/ecryptfs-setup-swap:126
1478+msgid "Your swap space isn't currently listed in /etc/fstab"
1479+msgstr ""
1480+
1481+#: src/utils/ecryptfs-setup-swap:134
1482+msgid ""
1483+"An encrypted swap is required to help ensure that encrypted files are not "
1484+"leaked to disk in an unencrypted format."
1485+msgstr ""
1486+
1487+#: src/utils/ecryptfs-setup-swap:136
1488+msgid ""
1489+"HOWEVER, THE SWAP ENCRYPTION CONFIGURATION PRODUCED BY THIS PROGRAM WILL "
1490+"BREAK HIBERNATE/RESUME ON THIS SYSTEM!"
1491+msgstr ""
1492+
1493+#: src/utils/ecryptfs-setup-swap:138
1494+msgid "NOTE: Your suspend/resume capabilities will not be affected."
1495+msgstr ""
1496+
1497+#: src/utils/ecryptfs-setup-swap:140
1498+msgid "Do you want to proceed with encrypting your swap?"
1499+msgstr ""
1500+
1501+#: src/utils/ecryptfs-setup-swap:145
1502+msgid "Aborting."
1503+msgstr ""
1504+
1505+#: src/utils/ecryptfs-setup-swap:153
1506+msgid "Setting up swap:"
1507+msgstr ""
1508+
1509+#: src/utils/ecryptfs-setup-swap:170
1510+msgid "Successfully setup encrypted swap!"
1511+msgstr ""
1512+
1513+#: src/utils/ecryptfs-umount-private:21
1514+msgid "Your private directory has been unmounted."
1515+msgstr ""
1516
1517=== modified file 'debian/rules'
1518--- debian/rules 2009-04-22 00:07:59 +0000
1519+++ debian/rules 2010-02-17 20:48:18 +0000
1520@@ -1,43 +1,63 @@
1521 #!/usr/bin/make -f
1522
1523-include /usr/share/dpatch/dpatch.make
1524+PKG=ecryptfs-utils
1525+PO_DIR=debian/po
1526
1527-DEB_BUILD_ARCH ?= $(shell dpkg-architecture -qDEB_BUILD_ARCH)
1528 DEB_HOST_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
1529 DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
1530
1531-CFLAGS = -Wall -g
1532-
1533-ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
1534- CFLAGS += -O0
1535+ifneq ($(DEB_HOST_GNU_TYPE),$(DEB_BUILD_GNU_TYPE))
1536+ CROSS=CC=$(DEB_HOST_GNU_TYPE)-gcc
1537 else
1538- CFLAGS += -O2
1539+ CROSS=
1540 endif
1541
1542+DEB_BUILD_ARCH ?= $(shell dpkg-architecture -qDEB_BUILD_ARCH)
1543+
1544 ifneq ($(DEB_BUILD_ARCH),s390)
1545 TPMFLAGS = --enable-opencryptoki
1546 endif
1547
1548-clean: unpatch
1549+install-po: update-pot
1550+ for po in ${PO_DIR}/*.po ; do \
1551+ lang=$${po#po/}; lang=$${lang%.po}; \
1552+ mkdir -p ${PO_DIR}/locale/$${lang}/LC_MESSAGES/; \
1553+ msgfmt $${po} -o ${PO_DIR}/locale/$${lang}/LC_MESSAGES/${PKG}.mo ; \
1554+ done
1555+
1556+update-pot:
1557+ rm -f ${PO_DIR}/${PKG}.pot
1558+ xgettext -o ${PO_DIR}/${PKG}.pot -L Shell -f ${PO_DIR}/POTFILES.sh
1559+ for po in ${PO_DIR}/*.po ; do \
1560+ msgmerge $${po} ${PO_DIR}/${PKG}.pot -o $${po} ; \
1561+ done
1562+
1563+clean:
1564 dh_testdir
1565 dh_testroot
1566 rm -f build-stamp
1567 rm -f config.guess config.sub
1568+ for po in ${PO_DIR}/*.po ; do \
1569+ lang=$${po#po/}; lang=$${lang%.po}; \
1570+ rm -f ${PO_DIR}/locale/$${lang}/LC_MESSAGES/${PKG}.mo ; \
1571+ done
1572+
1573
1574 [ ! -f Makefile ] || $(MAKE) distclean
1575
1576 dh_clean
1577
1578-config.status: configure patch
1579+config.status: configure
1580 dh_testdir
1581
1582+ifneq "$(wildcard /usr/share/misc/config.guess)" ""
1583+ cp -f /usr/share/misc/config.guess config.guess
1584+endif
1585 ifneq "$(wildcard /usr/share/misc/config.sub)" ""
1586 cp -f /usr/share/misc/config.sub config.sub
1587 endif
1588-ifneq "$(wildcard /usr/share/misc/config.guess)" ""
1589- cp -f /usr/share/misc/config.guess config.guess
1590-endif
1591- CFLAGS="$(CFLAGS)" ./configure --host=$(DEB_HOST_GNU_TYPE) --build=$(DEB_BUILD_GNU_TYPE) --prefix=/usr --libdir=\$${prefix}/lib --mandir=\$${prefix}/share/man --enable-static --enable-gpg --disable-gui --enable-pam --disable-openssl --disable-pkcs11-helper --disable-tspi $(TPMFLAGS)
1592+
1593+ ./configure $(CROSS) --prefix=/usr --libdir=\$${prefix}/lib --mandir=\$${prefix}/share/man --enable-static --enable-gpg --enable-nss --disable-gui --enable-pam --disable-openssl --disable-pkcs11-helper --disable-tspi $(TPMFLAGS) CFLAGS="$(CFLAGS)"
1594
1595 build: build-stamp
1596 build-stamp: config.status
1597@@ -47,17 +67,14 @@
1598
1599 touch build-stamp
1600
1601-install: build
1602+install: build install-po
1603 dh_testdir
1604 dh_testroot
1605 dh_prep
1606- dh_installdirs
1607
1608 $(MAKE) DESTDIR=$(CURDIR)/debian/tmp install
1609- install -m 644 -D $(CURDIR)/debian/ecryptfs-utils.pam-auth-update $(CURDIR)/debian/tmp/usr/share/pam-configs/ecryptfs-utils
1610
1611- mv debian/tmp/usr/share/ecryptfs-* debian/ecryptfs-utils/usr/share/ecryptfs-utils
1612- mv debian/tmp/usr/share/doc/ecryptfs-utils/ecryptfs-mount-private.txt debian/ecryptfs-utils/usr/share/ecryptfs-utils/ecryptfs-mount-private.txt
1613+ install -D -m 0644 debian/local/ecryptfs-utils.pam-auth-update debian/ecryptfs-utils/usr/share/pam-configs/ecryptfs-utils
1614
1615 chmod 4755 debian/tmp/sbin/mount.ecryptfs_private
1616
1617@@ -65,12 +82,14 @@
1618
1619 binary: binary-arch
1620
1621-binary-arch: build install
1622+binary-arch: install
1623 dh_testdir
1624 dh_testroot
1625 dh_installchangelogs ChangeLog
1626 dh_installdocs
1627 dh_install --fail-missing --sourcedir=debian/tmp
1628+ dh_installinit --noscripts --error-handler=true --name=ecryptfs-utils-save
1629+ dh_installinit --noscripts --error-handler=true --name=ecryptfs-utils-restore
1630 dh_lintian
1631 dh_link
1632 dh_strip
1633
1634=== modified file 'doc/Makefile.am'
1635--- doc/Makefile.am 2009-02-03 08:50:36 +0000
1636+++ doc/Makefile.am 2010-02-17 20:48:18 +0000
1637@@ -18,5 +18,4 @@
1638 dist_noinst_DATA += ecryptfs-pkcs11-helper-doc.txt
1639 endif
1640
1641-dist_doc_DATA += ecryptfs-mount-private.txt
1642-dist_noinst_DATA += ecryptfs-mount-private.txt
1643+dist_pkgdata_DATA = ecryptfs-mount-private.txt
1644
1645=== modified file 'doc/ecryptfs-mount-private.txt'
1646--- doc/ecryptfs-mount-private.txt 2009-02-03 08:50:36 +0000
1647+++ doc/ecryptfs-mount-private.txt 2010-02-17 20:48:18 +0000
1648@@ -6,4 +6,4 @@
1649 or
1650
1651 From the command line, run:
1652- $ ecryptfs-mount-private
1653+ ecryptfs-mount-private
1654
1655=== modified file 'doc/manpage/Makefile.am'
1656--- doc/manpage/Makefile.am 2009-03-20 19:29:14 +0000
1657+++ doc/manpage/Makefile.am 2010-02-17 20:48:18 +0000
1658@@ -21,10 +21,13 @@
1659 ecryptfs-rewrap-passphrase.1 \
1660 ecryptfs-rewrite-file.1 \
1661 ecryptfs-setup-private.1 \
1662+ ecryptfs-setup-swap.1 \
1663+ ecryptfs-stat.1 \
1664 ecryptfs-umount-private.1 \
1665 ecryptfs-unwrap-passphrase.1 \
1666 ecryptfs-wrap-passphrase.1 \
1667 mount.ecryptfs.8 \
1668+ umount.ecryptfs.8 \
1669 mount.ecryptfs_private.1 \
1670 pam_ecryptfs.8 \
1671 umount.ecryptfs_private.1
1672
1673=== modified file 'doc/manpage/ecryptfs-mount-private.1'
1674--- doc/manpage/ecryptfs-mount-private.1 2009-02-03 08:50:36 +0000
1675+++ doc/manpage/ecryptfs-mount-private.1 2010-02-17 20:48:18 +0000
1676@@ -6,7 +6,7 @@
1677 \fBecryptfs-mount-private\fP
1678
1679 .SH DESCRIPTION
1680-\fBecryptfs-mount-private\fP is a wrapper script for the \fBmount.ecryptfs_private\fP utility that will interactively prompt for the user's login password, if necessary.
1681+\fBecryptfs-mount-private\fP is a wrapper script for the \fBmount.ecryptfs_private\fP utility that will interactively prompt for the user's login password, if necessary. You need to be a member of \fBecryptfs\fB group to use this.
1682
1683 .SH FILES
1684 \fI~/.Private\fP - underlying directory containing encrypted data
1685@@ -17,7 +17,7 @@
1686
1687 \fI~/.ecryptfs/wrapped-passphrase\fP - file containing the wrapped passphrase
1688
1689-\fI~/.ecryptfs/wrapped-independent\fP - this file exists if the wrapping passphrase is independent from login passphrase
1690+\fI~/.ecryptfs/wrapping-independent\fP - this file exists if the wrapping passphrase is independent from login passphrase
1691
1692 .SH SEE ALSO
1693 .PD 0
1694
1695=== modified file 'doc/manpage/ecryptfs-rewrite-file.1'
1696--- doc/manpage/ecryptfs-rewrite-file.1 2009-03-20 22:12:06 +0000
1697+++ doc/manpage/ecryptfs-rewrite-file.1 2010-02-17 20:48:18 +0000
1698@@ -6,7 +6,7 @@
1699 \fBecryptfs-rewrite-file [file1] [file2] [file3] ...\fP
1700
1701 .SH DESCRIPTION
1702-This script takes one or more files/directories/symlinks as arguments, moves each of them to a temporary file, and the moves them back to the original name. This causes the file to be rewritten (and reencrypted) in the lower filesystem.
1703+This script takes one or more files/directories/symlinks as arguments, moves each of them to a temporary file, and then moves them back to the original name. This causes the file to be rewritten (and reencrypted) in the lower filesystem.
1704
1705 This script may be combined with \fBfind\fP(1) and \fBxargs\fP(1) to rewrite an entire eCryptfs mountpoint, unmount, and sync:
1706
1707
1708=== modified file 'doc/manpage/ecryptfs-setup-private.1'
1709--- doc/manpage/ecryptfs-setup-private.1 2009-03-18 22:00:04 +0000
1710+++ doc/manpage/ecryptfs-setup-private.1 2010-02-17 20:48:18 +0000
1711@@ -43,7 +43,7 @@
1712
1713
1714 .SH DESCRIPTION
1715-\fBecryptfs-setup-private\fP is a program that sets up a private cryptographic mountpoint for a non-root user.
1716+\fBecryptfs-setup-private\fP is a program that sets up a private cryptographic mountpoint for a non-root user, who is a member of \fBecryptfs\fP group.
1717
1718 Be sure to properly escape your parameters according to your shell's special character nuances, and also surround the parameters by double quotes, if necessary. Any of the parameters may be:
1719
1720@@ -78,7 +78,7 @@
1721
1722 \fI~/.ecryptfs/wrapped-passphrase\fP - file containing the mount passphrase, wrapped with the login passphrase
1723
1724-\fI~/.ecryptfs/wrapped-independent\fP - this file exists if the wrapping passphrase is independent from login passphrase
1725+\fI~/.ecryptfs/wrapping-independent\fP - this file exists if the wrapping passphrase is independent from login passphrase
1726
1727 .SH SEE ALSO
1728 .PD 0
1729
1730=== added file 'doc/manpage/ecryptfs-setup-swap.1'
1731--- doc/manpage/ecryptfs-setup-swap.1 1970-01-01 00:00:00 +0000
1732+++ doc/manpage/ecryptfs-setup-swap.1 2010-02-17 20:48:18 +0000
1733@@ -0,0 +1,29 @@
1734+.TH ecryptfs-setup-swap 1 2009-08-17 ecryptfs-utils "eCryptfs"
1735+.SH NAME
1736+ecryptfs-setup-swap \- ensure that any swap space is encrypted
1737+
1738+.SH SYNOPSIS
1739+\fBecryptfs-setup-swap\fP [-f|--force]
1740+
1741+.SH DESCRIPTION
1742+This script will detect existing swap partitions or swap files, and encrypt them, using cryptsetup.
1743+
1744+Encrypted swap is essential to securing any system using eCryptfs, since decrypted file contents will exist in the system's memory, which may be swapped to disk at any time. If the system swap space is not also encrypted, it is possible that decrypted files could be written to disk in clear text.
1745+
1746+Note that most Linux distributions do not yet support resuming from an encrypted swap space, and thus hibernate/resume will not work. Suspend/resume is unaffected.
1747+
1748+Upon running the utility, the user will be informed of the hibernate/resume break, and asked to confirm the behavior. The -f|--force option can be used to bypass this interactive prompt.
1749+
1750+.SH SEE ALSO
1751+.PD 0
1752+.TP
1753+\fBcryptsetup\fP(8)
1754+
1755+.TP
1756+\fIhttp://launchpad.net/ecryptfs/\fP
1757+.PD
1758+
1759+.SH AUTHOR
1760+This manpage and the utility was written by Dustin Kirkland <kirkland@canonical.com> for Ubuntu systems (but may be used by others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.
1761+
1762+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
1763
1764=== added file 'doc/manpage/ecryptfs-stat.1'
1765--- doc/manpage/ecryptfs-stat.1 1970-01-01 00:00:00 +0000
1766+++ doc/manpage/ecryptfs-stat.1 2010-02-17 20:48:18 +0000
1767@@ -0,0 +1,18 @@
1768+.TH ecryptfs-setup-swap 1 2009-08-17 ecryptfs-utils "eCryptfs"
1769+.SH NAME
1770+ecryptfs-stat \- Present statistics on encrypted eCryptfs file attributes
1771+
1772+.SH SYNOPSIS
1773+\fBecryptfs-stat\fP filename
1774+
1775+.SH DESCRIPTION
1776+This program will present statistics on encrypted eCryptfs file and its attributes.
1777+
1778+.TP
1779+\fIhttp://launchpad.net/ecryptfs/\fP
1780+.PD
1781+
1782+.SH AUTHOR
1783+This manpage was written by Dustin Kirkland <kirkland@canonical.com> for Ubuntu systems (but may be used by others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.
1784+
1785+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
1786
1787=== modified file 'doc/manpage/ecryptfs.7'
1788--- doc/manpage/ecryptfs.7 2009-04-21 23:20:27 +0000
1789+++ doc/manpage/ecryptfs.7 2010-02-17 20:48:18 +0000
1790@@ -34,7 +34,7 @@
1791 Do not check the mount key signature against the values in the user's ~/.ecryptfs/sig-cache.txt file. This is useful for such things as non-interactive setup scripts, so that the mount helper does not stop and prompt the user in the event that the key sig is not in the cache.
1792 .TP
1793 .B ecryptfs_encrypted_view
1794-This option, when set, will have eCryptfs return the encrypted versions of the lower files, rather than decrypt encrypted files and return the decrypted data from the lower files. This options is useful for such things as backup utilities.
1795+This option provides a unified encrypted file format of the eCryptfs files in the lower mount point. Currently, it is only useful if the lower mount point contains files with the metadata stored in the extended attribute. Upon a file read in the upper mount point, the encrypted version of the file will be presented with the metadata in the file header instead of the xattr. Files cannot be opened for writing when this option is enabled.
1796 .TP
1797 .B ecryptfs_xattr
1798 Store the metadata in the extended attribute of the lower files rather than the header region of the lower files.
1799@@ -79,7 +79,7 @@
1800 The filename should be the filename of a file containing an RSA SSL key.
1801 .TP
1802 .B openssl_passwd_file=(filename)
1803-The password should be specified in a file with passwd=(openssl-password). It is highly reccomended that the file be stored on a secure medium such as a personal usb key.
1804+The password should be specified in a file with openssl_passwd=(openssl-password). It is highly reccomended that the file be stored on a secure medium such as a personal usb key.
1805 .TP
1806 .B openssl_passwd_fd=(file descriptor)
1807 The password is specified through the specified file descriptor.
1808@@ -93,15 +93,13 @@
1809
1810 .PP
1811
1812-The following command will layover mount eCryptfs on /secret with a passphrase contained in a file stored on secure media mounted at /mnt/secureusb/.
1813+The following command will layover mount eCryptfs on /secret with a passphrase contained in a file stored on secure media mounted at /mnt/usb/.
1814
1815-\fBmount -t ecryptfs -o
1816-key=passphrase:passphrase_passwd_file=/mnt/secureusb/passwd_file.txt
1817-/secret /secret\fP
1818+\fBmount -t ecryptfs -o key=passphrase:passphrase_passwd_file=/mnt/usb/file.txt /secret /secret\fP
1819
1820 .PP
1821
1822-Where passwd_file.txt contains the contents
1823+Where file.txt contains the contents
1824 \fB"passphrase_passwd=[passphrase]"\fP.
1825
1826 .SH SEE ALSO
1827@@ -119,6 +117,8 @@
1828 .SH NOTES
1829 Do not run eCryptfs in verbose-mode unless you are doing so for the sole purpose of development, since secret values will be written out to the system log in that case. Make certain that your eCryptfs mount covers all locations where your applications may write sensitive data. In addition, use dm-crypt to encrypt your swap space with a random key on boot, or see \fBecryptfs-setup-swap\fP(1).
1830
1831+Passphrases have a maximum length of 64 characters.
1832+
1833 .SH BUGS
1834 Please post bug reports to the eCryptfs bug tracker on Launchpad.net: https://bugs.launchpad.net/ecryptfs/+filebug.
1835
1836@@ -128,131 +128,3 @@
1837 This manpage was (re-)written by Dustin Kirkland <kirkland@canonical.com> for Ubuntu systems (but may be used by others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.
1838
1839 On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
1840-.\" Automatically generated by Pod::Man v1.37, Pod::Parser v1.35
1841-.\"
1842-.\" Standard preamble:
1843-.\" ========================================================================
1844-.de Sh \" Subsection heading
1845-.br
1846-.if t .Sp
1847-.ne 5
1848-.PP
1849-\fB\\$1\fR
1850-.PP
1851-..
1852-.de Sp \" Vertical space (when we can't use .PP)
1853-.if t .sp .5v
1854-.if n .sp
1855-..
1856-.de Vb \" Begin verbatim text
1857-.ft CW
1858-.nf
1859-.ne \\$1
1860-..
1861-.de Ve \" End verbatim text
1862-.ft R
1863-.fi
1864-..
1865-.\" Set up some character translations and predefined strings. \*(-- will
1866-.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
1867-.\" double quote, and \*(R" will give a right double quote. | will give a
1868-.\" real vertical bar. \*(C+ will give a nicer C++. Capital omega is used to
1869-.\" do unbreakable dashes and therefore won't be available. \*(C` and \*(C'
1870-.\" expand to `' in nroff, nothing in troff, for use with C<>.
