eCryptfs

Merge lp://staging/~ecryptfs/ecryptfs/ecryptfs-utils into lp://staging/~mhlavink/ecryptfs/20090424

  1. ecryptfs-utils
  2. Merge into 20090424
Proposed by david
Status: Merged
Merge reported by: Dustin Kirkland 
Merged at revision: not available
Proposed branch: lp://staging/~ecryptfs/ecryptfs/ecryptfs-utils
Merge into: lp://staging/~mhlavink/ecryptfs/20090424
Diff against target: 5798 lines (+2544/-987)
72 files modified
README (+0/-5)
configure.ac (+4/-17)
debian/changelog (+311/-1)
debian/control (+49/-9)
debian/copyright (+10/-5)
debian/ecryptfs-utils.dirs (+0/-2)
debian/ecryptfs-utils.ecryptfs-utils-restore.upstart (+26/-0)
debian/ecryptfs-utils.ecryptfs-utils-save.upstart (+26/-0)
debian/ecryptfs-utils.install (+2/-1)
debian/ecryptfs-utils.postinst (+11/-35)
debian/libecryptfs0.shlibs (+1/-1)
debian/lintian/ecryptfs-utils (+13/-0)
debian/local/ecryptfs-utils.pam-auth-update (+3/-3)
debian/po/POTFILES.sh (+5/-0)
debian/po/ecryptfs-utils.pot (+407/-0)
debian/po/fr.po (+389/-0)
debian/rules (+38/-19)
doc/Makefile.am (+1/-2)
doc/ecryptfs-mount-private.txt (+1/-1)
doc/manpage/Makefile.am (+3/-0)
doc/manpage/ecryptfs-mount-private.1 (+2/-2)
doc/manpage/ecryptfs-rewrite-file.1 (+1/-1)
doc/manpage/ecryptfs-setup-private.1 (+2/-2)
doc/manpage/ecryptfs-setup-swap.1 (+29/-0)
doc/manpage/ecryptfs-stat.1 (+18/-0)
doc/manpage/ecryptfs.7 (+7/-135)
doc/manpage/mount.ecryptfs_private.1 (+1/-1)
doc/manpage/umount.ecryptfs.8 (+23/-0)
doc/manpage/umount.ecryptfs_private.1 (+1/-1)
doc/sourceforge_webpage/README (+0/-5)
lintian/ecryptfs-utils (+12/-0)
scripts/build-ubuntu.sh (+1/-1)
scripts/release.sh (+6/-2)
src/desktop/Makefile.am (+2/-1)
src/desktop/ecryptfs-record-passphrase (+6/-3)
src/include/ecryptfs.h (+5/-0)
src/key_mod/ecryptfs_key_mod_gpg.c (+5/-8)
src/key_mod/ecryptfs_key_mod_openssl.c (+28/-2)
src/key_mod/ecryptfs_key_mod_pkcs11_helper.c (+4/-3)
src/key_mod/ecryptfs_key_mod_tspi.c (+7/-3)
src/libecryptfs-swig/libecryptfs.i (+1/-1)
src/libecryptfs-swig/libecryptfs.py (+1/-1)
src/libecryptfs-swig/libecryptfs_wrap.c (+88/-47)
src/libecryptfs/cipher_list.c (+1/-1)
src/libecryptfs/cmd_ln_parser.c (+1/-1)
src/libecryptfs/decision_graph.c (+39/-13)
src/libecryptfs/key_management.c (+40/-102)
src/libecryptfs/libecryptfs.pc.in (+2/-2)
src/libecryptfs/main.c (+108/-30)
src/libecryptfs/module_mgr.c (+57/-11)
src/pam_ecryptfs/Makefile.am (+2/-2)
src/pam_ecryptfs/pam_ecryptfs.c (+66/-51)
src/python/ecryptfsapi.py (+82/-0)
src/utils/Makefile.am (+4/-3)
src/utils/ecryptfs-dot-private (+0/-34)
src/utils/ecryptfs-migrate-home (+195/-0)
src/utils/ecryptfs-mount-private (+8/-7)
src/utils/ecryptfs-rewrite-file (+29/-15)
src/utils/ecryptfs-setup-private (+125/-126)
src/utils/ecryptfs-setup-swap (+100/-89)
src/utils/ecryptfs-umount-private (+14/-16)
src/utils/ecryptfs_add_passphrase.c (+11/-7)
src/utils/ecryptfs_generate_tpm_key.c (+4/-1)
src/utils/ecryptfs_insert_wrapped_passphrase_into_keyring.c (+15/-5)
src/utils/ecryptfs_rewrap_passphrase.c (+0/-1)
src/utils/ecryptfs_unwrap_passphrase.c (+12/-3)
src/utils/ecryptfs_wrap_passphrase.c (+0/-1)
src/utils/io.c (+29/-12)
src/utils/manager.c (+1/-1)
src/utils/mount.ecryptfs.c (+13/-26)
src/utils/mount.ecryptfs_private.c (+32/-107)
src/utils/umount.ecryptfs.c (+4/-0)
To merge this branch: bzr merge lp://staging/~ecryptfs/ecryptfs/ecryptfs-utils
Reviewer Review Type Date Requested Status
Dustin Kirkland  (community) Needs Information
Review via email: mp+12512@code.staging.launchpad.net
To post a comment you must log in.
Revision history for this message
david (davidelizondo2006) wrote :

diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index 2f0945d..056fed6 100644 (file)
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -476,6 +476,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
        struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
        struct dentry *lower_dir_dentry;

+ dget(lower_dentry);
        lower_dir_dentry = lock_parent(lower_dentry);
        rc = vfs_unlink(lower_dir_inode, lower_dentry);
        if (rc) {
@@ -489,6 +490,7 @@ static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
        d_drop(dentry);
 out_unlock:
        unlock_dir(lower_dir_dentry);
+ dput(lower_dentry);
        return rc;
 }

  test ......

http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git;a=blob;f=fs/ecryptfs/inode.c;h=2f0945d632970511ba189a0ef8595e918c10b693;hb=96a7b9c2f5df899f302ade45cf17ad753fe130fd

Revision history for this message
david (davidelizondo2006) wrote :

> diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
> index 2f0945d..056fed6 100644 (file)
> --- a/fs/ecryptfs/inode.c
> +++ b/fs/ecryptfs/inode.c
> @@ -476,6 +476,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> dentry *dentry)
> struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
> struct dentry *lower_dir_dentry;
>
> + dget(lower_dentry);
> lower_dir_dentry = lock_parent(lower_dentry);
> rc = vfs_unlink(lower_dir_inode, lower_dentry);
> if (rc) {
> @@ -489,6 +490,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> dentry *dentry)
> d_drop(dentry);
> out_unlock:
> unlock_dir(lower_dir_dentry);
> + dput(lower_dentry);
> return rc;
> }
>
> test ......
>
> http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git;a=blob;f=fs/ecry
> ptfs/inode.c;h=2f0945d632970511ba189a0ef8595e918c10b693;hb=96a7b9c2f5df899f302
> ade45cf17ad753fe130fd

Merge branch 'for-linus' of git://git./linux/kernel/git/ecryptfs/ecryptfs-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ecryptfs/ecryptfs-2.6:
  eCryptfs: Prevent lower dentry from going negative during unlink
  eCryptfs: Propagate vfs_read and vfs_write return codes
  eCryptfs: Validate global auth tok keys
  eCryptfs: Filename encryption only supports password auth tokens
  eCryptfs: Check for O_RDONLY lower inodes when opening lower files
  eCryptfs: Handle unrecognized tag 3 cipher codes
  ecryptfs: improved dependency checking and reporting
  eCryptfs: Fix lockdep-reported AB-BA mutex issue
  ecryptfs: Remove unneeded locking that triggers lockdep false positives

Revision history for this message
david (davidelizondo2006) wrote :
Download full text (98.9 KiB)

> > diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
> > index 2f0945d..056fed6 100644 (file)
> > --- a/fs/ecryptfs/inode.c
> > +++ b/fs/ecryptfs/inode.c
> > @@ -476,6 +476,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> > dentry *dentry)
> > struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
> > struct dentry *lower_dir_dentry;
> >
> > + dget(lower_dentry);
> > lower_dir_dentry = lock_parent(lower_dentry);
> > rc = vfs_unlink(lower_dir_inode, lower_dentry);
> > if (rc) {
> > @@ -489,6 +490,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> > dentry *dentry)
> > d_drop(dentry);
> > out_unlock:
> > unlock_dir(lower_dir_dentry);
> > + dput(lower_dentry);
> > return rc;
> > }
> >
> > test ......
> >
> > http://git.kernel.org/?p=linux/kernel/git/next/linux-
> next.git;a=blob;f=fs/ecry
> >
> ptfs/inode.c;h=2f0945d632970511ba189a0ef8595e918c10b693;hb=96a7b9c2f5df899f302
> > ade45cf17ad753fe130fd
>
>
> Merge branch 'for-linus' of git://git./linux/kernel/git/ecryptfs/ecryptfs-2.6
>
> * 'for-linus' of
> git://git.kernel.org/pub/scm/linux/kernel/git/ecryptfs/ecryptfs-2.6:
> eCryptfs: Prevent lower dentry from going negative during unlink
> eCryptfs: Propagate vfs_read and vfs_write return codes
> eCryptfs: Validate global auth tok keys
> eCryptfs: Filename encryption only supports password auth tokens
> eCryptfs: Check for O_RDONLY lower inodes when opening lower files
> eCryptfs: Handle unrecognized tag 3 cipher codes
> ecryptfs: improved dependency checking and reporting
> eCryptfs: Fix lockdep-reported AB-BA mutex issue
> ecryptfs: Remove unneeded locking that triggers lockdep false positives

1 config ECRYPT_FS
2 tristate "eCrypt filesystem layer support (EXPERIMENTAL)"
3 depends on EXPERIMENTAL && KEYS && NET
4 select CRYPTO_ECB
5 select CRYPTO_CBC
6 help
7 Encrypted filesystem that operates on the VFS layer. See
8 <file:Documentation/filesystems/ecryptfs.txt> to learn more about
9 eCryptfs. Userspace components are required and can be
10 obtained from <http://ecryptfs.sf.net>.
11
12 To compile this file system support as a module, choose M here: the
13 module will be called ecryptfs.

#######################################################################################
/**
2 * eCryptfs: Linux filesystem encryption layer
3 *
4 * Copyright (C) 1997-2004 Erez Zadok
5 * Copyright (C) 2001-2004 Stony Brook University
6 * Copyright (C) 2004-2007 International Business Machines Corp.
7 * Author(s): Michael A. Halcrow <email address hidden>
8 * Michael C. Thompson <email address hidden>
9 *
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License as
12 * published by the Free Software Foundation; either version 2 of the
13 * License, or (at your option) any later version.
14 *
15 * This program is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of
17...

Revision history for this message
david (davidelizondo2006) wrote :
Download full text (262.0 KiB)

> > > diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
> > > index 2f0945d..056fed6 100644 (file)
> > > --- a/fs/ecryptfs/inode.c
> > > +++ b/fs/ecryptfs/inode.c
> > > @@ -476,6 +476,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> > > dentry *dentry)
> > > struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
> > > struct dentry *lower_dir_dentry;
> > >
> > > + dget(lower_dentry);
> > > lower_dir_dentry = lock_parent(lower_dentry);
> > > rc = vfs_unlink(lower_dir_inode, lower_dentry);
> > > if (rc) {
> > > @@ -489,6 +490,7 @@ static int ecryptfs_unlink(struct inode *dir, struct
> > > dentry *dentry)
> > > d_drop(dentry);
> > > out_unlock:
> > > unlock_dir(lower_dir_dentry);
> > > + dput(lower_dentry);
> > > return rc;
> > > }
> > >
> > > test ......
> > >
> > > http://git.kernel.org/?p=linux/kernel/git/next/linux-
> > next.git;a=blob;f=fs/ecry
> > >
> >
> ptfs/inode.c;h=2f0945d632970511ba189a0ef8595e918c10b693;hb=96a7b9c2f5df899f302
> > > ade45cf17ad753fe130fd
> >
> >
> > Merge branch 'for-linus' of
> git://git./linux/kernel/git/ecryptfs/ecryptfs-2.6
> >
> > * 'for-linus' of
> > git://git.kernel.org/pub/scm/linux/kernel/git/ecryptfs/ecryptfs-2.6:
> > eCryptfs: Prevent lower dentry from going negative during unlink
> > eCryptfs: Propagate vfs_read and vfs_write return codes
> > eCryptfs: Validate global auth tok keys
> > eCryptfs: Filename encryption only supports password auth tokens
> > eCryptfs: Check for O_RDONLY lower inodes when opening lower files
> > eCryptfs: Handle unrecognized tag 3 cipher codes
> > ecryptfs: improved dependency checking and reporting
> > eCryptfs: Fix lockdep-reported AB-BA mutex issue
> > ecryptfs: Remove unneeded locking that triggers lockdep false positives
>
>
> 1 config ECRYPT_FS
> 2 tristate "eCrypt filesystem layer support (EXPERIMENTAL)"
> 3 depends on EXPERIMENTAL && KEYS && NET
> 4 select CRYPTO_ECB
> 5 select CRYPTO_CBC
> 6 help
> 7 Encrypted filesystem that operates on the VFS layer. See
> 8 <file:Documentation/filesystems/ecryptfs.txt> to learn more about
> 9 eCryptfs. Userspace components are required and can be
> 10 obtained from <http://ecryptfs.sf.net>.
> 11
> 12 To compile this file system support as a module, choose M here:
> the
> 13 module will be called ecryptfs.
>
> ##############################################################################
> #########
> /**
> 2 * eCryptfs: Linux filesystem encryption layer
> 3 *
> 4 * Copyright (C) 1997-2004 Erez Zadok
> 5 * Copyright (C) 2001-2004 Stony Brook University
> 6 * Copyright (C) 2004-2007 International Business Machines Corp.
> 7 * Author(s): Michael A. Halcrow <email address hidden>
> 8 * Michael C. Thompson <email address hidden>
> 9 *
> 10 * This program is free software; you can redistribute it and/or
> 11 * modify it under the terms of the GNU General Public License as
> 12 * published by the Free Software Foundation; either version 2 of the
> 13 * License, or (at your option) any later ve...

lp://staging/~ecryptfs/ecryptfs/ecryptfs-utils updated
462. By Dustin Kirkland 

open 82 for development

Signed-off-by: Dustin Kirkland <email address hidden>

463. By Dustin Kirkland 

src/utils/ecryptfs-setup-private: fix bug where setup-private
incorrectly assumed that the home/private dir ownerships should
be owned by USER:USER; instead, default to USER:GROUP, where
GROUP is the USER's primary group by default, LP: #445301

464. By Dustin Kirkland 

src/utils/ecryptfs-setup-private: fix typo, s/getext/gettext, LP: #456565

465. By Dustin Kirkland 

* src/utils/ecryptfs-setup-private, debian/control: LP: #456565
  - fix typo, s/getext/gettext
  - depend on gettext-base

466. By Dustin Kirkland 

src/utils/ecryptfs-setup-private: fix printing of error strings,
which was broken by the gettext integration, LP: #471725

467. By Dustin Kirkland 

  which was broken by the gettext integration, LP: #471725;
  in doing so, use $() in place of ``, use '' for gettext arguments,
  and wrap gettext in "", like this: foo="$(gettext 'blah blah')"

468. By Dustin Kirkland 

* debian/control: one package per line, helps tremendously when looking
  at diffs
* debian/copyright: Add new fields
* debian/ecryptfs-utils.postinst: minor set -e change

469. By Dustin Kirkland 

releasing version 82

470. By Dustin Kirkland 

add release instructions

Signed-off-by: Dustin Kirkland <email address hidden>

471. By Dustin Kirkland <kirkland@x200>

* libecryptfs/key_management.c, utils/mount.ecryptfs_private.c:
  - use the session keyring, rather than the user keyring, such that
    keys are automatically cleared on logout