1871-.tr \(*W-|\(bv\*(Tr
1872-.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
1873-.ie n \{\
1874-. ds -- \(*W-
1875-. ds PI pi
1876-. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
1877-. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
1878-. ds L" ""
1879-. ds R" ""
1880-. ds C` ""
1881-. ds C' ""
1882-'br\}
1883-.el\{\
1884-. ds -- \|\(em\|
1885-. ds PI \(*p
1886-. ds L" ``
1887-. ds R" ''
1888-'br\}
1889-.\"
1890-.\" If the F register is turned on, we'll generate index entries on stderr for
1891-.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
1892-.\" entries marked with X<> in POD. Of course, you'll have to process the
1893-.\" output yourself in some meaningful fashion.
1894-.if \nF \{\
1895-. de IX
1896-. tm Index:\\$1\t\\n%\t"\\$2"
1897-..
1898-. nr % 0
1899-. rr F
1900-.\}
1901-.\"
1902-.\" For nroff, turn off justification. Always turn off hyphenation; it makes
1903-.\" way too many mistakes in technical documents.
1904-.hy 0
1905-.if n .na
1906-.\"
1907-.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
1908-.\" Fear. Run. Save yourself. No user-serviceable parts.
1909-. \" fudge factors for nroff and troff
1910-.if n \{\
1911-. ds #H 0
1912-. ds #V .8m
1913-. ds #F .3m
1914-. ds #[ \f1
1915-. ds #] \fP
1916-.\}
1917-.if t \{\
1918-. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
1919-. ds #V .6m
1920-. ds #F 0
1921-. ds #[ \&
1922-. ds #] \&
1923-.\}
1924-. \" simple accents for nroff and troff
1925-.if n \{\
1926-. ds ' \&
1927-. ds ` \&
1928-. ds ^ \&
1929-. ds , \&
1930-. ds ~ ~
1931-. ds /
1932-.\}
1933-.if t \{\
1934-. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
1935-. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
1936-. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
1937-. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
1938-. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
1939-. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
1940-.\}
1941-. \" troff and (daisy-wheel) nroff accents
1942-.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
1943-.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
1944-.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
1945-.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
1946-.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
1947-.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
1948-.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
1949-.ds ae a\h'-(\w'a'u*4/10)'e
1950-.ds Ae A\h'-(\w'A'u*4/10)'E
1951-. \" corrections for vroff
1952-.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
1953-.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
1954-. \" for low resolution devices (crt and lpr)
1955-.if \n(.H>23 .if \n(.V>19 \
1956-\{\
1957-. ds : e
1958-. ds 8 ss
1959-. ds o a
1960-. ds d- d\h'-1'\(ga
1961-. ds D- D\h'-1'\(hy
1962-. ds th \o'bp'
1963-. ds Th \o'LP'
1964-. ds ae ae
1965-. ds Ae AE
1966-.\}
1967-.rm #[ #] #H #V #F C
1968
1969=== modified file 'doc/manpage/mount.ecryptfs_private.1'
1970--- doc/manpage/mount.ecryptfs_private.1 2009-02-23 21:31:11 +0000
1971+++ doc/manpage/mount.ecryptfs_private.1 2010-02-17 20:48:18 +0000
1972@@ -8,7 +8,7 @@
1973 \fBNOTE:\fP This program will \fBnot\fP dynamically load the relevant keys. For this reason, it is recommended that users use \fBecryptfs-mount-private\fP(1) instead!
1974
1975 .SH DESCRIPTION
1976-\fBmount.ecryptfs_private\fP is a mount helper utility for non-root users to cryptographically mount a private directory, ~/Private.
1977+\fBmount.ecryptfs_private\fP is a mount helper utility for non-root users, who are members of \fBecryptfs\fP group, to cryptographically mount a private directory, ~/Private.
1978
1979 If, and only if:
1980 - the private mount passphrase is in their kernel keyring, and
1981
1982=== added file 'doc/manpage/umount.ecryptfs.8'
1983--- doc/manpage/umount.ecryptfs.8 1970-01-01 00:00:00 +0000
1984+++ doc/manpage/umount.ecryptfs.8 2010-02-17 20:48:19 +0000
1985@@ -0,0 +1,23 @@
1986+.TH umount.ecryptfs 8 2009-08-17 ecryptfs-utils "eCryptfs"
1987+.SH NAME
1988+umount.ecryptfs \- eCryptfs umount helper.
1989+
1990+.SH SYNOPSIS
1991+\fBumount\fP [\fIecryptfs\ mount\ point\fP]
1992+
1993+.SH DESCRIPTION
1994+\fBumount.ecryptfs\fP is an eCryptfs umount helper, that will also unlink keys from the keyring.
1995+
1996+.SH "SEE ALSO"
1997+.PD 0
1998+.TP
1999+\fBmount.ecryptfs\fP(8), \fBmount\fP(8)
2000+
2001+.TP
2002+\fIhttp://launchpad.net/ecryptfs/\fP
2003+.PD
2004+
2005+.SH AUTHOR
2006+This manpage was written by Dustin Kirkland <kirkland@canonical.com> for Ubuntu systems (but may be used by others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.
2007+
2008+On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
2009
2010=== modified file 'doc/manpage/umount.ecryptfs_private.1'
2011--- doc/manpage/umount.ecryptfs_private.1 2009-02-23 21:31:11 +0000
2012+++ doc/manpage/umount.ecryptfs_private.1 2010-02-17 20:48:19 +0000
2013@@ -14,7 +14,7 @@
2014 Force the unmount, ignoring the value of the mount counter in \fI/tmp/ecryptfs-USERNAME-Private\fP
2015
2016 .SH DESCRIPTION
2017-\fBumount.ecryptfs_private\fP is a mount helper utility for non-root users to unmount a cryptographically mounted private directory, ~/Private.
2018+\fBumount.ecryptfs_private\fP is a mount helper utility for non-root users, who ares members of \fBecryptfs\fP group, to unmount a cryptographically mounted private directory, ~/Private.
2019
2020 If, and only if:
2021 - the private mount passphrase is in their kernel keyring, and
2022
2023=== modified file 'doc/sourceforge_webpage/README'
2024--- doc/sourceforge_webpage/README 2009-02-03 08:50:36 +0000
2025+++ doc/sourceforge_webpage/README 2010-02-17 20:48:19 +0000
2026@@ -38,11 +38,6 @@
2027 1.0 or higher)
2028 - Finding its way into some distro's
2029 - Obtainable from <http://people.redhat.com/~dhowells/keyutils>
2030- - libgcrypt
2031- - Part of most distro's; install the development package
2032- - If you need to build from source, you probably will want these:
2033- - <ftp://ftp.gnupg.org/gcrypt/libgpg-error>
2034- - <ftp://ftp.gnupg.org/gcrypt/libgcrypt>
2035
2036
2037 KERNEL BUILD OPTIONS
2038
2039=== added directory 'lintian'
2040=== added file 'lintian/ecryptfs-utils'
2041--- lintian/ecryptfs-utils 1970-01-01 00:00:00 +0000
2042+++ lintian/ecryptfs-utils 2010-02-17 20:48:19 +0000
2043@@ -0,0 +1,12 @@
2044+# This setuid is required for encrypted-home and encrypted-private;
2045+# Other distros or sysadmins could perhaps make it 4750, and create
2046+# an ecryptfs group, adding permitted users to this group (though
2047+# we're not doing this in Ubuntu).
2048+ecryptfs-utils: setuid-binary sbin/mount.ecryptfs_private 4755 root/root
2049+
2050+# The *.desktop files should be executable
2051+ecryptfs-utils: executable-not-elf-or-script
2052+
2053+# We're not creating these files, but rather moving them, and the utilities
2054+# that use them provide the necessary owernship checks.
2055+ecryptfs-utils: possibly-insecure-handling-of-tmp-files-in-maintainer-script
2056
2057=== modified file 'scripts/build-ubuntu.sh'
2058--- scripts/build-ubuntu.sh 2009-03-24 20:39:50 +0000
2059+++ scripts/build-ubuntu.sh 2010-02-17 20:48:19 +0000
2060@@ -7,5 +7,5 @@
2061 cd ubuntu
2062 tar zxvf *.orig.tar.gz
2063 cd ecryptfs-utils*/
2064-cp -a ../../ecryptfs/debian .
2065+cp -a ../../upstream/debian .
2066 debuild -uc -us
2067
2068=== modified file 'scripts/release.sh'
2069--- scripts/release.sh 2009-04-22 00:17:57 +0000
2070+++ scripts/release.sh 2010-02-17 20:48:19 +0000
2071@@ -8,7 +8,7 @@
2072 exit 1
2073 }
2074
2075-head -n1 debian/changelog | grep "unreleased" || error "This version must be 'unreleased'"
2076+head -n1 debian/changelog | grep -i "unreleased" || error "This version must be 'unreleased'"
2077
2078
2079 rm -f ./ecryptfs-utils*.tar.*
2080@@ -36,5 +36,9 @@
2081 echo "TO MAKE THE RELEASE OFFICIAL, UPLOAD:"
2082 echo -n " "
2083 ls ../ecryptfs-utils*.orig.tar.gz
2084-echo "----> https://launchpad.net/ecryptfs/trunk"
2085+echo "----> https://launchpad.net/ecryptfs/trunk/+addrelease"
2086+echo
2087+echo " dch --release released"
2088+echo " debcommit --release"
2089+echo " bzr push lp:ecryptfs"
2090 echo
2091
2092=== modified file 'src/desktop/Makefile.am'
2093--- src/desktop/Makefile.am 2009-04-07 22:33:58 +0000
2094+++ src/desktop/Makefile.am 2010-02-17 20:48:19 +0000
2095@@ -1,3 +1,4 @@
2096 MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
2097
2098-dist_dataroot_DATA = ecryptfs-mount-private.desktop ecryptfs-setup-private.desktop ecryptfs-record-passphrase
2099+eudatarootdir = $(datarootdir)/ecryptfs-utils
2100+dist_eudataroot_SCRIPTS = ecryptfs-mount-private.desktop ecryptfs-setup-private.desktop ecryptfs-record-passphrase
2101
2102=== modified file 'src/desktop/ecryptfs-mount-private.desktop' (properties changed: -x to +x)
2103=== modified file 'src/desktop/ecryptfs-record-passphrase' (properties changed: -x to +x)
2104--- src/desktop/ecryptfs-record-passphrase 2009-04-07 22:33:58 +0000
2105+++ src/desktop/ecryptfs-record-passphrase 2010-02-17 20:48:19 +0000
2106@@ -6,13 +6,16 @@
2107 Terminal: True
2108 Command: "sh -c 'ecryptfs-unwrap-passphrase $HOME/.ecryptfs/wrapped-passphrase 2>/dev/null && echo [Enter] && head -n1 && touch $HOME/.ecryptfs/.wrapped-passphrase.recorded '"
2109 Description: To encrypt your home directory or "Private" folder, a strong
2110- passphrase has been autogenerated. Usually your directory is unlocked
2111+ passphrase has been automatically generated. Usually your directory is unlocked
2112 with your user password, but if you ever need to manually recover this
2113 directory, you will need this passphrase. Please print or write it down and
2114 store it in a safe location.
2115 .
2116- You can run the "ecryptfs-unwrap-passphrase" command now to do this. Enter
2117- your user password at the "Passphrase" prompt.
2118+ If you click "Run this action now", enter your login password at the "Passphrase"
2119+ prompt and you can display your randomly generated passphrase.
2120+ .
2121+ Otherwise, you will need to run "ecryptfs-unwrap-passphrase" from the command
2122+ line to retrive and record your generated passphrase.
2123 Description-de: Um Ihr Heimat- oder "Private"-Verzeichnis zu verschlüsseln,
2124 wurde automatisch ein starkes Passwort geniert. Normalerweise wird Ihr
2125 Verzeichnis mit Ihrem Benutzerpasswort freigegeben, aber wenn Sie jemals
2126
2127=== modified file 'src/desktop/ecryptfs-setup-private.desktop' (properties changed: -x to +x)
2128=== modified file 'src/include/ecryptfs.h'
2129--- src/include/ecryptfs.h 2009-02-06 13:20:40 +0000
2130+++ src/include/ecryptfs.h 2010-02-17 20:48:19 +0000
2131@@ -512,6 +512,7 @@
2132 uint32_t version);
2133 int get_string(char *val, int len, int echo);
2134 int get_string_stdin(char **val, char *prompt, int echo);
2135+int stack_pop(struct val_node **head);
2136 int stack_pop_val(struct val_node **head, void **val);
2137 int ecryptfs_mount(char *source, char *target, unsigned long flags, char *opts);
2138 int ecryptfs_get_current_kernel_ciphers(
2139@@ -581,6 +582,7 @@
2140 int ecryptfs_insert_wrapped_passphrase_into_keyring(
2141 char *auth_tok_sig, char *filename, char *wrapping_passphrase,
2142 char *salt);
2143+char *ecryptfs_get_wrapped_passphrase_filename();
2144 struct ecryptfs_key_mod_ops *passphrase_get_key_mod_ops(void);
2145 int ecryptfs_validate_keyring(void);
2146 #define ECRYPTFS_SHM_KEY 0x3c81b7f5
2147@@ -630,5 +632,8 @@
2148 char *ecryptfs_get_passphrase(char *prompt);
2149 int ecryptfs_run_daemon(struct ecryptfs_messaging_ctx *mctx);
2150
2151+#define ECRYPTFS_PRIVATE_DIR "Private"
2152+char *ecryptfs_fetch_private_mnt(char *pw_dir);
2153+int ecryptfs_private_is_mounted(char *dev, char *mnt, char *sig, int mounting);
2154
2155 #endif
2156
2157=== modified file 'src/key_mod/ecryptfs_key_mod_gpg.c'
2158--- src/key_mod/ecryptfs_key_mod_gpg.c 2009-04-22 09:05:00 +0000
2159+++ src/key_mod/ecryptfs_key_mod_gpg.c 2010-02-17 20:48:19 +0000
2160@@ -18,6 +18,7 @@
2161 * 02111-1307, USA.
2162 */
2163
2164+#include "config.h"
2165 #include <fcntl.h>
2166 #include <pwd.h>
2167 #include <stdio.h>
2168@@ -29,7 +30,6 @@
2169 #include <gpgme.h>
2170 #include <sys/types.h>
2171 #include <sys/stat.h>
2172-#include "config.h"
2173 #include "../include/ecryptfs.h"
2174 #include "../include/decision_graph.h"
2175
2176@@ -131,7 +131,7 @@
2177
2178 int ecryptfs_gpg_encrypt(char *to, int size, char *from, unsigned char *blob)
2179 {
2180- int rc;
2181+ int rc = 0;
2182
2183 /* gpg_op_encrypt(...); */
2184 out:
2185@@ -251,7 +251,7 @@
2186 struct val_node **head, void **foo)
2187 {
2188 struct key_mod_gpg *key_mod_gpg = (struct key_mod_gpg *)(*foo);
2189- int i;
2190+ int i = 0;
2191 gpgme_error_t err;
2192 int rc = 0;
2193 gpgme_key_t key;
2194@@ -283,10 +283,7 @@
2195
2196 static int generate_name_val_list(struct ecryptfs_name_val_pair *head)
2197 {
2198- struct stat buf;
2199- int i = 0;
2200 uid_t id = getuid();
2201- struct passwd *pw = getpwuid(id);
2202 int rc = 0;
2203
2204 head->next = NULL;
2205@@ -304,6 +301,7 @@
2206 destroy_key_mod_gpg(key_mod_gpg);
2207 free(key_mod_gpg);
2208 }
2209+ return 0;
2210 }
2211
2212
2213@@ -312,7 +310,6 @@
2214 {
2215 struct key_mod_gpg *key_mod_gpg;
2216 gpgme_error_t err;
2217- gpgme_keylist_result_t keylist_res;
2218 int rc = 0;
2219
2220 (*foo) = NULL;
2221@@ -329,7 +326,7 @@
2222 if ((err = gpgme_op_keylist_start(key_mod_gpg->ctx, "", 0))) {
2223 printf("Error attempting to start keylist\n");
2224 rc = -EINVAL;
2225- gpgme_release(ctx);
2226+ gpgme_release(key_mod_gpg->ctx);
2227 free(key_mod_gpg);
2228 goto out;
2229 }
2230
2231=== modified file 'src/key_mod/ecryptfs_key_mod_openssl.c'
2232--- src/key_mod/ecryptfs_key_mod_openssl.c 2009-04-22 09:05:00 +0000
2233+++ src/key_mod/ecryptfs_key_mod_openssl.c 2010-02-17 20:48:19 +0000
2234@@ -550,6 +550,30 @@
2235 return rc;
2236 }
2237
2238+static int limit_key_size(struct val_node **params,
2239+ struct ecryptfs_subgraph_ctx *subgraph_ctx)
2240+{
2241+ char *buf;
2242+ int rc;
2243+ RSA *rsa = NULL;
2244+
2245+ if ((rc=ecryptfs_openssl_read_key(&rsa,
2246+ (unsigned char *)subgraph_ctx->key_mod->blob)))
2247+ return rc;
2248+ /* 41 is for padding and 3 are for additional data send from
2249+ * kernel (1 for cipher type and 2 for checksum */
2250+ if ((rc = asprintf(&buf, "max_key_bytes=%d",
2251+ RSA_size(rsa)-41-3)) == -1) {
2252+ rc = -ENOMEM;
2253+ goto out;
2254+ }
2255+
2256+ rc = stack_push(params, buf);
2257+out:
2258+ RSA_free(rsa);
2259+ return rc;
2260+}
2261+
2262 /**
2263 *
2264 *
2265@@ -575,6 +599,7 @@
2266 syslog(LOG_ERR, "Error processing OpenSSL key; rc = [%d]", rc);
2267 goto out;
2268 }
2269+ limit_key_size(mnt_params, subgraph_ctx);
2270 ecryptfs_openssl_destroy_subgraph_ctx(subgraph_ctx);
2271 free(subgraph_ctx);
2272 (*foo) = NULL;
2273@@ -629,7 +654,7 @@
2274 walker = walker->next;
2275 }
2276 if (!walker) {
2277- syslog(LOG_ERR, "%s: No passwd option found in file\n",
2278+ syslog(LOG_ERR, "%s: No openssl_passwd option found in file\n",
2279 __FUNCTION__);
2280 rc = MOUNT_ERROR;
2281 goto out;
2282@@ -639,6 +664,7 @@
2283 syslog(LOG_ERR, "Error processing OpenSSL key; rc = [%d]", rc);
2284 goto out;
2285 }
2286+ limit_key_size(mnt_params, subgraph_ctx);
2287 ecryptfs_openssl_destroy_subgraph_ctx(subgraph_ctx);
2288 free(subgraph_ctx);
2289 (*foo) = NULL;
2290@@ -727,7 +753,7 @@
2291 .display_opts = NULL,
2292 .default_val = NULL,
2293 .suggested_val = NULL,
2294- .flags = ECRYPTFS_PARAM_FLAG_MASK_OUTPUT,
2295+ .flags = ECRYPTFS_PARAM_FLAG_MASK_OUTPUT | VERIFY_VALUE,
2296 .num_transitions = 1,
2297 .tl = {{.val = NULL,
2298 .pretty_val = NULL,
2299
2300=== modified file 'src/key_mod/ecryptfs_key_mod_pkcs11_helper.c'
2301--- src/key_mod/ecryptfs_key_mod_pkcs11_helper.c 2009-04-22 09:05:00 +0000
2302+++ src/key_mod/ecryptfs_key_mod_pkcs11_helper.c 2010-02-17 20:48:19 +0000
2303@@ -20,6 +20,7 @@
2304 * 02111-1307, USA.
2305 */
2306
2307+#include "config.h"
2308 #include <fcntl.h>
2309 #include <pwd.h>
2310 #include <stdio.h>
2311@@ -28,11 +29,12 @@
2312 #include <errno.h>
2313 #include <stdlib.h>
2314 #include <unistd.h>
2315+#include <openssl/err.h>
2316+#include <openssl/pem.h>
2317 #include <openssl/x509.h>
2318 #include <sys/types.h>
2319 #include <sys/stat.h>
2320 #include <pkcs11-helper-1.0/pkcs11h-certificate.h>
2321-#include "config.h"
2322 #include "../include/ecryptfs.h"
2323 #include "../include/decision_graph.h"
2324
2325@@ -590,7 +592,6 @@
2326 char dn[1024] = {0};
2327 char serial[1024] = {0};
2328 char *ser = NULL;
2329- char *ssh_key = NULL;
2330 size_t ser_len = 0;
2331 int n;
2332
2333@@ -1536,7 +1537,6 @@
2334 struct ecryptfs_ctx *ctx = &_ctx;
2335 struct ecryptfs_name_val_pair nvp_head;
2336 struct val_node *dummy_mnt_params;
2337- uid_t id;
2338 struct passwd *pw;
2339 char *rcfile_fullpath = NULL;
2340 int fd;
2341@@ -1647,6 +1647,7 @@
2342 if (pkcs11h_key_param_nodes[PKCS11H_KEY_TOK_ID].suggested_val)
2343 free(pkcs11h_key_param_nodes[PKCS11H_KEY_TOK_ID].suggested_val);
2344 pkcs11h_terminate ();
2345+ return 0;
2346 }
2347
2348 static struct ecryptfs_key_mod_ops ecryptfs_pkcs11h_ops = {
2349
2350=== modified file 'src/key_mod/ecryptfs_key_mod_tspi.c'
2351--- src/key_mod/ecryptfs_key_mod_tspi.c 2009-02-09 15:33:25 +0000
2352+++ src/key_mod/ecryptfs_key_mod_tspi.c 2010-02-17 20:48:19 +0000
2353@@ -317,6 +317,7 @@
2354 struct tspi_data tspi_data;
2355 struct ecryptfs_tspi_connect_ticket *ticket;
2356 int rc = 0;
2357+ BYTE wellknown[] = TSS_WELL_KNOWN_SECRET;
2358
2359 pthread_mutex_lock(&encrypt_lock);
2360 (*to_size) = 0;
2361@@ -345,8 +346,9 @@
2362 rc = -EIO;
2363 goto out;
2364 }
2365- if ((result = Tspi_Policy_SetSecret(h_srk_policy, TSS_SECRET_MODE_PLAIN,
2366- 0, NULL))
2367+ if ((result = Tspi_Policy_SetSecret(h_srk_policy,
2368+ TSS_SECRET_MODE_SHA1,
2369+ sizeof(wellknown), wellknown))
2370 != TSS_SUCCESS) {
2371 syslog(LOG_ERR, "Tspi_Policy_SetSecret failed: [%s]\n",
2372 Trspi_Error_String(result));
2373@@ -415,6 +417,7 @@
2374 struct ecryptfs_tspi_connect_ticket *ticket;
2375 TSS_RESULT result;
2376 int rc = 0;
2377+ BYTE wellknown[] = TSS_WELL_KNOWN_SECRET;
2378
2379 pthread_mutex_lock(&decrypt_lock);
2380 ecryptfs_tspi_deserialize(&tspi_data, blob);
2381@@ -442,7 +445,8 @@
2382 goto out;
2383 }
2384 if ((result = Tspi_Policy_SetSecret(h_srk_policy,
2385- TSS_SECRET_MODE_PLAIN, 0, NULL))
2386+ TSS_SECRET_MODE_SHA1,
2387+ sizeof(wellknown), wellknown))
2388 != TSS_SUCCESS) {
2389 syslog(LOG_ERR, "Tspi_Policy_SetSecret failed: [%s]\n",
2390 Trspi_Error_String(result));
2391
2392=== modified file 'src/libecryptfs-swig/libecryptfs.i'
2393--- src/libecryptfs-swig/libecryptfs.i 2009-02-03 08:50:36 +0000
2394+++ src/libecryptfs-swig/libecryptfs.i 2010-02-17 20:48:19 +0000
2395@@ -9,7 +9,7 @@
2396 #include "../include/ecryptfs.h"
2397
2398 %typemap(out) binary_data {
2399- $result = PyString_FromStringAndSize($1.data,$1.size);
2400+ $result = PyString_FromStringAndSize((char *)($1.data),$1.size);
2401 }
2402
2403 extern binary_data ecryptfs_passphrase_blob(char *salt, char *passphrase);
2404
2405=== modified file 'src/libecryptfs-swig/libecryptfs.py'
2406--- src/libecryptfs-swig/libecryptfs.py 2009-02-03 08:50:36 +0000
2407+++ src/libecryptfs-swig/libecryptfs.py 2010-02-17 20:48:19 +0000
2408@@ -1,5 +1,5 @@
2409 # This file was automatically generated by SWIG (http://www.swig.org).
2410-# Version 1.3.31
2411+# Version 1.3.36
2412 #
2413 # Don't modify this file, modify the SWIG interface instead.
2414 # This file is compatible with both classic and new-style classes.
2415
2416=== modified file 'src/libecryptfs-swig/libecryptfs_wrap.c'
2417--- src/libecryptfs-swig/libecryptfs_wrap.c 2009-02-03 08:50:36 +0000
2418+++ src/libecryptfs-swig/libecryptfs_wrap.c 2010-02-17 20:48:19 +0000
2419@@ -1,6 +1,6 @@
2420 /* ----------------------------------------------------------------------------
2421 * This file was automatically generated by SWIG (http://www.swig.org).
2422- * Version 1.3.31
2423+ * Version 1.3.36
2424 *
2425 * This file is not intended to be easily readable and contains a number of
2426 * coding conventions designed to improve portability and efficiency. Do not make
2427@@ -17,14 +17,14 @@
2428
2429 /* template workaround for compilers that cannot correctly implement the C++ standard */
2430 #ifndef SWIGTEMPLATEDISAMBIGUATOR
2431-# if defined(__SUNPRO_CC)
2432-# if (__SUNPRO_CC <= 0x560)
2433-# define SWIGTEMPLATEDISAMBIGUATOR template
2434-# else
2435-# define SWIGTEMPLATEDISAMBIGUATOR
2436-# endif
2437+# if defined(__SUNPRO_CC) && (__SUNPRO_CC <= 0x560)
2438+# define SWIGTEMPLATEDISAMBIGUATOR template
2439+# elif defined(__HP_aCC)
2440+/* Needed even with `aCC -AA' when `aCC -V' reports HP ANSI C++ B3910B A.03.55 */
2441+/* If we find a maximum version that requires this, the test would be __HP_aCC <= 35500 for A.03.55 */
2442+# define SWIGTEMPLATEDISAMBIGUATOR template
2443 # else
2444-# define SWIGTEMPLATEDISAMBIGUATOR
2445+# define SWIGTEMPLATEDISAMBIGUATOR
2446 # endif
2447 #endif
2448
2449@@ -52,6 +52,12 @@
2450 # endif
2451 #endif
2452
2453+#ifndef SWIG_MSC_UNSUPPRESS_4505
2454+# if defined(_MSC_VER)
2455+# pragma warning(disable : 4505) /* unreferenced local function has been removed */
2456+# endif
2457+#endif
2458+
2459 #ifndef SWIGUNUSEDPARM
2460 # ifdef __cplusplus
2461 # define SWIGUNUSEDPARM(p)
2462@@ -107,6 +113,12 @@
2463 # define _CRT_SECURE_NO_DEPRECATE
2464 #endif
2465
2466+/* Deal with Microsoft's attempt at deprecating methods in the standard C++ library */
2467+#if !defined(SWIG_NO_SCL_SECURE_NO_DEPRECATE) && defined(_MSC_VER) && !defined(_SCL_SECURE_NO_DEPRECATE)
2468+# define _SCL_SECURE_NO_DEPRECATE
2469+#endif
2470+
2471+
2472
2473 /* Python.h has to appear first */
2474 #include <Python.h>
2475@@ -120,7 +132,7 @@
2476
2477 /* This should only be incremented when either the layout of swig_type_info changes,
2478 or for whatever reason, the runtime changes incompatibly */
2479-#define SWIG_RUNTIME_VERSION "3"
2480+#define SWIG_RUNTIME_VERSION "4"
2481
2482 /* define SWIG_TYPE_TABLE_NAME as "SWIG_TYPE_TABLE" */
2483 #ifdef SWIG_TYPE_TABLE
2484@@ -155,6 +167,7 @@
2485
2486 /* Flags for pointer conversions */
2487 #define SWIG_POINTER_DISOWN 0x1
2488+#define SWIG_CAST_NEW_MEMORY 0x2
2489
2490 /* Flags for new pointer objects */
2491 #define SWIG_POINTER_OWN 0x1
2492@@ -295,10 +308,10 @@
2493 extern "C" {
2494 #endif
2495
2496-typedef void *(*swig_converter_func)(void *);
2497+typedef void *(*swig_converter_func)(void *, int *);
2498 typedef struct swig_type_info *(*swig_dycast_func)(void **);
2499
2500-/* Structure to store inforomation on one type */
2501+/* Structure to store information on one type */
2502 typedef struct swig_type_info {
2503 const char *name; /* mangled name of this type */
2504 const char *str; /* human readable name of this type */
2505@@ -343,7 +356,7 @@
2506 while ((*f2 == ' ') && (f2 != l2)) ++f2;
2507 if (*f1 != *f2) return (*f1 > *f2) ? 1 : -1;
2508 }
2509- return (l1 - f1) - (l2 - f2);
2510+ return (int)((l1 - f1) - (l2 - f2));
2511 }
2512
2513 /*
2514@@ -425,8 +438,8 @@
2515 Cast a pointer up an inheritance hierarchy
2516 */
2517 SWIGRUNTIMEINLINE void *
2518-SWIG_TypeCast(swig_cast_info *ty, void *ptr) {
2519- return ((!ty) || (!ty->converter)) ? ptr : (*ty->converter)(ptr);
2520+SWIG_TypeCast(swig_cast_info *ty, void *ptr, int *newmemory) {
2521+ return ((!ty) || (!ty->converter)) ? ptr : (*ty->converter)(ptr, newmemory);
2522 }
2523
2524 /*
2525@@ -850,7 +863,7 @@
2526 Py_DECREF(old_str);
2527 Py_DECREF(value);
2528 } else {
2529- PyErr_Format(PyExc_RuntimeError, mesg);
2530+ PyErr_SetString(PyExc_RuntimeError, mesg);
2531 }
2532 }
2533
2534@@ -1090,14 +1103,14 @@
2535 /* Unpack the argument tuple */
2536
2537 SWIGINTERN int
2538-SWIG_Python_UnpackTuple(PyObject *args, const char *name, int min, int max, PyObject **objs)
2539+SWIG_Python_UnpackTuple(PyObject *args, const char *name, Py_ssize_t min, Py_ssize_t max, PyObject **objs)
2540 {
2541 if (!args) {
2542 if (!min && !max) {
2543 return 1;
2544 } else {
2545 PyErr_Format(PyExc_TypeError, "%s expected %s%d arguments, got none",
2546- name, (min == max ? "" : "at least "), min);
2547+ name, (min == max ? "" : "at least "), (int)min);
2548 return 0;
2549 }
2550 }
2551@@ -1105,14 +1118,14 @@
2552 PyErr_SetString(PyExc_SystemError, "UnpackTuple() argument list is not a tuple");
2553 return 0;
2554 } else {
2555- register int l = PyTuple_GET_SIZE(args);
2556+ register Py_ssize_t l = PyTuple_GET_SIZE(args);
2557 if (l < min) {
2558 PyErr_Format(PyExc_TypeError, "%s expected %s%d arguments, got %d",
2559- name, (min == max ? "" : "at least "), min, l);
2560+ name, (min == max ? "" : "at least "), (int)min, (int)l);
2561 return 0;
2562 } else if (l > max) {
2563 PyErr_Format(PyExc_TypeError, "%s expected %s%d arguments, got %d",
2564- name, (min == max ? "" : "at most "), max, l);
2565+ name, (min == max ? "" : "at most "), (int)max, (int)l);
2566 return 0;
2567 } else {
2568 register int i;
2569@@ -1410,7 +1423,7 @@
2570 {
2571 PySwigObject *sobj = (PySwigObject *) v;
2572 PyObject *next = sobj->next;
2573- if (sobj->own) {
2574+ if (sobj->own == SWIG_POINTER_OWN) {
2575 swig_type_info *ty = sobj->ty;
2576 PySwigClientData *data = ty ? (PySwigClientData *) ty->clientdata : 0;
2577 PyObject *destroy = data ? data->destroy : 0;
2578@@ -1428,12 +1441,13 @@
2579 res = ((*meth)(mself, v));
2580 }
2581 Py_XDECREF(res);
2582- } else {
2583+ }
2584+#if !defined(SWIG_PYTHON_SILENT_MEMLEAK)
2585+ else {
2586 const char *name = SWIG_TypePrettyName(ty);
2587-#if !defined(SWIG_PYTHON_SILENT_MEMLEAK)
2588- printf("swig/python detected a memory leak of type '%s', no destructor found.\n", name);
2589+ printf("swig/python detected a memory leak of type '%s', no destructor found.\n", (name ? name : "unknown"));
2590+ }
2591 #endif
2592- }
2593 }
2594 Py_XDECREF(next);
2595 PyObject_DEL(v);
2596@@ -1591,9 +1605,11 @@
2597 (unaryfunc)0, /*nb_float*/
2598 (unaryfunc)PySwigObject_oct, /*nb_oct*/
2599 (unaryfunc)PySwigObject_hex, /*nb_hex*/
2600-#if PY_VERSION_HEX >= 0x02020000
2601- 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 /* nb_inplace_add -> nb_inplace_true_divide */
2602-#elif PY_VERSION_HEX >= 0x02000000
2603+#if PY_VERSION_HEX >= 0x02050000 /* 2.5.0 */
2604+ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 /* nb_inplace_add -> nb_index */
2605+#elif PY_VERSION_HEX >= 0x02020000 /* 2.2.0 */
2606+ 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 /* nb_inplace_add -> nb_inplace_true_divide */
2607+#elif PY_VERSION_HEX >= 0x02000000 /* 2.0.0 */
2608 0,0,0,0,0,0,0,0,0,0,0 /* nb_inplace_add -> nb_inplace_or */
2609 #endif
2610 };
2611@@ -1936,7 +1952,7 @@
2612
2613 SWIGRUNTIME int
2614 SWIG_Python_AcquirePtr(PyObject *obj, int own) {
2615- if (own) {
2616+ if (own == SWIG_POINTER_OWN) {
2617 PySwigObject *sobj = SWIG_Python_GetSwigThis(obj);
2618 if (sobj) {
2619 int oldown = sobj->own;
2620@@ -1957,6 +1973,8 @@
2621 return SWIG_OK;
2622 } else {
2623 PySwigObject *sobj = SWIG_Python_GetSwigThis(obj);
2624+ if (own)
2625+ *own = 0;
2626 while (sobj) {
2627 void *vptr = sobj->ptr;
2628 if (ty) {
2629@@ -1970,7 +1988,15 @@
2630 if (!tc) {
2631 sobj = (PySwigObject *)sobj->next;
2632 } else {
2633- if (ptr) *ptr = SWIG_TypeCast(tc,vptr);
2634+ if (ptr) {
2635+ int newmemory = 0;
2636+ *ptr = SWIG_TypeCast(tc,vptr,&newmemory);
2637+ if (newmemory == SWIG_CAST_NEW_MEMORY) {
2638+ assert(own);
2639+ if (own)
2640+ *own = *own | SWIG_CAST_NEW_MEMORY;
2641+ }
2642+ }
2643 break;
2644 }
2645 }
2646@@ -1980,7 +2006,8 @@
2647 }
2648 }
2649 if (sobj) {
2650- if (own) *own = sobj->own;
2651+ if (own)
2652+ *own = *own | sobj->own;
2653 if (flags & SWIG_POINTER_DISOWN) {
2654 sobj->own = 0;
2655 }
2656@@ -2045,8 +2072,13 @@
2657 }
2658 if (ty) {
2659 swig_cast_info *tc = SWIG_TypeCheck(desc,ty);
2660- if (!tc) return SWIG_ERROR;
2661- *ptr = SWIG_TypeCast(tc,vptr);
2662+ if (tc) {
2663+ int newmemory = 0;
2664+ *ptr = SWIG_TypeCast(tc,vptr,&newmemory);
2665+ assert(!newmemory); /* newmemory handling not yet implemented */
2666+ } else {
2667+ return SWIG_ERROR;
2668+ }
2669 } else {
2670 *ptr = vptr;
2671 }
2672@@ -2469,7 +2501,7 @@
2673
2674 #define SWIG_name "_libecryptfs"
2675
2676-#define SWIGVERSION 0x010331
2677+#define SWIGVERSION 0x010336
2678 #define SWIG_VERSION SWIGVERSION
2679
2680
2681@@ -2567,7 +2599,6 @@
2682 PyObject *resultobj = 0;
2683 char *arg1 = (char *) 0 ;
2684 char *arg2 = (char *) 0 ;
2685- binary_data result;
2686 int res1 ;
2687 char *buf1 = 0 ;
2688 int alloc1 = 0 ;
2689@@ -2576,6 +2607,7 @@
2690 int alloc2 = 0 ;
2691 PyObject * obj0 = 0 ;
2692 PyObject * obj1 = 0 ;
2693+ binary_data result;
2694
2695 if (!PyArg_ParseTuple(args,(char *)"OO:ecryptfs_passphrase_blob",&obj0,&obj1)) SWIG_fail;
2696 res1 = SWIG_AsCharPtrAndSize(obj0, &buf1, NULL, &alloc1);
2697@@ -2590,7 +2622,7 @@
2698 arg2 = (char *)(buf2);
2699 result = ecryptfs_passphrase_blob(arg1,arg2);
2700 {
2701- resultobj = PyString_FromStringAndSize((char *)(&result)->data,(&result)->size);
2702+ resultobj = PyString_FromStringAndSize((char *)((&result)->data),(&result)->size);
2703 }
2704 if (alloc1 == SWIG_NEWOBJ) free((char*)buf1);
2705 if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
2706@@ -2605,11 +2637,11 @@
2707 SWIGINTERN PyObject *_wrap_ecryptfs_passphrase_sig_from_blob(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
2708 PyObject *resultobj = 0;
2709 char *arg1 = (char *) 0 ;
2710- binary_data result;
2711 int res1 ;
2712 char *buf1 = 0 ;
2713 int alloc1 = 0 ;
2714 PyObject * obj0 = 0 ;
2715+ binary_data result;
2716
2717 if (!PyArg_ParseTuple(args,(char *)"O:ecryptfs_passphrase_sig_from_blob",&obj0)) SWIG_fail;
2718 res1 = SWIG_AsCharPtrAndSize(obj0, &buf1, NULL, &alloc1);
2719@@ -2619,7 +2651,7 @@
2720 arg1 = (char *)(buf1);
2721 result = ecryptfs_passphrase_sig_from_blob(arg1);
2722 {
2723- resultobj = PyString_FromStringAndSize((char *)(&result)->data,(&result)->size);
2724+ resultobj = PyString_FromStringAndSize((char *)((&result)->data),(&result)->size);
2725 }
2726 if (alloc1 == SWIG_NEWOBJ) free((char*)buf1);
2727 return resultobj;
2728@@ -2633,15 +2665,15 @@
2729 PyObject *resultobj = 0;
2730 char *arg1 = (char *) 0 ;
2731 char *arg2 = (char *) 0 ;
2732+ int res1 ;
2733+ char *buf1 = 0 ;
2734+ int alloc1 = 0 ;
2735+ int res2 ;
2736+ char *buf2 = 0 ;
2737+ int alloc2 = 0 ;
2738+ PyObject * obj0 = 0 ;
2739+ PyObject * obj1 = 0 ;
2740 int result;
2741- int res1 ;
2742- char *buf1 = 0 ;
2743- int alloc1 = 0 ;
2744- int res2 ;
2745- char *buf2 = 0 ;
2746- int alloc2 = 0 ;
2747- PyObject * obj0 = 0 ;
2748- PyObject * obj1 = 0 ;
2749
2750 if (!PyArg_ParseTuple(args,(char *)"OO:ecryptfs_add_blob_to_keyring",&obj0,&obj1)) SWIG_fail;
2751 res1 = SWIG_AsCharPtrAndSize(obj0, &buf1, NULL, &alloc1);
2752@@ -2754,7 +2786,7 @@
2753 SWIG_InitializeModule(void *clientdata) {
2754 size_t i;
2755 swig_module_info *module_head, *iter;
2756- int found;
2757+ int found, init;
2758
2759 clientdata = clientdata;
2760
2761@@ -2764,6 +2796,9 @@
2762 swig_module.type_initial = swig_type_initial;
2763 swig_module.cast_initial = swig_cast_initial;
2764 swig_module.next = &swig_module;
2765+ init = 1;
2766+ } else {
2767+ init = 0;
2768 }
2769
2770 /* Try and load any already created modules */
2771@@ -2792,6 +2827,12 @@
2772 module_head->next = &swig_module;
2773 }
2774
2775+ /* When multiple interpeters are used, a module could have already been initialized in
2776+ a different interpreter, but not yet have a pointer in this interpreter.