472. By Dustin Kirkland <kirkland@x200>

src/pam_ecryptfs/pam_ecryptfs.c, src/utils/Makefile.am,
src/utils/ecryptfs-migrate-home: add a script and pam hooks to
support automatic migration to encrypted home directory

473. By Dustin Kirkland <kirkland@x200>

add uid arg to wrap_passphrase_if_necessary

474. By Dustin Kirkland <kirkland@x200>

revert -r471, not quite ready for this yet

475. By Dustin Kirkland <kirkland@x200>

move wrap_passphrase_if_necessary() definition up before first use

476. By Dustin Kirkland <kirkland@x200>

* src/utils/ecryptfs-migrate-home: clean up for merge
  - use $() rather than ``
  - drop set -u
  - use = and !=, and quote vars, rather than testing with -ne, -eq,
    for better shell portability
  - improve usage statement and error text

477. By Dustin Kirkland <kirkland@x200>

  - check if already encrypted
  - handle migration of multiple users on boot

478. By Dustin Kirkland <kirkland@x200>

fix all whitespace, use tabs for indents

479. By Dustin Kirkland <kirkland@x200>

use quotes around variables, rather than ${} (stylistic preference)

480. By Dustin Kirkland <kirkland@x200>

  - major simplification for immediate release
    + remove boot and user modes; only support administrator mode for
      security reasons and to avoid race conditions
    + other modes can be re-added, if necessary, and if security
      concerns can be addressed

481. By Dustin Kirkland <kirkland@x200>

src/utils/Makefile.am: install to /usr/sbin, since this is an
administrative utility

482. By Dustin Kirkland <kirkland@x200>

ensure running as root

483. By Dustin Kirkland <kirkland@x200>

revert sbin change, as it installed to /sbin instead of /usr/sbin

484. By Dustin Kirkland <kirkland@x200>

drop verbose option, always print useful info messages

485. By Dustin Kirkland <kirkland@x200>

call the user $USER_NAME rather than $USER_ID since id implies
number, and here we're deailing with names

486. By Dustin Kirkland <kirkland@x200>

no decimals on awk calculation

487. By Dustin Kirkland <kirkland@x200>

mktemp on the target user, not root

488. By Dustin Kirkland <kirkland@x200>

drop VERBOSE option, always print useful info messages

489. By Dustin Kirkland <kirkland@x200>

check that there is enough disk space available to do the migration

490. By Dustin Kirkland <kirkland@x200>

ensure the user's homedir group is correct

491. By Dustin Kirkland <kirkland@x200>

add critical instructions, user *must* login after the migration and
before the reboot, as their wrapped passphrase will be cleared on
reboot (possible we should use an init script to move these to
/var/tmp on reboot)

492. By Dustin Kirkland <kirkland@x200>

ensure permissions are set correctly

493. By Dustin Kirkland <kirkland@x200>

fix versioning

494. By Dustin Kirkland <kirkland@x200>

debian/ecryptfs-utils.upstart, debian/rules: try to protect migrating
users who don't login before the next reboot

495. By Dustin Kirkland <kirkland@x200>

* ecryptfs-utils.ecryptfs-utils-restore.upstart,
  ecryptfs-utils.ecryptfs-utils-save.upstart, rules:
  - try to protect migrating users who don't login before the next reboot

496. By Dustin Kirkland <kirkland@x200>

improve text at the end of the migration

497. By Dustin Kirkland <kirkland@x200>

src/desktop/ecryptfs-record-passphrase: improve text

Revision history for this message
Dustin Kirkland  (kirkland) wrote :

Is this branch still active at all?