2777+ In this case, we do not want to continue adding types... everything should be
2778+ set up already */
2779+ if (init == 0) return;
2780+
2781 /* Now work on filling in swig_module.types */
2782 #ifdef SWIGRUNTIME_DEBUG
2783 printf("SWIG_InitializeModule: size %d\n", swig_module.size);
2784
2785=== modified file 'src/libecryptfs/cipher_list.c'
2786--- src/libecryptfs/cipher_list.c 2009-04-22 09:05:00 +0000
2787+++ src/libecryptfs/cipher_list.c 2010-02-17 20:48:19 +0000
2788@@ -338,7 +338,7 @@
2789 {"tea", "tea.ko", 8, 16, 16, 7, 0},
2790 {"xeta", "tea.ko", 8, 16, 16, 9, 0},
2791 {"xtea", "tea.ko", 8, 16, 16, 8, 0},
2792- {"blowfish", "blowfish.ko", 16, 16, 32, 2, 1},
2793+ {"blowfish", "blowfish.ko", 16, 16, 56, 2, 1},
2794 {"twofish", "twofish.ko", 16, 16, 32, 4, 1},
2795 {"khazad", "khazad.ko", 8, 16, 16, 11, 0},
2796 {"cast5", "cast5.ko", 8, 5, 16, 14, 1},
2797
2798=== modified file 'src/libecryptfs/cmd_ln_parser.c'
2799--- src/libecryptfs/cmd_ln_parser.c 2009-04-22 09:05:00 +0000
2800+++ src/libecryptfs/cmd_ln_parser.c 2010-02-17 20:48:19 +0000
2801@@ -200,7 +200,7 @@
2802
2803 fd = open(fullpath, O_RDONLY);
2804 if (fd == -1) {
2805- rc = -EIO;
2806+ rc = -errno;
2807 goto out;
2808 }
2809 rc = parse_options_file(fd, nvp_list_head);
2810
2811=== modified file 'src/libecryptfs/decision_graph.c'
2812--- src/libecryptfs/decision_graph.c 2009-04-23 16:31:05 +0000
2813+++ src/libecryptfs/decision_graph.c 2010-02-17 20:48:19 +0000
2814@@ -209,8 +209,15 @@
2815 struct ecryptfs_name_val_pair *nvp_head,
2816 struct val_node **mnt_params, void **foo)
2817 {
2818+ static int repeated = 0;
2819+ static struct param_node *lastnode = NULL;
2820 int i, rc;
2821
2822+ if (current != lastnode)
2823+ repeated = 0;
2824+
2825+ lastnode = current;
2826+
2827 for (i = 0; i < current->num_transitions; i++) {
2828 struct transition_node *tn = &current->tl[i];
2829 struct ecryptfs_name_val_pair *nvp = nvp_head->next;
2830@@ -275,11 +282,17 @@
2831 trans_func_tok_id =
2832 tn->trans_func(ctx, current,
2833 mnt_params, foo);
2834- if (trans_func_tok_id == WRONG_VALUE &&
2835- (ctx->verbosity ||
2836- (current->flags & STDIN_REQUIRED))) {
2837- *next = current;
2838- return 0;
2839+ if (trans_func_tok_id == WRONG_VALUE) {
2840+ if (ctx->verbosity ||
2841+ (current->flags & STDIN_REQUIRED)) {
2842+ if (++repeated >= 5)
2843+ return -EINVAL;
2844+ else {
2845+ *next = current;
2846+ return 0;
2847+ }
2848+ } else
2849+ return -EINVAL;
2850 }
2851 if (trans_func_tok_id == MOUNT_ERROR ||
2852 trans_func_tok_id < 0)
2853@@ -289,6 +302,8 @@
2854 else return -EINVAL;
2855 }
2856 }
2857+ if (current->num_transitions)
2858+ return MOUNT_ERROR;
2859 return NULL_TOK;
2860 }
2861
2862@@ -560,10 +575,13 @@
2863 }
2864 prompt[i] = '\0';
2865 get_value:
2866- rc = (ctx->get_string)
2867- (&(node->val), prompt,
2868- (node->flags
2869- & ECRYPTFS_PARAM_FLAG_ECHO_INPUT));
2870+ if ((rc = (ctx->get_string)
2871+ (&(node->val), prompt,
2872+ (node->flags
2873+ & ECRYPTFS_PARAM_FLAG_ECHO_INPUT)))) {
2874+ free(prompt);
2875+ return rc;
2876+ }
2877 val = atoi(node->val);
2878 if (val > 0 && val <= node->num_transitions) {
2879 free(node->val);
2880@@ -627,26 +645,34 @@
2881 (&(node->val), prompt,
2882 (node->flags
2883 & ECRYPTFS_PARAM_FLAG_ECHO_INPUT));
2884+ free(prompt);
2885+ if (rc)
2886+ goto out;
2887 if (node->val[0] == '\0' &&
2888 (node->flags & ECRYPTFS_NONEMPTY_VALUE_REQUIRED)) {
2889 fprintf(stderr,"Wrong input, non-empty value "
2890 "required!\n");
2891 goto obtain_value;
2892 }
2893- free(prompt);
2894 if (node->flags & VERIFY_VALUE) {
2895 rc = asprintf(&verify_prompt, "Verify %s",
2896 node->prompt);
2897 if (rc == -1)
2898- return MOUNT_ERROR;
2899+ return -ENOMEM;
2900 rc = (ctx->get_string)
2901 (&verify, verify_prompt,
2902 (node->flags
2903 & ECRYPTFS_PARAM_FLAG_ECHO_INPUT));
2904+ free(verify_prompt);
2905 if (rc)
2906- return MOUNT_ERROR;
2907- if (strcmp(verify, node->val))
2908+ return -EIO;
2909+ rc = strcmp(verify, node->val);
2910+ free(verify);
2911+ if (rc) {
2912+ free(node->val);
2913+ node->val = NULL;
2914 goto obtain_value;
2915+ }
2916 }
2917 if (node->val[0] == '\0') {
2918 free(node->val);
2919
2920=== modified file 'src/libecryptfs/key_management.c'
2921--- src/libecryptfs/key_management.c 2009-04-22 09:36:25 +0000
2922+++ src/libecryptfs/key_management.c 2010-02-17 20:48:19 +0000
2923@@ -18,13 +18,10 @@
2924 * 02111-1307, USA.
2925 */
2926
2927+#include "config.h"
2928 #include <errno.h>
2929-#ifdef ENABLE_NSS
2930 #include <nss.h>
2931 #include <pk11func.h>
2932-#else
2933-#include <gcrypt.h>
2934-#endif /* #ifdef ENABLE_NSS */
2935 #include <keyutils.h>
2936 #ifndef S_SPLINT_S
2937 #include <stdio.h>
2938@@ -38,7 +35,7 @@
2939 #include <sys/mman.h>
2940 #include <sys/types.h>
2941 #include <sys/stat.h>
2942-#include "config.h"
2943+#include <pwd.h>
2944 #include "../include/ecryptfs.h"
2945
2946 #ifndef ENOKEY
2947@@ -166,8 +163,6 @@
2948 rc = (int)keyctl_search(KEY_SPEC_USER_KEYRING, "user", auth_tok_sig, 0);
2949 if (rc != -1) { /* we already have this key in keyring; we're done */
2950 rc = 1;
2951- syslog(LOG_WARNING, "Passphrase key already in keyring;"
2952- " rc = [%d]\n", rc);
2953 goto out;
2954 } else if ((rc == -1) && (errno != ENOKEY)) {
2955 int errnum = errno;
2956@@ -180,11 +175,11 @@
2957 rc = add_key("user", auth_tok_sig, (void *)auth_tok,
2958 sizeof(struct ecryptfs_auth_tok), KEY_SPEC_USER_KEYRING);
2959 if (rc == -1) {
2960- int errnum = errno;
2961-
2962+ rc = -errno;
2963 syslog(LOG_ERR, "Error adding key with sig [%s]; rc = [%d] "
2964 "\"%m\"\n", auth_tok_sig, rc);
2965- rc = (errnum < 0) ? errnum : errnum * -1;
2966+ if (rc == -EDQUOT)
2967+ syslog(LOG_WARNING, "Error adding key to keyring - keyring is full\n");
2968 goto out;
2969 }
2970 rc = 0;
2971@@ -300,7 +295,6 @@
2972 ECRYPTFS_AES_BLOCK_SIZE + 1];
2973 int encrypted_passphrase_pos = 0;
2974 int decrypted_passphrase_pos = 0;
2975-#ifdef ENABLE_NSS
2976 int tmp1_outlen = 0;
2977 int tmp2_outlen = 0;
2978 SECStatus err;
2979@@ -309,11 +303,6 @@
2980 PK11SlotInfo *slot = NULL;
2981 PK11Context *enc_ctx = NULL;
2982 SECItem *sec_param = NULL;
2983-#else
2984-#warning Building against gcrypt instead of nss
2985- gcry_cipher_hd_t gcry_handle;
2986- gcry_error_t gcry_err;
2987-#endif /* #ifdef ENABLE_NSS */
2988 int encrypted_passphrase_bytes;
2989 int decrypted_passphrase_bytes;
2990 int fd;
2991@@ -345,7 +334,6 @@
2992 - (decrypted_passphrase_bytes
2993 % ECRYPTFS_AES_BLOCK_SIZE));
2994 encrypted_passphrase_bytes = decrypted_passphrase_bytes;
2995-#ifdef ENABLE_NSS
2996 NSS_NoDB_Init(NULL);
2997 slot = PK11_GetBestSlot(CKM_AES_ECB, NULL);
2998 key_item.data = (unsigned char *)wrapping_key;
2999@@ -406,41 +394,6 @@
3000 rc = - EIO;
3001 goto out;
3002 }
3003-#else
3004- if ((gcry_err = gcry_cipher_open(&gcry_handle, GCRY_CIPHER_AES,
3005- GCRY_CIPHER_MODE_ECB, 0))) {
3006- syslog(LOG_ERR, "Error attempting to initialize AES cipher; "
3007- "gcry_error_t = [%d]\n", gcry_err);
3008- rc = -EIO;
3009- goto out;
3010- }
3011- if ((gcry_err = gcry_cipher_setkey(gcry_handle, wrapping_key,
3012- ECRYPTFS_AES_KEY_BYTES))) {
3013- syslog(LOG_ERR, "Error attempting to set AES key; "
3014- "gcry_error_t = [%d]\n", gcry_err);
3015- rc = -EIO;
3016- gcry_cipher_close(gcry_handle);
3017- goto out;
3018- }
3019- while (decrypted_passphrase_bytes > 0) {
3020- if ((gcry_err = gcry_cipher_encrypt(
3021- gcry_handle,
3022- &encrypted_passphrase[encrypted_passphrase_pos],
3023- ECRYPTFS_AES_BLOCK_SIZE,
3024- &decrypted_passphrase[decrypted_passphrase_pos],
3025- ECRYPTFS_AES_BLOCK_SIZE))) {
3026- syslog(LOG_ERR, "Error attempting to encrypt block; "
3027- "gcry_error = [%d]\n", gcry_err);
3028- rc = -EIO;
3029- gcry_cipher_close(gcry_handle);
3030- goto out;
3031- }
3032- encrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
3033- decrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
3034- decrypted_passphrase_bytes -= ECRYPTFS_AES_BLOCK_SIZE;
3035- }
3036- gcry_cipher_close(gcry_handle);
3037-#endif /* #ifdef ENABLE_NSS */
3038 unlink(filename);
3039 if ((fd = open(filename, (O_WRONLY | O_CREAT | O_EXCL),
3040 (S_IRUSR | S_IWUSR))) == -1) {
3041@@ -486,7 +439,6 @@
3042 char encrypted_passphrase[ECRYPTFS_MAX_PASSPHRASE_BYTES + 1];
3043 int encrypted_passphrase_pos = 0;
3044 int decrypted_passphrase_pos = 0;
3045-#ifdef ENABLE_NSS
3046 int tmp1_outlen = 0;
3047 int tmp2_outlen = 0;
3048 SECStatus err;
3049@@ -495,10 +447,6 @@
3050 PK11SlotInfo *slot = NULL;
3051 PK11Context *enc_ctx = NULL;
3052 SECItem *sec_param = NULL;
3053-#else
3054- gcry_cipher_hd_t gcry_handle;
3055- gcry_error_t gcry_err;
3056-#endif /* #ifdef ENABLE_NSS */
3057 int encrypted_passphrase_bytes;
3058 int fd;
3059 ssize_t size;
3060@@ -545,7 +493,6 @@
3061 goto out;
3062 }
3063 encrypted_passphrase_bytes = size;
3064-#ifdef ENABLE_NSS
3065 NSS_NoDB_Init(NULL);
3066 slot = PK11_GetBestSlot(CKM_AES_ECB, NULL);
3067 key_item.data = (unsigned char *)wrapping_key;
3068@@ -605,41 +552,6 @@
3069 rc = - EIO;
3070 goto out;
3071 }
3072-#else
3073- if ((gcry_err = gcry_cipher_open(&gcry_handle, GCRY_CIPHER_AES,
3074- GCRY_CIPHER_MODE_ECB, 0))) {
3075- syslog(LOG_ERR, "Error attempting to initialize AES cipher; "
3076- "gcry_error_t = [%d]\n", gcry_err);
3077- rc = -EIO;
3078- goto out;
3079- }
3080- if ((gcry_err = gcry_cipher_setkey(gcry_handle, wrapping_key,
3081- ECRYPTFS_AES_KEY_BYTES))) {
3082- syslog(LOG_ERR, "Error attempting to set AES key; "
3083- "gcry_error_t = [%d]\n", gcry_err);
3084- rc = -EIO;
3085- gcry_cipher_close(gcry_handle);
3086- goto out;
3087- }
3088- memset(decrypted_passphrase, 0, ECRYPTFS_MAX_PASSPHRASE_BYTES + 1);
3089- while (encrypted_passphrase_bytes > 0) {
3090- if ((gcry_err = gcry_cipher_decrypt(
3091- gcry_handle,
3092- &decrypted_passphrase[encrypted_passphrase_pos],
3093- ECRYPTFS_AES_BLOCK_SIZE,
3094- &encrypted_passphrase[decrypted_passphrase_pos],
3095- ECRYPTFS_AES_BLOCK_SIZE))) {
3096- syslog(LOG_ERR, "Error attempting to decrypt block; "
3097- "gcry_error = [%d]\n", gcry_err);
3098- rc = -EIO;
3099- gcry_cipher_close(gcry_handle);
3100- goto out;
3101- }
3102- encrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
3103- decrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
3104- encrypted_passphrase_bytes -= ECRYPTFS_AES_BLOCK_SIZE;
3105- }
3106-#endif /* #ifdef ENABLE_NSS */
3107 out:
3108 return rc;
3109 }
3110@@ -676,18 +588,20 @@
3111 if ((rc = ecryptfs_add_passphrase_key_to_keyring(
3112 auth_tok_sig,
3113 decrypted_passphrase,
3114- ECRYPTFS_DEFAULT_SALT_FNEK_HEX))) {
3115+ ECRYPTFS_DEFAULT_SALT_FNEK_HEX)) != 0) {
3116 syslog(LOG_ERR,
3117 "Error attempting to add filename encryption key to "
3118 "user session keyring; rc = [%d]\n", rc);
3119+ goto out;
3120 }
3121 }
3122 if ((rc = ecryptfs_add_passphrase_key_to_keyring(auth_tok_sig,
3123 decrypted_passphrase,
3124- salt))) {
3125+ salt)) != 0) {
3126 syslog(LOG_ERR, "Error attempting to add passphrase key to "
3127 "user session keyring; rc = [%d]\n", rc);
3128- }
3129+ } else
3130+ rc = 0;
3131 out:
3132 return rc;
3133 }
3134@@ -744,10 +658,13 @@
3135 rc = add_key("user", auth_tok_sig, (void *)auth_tok,
3136 (sizeof(struct ecryptfs_auth_tok) + blob_size),
3137 KEY_SPEC_USER_KEYRING);
3138- if (rc < 0)
3139+ if (rc < 0) {
3140+ rc = -errno;
3141 syslog(LOG_ERR, "Error adding key with sig [%s]; rc ="
3142 " [%d]\n", auth_tok_sig, rc);
3143- else rc = 0;
3144+ if (rc == -EDQUOT)
3145+ syslog(LOG_WARNING, "Error adding key to keyring - keyring is full\n");
3146+ } else rc = 0;
3147 out:
3148 if (auth_tok != NULL) {
3149 memset(auth_tok, 0, (sizeof(struct ecryptfs_auth_tok) + blob_size));
3150@@ -765,14 +682,14 @@
3151 memset(&nvp_list_head, 0, sizeof(struct ecryptfs_name_val_pair));
3152 rc = ecryptfs_parse_rc_file(&nvp_list_head);
3153 if (rc) {
3154- if (rc != -EIO) {
3155+ if (rc != -ENOENT) {
3156 syslog(LOG_WARNING,
3157 "Error attempting to parse .ecryptfsrc file; "
3158 "rc = [%d]", rc);
3159 }
3160 goto out;
3161 }
3162- nvp = &nvp_list_head;
3163+ nvp = nvp_list_head.next;
3164 while (nvp) {
3165 if (strcmp(nvp->name, "salt") == 0) {
3166 int valsize;
3167@@ -780,7 +697,7 @@
3168 if (!nvp->value)
3169 goto next_iteration;
3170 valsize = strlen(nvp->value);
3171- if (valsize != ECRYPTFS_SALT_SIZE_HEX);
3172+ if (valsize != ECRYPTFS_SALT_SIZE_HEX)
3173 goto next_iteration;
3174 memcpy(salt_hex, nvp->value, ECRYPTFS_SALT_SIZE_HEX);
3175 goto out_free;
3176@@ -917,7 +834,8 @@
3177 ecryptfs_enable_echo(&current_settings);
3178 p = strrchr(passphrase, '\n');
3179 if (p) *p = '\0';
3180- printf("\n");
3181+ if (prompt != NULL)
3182+ printf("\n");
3183 if (strlen(passphrase) > ECRYPTFS_MAX_PASSWORD_LENGTH) {
3184 fprintf(stderr,"Passphrase is too long. Use at most %u "
3185 "characters long passphrase.\n",
3186@@ -927,3 +845,23 @@
3187 }
3188 return passphrase;
3189 }
3190+
3191+char *ecryptfs_get_wrapped_passphrase_filename() {
3192+ struct passwd *pwd = NULL;
3193+ struct stat s;
3194+ char *filename = NULL;
3195+ if ((pwd = getpwuid(getuid())) == NULL) {
3196+ perror("getpwuid");
3197+ return NULL;
3198+ }
3199+ if ((asprintf(&filename,
3200+ "%s/.ecryptfs/wrapped-passphrase", pwd->pw_dir) < 0)) {
3201+ perror("asprintf");
3202+ return NULL;
3203+ }
3204+ if (stat(filename, &s) != 0) {
3205+ perror("stat");
3206+ return NULL;
3207+ }
3208+ return filename;
3209+}
3210
3211=== modified file 'src/libecryptfs/libecryptfs.pc.in'
3212--- src/libecryptfs/libecryptfs.pc.in 2009-02-03 08:50:36 +0000
3213+++ src/libecryptfs/libecryptfs.pc.in 2010-02-17 20:48:19 +0000
3214@@ -6,5 +6,5 @@
3215 Name: libecryptfs
3216 Description: eCryptfs library
3217 Version: @PACKAGE_VERSION@
3218-Cflags: -I${includedir} @LIBGCRYPT_CFLAGS@ @KEYUTILS_CFLAGS@
3219-Libs: @LIBGCRYPT_LIBS@ @KEYUTILS_LIBS@ -L${libdir} -lecryptfs
3220+Cflags: -I${includedir} @KEYUTILS_CFLAGS@
3221+Libs: @KEYUTILS_LIBS@ -L${libdir} -lecryptfs
3222
3223=== modified file 'src/libecryptfs/main.c'
3224--- src/libecryptfs/main.c 2009-02-09 15:33:25 +0000
3225+++ src/libecryptfs/main.c 2010-02-17 20:48:19 +0000
3226@@ -21,12 +21,8 @@
3227
3228 #include "config.h"
3229 #include <errno.h>
3230-#ifdef ENABLE_NSS
3231 #include <nss.h>
3232 #include <pk11func.h>
3233-#else
3234-#include <gcrypt.h>
3235-#endif /* #ifdef ENABLE_NSS */
3236 #include <mntent.h>
3237 #ifndef S_SPLINT_S
3238 #include <stdio.h>
3239@@ -37,9 +33,10 @@
3240 #include <signal.h>
3241 #include <sys/mount.h>
3242 #include <getopt.h>
3243+#include <sys/types.h>
3244 #include <keyutils.h>
3245-#include <sys/types.h>
3246 #include <sys/ipc.h>
3247+#include <sys/param.h>
3248 #include <sys/shm.h>
3249 #include <sys/sem.h>
3250 #include "../include/ecryptfs.h"
3251@@ -77,16 +74,8 @@
3252
3253 int do_hash(char *src, int src_size, char *dst, int algo)
3254 {
3255-#ifdef ENABLE_NSS
3256 SECStatus err;
3257-#else
3258- gcry_md_hd_t hd;
3259- gcry_error_t err = 0;
3260- unsigned char * hash;
3261- unsigned int mdlen;
3262-#endif /* #ifdef ENABLE_NSS */
3263
3264-#ifdef ENABLE_NSS
3265 NSS_NoDB_Init(NULL);
3266 err = PK11_HashBuf(algo, (unsigned char *)dst, (unsigned char *)src,
3267 src_size);
3268@@ -97,23 +86,115 @@
3269 err = -EINVAL;
3270 goto out;
3271 }
3272-#else
3273- err = gcry_md_open(&hd, algo, 0);
3274- mdlen = gcry_md_get_algo_dlen(algo);
3275- if (err) {
3276- syslog(LOG_ERR, "Failed to open hash algo [%d]: "
3277- "[%d]\n", algo, err);
3278- goto out;
3279- }
3280- gcry_md_write(hd, src, src_size);
3281- hash = gcry_md_read(hd, algo);
3282- memcpy(dst, hash, mdlen);
3283- gcry_md_close(hd);
3284-#endif /* #ifdef ENABLE_NSS */
3285 out:
3286 return (int)err;
3287 }
3288
3289+/* Read ecryptfs private mount from file
3290+ * Allocate and return a string
3291+ */
3292+char *ecryptfs_fetch_private_mnt(char *pw_dir) {
3293+ char *mnt_file = NULL;
3294+ char *mnt_default = NULL;
3295+ char *mnt = NULL;
3296+ FILE *fh = NULL;
3297+ /* Construct mnt file name */
3298+ if (asprintf(&mnt_default, "%s/%s", pw_dir, ECRYPTFS_PRIVATE_DIR) < 0
3299+ || mnt_default == NULL) {
3300+ perror("asprintf");
3301+ return NULL;
3302+ }
3303+ if (
3304+ asprintf(&mnt_file, "%s/.ecryptfs/%s.mnt", pw_dir, ECRYPTFS_PRIVATE_DIR) < 0
3305+ || mnt_file == NULL) {
3306+ perror("asprintf");
3307+ return NULL;
3308+ }
3309+ fh = fopen(mnt_file, "r");
3310+ if (fh == NULL) {
3311+ mnt = mnt_default;
3312+ } else {
3313+ flockfile(fh);
3314+ if ((mnt = (char *)malloc(MAXPATHLEN+1)) == NULL) {
3315+ perror("malloc");
3316+ return NULL;
3317+ }
3318+ if (fgets(mnt, MAXPATHLEN, fh) == NULL) {
3319+ mnt = mnt_default;
3320+ } else {
3321+ /* Ensure that mnt doesn't contain newlines */
3322+ mnt = strtok(mnt, "\n");
3323+ }
3324+ fclose(fh);
3325+ }
3326+ if (mnt_file != NULL)
3327+ free(mnt_file);
3328+ if (mnt_default != NULL && mnt != mnt_default)
3329+ free(mnt_default);
3330+ return mnt;
3331+}
3332+
3333+
3334+/* Check if an ecryptfs private device or mount point is mounted.
3335+ * Return 1 if a filesystem in mtab matches dev && mnt && sig.
3336+ * Return 0 otherwise.
3337+ */
3338+int ecryptfs_private_is_mounted(char *dev, char *mnt, char *sig, int mounting) {
3339+ FILE *fh = NULL;
3340+ struct mntent *m = NULL;
3341+ char *opt = NULL;
3342+ int mounted;
3343+ if (asprintf(&opt, "ecryptfs_sig=%s", sig) < 0) {
3344+ perror("asprintf");
3345+ return 0;
3346+ }
3347+ fh = setmntent("/proc/mounts", "r");
3348+ if (fh == NULL) {
3349+ perror("setmntent");
3350+ return 0;
3351+ }
3352+ mounted = 0;
3353+ flockfile(fh);
3354+ while ((m = getmntent(fh)) != NULL) {
3355+ if (strcmp(m->mnt_type, "ecryptfs") != 0)
3356+ /* Skip if this entry is not an ecryptfs mount */
3357+ continue;
3358+ if (mounting == 1) {
3359+ /* If mounting, return "already mounted" if EITHER the
3360+ * dev or the mnt dir shows up in mtab/mounts;
3361+ * regardless of the signature of such mounts;
3362+ */
3363+ if (dev != NULL && strcmp(m->mnt_fsname, dev) == 0) {
3364+ mounted = 1;
3365+ break;
3366+ }
3367+ if (mnt != NULL && strcmp(m->mnt_dir, mnt) == 0) {
3368+ mounted = 1;
3369+ break;
3370+ }
3371+ } else {
3372+ /* Otherwise, we're unmounting, and we need to be
3373+ * very conservative in finding a perfect match
3374+ * to unmount. The device, mountpoint, and signature
3375+ * must *all* match perfectly.
3376+ */
3377+ if (
3378+ strcmp(m->mnt_fsname, dev) == 0 &&
3379+ strcmp(m->mnt_dir, mnt) == 0 &&
3380+ hasmntopt(m, opt) != NULL
3381+ ) {
3382+ mounted = 1;
3383+ break;
3384+ }
3385+ }
3386+ }
3387+ endmntent(fh);
3388+ if (opt != NULL)
3389+ free(opt);
3390+ return mounted;
3391+}
3392+
3393+
3394 /**
3395 * TODO: We need to support more hash algs
3396 * @fekek: ECRYPTFS_MAX_KEY_BYTES bytes of allocated memory
3397@@ -133,11 +214,7 @@
3398 char salt_and_passphrase[ECRYPTFS_MAX_PASSPHRASE_BYTES
3399 + ECRYPTFS_SALT_SIZE];
3400 int passphrase_size;
3401-#ifdef ENABLE_NSS
3402 int alg = SEC_OID_SHA512;
3403-#else
3404- int alg = GCRY_MD_SHA512;
3405-#endif /* #ifdef ENABLE_NSS */
3406 int dig_len = SHA512_DIGEST_LENGTH;
3407 char buf[SHA512_DIGEST_LENGTH];
3408 int hash_iterations = ECRYPTFS_DEFAULT_NUM_HASH_ITERATIONS;
3409@@ -890,3 +967,4 @@
3410 {
3411 return &ctx_ops;
3412 }
3413+
3414
3415=== modified file 'src/libecryptfs/module_mgr.c'
3416--- src/libecryptfs/module_mgr.c 2009-04-21 17:59:16 +0000
3417+++ src/libecryptfs/module_mgr.c 2010-02-17 20:48:19 +0000
3418@@ -97,15 +97,20 @@
3419 .trans_func = sig_param_node_callback}}
3420 };
3421
3422-/* returns: 1 for str=="yes" or "y", 0 for "no" or "n", -1 elsewhere */
3423-static int is_yes(const char *str)
3424+/* returns:
3425+ * on_null for str == NULL
3426+ * 1 for str=="yes" or "y"
3427+ * 0 for str=="no" or "n"
3428+ * -1 elsewhere */
3429+static int is_yes(const char *str, int on_null)
3430 {
3431 if (str) {
3432 if (!strcmp(str,"y") || !strcmp(str,"yes"))
3433 return 1;
3434 if (!strcmp(str,"no") || !strcmp(str,"n"))
3435 return 0;
3436- }
3437+ } else
3438+ return on_null;
3439
3440 return -1;
3441 }
3442@@ -120,7 +125,7 @@
3443 {
3444 int rc;
3445
3446- if (((rc=is_yes(node->val)) == 1) || (node->flags & PARAMETER_SET)) {
3447+ if (((rc=is_yes(node->val, 0)) == 1) || (node->flags & PARAMETER_SET)) {
3448 rc = stack_push(head, opt_name);
3449 } else if (rc == -1)
3450 rc = WRONG_VALUE;
3451@@ -207,7 +212,7 @@
3452 static struct param_node filename_crypto_fnek_sig_param_node = {
3453 .num_mnt_opt_names = 1,
3454 .mnt_opt_names = {"ecryptfs_fnek_sig"},
3455- .prompt = "Filname Encryption Key (FNEK) Signature",
3456+ .prompt = "Filename Encryption Key (FNEK) Signature",
3457 .val_type = VAL_STR,
3458 .val = NULL,
3459 .display_opts = NULL,
3460@@ -227,7 +232,7 @@
3461 {
3462 int yn, rc = 0;
3463
3464- if (((yn=is_yes(node->val)) > 0)
3465+ if (((yn=is_yes(node->val, 0)) > 0)
3466 || (node->flags & PARAMETER_SET)) {
3467 int i;
3468 struct val_node *val_node;
3469@@ -407,6 +412,7 @@
3470 {"twofish", 32, 2},
3471 {"blowfish", 16, 1},
3472 {"blowfish", 32, 2},
3473+ {"blowfish", 56, 2},
3474 {"khazad", 16, 1},
3475 {"arc4", 16, 1},
3476 {"arc4", 32, 2},
3477@@ -432,15 +438,18 @@
3478 return rc;
3479 }
3480
3481-static int init_ecryptfs_key_bytes_param_node(char *cipher_name)
3482+static int init_ecryptfs_key_bytes_param_node(char *cipher_name,
3483+ int min, int max)
3484 {
3485 int i;
3486 int rc = 0;
3487
3488 i = 0;
3489 while (supported_key_bytes[i].cipher_name) {
3490- if (strcmp(cipher_name, supported_key_bytes[i].cipher_name)
3491- == 0) {
3492+ if ((supported_key_bytes[i].key_bytes >= min) &&
3493+ (supported_key_bytes[i].key_bytes <= max) &&
3494+ (strcmp(cipher_name, supported_key_bytes[i].cipher_name)
3495+ == 0)) {
3496 struct transition_node *tn;
3497
3498 tn = &ecryptfs_key_bytes_param_node.tl[
3499@@ -468,6 +477,11 @@
3500 }
3501 i++;
3502 }
3503+ if (ecryptfs_key_bytes_param_node.num_transitions == 0) {
3504+ syslog(LOG_ERR, "Error initializing key_bytes selection: "
3505+ "there is no posibility left for used params\n");
3506+ return -EINVAL;
3507+ }
3508 out:
3509 return rc;
3510 }
3511@@ -477,8 +491,40 @@
3512 {
3513 char *opt;
3514 int rc;
3515-
3516- rc = init_ecryptfs_key_bytes_param_node(node->val);
3517+ int min = 0, max = 999999;
3518+ struct val_node *tmp = *head, *tmpprev = NULL;
3519+
3520+ while (tmp) {
3521+ char *ptr;
3522+ int popval = 0;
3523+ if (tmp->val && (strstr(tmp->val,"max_key_bytes=") != NULL) &&
3524+ ((ptr=strchr(tmp->val,'=')) != NULL)) {
3525+ char *eptr;
3526+ max = strtol(++ptr, &eptr, 10);
3527+ if (eptr == ptr)
3528+ return -EINVAL;
3529+ popval = 1;
3530+ }
3531+ if (tmp->val && (strstr(tmp->val,"min_key_bytes=") != NULL) &&
3532+ ((ptr=strchr(tmp->val,'=')) != NULL)) {
3533+ char *eptr;
3534+ min = strtol(++ptr, &eptr, 10);
3535+ if (eptr == ptr)
3536+ return -EINVAL;
3537+ popval = 1;
3538+ }
3539+ if (popval) {
3540+ if (tmp == *head)
3541+ *head = (*head)->next;
3542+ stack_pop(&tmp);
3543+ if (tmpprev != NULL)
3544+ tmpprev->next = tmp;
3545+ }
3546+ tmpprev = tmp;
3547+ tmp = tmp->next;
3548+ }
3549+
3550+ rc = init_ecryptfs_key_bytes_param_node(node->val, min, max);
3551 if (rc) {
3552 syslog(LOG_ERR, "%s: Error initializing key_bytes param node; "
3553 "rc = [%d]\n", __FUNCTION__, rc);
3554
3555=== modified file 'src/pam_ecryptfs/Makefile.am'
3556--- src/pam_ecryptfs/Makefile.am 2009-02-03 08:50:36 +0000
3557+++ src/pam_ecryptfs/Makefile.am 2010-02-17 20:48:19 +0000
3558@@ -12,6 +12,6 @@
3559 endif
3560
3561 pam_ecryptfs_la_SOURCES = pam_ecryptfs.c
3562-pam_ecryptfs_la_CFLAGS = $(AM_CFLAGS) $(LIBGCRYPT_CFLAGS)
3563-pam_ecryptfs_la_LIBADD = $(top_builddir)/src/libecryptfs/libecryptfs.la $(PAM_LIBS) $(LIBGCRYPT_LIBS)
3564+pam_ecryptfs_la_CFLAGS = $(AM_CFLAGS)
3565+pam_ecryptfs_la_LIBADD = $(top_builddir)/src/libecryptfs/libecryptfs.la $(PAM_LIBS)
3566 pam_ecryptfs_la_LDFLAGS = $(AM_LDFLAGS) -module -avoid-version -shared
3567
3568=== modified file 'src/pam_ecryptfs/pam_ecryptfs.c'
3569--- src/pam_ecryptfs/pam_ecryptfs.c 2009-04-21 23:20:27 +0000
3570+++ src/pam_ecryptfs/pam_ecryptfs.c 2010-02-17 20:48:23 +0000
3571@@ -1,4 +1,5 @@
3572-/**
3573+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*-
3574+ *
3575 * pam_ecryptfs.c: PAM module that sends the user's authentication
3576 * tokens into the kernel keyring.
3577 *
3578@@ -73,30 +74,48 @@
3579 char *file_path;
3580 int rc = 0;
3581 struct stat s;
3582- if (asprintf(
3583- &file_path, "%s/.ecryptfs/%s",
3584- homedir,
3585- ECRYPTFS_DEFAULT_WRAPPED_PASSPHRASE_FILENAME) == -1)
3586- return -ENOMEM;
3587- if (stat(file_path, &s) != 0) {
3588- if (errno != ENOENT)
3589- rc = -errno;
3590- goto out;
3591- }
3592- free(file_path);
3593 if (asprintf(&file_path, "%s/.ecryptfs/auto-mount", homedir) == -1)
3594 return -ENOMEM;
3595 if (stat(file_path, &s) != 0) {
3596 if (errno != ENOENT)
3597 rc = -errno;
3598 goto out;
3599- }
3600+ }
3601 rc = 1;
3602 out:
3603 free(file_path);
3604 return rc;
3605 }
3606
3607+static int wrap_passphrase_if_necessary(char *username, uid_t uid, char *wrapped_pw_filename, char *passphrase, char *salt)
3608+{
3609+ char *unwrapped_pw_filename = NULL;
3610+ struct stat s;
3611+ int rc = 0;
3612+
3613+ rc = asprintf(&unwrapped_pw_filename, "/dev/shm/.ecryptfs-%s", username);
3614+ if (rc == -1) {
3615+ syslog(LOG_ERR, "Unable to allocate memory\n");
3616+ return -ENOMEM;
3617+ }
3618+ /* If /dev/shm/.ecryptfs-$USER exists and owned by the user
3619+ and ~/.ecryptfs/wrapped-passphrase does not exist
3620+ and a passphrase is set:
3621+ wrap the unwrapped passphrase file */
3622+ if (stat(unwrapped_pw_filename, &s) == 0 && (s.st_uid == uid) &&
3623+ stat(wrapped_pw_filename, &s) != 0 &&
3624+ passphrase != NULL && *passphrase != '\0' &&
3625+ username != NULL && *username != '\0') {
3626+ setuid(uid);
3627+ rc = ecryptfs_wrap_passphrase_file(wrapped_pw_filename, passphrase, salt, unwrapped_pw_filename);
3628+ if (rc != 0) {
3629+ syslog(LOG_ERR, "Error wrapping cleartext password; " "rc = [%d]\n", rc);
3630+ }
3631+ return rc;
3632+ }
3633+ return 0;
3634+}
3635+
3636 PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
3637 const char **argv)
3638 {
3639@@ -108,8 +127,10 @@
3640 char salt[ECRYPTFS_SALT_SIZE];
3641 char salt_hex[ECRYPTFS_SALT_SIZE_HEX];
3642 char *auth_tok_sig;
3643+ char *private_mnt = NULL;
3644 pid_t child_pid, tmp_pid;
3645 long rc;
3646+ uint32_t version;
3647
3648 syslog(LOG_INFO, "%s: Called\n", __FUNCTION__);
3649 rc = pam_get_user(pamh, &username, NULL);
3650@@ -130,6 +151,18 @@
3651 }
3652 if (!ecryptfs_pam_automount_set(homedir))
3653 goto out;
3654+ private_mnt = ecryptfs_fetch_private_mnt(homedir);
3655+ if (ecryptfs_private_is_mounted(NULL, private_mnt, NULL, 1)) {
3656+ syslog(LOG_INFO, "%s: %s is already mounted\n", __FUNCTION__,
3657+ homedir);
3658+ /* If private/home is already mounted, then we can skip
3659+ costly loading of keys */
3660+ goto out;
3661+ }
3662+ /* we need side effect of this check:
3663+ load ecryptfs module if not loaded already */
3664+ if (ecryptfs_get_version(&version) != 0)
3665+ syslog(LOG_WARNING, "Can't check if kernel supports ecryptfs\n");
3666 saved_uid = geteuid();
3667 seteuid(uid);
3668 rc = pam_get_item(pamh, PAM_AUTHTOK, (const void **)&passphrase);
3669@@ -147,7 +180,6 @@
3670 }
3671 rc = ecryptfs_read_salt_hex_from_rc(salt_hex);
3672 if (rc) {
3673- syslog(LOG_WARNING, "%s\n", ECRYPTFS_WARN_DEFAULT_SALT);
3674 from_hex(salt, ECRYPTFS_DEFAULT_SALT_HEX, ECRYPTFS_SALT_SIZE);
3675 } else
3676 from_hex(salt, salt_hex, ECRYPTFS_SALT_SIZE);
3677@@ -166,7 +198,9 @@
3678 if ((argc == 1)
3679 && (memcmp(argv[0], "unwrap\0", 7) == 0)) {
3680 char *wrapped_pw_filename;
3681-
3682+ char *unwrapped_pw_filename;
3683+ struct stat s;
3684+
3685 rc = asprintf(
3686 &wrapped_pw_filename, "%s/.ecryptfs/%s",
3687 homedir,
3688@@ -176,6 +210,11 @@
3689 rc = -ENOMEM;
3690 goto out_child;
3691 }
3692+ if (wrap_passphrase_if_necessary(username, uid, wrapped_pw_filename, passphrase, salt) == 0) {
3693+ syslog(LOG_INFO, "Passphrase file wrapped");
3694+ } else {
3695+ goto out_child;
3696+ }
3697 rc = ecryptfs_insert_wrapped_passphrase_into_keyring(
3698 auth_tok_sig, wrapped_pw_filename, passphrase,
3699 salt);
3700@@ -185,9 +224,6 @@
3701 auth_tok_sig, passphrase, salt);
3702 }
3703 if (rc == 1) {
3704- syslog(LOG_WARNING, "There is already a key in the "
3705- "user session keyring for the given "
3706- "passphrase.\n");
3707 goto out_child;
3708 }
3709 if (rc) {
3710@@ -198,8 +234,8 @@
3711 if (fork() == 0) {
3712 if ((rc = ecryptfs_set_zombie_session_placeholder())) {
3713 syslog(LOG_ERR, "Error attempting to create "
3714- "and register zombie process; "
3715- "rc = [%ld]\n", rc);
3716+ "and register zombie process; "
3717+ "rc = [%ld]\n", rc);
3718 }
3719 }
3720 out_child:
3721@@ -211,6 +247,8 @@
3722 syslog(LOG_WARNING,
3723 "waitpid() returned with error condition\n");
3724 out:
3725+ if (private_mnt != NULL)
3726+ free(private_mnt);
3727 return PAM_SUCCESS;
3728 }
3729
3730@@ -272,7 +310,7 @@
3731 return 1;
3732 }
3733 if (
3734- (asprintf(&sigfile, "%s/.ecryptfs/%s.sig", pwd->pw_dir,
3735+ (asprintf(&sigfile, "%s/.ecryptfs/%s.sig", pwd->pw_dir,
3736 PRIVATE_DIR) < 0) || sigfile == NULL) {
3737 syslog(LOG_ERR, "Error allocating memory for sigfile name");
3738 return 1;
3739@@ -288,7 +326,7 @@
3740 if ((pid = fork()) < 0) {
3741 syslog(LOG_ERR, "Error setting up private mount");
3742 return 1;
3743- }
3744+ }
3745 if (pid == 0) {
3746 if (mount == 1) {
3747 if ((asprintf(&recorded,
3748@@ -313,7 +351,7 @@
3749 }
3750 /* run mount.ecryptfs_private as the user */
3751 setresuid(pwd->pw_uid, pwd->pw_uid, pwd->pw_uid);
3752- execl("/sbin/mount.ecryptfs_private",
3753+ execl("/sbin/mount.ecryptfs_private",
3754 "mount.ecryptfs_private", NULL);
3755 } else {
3756 if (stat(autofile, &s) != 0) {
3757@@ -324,14 +362,12 @@
3758 }
3759 /* run umount.ecryptfs_private as the user */
3760 setresuid(pwd->pw_uid, pwd->pw_uid, pwd->pw_uid);
3761- execl("/sbin/umount.ecryptfs_private",
3762+ execl("/sbin/umount.ecryptfs_private",
3763 "umount.ecryptfs_private", NULL);
3764 }
3765 return 1;
3766 } else {
3767 waitpid(pid, &rc, 0);
3768- syslog(LOG_INFO,
3769- "Mount of private directory return code [%d]", rc);
3770 goto out;
3771 }
3772 out:
3773@@ -374,12 +410,10 @@
3774 char *old_passphrase = NULL;
3775 char *new_passphrase = NULL;
3776 char *wrapped_pw_filename;
3777- char *unwrapped_pw_filename;
3778 char *name = NULL;
3779 char salt[ECRYPTFS_SALT_SIZE];
3780 char salt_hex[ECRYPTFS_SALT_SIZE_HEX];
3781 pid_t child_pid, tmp_pid;
3782- struct stat s;
3783 int rc = PAM_SUCCESS;
3784
3785 rc = pam_get_user(pamh, &username, NULL);
3786@@ -434,36 +468,17 @@
3787 rc = -ENOMEM;
3788 goto out;
3789 }
3790- rc = asprintf(&unwrapped_pw_filename, "/dev/shm/.ecryptfs-%s", name);
3791- if (rc == -1) {
3792- syslog(LOG_ERR, "Unable to allocate memory\n");
3793- rc = -ENOMEM;
3794- goto out;
3795- }
3796 if ((rc = ecryptfs_read_salt_hex_from_rc(salt_hex))) {
3797- syslog(LOG_WARNING, "%s\n", ECRYPTFS_WARN_DEFAULT_SALT);
3798 from_hex(salt, ECRYPTFS_DEFAULT_SALT_HEX, ECRYPTFS_SALT_SIZE);
3799 } else {
3800 from_hex(salt, salt_hex, ECRYPTFS_SALT_SIZE);
3801 }
3802- /* If /dev/shm/.ecryptfs-$USER exists and owned by the user
3803- and ~/.ecryptfs/wrapped-passphrase does not exist
3804- and a new_passphrase is set:
3805- wrap the unwrapped passphrase file */
3806- if (stat(unwrapped_pw_filename, &s) == 0 && (s.st_uid == uid) &&
3807- stat(wrapped_pw_filename, &s) != 0 &&
3808- new_passphrase != NULL && *new_passphrase != '\0' &&
3809- name != NULL && *name != '\0') {
3810- setuid(uid);
3811- rc = ecryptfs_wrap_passphrase_file(wrapped_pw_filename,
3812- new_passphrase, salt, unwrapped_pw_filename);
3813- if (rc != 0) {
3814- syslog(LOG_ERR,
3815- "Error wrapping cleartext password; "
3816- "rc = [%d]\n", rc);
3817- }
3818+ if (wrap_passphrase_if_necessary(username, uid, wrapped_pw_filename, new_passphrase, salt) == 0) {
3819+ syslog(LOG_INFO, "Passphrase file wrapped");
3820+ } else {
3821 goto out;
3822 }
3823+
3824 seteuid(saved_uid);
3825 if (!old_passphrase || !new_passphrase || *new_passphrase == '\0') {
3826 syslog(LOG_WARNING, "eCryptfs PAM passphrase change module "
3827
3828=== added directory 'src/python'
3829=== added file 'src/python/__init__.py'
3830=== added file 'src/python/ecryptfsapi.py'
3831--- src/python/ecryptfsapi.py 1970-01-01 00:00:00 +0000
3832+++ src/python/ecryptfsapi.py 2010-02-17 20:48:23 +0000
3833@@ -0,0 +1,82 @@
3834+#!/usr/bin/env python
3835+#
3836+# ecryptfsapi.py, Copyright 2008, 2009 Michael Rooney <mrooney@ubuntu.com>
3837+# Date: 2009-05-28
3838+# Version: 0.4
3839+#
3840+# This is a python API for interacting with ecryptfs-utils and its
3841+# encrypted directories.