review: Needs Information

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
=== modified file 'README'
--- README 2009-02-03 08:50:36 +0000
+++ README 2010-02-17 20:48:18 +0000
@@ -43,11 +43,6 @@
43 1.0 or higher)43 1.0 or higher)
44 - Finding its way into some distros44 - Finding its way into some distros
45 - Obtainable from <http://people.redhat.com/~dhowells/keyutils> 45 - Obtainable from <http://people.redhat.com/~dhowells/keyutils>
46 - libgcrypt
47 - Part of most distros; install the development package
48 - If you need to build from source, you probably will want these:
49 - <ftp://ftp.gnupg.org/gcrypt/libgpg-error>
50 - <ftp://ftp.gnupg.org/gcrypt/libgcrypt>
5146
5247
53KERNEL BUILD OPTIONS48KERNEL BUILD OPTIONS
5449
=== modified file 'configure.ac'
--- configure.ac 2009-04-21 23:25:42 +0000
+++ configure.ac 2010-02-17 20:48:18 +0000
@@ -10,7 +10,7 @@
1010
1111
12AC_PREREQ(2.59)12AC_PREREQ(2.59)
13AC_INIT([ecryptfs-utils],[74])13AC_INIT([ecryptfs-utils],[82])
14AC_CANONICAL_HOST14AC_CANONICAL_HOST
15AC_CANONICAL_TARGET15AC_CANONICAL_TARGET
16AM_INIT_AUTOMAKE([${PACKAGE_NAME}], [${PACKAGE_VERSION}])16AM_INIT_AUTOMAKE([${PACKAGE_NAME}], [${PACKAGE_VERSION}])
@@ -187,14 +187,6 @@
187AC_HEADER_STDC187AC_HEADER_STDC
188AC_CHECK_LIB([dl], [dlopen])188AC_CHECK_LIB([dl], [dlopen])
189189
190# Verify gcrypt
191AC_MSG_CHECKING([for libgcrypt])
192AM_PATH_LIBGCRYPT(,,[AC_MSG_ERROR([eCryptfs userspace tools require libgcrypt
193You might find the package at:
194http://directory.fsf.org/security/libgcrypt.html
195])]
196)
197
198# Verify keyutils version 1.0 or higher190# Verify keyutils version 1.0 or higher
199if test -z "${KEYUTILS_LIBS}"; then191if test -z "${KEYUTILS_LIBS}"; then
200 AC_ARG_VAR([KEYUTILS_CFLAGS], [C compiler flags for keyutils])192 AC_ARG_VAR([KEYUTILS_CFLAGS], [C compiler flags for keyutils])
@@ -327,7 +319,7 @@
327 AC_CHECK_LIB(319 AC_CHECK_LIB(
328 [pam_misc],320 [pam_misc],
329 [pam_misc_setenv],321 [pam_misc_setenv],
330 [PAM_LIBS="${TSPI_LIBS} -lpam_misc"],322 [PAM_LIBS="${PAM_LIBS} ${TSPI_LIBS} -lpam_misc"],
331 [AC_MSG_ERROR([Cannot find pam_misc])]323 [AC_MSG_ERROR([Cannot find pam_misc])]
332 )324 )
333 fi325 fi
@@ -353,13 +345,8 @@
353 rootsbindir="\$(sbindir)"345 rootsbindir="\$(sbindir)"
354fi346fi
355347
356if test "${enable_nss}" == "yes" ; then348CRYPTO_CFLAGS=${NSS_CFLAGS}
357 CRYPTO_CFLAGS=${NSS_CFLAGS}349CRYPTO_LIBS=${NSS_LIBS}
358 CRYPTO_LIBS=${NSS_LIBS}
359else
360 CRYPTO_CFLAGS=${LIBGCRYPT_CFLAGS}
361 CRYPTO_LIBS=${LIBGCRYPT_LIBS}
362fi
363350
364AC_SUBST([pamdir])351AC_SUBST([pamdir])
365AC_SUBST([pamlibdir])352AC_SUBST([pamlibdir])
366353
=== modified file 'debian/changelog'
--- debian/changelog 2009-04-21 23:24:32 +0000
+++ debian/changelog 2010-02-17 20:48:18 +0000
@@ -1,4 +1,314 @@
1ecryptfs-utils (74) unreleased; urgency=low1ecryptfs-utils (83) UNRELEASED; urgency=low
2
3 [ Yan Li <yan.i.li@intel.com> ]
4 * src/pam_ecryptfs/pam_ecryptfs.c, src/utils/Makefile.am,
5 src/utils/ecryptfs-migrate-home: add a script and pam hooks to
6 support automatic migration to encrypted home directory
7
8 [ Dustin Kirkland ]
9 * src/utils/ecryptfs-migrate-home: clean up for merge
10 - use $() rather than ``
11 - drop set -u
12 - use = and !=, and quote vars, rather than testing with -ne, -eq,
13 for better shell portability
14 - improve usage statement and error text
15 - check if already encrypted
16 - handle migration of multiple users on boot
17 - fix all whitespace, use tabs for indents