3842+#
3843+# This program is free software: you can redistribute it and/or modify
3844+# it under the terms of the GNU General Public License as published by
3845+# the Free Software Foundation, either version 3 of the License, or
3846+# (at your option) any later version.
3847+#
3848+# This program is distributed in the hope that it will be useful,
3849+# but WITHOUT ANY WARRANTY; without even the implied warranty of
3850+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
3851+# GNU General Public License for more details.
3852+#
3853+# You should have received a copy of the GNU General Public License
3854+# along with this program. If not, see <http://www.gnu.org/licenses/>.
3855+
3856+import commands, os
3857+
3858+AUTOMOUNT_FILE = os.path.expanduser("~/.ecryptfs/auto-mount")
3859+AUTOUMOUNT_FILE = os.path.expanduser("~/.ecryptfs/auto-umount")
3860+PRIVATE_LOCATION_FILE = os.path.expanduser("~/.ecryptfs/Private.mnt")
3861+PRIVATE_LOCATION = os.path.exists(PRIVATE_LOCATION_FILE) and open(PRIVATE_LOCATION_FILE).read().strip()
3862+
3863+def set_automount(doAuto):
3864+ """Enable or disable automounting for this user."""
3865+ if doAuto:
3866+ command = "touch %s" % AUTOMOUNT_FILE
3867+ #open(AUTOMOUNT_FILE, "w")
3868+ else:
3869+ command = "rm %s" % AUTOMOUNT_FILE
3870+ #os.remove(AUTOMOUNT_FILE)
3871+
3872+ return commands.getstatusoutput(command)
3873+
3874+def get_automount():
3875+ """Return whether or not automounting is enabled for this user."""
3876+ return os.path.exists(AUTOMOUNT_FILE)
3877+
3878+def set_autounmount(doAuto):
3879+ """Enable or disable automounting for this user."""
3880+ if doAuto:
3881+ command = "touch %s" % AUTOUMOUNT_FILE
3882+ else:
3883+ command = "rm %s" % AUTOUMOUNT_FILE
3884+
3885+ return commands.getstatusoutput(command)
3886+
3887+def get_autounmount():
3888+ """Return whether or not autounmounting is enabled for this user."""
3889+ return os.path.exists(AUTOUMOUNT_FILE)
3890+
3891+def set_mounted(doMount):
3892+ """Set the mounted (unencrypted) state of ~/Private."""
3893+ if doMount:
3894+ command = "/sbin/mount.ecryptfs_private"
3895+ else:
3896+ command = "/sbin/umount.ecryptfs_private"
3897+
3898+ return commands.getstatusoutput(command)
3899+
3900+def get_mounted():
3901+ """Return whether or not ~/Private is mounted (unencrypted)."""
3902+ if PRIVATE_LOCATION:
3903+ mounts = open("/proc/mounts").read()
3904+ return PRIVATE_LOCATION in mounts
3905+ else:
3906+ return False
3907+
3908+def needs_setup():
3909+ """
3910+ Return whether or not an encrypted directory has been set up by ecryptfs
3911+ for this user, either Home or Private.
3912+ """
3913+ encryptedHome = False #TODO: implement
3914+ encryptedPrivate = PRIVATE_LOCATION
3915+ return not (encryptedHome or encryptedPrivate)
3916
3917=== modified file 'src/utils/Makefile.am'
3918--- src/utils/Makefile.am 2009-04-21 23:36:43 +0000
3919+++ src/utils/Makefile.am 2010-02-17 20:48:23 +0000
3920@@ -1,6 +1,6 @@
3921 MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
3922
3923-EXTRA_DIST=ecryptfsrc ecryptfs-rewrite-file ecryptfs-setup-private ecryptfs-setup-swap ecryptfs-mount-private ecryptfs-umount-private ecryptfs-dot-private
3924+EXTRA_DIST=ecryptfsrc ecryptfs-rewrite-file ecryptfs-setup-private ecryptfs-setup-swap ecryptfs-mount-private ecryptfs-umount-private ecryptfs-migrate-home
3925
3926 rootsbin_PROGRAMS=mount.ecryptfs \
3927 umount.ecryptfs \
3928@@ -16,7 +16,8 @@
3929 ecryptfs-mount-private \
3930 ecryptfs-umount-private \
3931 ecryptfs-rewrite-file \
3932- ecryptfs-dot-private
3933+ ecryptfs-migrate-home
3934+bin2dir = $(bindir)
3935
3936 noinst_PROGRAMS=test
3937
3938@@ -55,7 +56,7 @@
3939 ecryptfs_generate_tpm_key_LDADD = $(TSPI_LIBS)
3940
3941 mount_ecryptfs_private_SOURCES = mount.ecryptfs_private.c
3942-mount_ecryptfs_private_LDADD = $(KEYUTILS_LIBS)
3943+mount_ecryptfs_private_LDADD = $(top_builddir)/src/libecryptfs/libecryptfs.la $(KEYUTILS_LIBS)
3944
3945 ecryptfs_stat_SOURCES = ecryptfs-stat.c
3946 ecryptfs_stat_LDADD = $(top_builddir)/src/libecryptfs/libecryptfs.la
3947
3948=== removed file 'src/utils/ecryptfs-dot-private'
3949--- src/utils/ecryptfs-dot-private 2009-04-08 22:36:45 +0000
3950+++ src/utils/ecryptfs-dot-private 1970-01-01 00:00:00 +0000
3951@@ -1,34 +0,0 @@
3952-#!/bin/sh -e
3953-#
3954-# ecryptfs-dot-private
3955-# Copyright (C) 2009 Canonical Ltd.
3956-#
3957-# Authors: Dustin Kirkland <kirkland@canonical.com>
3958-#
3959-# This program is free software: you can redistribute it and/or modify
3960-# it under the terms of the GNU General Public License as published by
3961-# the Free Software Foundation, version 2 of the License.
3962-#
3963-# This program is distributed in the hope that it will be useful,
3964-# but WITHOUT ANY WARRANTY; without even the implied warranty of
3965-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
3966-# GNU General Public License for more details.
3967-#
3968-# You should have received a copy of the GNU General Public License
3969-
3970-if echo "$0" | grep -qs "ecryptfs"; then
3971- echo "ERROR: This file must be sourced, rather than executed:"
3972- echo
3973- echo " . $0"
3974- echo
3975- exit 1
3976-fi
3977-
3978-# Hacky, umount.ecryptfs_private should be taught to exit 1 on
3979-# unsuccessful unmount, must check who else depends on this exit code.
3980-if /sbin/umount.ecryptfs_private | grep -v "Sessions still open"; then
3981- cd "$HOME"/.Private
3982-else
3983- echo "ERROR: Unable to access .Private, please close some sessions"
3984-fi
3985-/sbin/mount.ecryptfs_private
3986
3987=== added file 'src/utils/ecryptfs-migrate-home'
3988--- src/utils/ecryptfs-migrate-home 1970-01-01 00:00:00 +0000
3989+++ src/utils/ecryptfs-migrate-home 2010-02-17 20:48:23 +0000
3990@@ -0,0 +1,195 @@
3991+#!/bin/sh
3992+# -*- sh-basic-offset: 4; sh-indentation: 4; tab-width: 4; indent-tabs-mode: t; sh-indent-comment: t; -*-
3993+# This script encrypts an user's home
3994+#
3995+# Written by Yan Li <yan.i.li@intel.com>, <yanli@gnome.org>
3996+# Copyright (C) 2010 Intel Corporation
3997+#
3998+# Modified by Dustin Kirkland <kirkland@canonical.com>
3999+#
4000+# This program is free software; you can redistribute it and/or
4001+# modify it under the terms of the GNU General Public License as
4002+# published by the Free Software Foundation; either version 2 of the
4003+# License, or (at your option) any later version.
4004+#
4005+# This program is distributed in the hope that it will be useful, but
4006+# WITHOUT ANY WARRANTY; without even the implied warranty of
4007+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
4008+# General Public License for more details.
4009+#
4010+# You should have received a copy of the GNU General Public License
4011+# along with this program; if not, write to the Free Software
4012+# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
4013+# 02111-1307, USA.
4014+
4015+set -e
4016+
4017+PRIVATE_DIR="Private"
4018+
4019+usage() {
4020+ echo "
4021+Usage:
4022+
4023+$0 -u USER
4024+
4025+ -u,--user Migrate USER's home directory to an encrypted home directory
4026+
4027+WARNING: Make a complete backup copy of the non-encrypted data to
4028+another system or external media. This script is dangerous and, in
4029+case of an error, could result in data lost, or lock you out of your
4030+system!
4031+
4032+This program must be executed by root.
4033+
4034+"
4035+ exit 1
4036+}
4037+
4038+error() {
4039+ echo "$(gettext 'ERROR: ')" "$@" 1>&2
4040+ exit 1
4041+}
4042+
4043+warning() {
4044+ echo "$(gettext 'WARNING: ')" "$@" 1>&2
4045+}
4046+
4047+info() {
4048+ echo "$(gettext 'INFO: ')" "$@" 1>&2
4049+}
4050+
4051+assert_dir_empty() {
4052+ local DIR="$1"
4053+ if [ -e "$DIR" ]; then
4054+ # if $DIR is a directory, make sure it's empty
4055+ if [ -d "$DIR" ]; then
4056+ ls=$(ls -A "$DIR" | wc -l)
4057+ if [ "$ls" != "0" ]; then
4058+ echo 1>&2 "If you already have some data in directory $DIR,"
4059+ echo 1>&2 "please move all of these files and directories out of the way, and"
4060+ echo 1>&2 "follow the instructions in:"
4061+ echo 1>&2 " ecryptfs-setup-private --undo"
4062+ echo 1>&2
4063+ error "$DIR is not empty, cannot continue."
4064+ fi
4065+ else
4066+ error "$DIR exists but is not an empty directory, cannot continue."
4067+ fi
4068+ fi
4069+}
4070+
4071+# get user home by username
4072+get_user_home () {
4073+ local USER_NAME="$1"
4074+ local USER_HOME=$(grep "^$USER_NAME:" /etc/passwd | cut -d":" -f 6)
4075+ if [ -z "$USER_HOME" ]; then
4076+ error "Cannot find the home directory of $USER_NAME."
4077+ fi
4078+ echo "$USER_HOME"
4079+}
4080+
4081+sanity_check () {
4082+ local USER_NAME="$1"
4083+ local USER_HOME="$2"
4084+ if [ -e "$USER_HOME/.ecryptfs" ]; then
4085+ error "$USER_HOME appears to be encrypted already."
4086+ fi
4087+ # Check for rsync
4088+ if ! which rsync >/dev/null 2>&1; then
4089+ error "Please install the rsync package."
4090+ fi
4091+ # Check free space: make sure we have sufficient disk space
4092+ # available. To make a full copy, we will need at least 2.5x the
4093+ # disk usage of the target home directory.
4094+ info "Checking disk space, this may take a few moments. Please be patient."
4095+ needed=$(du -s "$USER_HOME" | awk '{printf "%.0f", $1*2.5}')
4096+ free=$(df -P "$USER_HOME" | tail -n 1 | awk '{print $4}')
4097+ if [ $needed -gt $free ]; then
4098+ info "2.5x the size your current home directory is required to perform a migration."
4099+ info "Once the migration succeeds, you may recover most of this space by deleting the cleartext directory."
4100+ error "Not enough free disk space."
4101+ fi
4102+ assert_dir_empty "$USER_HOME/.$PRIVATE_DIR"
4103+ assert_dir_empty "$USER_HOME/.ecryptfs"
4104+ assert_dir_empty "/home/.ecryptfs/$USER_NAME"
4105+}
4106+
4107+encrypt_dir () {
4108+ local USER_NAME="$1"
4109+ local USER_HOME="$2"
4110+ if ! which lsof >/dev/null 2>&1; then
4111+ info "Please install lsof."
4112+ error "Can not tell whether $USER_HOME is in use or not."
4113+ fi
4114+ info "Checking for open files in $USER_HOME"
4115+ lsof=$(lsof +D "$USER_HOME" | wc -l)
4116+ if [ "$lsof" != "0" ]; then
4117+ info "The following files are in use:"
4118+ echo
4119+ lsof +D "$USER_HOME" | sed "s/^/ /"
4120+ echo
4121+ error "Cannot proceed."
4122+ fi
4123+ # start encryption
4124+ orig=$(mktemp /home/$USER_NAME.XXXXXXXX)
4125+ rm "$orig" && mv "$USER_HOME" "$orig"
4126+ chmod 700 "$orig"
4127+ mkdir -p -m 700 "$USER_HOME"
4128+ USER_GROUP=$(id -g "$USER_NAME")
4129+ chown "$USER_NAME:$USER_GROUP" "$USER_HOME" "$orig"
4130+ ECRYPTFS_SETUP_PRIVATE_ARGS=""
4131+ if [ -n "$LOGINPASS" ]; then
4132+ ECRYPTFS_SETUP_PRIVATE_ARGS="-l $LOGINPASS"
4133+ fi
4134+ if [ -n "$MOUNTPASS" ]; then
4135+ ECRYPTFS_SETUP_PRIVATE_ARGS="$ECRYPTFS_SETUP_PRIVATE_ARGS -m $MOUNTPASS"
4136+ fi
4137+ if ! ecryptfs-setup-private -u "$USER_NAME" -b $ECRYPTFS_SETUP_PRIVATE_ARGS; then
4138+ # too bad, something went wrong, we'll try to recover
4139+ rm -rf "$USER_HOME"
4140+ mv "$orig" "$USER_HOME"
4141+ exit 1
4142+ fi
4143+ info "Encrypted home has been set up, encrypting files now...this may take a while."
4144+ rsync -a "$orig/" "$USER_HOME/"
4145+ umount "$USER_HOME/"
4146+ echo
4147+ info "======================================================================"
4148+ info "The file encryption appears to have completed successfully, however,"
4149+ info "$USER_NAME MUST LOGIN IMMEDIATELY (BEFORE THE NEXT REBOOT) TO COMPLETE THE MIGRATION!!!"
4150+ info "======================================================================"
4151+ echo
4152+ info "If $USER_NAME can log in and read and write their files, then the migration is complete, and you should remove $orig."
4153+ echo
4154+ info "Otherwise, remove $USER_HOME and move $orig back to $USER_HOME."
4155+ echo
4156+}
4157+
4158+DO_ENCRYPT=
4159+while true; do
4160+ [ -z "$1" ] && break
4161+ case "$1" in
4162+ -u|--user)
4163+ DO_ENCRYPT=1
4164+ USER_NAME="$2"
4165+ shift 2
4166+ ;;
4167+ *)
4168+ usage
4169+ ;;
4170+ esac
4171+done
4172+
4173+if [ "$DO_ENCRYPT" != "1" ]; then
4174+ usage
4175+fi
4176+
4177+if [ "$(id -u)" != "0" ]; then
4178+ error "This program must be executed with root privileges"
4179+fi
4180+
4181+if [ "$DO_ENCRYPT" = "1" ]; then
4182+ USER_HOME=$(get_user_home "$USER_NAME")
4183+ sanity_check "$USER_NAME" "$USER_HOME"
4184+ encrypt_dir "$USER_NAME" "$USER_HOME" "$LOGINPASS" "$MOUNTPASS"
4185+fi
4186
4187=== modified file 'src/utils/ecryptfs-mount-private'
4188--- src/utils/ecryptfs-mount-private 2009-03-20 21:44:01 +0000
4189+++ src/utils/ecryptfs-mount-private 2010-02-17 20:48:23 +0000
4190@@ -15,12 +15,13 @@
4191 PRIVATE_DIR="Private"
4192 WRAPPING_PASS="LOGIN"
4193 PW_ATTEMPTS=3
4194-MESSAGE="Enter your login passphrase: "
4195+TEXTDOMAIN="ecryptfs-utils"
4196+MESSAGE=`gettext "Enter your login passphrase:"`
4197
4198 if [ -f $HOME/.ecryptfs/wrapping-independent ]; then
4199 # use a wrapping passphrase different from the login passphrase
4200 WRAPPING_PASS="INDEPENDENT"
4201- MESSAGE="Enter your wrapping passphrase: "
4202+ MESSAGE=`gettext "Enter your wrapping passphrase:"`
4203 fi
4204
4205 WRAPPED_PASSPHRASE_FILE="$HOME/.ecryptfs/wrapped-passphrase"
4206@@ -45,24 +46,24 @@
4207 if printf "%s\0" "$LOGINPASS" | ecryptfs-insert-wrapped-passphrase-into-keyring "$WRAPPED_PASSPHRASE_FILE" - ; then
4208 break
4209 else
4210- echo "ERROR: Your passphrase is incorrect"
4211+ echo `gettext "ERROR:"` `gettext "Your passphrase is incorrect"`
4212 tries=$(($tries + 1))
4213 continue
4214 fi
4215 done
4216 if [ $tries -ge $PW_ATTEMPTS ]; then
4217- echo "ERROR: Too many incorrect password attempts, exiting"
4218+ echo `gettext "ERROR:"` `gettext "Too many incorrect password attempts, exiting"`
4219 exit 1
4220 fi
4221 /sbin/mount.ecryptfs_private
4222 else
4223- echo "ERROR: Encrypted $PRIVATE_DIR is not setup properly"
4224+ echo `gettext "ERROR:"` `gettext "Encrypted private directory is not setup properly"`
4225 exit 1
4226 fi
4227 if grep -qs "$HOME/.Private $PWD ecryptfs " /proc/mounts 2>/dev/null; then
4228 echo
4229- echo "INFO: Your private directory has been mounted."
4230- echo "INFO: To see this change in your current shell:"
4231+ echo `gettext "INFO:"` `gettext "Your private directory has been mounted."`
4232+ echo `gettext "INFO:"` `gettext "To see this change in your current shell:"`
4233 echo " cd $PWD"
4234 echo
4235 fi
4236
4237=== modified file 'src/utils/ecryptfs-rewrite-file'
4238--- src/utils/ecryptfs-rewrite-file 2009-03-20 22:11:25 +0000
4239+++ src/utils/ecryptfs-rewrite-file 2010-02-17 20:48:23 +0000
4240@@ -17,45 +17,59 @@
4241 # You should have received a copy of the GNU General Public License
4242 # along with this program. If not, see <http://www.gnu.org/licenses/>.
4243
4244+TEXTDOMAIN="ecryptfs-utils"
4245+
4246 error() {
4247- echo
4248- echo "ERROR: $1" 1>&2
4249+ echo `gettext "[FAILED]"`
4250+ echo `gettext "ERROR:"` "$1" 1>&2
4251 }
4252 j=0
4253+OKs=0
4254 for i in "$@"; do
4255- [ "$i" = "." ] && continue
4256 j=`expr $j + 1`
4257- echo -n "INFO: Rewriting [$j/$#] [$i] ... "
4258+ echo -n `gettext "INFO:"` `gettext "Rewriting"` "[$j/$#] [$i] ... "
4259+ if [ ! -e "$i" ] ; then
4260+ error `gettext "File does not exist"`
4261+ continue
4262+ fi
4263+ if [ "$i" = "." ]; then
4264+ echo `gettext "[EXCLUDED]"` >&2
4265+ continue
4266+ fi
4267 opt=
4268 if [ -d "$i" -a ! -h "$i" ]; then
4269 # A directory, re-encrypt the filename
4270 temp1=`mktemp -d "$i".XXXXXXXXXX` || {
4271- error "Could not create tempdir"
4272+ error `gettext "Could not create tempdir"`
4273 continue
4274 }
4275- mv -f -T "$i" "$temp1" || {
4276- error "Could not rename [$i] to [$temp1]"
4277+ mv -f -T "$i" "$temp1" 2>/dev/null || {
4278+ error `gettext "Could not rename"` "[$i] -> [$temp1]"
4279 rmdir "$temp1"
4280 continue
4281 }
4282- mv -f "$temp1" "$i" || {
4283- error "Could not rename [$temp1] to [$i]"
4284+ mv -f "$temp1" "$i" 2>/dev/null || {
4285+ error `gettext "Could not rename"` "[$temp1] -> [$i]"
4286 }
4287 else
4288 # A file or symlink, re-encrypt the contents
4289 temp1=`mktemp "$i".XXXXXXXXXX` || {
4290- error "Could not create tempfile"
4291+ error `gettext "Could not create tempfile"`
4292 continue
4293 }
4294- cp -a "$i" "$temp1" || {
4295- error "Could not copy [$i] to [$temp1]"
4296+ cp -a "$i" "$temp1" 2>/dev/null || {
4297+ error `gettext "Could not copy"` "[$i] -> [$temp1]"
4298 rm -f "$temp1"
4299 continue
4300 }
4301- mv -f "$temp1" "$i" || {
4302- error "Could not rename [$temp1] to [$i]"
4303+ mv -f "$temp1" "$i" 2>/dev/null || {
4304+ error `gettext "Could not rename"` "[$temp1] -> [$i]"
4305+ continue
4306 }
4307 fi
4308- echo "[OK]"
4309+ echo `gettext "[OK]"`
4310+ OKs=$((OKs+1))
4311 done
4312+echo "$OKs/$j" `gettext "rewrites succeeded"`
4313+[ $OKs -ne $j ] && exit 1
4314 exit 0
4315
4316=== modified file 'src/utils/ecryptfs-setup-private'
4317--- src/utils/ecryptfs-setup-private 2009-03-24 19:38:23 +0000
4318+++ src/utils/ecryptfs-setup-private 2010-02-17 20:48:23 +0000
4319@@ -8,8 +8,10 @@
4320 # Copyright (C) 2007-2008 International Business Machines
4321 PRIVATE_DIR="Private"
4322 WRAPPING_PASS="LOGIN"
4323+ECRYPTFS_DIR="/home/.ecryptfs"
4324 PW_ATTEMPTS=3
4325-MESSAGE="Enter your login passphrase"
4326+TEXTDOMAIN="ecryptfs-utils"
4327+MESSAGE="$(gettext 'Enter your login passphrase')"
4328 CIPHER="aes"
4329 KEYBYTES="16"
4330 FNEK=
4331@@ -18,42 +20,43 @@
4332 GREP_OPTIONS=
4333
4334 usage() {
4335- echo
4336- echo "Usage:"
4337- echo " $0 [-f|--force] [-w|--wrapping] [--nopwcheck] [-n|--no-fnek]"
4338- echo " [-u|--username USER] [-l|--loginpass LOGINPASS]"
4339- echo " [-m|--mountpass MOUNTPASS]"
4340- echo
4341- echo " -f, --force Force overwriting of an existing setup"
4342- echo " -w, --wrapping Use an independent wrapping passphrase,"
4343- echo " different from the login passphrase"
4344- echo " -n, --no-fnek Do not encrypt filenames; If this flag is"
4345- echo " omitted, and the kernel supports filename"
4346- echo " encryption, then filenames will be encrypted"
4347- echo " -u, --username Username for encrypted private mountpoint,"
4348- echo " defaults to yourself"
4349- echo " -l, --loginpass Login/Wrapping passphrase for USER,"
4350- echo " used to wrap MOUNTPASS"
4351- echo " --nopwcheck Do not check the validity of the specified"
4352- echo " login password (useful for LDAP user accounts)"
4353- echo " --noautomount Setup this user such that the encrypted private"
4354- echo " directory is not automatically mounted on login"
4355- echo " --noautoumount Setup this user such that the encrypted private"
4356- echo " directory is not automatically unmounted at"
4357- echo " logout"
4358- echo " -m, --mountpass Passphrase for mounting the ecryptfs directory,"
4359- echo " defaults to randomly generated $KEYBYTES bytes"
4360- echo " -b, --bootstrap Bootstrap a new user's entire home directory"
4361- echo " Generates a random mount passphrase, which"
4362- echo " will be wrapped when the new login passphrase"
4363- echo " is set. SHOULD ONLY BE CALLED FROM 'adduser'."
4364- echo " --undo Provide instructions on how to undo an"
4365- echo " encrypted private setup"
4366- echo
4367- echo " Be sure to properly escape your parameters according to your"
4368- echo " shell's special character nuances, and also surround the"
4369- echo " parameters by double quotes, if necessary."
4370- echo
4371+ echo "
4372+Usage:
4373+
4374+$0 [-f|--force] [-w|--wrapping] [--nopwcheck] [-n|--no-fnek]
4375+ [-u|--username USER] [-l|--loginpass LOGINPASS]
4376+ [-m|--mountpass MOUNTPASS]
4377+
4378+ -f, --force Force overwriting of an existing setup
4379+ -w, --wrapping Use an independent wrapping passphrase,
4380+ different from the login passphrase
4381+ -n, --no-fnek Do not encrypt filenames; If this flag is
4382+ omitted, and the kernel supports filename
4383+ encryption, then filenames will be encrypted
4384+ -u, --username Username for encrypted private mountpoint,
4385+ defaults to yourself
4386+ -l, --loginpass Login/Wrapping passphrase for USER,
4387+ used to wrap MOUNTPASS
4388+ --nopwcheck Do not check the validity of the specified
4389+ login password (useful for LDAP user accounts)
4390+ --noautomount Setup this user such that the encrypted private
4391+ directory is not automatically mounted on login
4392+ --noautoumount Setup this user such that the encrypted private
4393+ directory is not automatically unmounted at
4394+ logout
4395+ -m, --mountpass Passphrase for mounting the ecryptfs directory,
4396+ defaults to randomly generated $KEYBYTES bytes
4397+ -b, --bootstrap Bootstrap a new user's entire home directory
4398+ Generates a random mount passphrase, which
4399+ will be wrapped when the new login passphrase
4400+ is set. SHOULD ONLY BE CALLED FROM 'adduser'.
4401+ --undo Provide instructions on how to undo an
4402+ encrypted private setup
4403+
4404+ Be sure to properly escape your parameters according to your
4405+ shell's special character nuances, and also surround the
4406+ parameters by double quotes, if necessary.
4407+"
4408 exit 1
4409 }
4410
4411@@ -63,7 +66,7 @@
4412 you will need to very carefully perform the following actions manually:
4413
4414 1. Obtain your Private directory mountpoint
4415- $ PRIVATE=\`cat ~/.ecryptfs/Private.mnt 2>/dev/null || echo \$HOME/Private\`
4416+ $ PRIVATE=\`cat ~/.ecryptfs/Private.mnt 2>/dev/null || echo \$HOME/$PRIVATE_DIR\`
4417 2. Ensure that you have moved all relevant data out of your \$PRIVATE directory
4418 3. Unmount your encrypted private directory
4419 $ ecryptfs-umount-private
4420@@ -78,14 +81,15 @@
4421 }
4422
4423 error() {
4424- echo "ERROR: $1" 1>&2
4425+ echo "$(gettext 'ERROR: ')" "$@" 1>&2
4426 exit 1
4427 }
4428
4429 error_testing() {
4430 rm -f "$1" >/dev/null
4431+ shift
4432 /sbin/umount.ecryptfs_private >/dev/null
4433- error "$2"
4434+ error "$@"
4435 exit 1
4436 }
4437
4438@@ -98,7 +102,7 @@
4439
4440 filename_encryption_available() {
4441 version=$(cat /sys/fs/ecryptfs/version 2>/dev/null)
4442- [ -z "$version" ] && error "Can't get ecryptfs version, ecryptfs kernel module not loaded?"
4443+ [ -z "$version" ] && error "$(gettext 'Cannot get ecryptfs version, ecryptfs kernel module not loaded?')"
4444 [ $(($version & 0x100)) -eq 0 ] && return 1
4445 return 0
4446 }
4447@@ -125,7 +129,7 @@
4448 ;;
4449 -w|--wrapping)
4450 WRAPPING_PASS="INDEPENDENT"
4451- MESSAGE="Enter your wrapping passphrase"
4452+ MESSAGE="$(gettext 'Enter your wrapping passphrase')"
4453 shift 1
4454 ;;
4455 -f|--force)
4456@@ -149,7 +153,7 @@
4457 exit 0
4458 ;;
4459 -b|--bootstrap)
4460- [ `whoami` = "root" ] || error "You must be root to bootstrap encrypt a home directory"
4461+ [ `whoami` = "root" ] || error "$(gettext 'You must be root to bootstrap encrypt a home directory')"
4462 BOOTSTRAP=1
4463 MOUNTPASS=`random_passphrase $KEYBYTES`
4464 RANDOM_MOUNTPASS=1
4465@@ -168,16 +172,16 @@
4466 # Prompt for the USER name, if not on the command line and not in the env
4467 if [ -z "$USER" ]; then
4468 while [ true ]; do
4469- echo -n "Enter the username: "
4470+ echo -n "$(gettext 'Enter the username: ')"
4471 USER=`head -n1`
4472 echo
4473 if [ -z "$USER" ]; then
4474- echo "ERROR: You must provide a username"
4475+ echo "$(gettext 'ERROR: ')" "$(gettext 'You must provide a username')"
4476 continue
4477 else
4478 # Verify that the user exists
4479 if ! id "$USER" >/dev/null; then
4480- echo "ERROR: User [$USER] does not exist"
4481+ echo "$(gettext 'ERROR: ')" "$(gettext 'User does not exist')" " [$USER]"
4482 continue
4483 fi
4484 break
4485@@ -185,49 +189,61 @@
4486 done
4487 else
4488 # Verify that the user exists
4489- id "$USER" >/dev/null || error "User [$USER] does not exist"
4490+ id "$USER" >/dev/null || error "$(gettext 'User does not exist')" "[$USER]"
4491+fi
4492+
4493+# Obtain USER's primary group
4494+GROUP=$(id -g $USER)
4495+
4496+# Check if the ecryptfs group exists, and user is member of ecryptfs group
4497+if grep -qs "^ecryptfs:" /etc/group; then
4498+ if ! id "$USER" | grep -qs "\(ecryptfs\)"; then
4499+ error "$(gettext 'User needs to be a member of ecryptfs group')"
4500+ fi
4501 fi
4502
4503 # Obtain the user's home directory
4504 HOME=`getent passwd "$USER" | awk -F: '{print $6}'`
4505 if [ ! -d "$HOME" ]; then
4506- error "User home directory [$HOME] does not exist"
4507+ error "$(gettext 'User home directory does not exist')" "[$HOME]"
4508 fi
4509
4510 if [ "$BOOTSTRAP" = "1" ]; then
4511 # If we want to encrypt the entire homedir, we need the .ecryptfs
4512 # config dir elsewhere, but linked into the homedir
4513- mkdir -p -m 700 /var/lib/ecryptfs/$USER
4514- ln -sf /var/lib/ecryptfs/$USER $HOME/.ecryptfs
4515+ mkdir -p -m 700 $ECRYPTFS_DIR/$USER/.ecryptfs
4516+ ln -sf $ECRYPTFS_DIR/$USER/.ecryptfs $HOME/.ecryptfs
4517+ ln -sf $ECRYPTFS_DIR/$USER/.$PRIVATE_DIR $HOME/.$PRIVATE_DIR
4518 MOUNTPOINT="$HOME"
4519+ CRYPTDIR="$ECRYPTFS_DIR/$USER/.$PRIVATE_DIR"
4520 else
4521 mkdir -m 700 $HOME/.ecryptfs
4522 MOUNTPOINT="$HOME/$PRIVATE_DIR"
4523+ CRYPTDIR="$HOME/.$PRIVATE_DIR"
4524 fi
4525
4526 # Check for previously setup private directory
4527 if [ -s "$HOME/.ecryptfs/wrapped-passphrase" -a "$FORCE" != "1" ]; then
4528- error "wrapped-passphrase file already exists, use --force to overwrite."
4529+ error "$(gettext 'wrapped-passphrase file already exists, use --force to overwrite.')"
4530 fi
4531 if [ -s "$HOME/.ecryptfs/$PRIVATE_DIR.sig" -a "$FORCE" != "1" ]; then
4532- error "$PRIVATE_DIR.sig file already exists, use --force to overwrite."
4533+ error "$PRIVATE_DIR.sig" "$(gettext 'file already exists, use --force to overwrite.')"
4534 fi
4535
4536 # Check for active mounts
4537-CRYPTDIR="$HOME/.$PRIVATE_DIR"
4538-grep -qs "$MOUNTPOINT " /proc/mounts && error "[$MOUNTPOINT] is already mounted"
4539-grep -qs "$CRYPTDIR " /proc/mounts && error "[$CRYPTDIR] is already mounted"
4540+grep -qs "$MOUNTPOINT " /proc/mounts && error "[$MOUNTPOINT]" "$(gettext 'is already mounted')"
4541+grep -qs "$CRYPTDIR " /proc/mounts && error "[$CRYPTDIR]" "$(gettext 'is already mounted')"
4542
4543 # Check that the mount point and encrypted directory are empty (skip symlinks).
4544 # Perhaps one day we could provide a migration mode (using rsync or something),
4545 # but this would be VERY hard to do safely.
4546 count=`ls -Al "$MOUNTPOINT" 2>/dev/null | egrep -c "^[drwx-]{10}"`
4547 if [ "$count" != "0" ]; then
4548- error "$MOUNTPOINT must be empty before proceeding"
4549+ error "$MOUNTPOINT" "$(gettext 'must be empty before proceeding')"
4550 fi
4551 count=`ls -Al "$CRYPTDIR" 2>/dev/null | egrep -c "^[dlrwx-]{10}"`
4552 if [ "$count" != "0" ]; then
4553- error "$CRYPTDIR must be empty before proceeding"
4554+ error "$CRYPTDIR" "$(gettext 'must be empty before proceeding')"
4555 fi
4556
4557 stty_orig=`stty -g`
4558@@ -240,14 +256,16 @@
4559 LOGINPASS=`head -n1`
4560 stty $stty_orig
4561 echo
4562- if [ $WRAPPING_PASS != "LOGIN" ]; then
4563+ if [ $WRAPPING_PASS != "LOGIN" -o ! -x /sbin/unix_chkpwd ]; then
4564+ # If we can't check the accuracy of the user's entered
4565+ # passphrase, force them to type it twice (matching)
4566 stty -echo
4567 echo -n "$MESSAGE (again): "
4568 LOGINPASS2=`head -n1`
4569 stty $stty_orig
4570 echo
4571 if [ "$LOGINPASS" != "$LOGINPASS2" ]; then
4572- echo "ERROR: Wrapping passphrases must match"
4573+ echo "$(gettext 'ERROR: ')" "$(gettext 'Wrapping passphrases must match')"
4574 else
4575 break
4576 fi
4577@@ -255,25 +273,24 @@
4578 continue
4579 fi
4580 if [ -z "$LOGINPASS" ]; then
4581- echo "ERROR: You must provide a login passphrase"
4582+ echo "$(gettext 'ERROR: ')" "$(gettext 'You must provide a login passphrase')"
4583 tries=$(($tries + 1))
4584 else
4585 if [ "$NOPWCHECK" = "1" ]; then
4586- echo "INFO: Skipping password verification"
4587+ echo "$(gettext 'INFO:')" "$(gettext 'Skipping password verification')"
4588 break
4589 else
4590 if printf "%s\0" "$LOGINPASS" | /sbin/unix_chkpwd "$USER" nullok; then
4591 break
4592 else
4593- echo "ERROR: Your login passphrase is incorrect"
4594+ echo "$(gettext 'ERROR: ')" "$(gettext 'Your login passphrase is incorrect')"
4595 tries=$(($tries + 1))
4596 fi
4597 fi
4598 fi
4599 done
4600 if [ $tries -ge $PW_ATTEMPTS ]; then
4601- echo "ERROR: Too many incorrect password attempts, exiting"
4602- exit 1
4603+ error "$(gettext 'Too many incorrect password attempts, exiting')"
4604 fi
4605 fi
4606
4607@@ -282,7 +299,7 @@
4608 tries=0
4609 while [ $tries -lt $PW_ATTEMPTS ]; do
4610 stty -echo
4611- echo -n "Enter your mount passphrase [leave blank to generate one]: "
4612+ echo -n "$(gettext 'Enter your mount passphrase [leave blank to generate one]: ')"
4613 MOUNTPASS=`head -n1`
4614 stty $stty_orig
4615 echo
4616@@ -292,12 +309,12 @@
4617 break
4618 else
4619 stty -echo
4620- echo -n "Enter your mount passphrase (again): "
4621+ echo -n "$(gettext 'Enter your mount passphrase (again): ')"
4622 MOUNTPASS2=`head -n1`
4623 stty $stty_orig
4624 echo
4625 if [ "$MOUNTPASS" != "$MOUNTPASS2" ]; then
4626- echo "ERROR: Mount passphrases do not match"
4627+ echo "$(gettext 'ERROR: ')" "$(gettext 'Mount passphrases do not match')"
4628 tries=$(($tries + 1))
4629 else
4630 break
4631@@ -305,58 +322,43 @@
4632 fi
4633 done
4634 if [ $tries -ge $PW_ATTEMPTS ]; then
4635- echo "ERROR: Too many incorrect passphrase attempts, exiting"
4636- exit 1
4637+ error "$(gettext 'Too many incorrect passphrase attempts, exiting')"
4638 fi
4639 fi
4640
4641-#echo
4642-#echo "Using username [$USER]"
4643-#echo "Using mount passphrase [$MOUNTPASS]"
4644-#echo "Using login passphrase [$LOGINPASS]"
4645-#echo "Using mount point [$MOUNTPOINT]"
4646-#echo "Using encrypted dir [$CRYPTDIR]"
4647-#echo
4648-#echo "This script will attempt to set up your system to mount"
4649-#echo "$MOUNTPOINT with eCryptfs automatically on login,"
4650-#echo "using your login passphrase."