18 - use quotes around variables, rather than ${} (stylistic preference)
19 - major simplification for immediate release
20 + remove boot and user modes; only support administrator mode for
21 security reasons and to avoid race conditions
22 + other modes can be re-added, if necessary, and if security
23 concerns can be addressed
24 - ensure running as root
25 - drop VERBOSE option, always print useful info messages
26 - call the user $USER_NAME rather than $USER_ID since id implies
27 number, and here we're deailing with names
28 - no decimals on awk calculation
29 - mktemp on the target user, not root
30 - check that there is enough disk space available to do the migration
31 - ensure the user's homedir group is correct
32 - add critical instructions, user *must* login after the migration and
33 before the reboot, as their wrapped passphrase will be cleared on
34 reboot (possible we should use an init script to move these to
35 /var/tmp on reboot)
36 - ensure permissions are set correctly
37 - improve text at the end of the migration
38 * ecryptfs-utils.ecryptfs-utils-restore.upstart,
39 ecryptfs-utils.ecryptfs-utils-save.upstart, rules:
40 - try to protect migrating users who don't login before the next reboot
41 * src/desktop/ecryptfs-record-passphrase: improve text
42
43 -- Dustin Kirkland <kirkland@ubuntu.com> Sat, 06 Feb 2010 17:48:57 -0600
44
45ecryptfs-utils (82) released; urgency=low
46
47 * src/utils/ecryptfs-setup-private: fix bug where setup-private
48 incorrectly assumed that the home/private dir ownerships should
49 be owned by USER:USER; instead, default to USER:GROUP, where
50 GROUP is the USER's primary group by default, LP: #445301
51 * src/utils/ecryptfs-setup-private, debian/control: LP: #456565
52 - fix typo, s/getext/gettext
53 - depend on gettext-base
54 * src/utils/ecryptfs-setup-private: fix printing of error strings,
55 which was broken by the gettext integration, LP: #471725;
56 in doing so, use $() in place of ``, use '' for gettext arguments,
57 and wrap gettext in "", like this: foo="$(gettext 'blah blah')"
58 * debian/control: one package per line, helps tremendously when looking
59 at diffs
60 * debian/copyright: Add new fields
61 * debian/ecryptfs-utils.postinst: minor set -e change
62
63
64 -- Dustin Kirkland <kirkland@ubuntu.com> Tue, 10 Nov 2009 11:31:25 -0600
65
66ecryptfs-utils (81) released; urgency=low
67
68 [ Michael Terry ]
69 * src/utils/ecryptfs-setup=swap: clean up some error message reporting,
70 LP: #430891, #430890
71
72 [ Dustin Kirkland ]
73 * doc/manpage/ecryptfs.7: note the 64-char passphrase limit, LP: #386504
74 * src/utils/ecryptfs-setup-private: minor documentation change
75
76 -- Dustin Kirkland <kirkland@ubuntu.com> Fri, 18 Sep 2009 18:46:07 -0500
77
78ecryptfs-utils (80) released; urgency=low
79
80 [ Evan Dandrea ]
81 * src/utils/ecryptfs-setup-swap: allow for setting up encrpyted swap,
82 without activating it immediately, necessary for livecd installations
83
84 -- Dustin Kirkland <kirkland@ubuntu.com> Wed, 19 Aug 2009 11:31:03 -0500
85
86ecryptfs-utils (79) released; urgency=low
87
88 [ Dustin Kirkland ]
89 * debian/control: updated bzr and browser urls, bumped standards version
90 * src/pam_ecryptfs/pam_ecryptfs.c: silence useless, oft-shown info
91 message
92 * src/utils/ecryptfs-mount-private, src/utils/ecryptfs-rewrite-file,
93 src/utils/ecryptfs-setup-private, src/utils/ecryptfs-setup-swap,
94 src/utils/ecryptfs-umount-private: use gettext for all string printing,
95 such that we can internationalize ecryptfs