4651 echo
4652 echo "************************************************************************"
4653-if [ "$RANDOM_MOUNTPASS" = "1" ]; then
4654- echo "YOU SHOULD RECORD THIS MOUNT PASSPHRASE AND STORE IN A SAFE LOCATION:"
4655- echo "$MOUNTPASS"
4656-else
4657- echo "YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IN A SAFE LOCATION:"
4658-fi
4659-echo "THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME."
4660+echo "$(gettext 'YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION.')"
4661+echo " ecryptfs-unwrap-passphrase ~/.ecryptfs/wrapped-passphrase"
4662+echo "$(gettext 'THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME.')"
4663 echo "************************************************************************"
4664 echo
4665
4666 ###############################################################################
4667
4668 # Setup private directory in home
4669-mkdir -m 700 -p "$CRYPTDIR" || error "Could not create crypt directory [$CRYPTDIR]"
4670-mkdir -m 700 -p "$MOUNTPOINT" || error "Could not create mount directory [$MOUNTPOINT]"
4671+mkdir -m 700 -p "$CRYPTDIR" || error "$(gettext 'Could not create crypt directory')" "[$CRYPTDIR]"
4672+mkdir -m 700 -p "$MOUNTPOINT" || error "$(gettext 'Could not create mount directory')" "[$MOUNTPOINT]"
4673 ln -sf /usr/share/ecryptfs-utils/ecryptfs-mount-private.txt "$MOUNTPOINT"/README.txt
4674 ln -sf /usr/share/ecryptfs-utils/ecryptfs-mount-private.desktop "$MOUNTPOINT"/Access-Your-Private-Data.desktop
4675 chmod 500 "$MOUNTPOINT"
4676
4677 # Setup ~/.ecryptfs directory
4678 if [ "$NOAUTOMOUNT" = "1" ]; then
4679- echo "INFO: $HOME/$PRIVATE_DIR will not be mounted on login"
4680+ echo "$(gettext 'INFO:')" "$HOME/$PRIVATE_DIR" "$(gettext 'will not be mounted on login')"
4681 else
4682- touch $HOME/.ecryptfs/auto-mount || error "Could not setup ecryptfs auto-mount"
4683+ touch $HOME/.ecryptfs/auto-mount || error "$(gettext 'Could not setup ecryptfs auto-mount')"
4684 fi
4685 if [ "$NOAUTOUMOUNT" = "1" ]; then
4686- echo "INFO: $HOME/$PRIVATE_DIR will not be unmounted on logout"
4687+ echo "$(gettext 'INFO:')" "$HOME/$PRIVATE_DIR" "$(gettext 'will not be unmounted on logout')"
4688 else
4689- touch $HOME/.ecryptfs/auto-umount || error "Could not setup ecryptfs auto-umount"
4690+ touch $HOME/.ecryptfs/auto-umount || error "$(gettext 'Could not setup ecryptfs auto-umount')"
4691 fi
4692
4693 if [ "$WRAPPING_PASS" = "LOGIN" ]; then
4694- rm -f $HOME/.ecryptfs/wrapping-independent || error "Could not remove ecryptfs wrapping-independent"
4695+ rm -f $HOME/.ecryptfs/wrapping-independent || error "$(gettext 'Could not remove ecryptfs wrapping-independent')"
4696 else
4697- touch $HOME/.ecryptfs/wrapping-independent || error "Could not setup ecryptfs wrapping-independent"
4698+ touch $HOME/.ecryptfs/wrapping-independent || error "$(gettext 'Could not setup ecryptfs wrapping-independent')"
4699 fi
4700
4701
4702@@ -364,7 +366,7 @@
4703 timestamp=`date +%Y%m%d%H%M%S`
4704 for i in "$HOME/.ecryptfs/wrapped-passphrase" "$HOME/.ecryptfs/$PRIVATE_DIR.sig"; do
4705 if [ -s "$i" ]; then
4706- mv -f "$i" "$i.$timestamp" || error "Could not backup existing data [$i]"
4707+ mv -f "$i" "$i.$timestamp" || error "(gettext 'Could not backup existing data')" "[$i]"
4708 fi
4709 done
4710
4711@@ -380,7 +382,7 @@
4712 printf "%s" "$MOUNTPASS" > "$temp"
4713 mv "$temp" "/dev/shm/.ecryptfs-$USER"
4714 else
4715- printf "%s\n%s" "$MOUNTPASS" "$LOGINPASS" | ecryptfs-wrap-passphrase "$HOME/.ecryptfs/wrapped-passphrase" - || error "Could not wrap passphrase"
4716+ printf "%s\n%s" "$MOUNTPASS" "$LOGINPASS" | ecryptfs-wrap-passphrase "$HOME/.ecryptfs/wrapped-passphrase" - || error "$(gettext 'Could not wrap passphrase')"
4717 fi
4718 umask $u
4719
4720@@ -388,21 +390,21 @@
4721 # On subsequent logins, this should be handled by "pam_ecryptfs.so unwrap"
4722 response=`printf "%s" "$MOUNTPASS" | ecryptfs-add-passphrase $FNEK -`
4723 if [ $? -ne 0 ]; then
4724- error "Could not add passphrase to the current keyring"
4725+ error "$(gettext 'Could not add passphrase to the current keyring')"
4726 fi
4727 sig=`echo "$response" | grep "Inserted auth tok" | sed "s/^.*\[//" | sed "s/\].*$//"`
4728 if ! echo "$sig" | egrep -qs "^[0-9a-fA-F]{$KEYBYTES,$KEYBYTES}$"; then
4729- error "Could not obtain the key signature"
4730+ error "$(gettext 'Could not obtain the key signature')"
4731 fi
4732 temp=`mktemp`
4733-echo "$sig" > "$temp" || error "Could not create signature file [$HOME/.ecryptfs/$PRIVATE_DIR.sig]"
4734+echo "$sig" > "$temp" || error "$(gettext 'Could not create signature file')" "[$HOME/.ecryptfs/$PRIVATE_DIR.sig]"
4735 mv "$temp" "$HOME/.ecryptfs/$PRIVATE_DIR.sig"
4736 temp=`mktemp`
4737-echo "$MOUNTPOINT" > "$temp" || error "Could not create mountpoint file [$HOME/.ecryptfs/$PRIVATE_DIR.mnt]"
4738+echo "$MOUNTPOINT" > "$temp" || error "$(gettext 'Could not create mountpoint file')" "[$HOME/.ecryptfs/$PRIVATE_DIR.mnt]"
4739 mv "$temp" "$HOME/.ecryptfs/$PRIVATE_DIR.mnt"
4740
4741 echo
4742-echo "Done configuring."
4743+echo "$(gettext 'Done configuring.')"
4744 echo
4745
4746 # Skip the tests if we're in bootstrap mode, but exit with the encrypted
4747@@ -412,7 +414,9 @@
4748 # and the calling 'adduser' is about to copy over /etc/skel
4749 # NOTE: it is the responsibility of 'adduser' to unmount!
4750 # And ensure that $USER owns the files/dirs we've created as root
4751- chown $USER:$USER "$CRYPTDIR" /dev/shm/.ecryptfs-$USER
4752+ chown $USER:$GROUP "$CRYPTDIR" /dev/shm/.ecryptfs-$USER
4753+ chown -R $USER:$GROUP $ECRYPTFS_DIR/$USER
4754+ chown -R $USER:$GROUP $MOUNTPOINT
4755 if [ "$FNEK" = "--fnek" ]; then
4756 fnek_sig=`tail -n 1 "$HOME/.ecryptfs/$PRIVATE_DIR.sig"`
4757 sig=`head -n 1 "$HOME/.ecryptfs/$PRIVATE_DIR.sig"`
4758@@ -420,42 +424,37 @@
4759 else
4760 sig_opt="ecryptfs_sig=$sig"
4761 fi
4762+ # Do the mount, and provide some helpful symlinks
4763 mount -i -t ecryptfs -o "rw,$sig_opt,ecryptfs_cipher=$CIPHER,ecryptfs_key_bytes=$KEYBYTES" "$CRYPTDIR" "$MOUNTPOINT" || error "Could not mount"
4764- ln -sf /var/lib/ecryptfs/$USER $MOUNTPOINT/.ecryptfs
4765- for i in auto-mount \
4766- auto-umount \
4767- $PRIVATE_DIR.mnt \
4768- $PRIVATE_DIR.sig \
4769- wrapped-passphrase;
4770- do
4771- [ -e $HOME/.ecryptfs/$i ] && chown $USER:$USER $MOUNTPOINT/.ecryptfs/$i
4772- done
4773- chown $USER:$USER /var/lib/ecryptfs/$USER
4774- chown -h $USER:$USER $MOUNTPOINT/.ecryptfs
4775+ ln -sf $ECRYPTFS_DIR/$USER/.ecryptfs $MOUNTPOINT/.ecryptfs
4776+ ln -sf $ECRYPTFS_DIR/$USER/.$PRIVATE_DIR $MOUNTPOINT/.$PRIVATE_DIR
4777+ chown -R $USER:$GROUP $ECRYPTFS_DIR/$USER
4778+ chown -R $USER:$GROUP $MOUNTPOINT
4779 exit 0
4780 fi
4781
4782 # Now let's perform some basic mount/write/umount/read sanity testing...
4783-echo "Testing mount/write/umount/read..."
4784-/sbin/mount.ecryptfs_private || error "Could not mount private ecryptfs directory"
4785-temp=`mktemp "$MOUNTPOINT/ecryptfs.test.XXXXXX"` || error_testing "$temp" "Could not create empty file"
4786-random_data=`head -c 16000 /dev/urandom | od -x` || error_testing "$temp" "Could not generate random data"
4787-echo "$random_data" > "$temp" || error_testing "$temp" "Could not write encrypted file"
4788-md5sum1=`md5sum "$temp"` || error_testing "$temp" "Could not read encrypted file"
4789-/sbin/umount.ecryptfs_private || error_testing "$temp" "Could not unmount private ecryptfs directory"
4790-/sbin/mount.ecryptfs_private || error_testing "$temp" "Could not mount private ecryptfs directory (2)"
4791-md5sum2=`md5sum "$temp"` || error_testing "$temp" "Could not read encrypted file (2)"
4792+echo "$(gettext 'Testing mount/write/umount/read...')"
4793+/sbin/mount.ecryptfs_private || error "$(gettext 'Could not mount private ecryptfs directory')"
4794+temp=`mktemp "$MOUNTPOINT/ecryptfs.test.XXXXXX"` || error_testing "$temp" "$(gettext 'Could not create empty file')"
4795+random_data=`head -c 16000 /dev/urandom | od -x` || error_testing "$temp" "$(gettext 'Could not generate random data')"
4796+echo "$random_data" > "$temp" || error_testing "$temp" "$(gettext 'Could not write encrypted file')"
4797+md5sum1=`md5sum "$temp"` || error_testing "$temp" "$(gettext 'Could not read encrypted file')"
4798+/sbin/umount.ecryptfs_private || error_testing "$temp" "$(gettext 'Could not unmount private ecryptfs directory')"
4799+/sbin/mount.ecryptfs_private || error_testing "$temp" "$(gettext 'Could not mount private ecryptfs directory (2)')"
4800+md5sum2=`md5sum "$temp"` || error_testing "$temp" "$(gettext 'Could not read encrypted file (2)')"
4801 rm -f "$temp"
4802 # Use ecryptfs-umount-private on the final run, to clear the used keys
4803 # out of the keyring
4804-ecryptfs-umount-private || error_testing "$temp" "Could not unmount private ecryptfs directory (2)"
4805+ecryptfs-umount-private || error_testing "$temp" "$(gettext 'Could not unmount private ecryptfs directory (2)')"
4806 if [ "$md5sum1" != "$md5sum2" ]; then
4807- error "Testing failed."
4808+ error "$(gettext 'Testing failed.')"
4809 else
4810- echo "Testing succeeded."
4811+ echo "$(gettext 'Testing succeeded.')"
4812 fi
4813
4814 echo
4815-echo "Logout, and log back in to begin using your encrypted directory."
4816+echo "$(gettext 'Logout, and log back in to begin using your encrypted directory.')"
4817 echo
4818+
4819 exit 0
4820
4821=== modified file 'src/utils/ecryptfs-setup-swap'
4822--- src/utils/ecryptfs-setup-swap 2009-03-20 21:44:01 +0000
4823+++ src/utils/ecryptfs-setup-swap 2010-02-17 20:48:23 +0000
4824@@ -19,23 +19,25 @@
4825 # The cryptswap setup used here follows a guide published at:
4826 # * http://ubuntumagnet.com/2007/11/creating-encrypted-swap-file-ubuntu-using-cryptsetup
4827
4828+TEXTDOMAIN="ecryptfs-utils"
4829+
4830 error() {
4831- echo "ERROR: $1" 1>&2
4832+ echo `gettext "ERROR:"` "$@" 1>&2
4833 exit 1
4834 }
4835
4836 info() {
4837- echo "INFO: $1"
4838+ echo `gettext "INFO:"` "$@"
4839 }
4840
4841-warning() {
4842- echo "WARNING: "
4843+warn() {
4844+ echo `gettext "WARNING:"` "$@" 1>&2
4845 }
4846
4847 usage() {
4848 echo
4849- echo "Usage:"
4850- echo " $0 [-f|--force]"
4851+ echo `gettext "Usage:"`
4852+ echo " $0 [-f|--force] [-n|--no-reload]"
4853 echo
4854 exit 1
4855 }
4856@@ -48,6 +50,10 @@
4857 FORCE=1
4858 shift 1
4859 ;;
4860+ -n|--no-reload)
4861+ NO_RELOAD=1
4862+ shift 1
4863+ ;;
4864 *)
4865 usage
4866 ;;
4867@@ -55,94 +61,83 @@
4868 done
4869
4870 # Ensure that cryptsetup is available
4871-[ -x /sbin/cryptsetup ] || error "Please install 'cryptsetup'"
4872+[ -x /sbin/cryptsetup ] || error `gettext "Please install"` "'cryptsetup'"
4873
4874 # Ensure that we're running with root privileges
4875-[ -w /etc/passwd ] || error "This program must be run with 'sudo', or as root"
4876+[ -w /etc/passwd ] || error `gettext "This program must be run with 'sudo', or as root"`
4877
4878 # Count swap spaces available
4879-# BUG: We only support setting up a single swap space at this time
4880 if [ $(grep -c "^/" /proc/swaps) -eq 0 ]; then
4881 mem=$(grep "^MemTotal:" /proc/meminfo | awk '{print $2}')
4882 swapsize=$((4*$mem))
4883 info "You do not currently have any swap space defined."
4884 echo
4885- echo "You can create a swap file by doing:"
4886+ echo `gettext "You can create a swap file by doing:"`
4887 echo " $ sudo dd if=/dev/zero of=/swapfile count=$swapsize"
4888 echo " $ sudo mkswap /swapfile"
4889 echo " $ sudo swapon /swapfile"
4890 echo
4891- echo "And then re-run $0"
4892+ echo `gettext "And then re-run"` "$0"
4893 echo
4894 exit 0
4895-elif [ $(grep -c "^/" /proc/swaps) -gt 1 ]; then
4896- info "You have more than one swap space defined."
4897- error "$0 only supports setting up a single swap space"
4898-else
4899- swap=$(grep "^/" /proc/swaps | awk '{print $1}')
4900-fi
4901-
4902-# Make sure this is swap space
4903-if ! vol_id "$swap" | grep -qs "ID_FS_TYPE=swap"; then
4904- error "[$swap] does not appear to be swap space"
4905-fi
4906-
4907-# Check if this this swap space is already setup for encryption
4908-if /sbin/dmsetup table "$swap" | grep -qs " crypt " 2>/dev/null; then
4909- info "[$swap] already appears to be encrypted."
4910- exit 0
4911-else
4912- # keep going
4913- /bin/true
4914-fi
4915-
4916-base=$(basename "$swap")
4917-if grep -qs "^$base.*swap.*cipher" /etc/crypttab 2>/dev/null; then
4918- info "[$swap] already has an entry in /etc/crypttab."
4919- exit 0
4920-fi
4921-if grep -qs "$swap" /etc/initramfs-tools/conf.d/cryptroot 2>/dev/null; then
4922- info "[$swap] already has an entry in /etc/fstab."
4923- exit 0
4924-fi
4925-
4926-# Ensure available dev mapper name 'cryptswap'
4927-if grep -qs "^cryptswap" /etc/crypttab; then
4928- error "There appears to be a cryptswap entry in /etc/cryptab; aborting."
4929-fi
4930-
4931-# Ensure available fstab entry
4932-if grep -qs "^/dev/mapper/cryptswap" /etc/fstab; then
4933- error "There appears to be a cryptswap entry in /etc/fstab; aborting."
4934-fi
4935-
4936-# Ensure that the existing swap space exists in fstab
4937-if grep -qs "^$swap" /etc/fstab; then
4938- sed -i "s:^$swap:\#$swap:" /etc/fstab
4939- info "Commented out your unencrypted swap from /etc/fstab"
4940-else
4941- info "Your swap space isn't currently listed in /etc/fstab"
4942-fi
4943-
4944+fi
4945+
4946+swaps=$(grep "^/" /proc/swaps | awk '{print $1}')
4947+
4948+filtered_swaps=$(
4949+for swap in $swaps; do
4950+ # Make sure this is swap space
4951+ if [ "$(blkid -o value -s TYPE $swap)" != "swap" ]; then
4952+ warn "[$swap]" `gettext "does not appear to be swap space, skipping."`
4953+ continue
4954+ fi
4955+
4956+ if [ "${swap#/dev/ram}" != "$swap" ]; then
4957+ warn "[$swap]" `gettext "is a RAM device, skipping."`
4958+ continue
4959+ fi
4960+
4961+ # Check if this swap space is already setup for encryption
4962+ if /sbin/dmsetup table "$swap" 2>/dev/null | grep -qs " crypt "; then
4963+ warn "[$swap]" `gettext "already appears to be encrypted, skipping."`
4964+ continue
4965+ fi
4966+
4967+ base=$(basename "$swap")
4968+ if grep -qs "^$base.*swap.*cipher" /etc/crypttab 2>/dev/null; then
4969+ warn "[$swap]" `gettext "already has an entry in /etc/crypttab, skipping."`
4970+ continue
4971+ fi
4972+ if grep -qs "$swap" /etc/initramfs-tools/conf.d/cryptroot 2>/dev/null; then
4973+ warn "[$swap]" `gettext "already has an entry in /etc/crypttab, skipping."`
4974+ continue
4975+ fi
4976+
4977+ echo $swap
4978+done
4979+)
4980+swaps="$filtered_swaps"
4981+if [ -z "$swaps" ]; then
4982+ warn "There were no usable swap devices to be encrypted. Exiting."
4983+ exit 0
4984+fi
4985 ##########################################################################
4986 # Warn the user about breaking hibernate mode
4987 if [ "$FORCE" != 1 ]; then
4988 echo
4989- warning
4990- echo " An encrypted swap is required to help ensure that encrypted files"
4991- echo " are not leaked to disk in an unencrypted format."
4992- echo
4993- echo " HOWEVER, THE SWAP ENCRYPTION CONFIGURATION PRODUCED BY THIS PROGRAM"
4994- echo " WILL BREAK HIBERNATE/RESUME ON THIS SYSTEM!"
4995- echo
4996- echo " NOTE: Your suspend/resume capabilities will not be affected."
4997- echo
4998- echo -n "Do you want to proceed with encrypting your swap [y/N]: "
4999+ echo `gettext "WARNING:"`
5000+ echo `gettext "An encrypted swap is required to help ensure that encrypted files are not leaked to disk in an unencrypted format."`
The diff has been truncated for viewing.

Subscribers

People subscribed via source and target branches