96 * po/POTFILES.sh, po/ecryptfs-utils.pot, po/fr.po, rules: add po to the
97 build system; for now, in the debian/ directory; this should be put in
98 the upstream source tree eventually (but I need some help with the
99 automake/autoconf integration)
100 * ecryptfs-setup-swap: exit(0) if there's no swaps to encrypt, ensures
101 that this script succeeds if there is no swap space that needs to be
102 secured, or if the existing swap space is already secured
103 * doc/manpage/ecryptfs-setup-swap.1, doc/manpage/ecryptfs-stat.1,
104 doc/manpage/umount.ecryptfs.8, doc/manpage/Makefile.am: added manpagess
105 * doc/manpage/ecryptfs.7: fix lintian warning
106 * debian/lintian/ecryptfs-utils: added a lintian overrides file
107 * debian/lintian/ecryptfs-utils, debian/ecryptfs-utils.install: add and
108 install some proper lintian overrides
109 * src/libecryptfs/module_mgr.c: fix typo, LP: #408437
110
111 [ Evan Dandrea ]
112 * ecryptfs-setup-swap: support more than one encrypted swap device
113
114 [ Dorin Scutarașu ]
115 * src/libecryptfs/key_management.c: fix null pointer deref, LP: #409565
116
117 -- Dustin Kirkland <kirkland@ubuntu.com> Mon, 17 Aug 2009 11:58:35 -0500
118
119ecryptfs-utils (78) released; urgency=low
120
121 [ James Westby ]
122 * src/libecryptfs/main.c flockfile the filehandle after checking that
123 we were able to successfully open it (LP: #403011)
124 * debian/libecryptfs0.shlibs: bump shlibs dep to 77 since we added new
125 symbols there
126
127 -- Dustin Kirkland <kirkland@ubuntu.com> Wed, 22 Jul 2009 11:28:20 -0500
128
129ecryptfs-utils (77) released; urgency=low
130
131 [ Dustin Kirkland ]
132 * src/libecryptfs/key_management.c, src/pam_ecryptfs/pam_ecryptfs.c:
133 revert the zombie code removal from pam_ecryptfs as it seems this
134 bit is still needed; fix the source of the problem introduced in
135 commit r407; check for non-zero return codes; this problem would
136 manifest itself as a) unable to unlock screensaver, b) unable to
137 switch users, c) unable to mount home folder on initial login;
138 LP: #402222, #402029
139 * src/utils/ecryptfs-umount-private: use for loop to loop over key
140 ids on removal
141 * src/utils/mount.ecryptfs_private.c: return non-zero on unmount failure
142 due to open sessions; handle this in ecryptfs-umount-private too; make
143 the flock() blocking; use /dev/shm for counter; add an iterator to the
144 counter file to prevent users from DoS'ing one another from accessing
145 their encrypted directories, LP: #402745
146 * debian/ecryptfs-utils.postinst: move /tmp counters to /dev/shm
147 * configure.ac: link against pam, silence shlib warning
148 * src/include/ecryptfs.h, src/libecryptfs/main.c,
149 src/pam_ecryptfs/pam_ecryptfs.c, src/utils/Makefile.am,
150 src/utils/mount.ecryptfs_private.c: move two functions from
151 mount.ecryptfs_private to libecryptfs, namely is_mounted() and
152 fetch_private_mnt(); use these in both pam_ecryptfs and
153 mount.ecryptfs_private; also move PRIVATE to ECRYPTFS_PRIVATE in
154 the ecryptfs.h headers; this will allow us to short-circuit some of the
155 costly key-loading code on pam_auth if the private dir is already
156 mounted, speeding up some subsequent authentications significantly,
157 LP: #402748
158 * doc/ecryptfs-mount-private.txt: removed the "$" to make copy-n-paste
159 more user friendly
160 * src/utils/ecryptfs-setup-private: when encrypting home, put the
161 .ecryptfs and .Private data in /home/.ecryptfs rather than /var/lib,
162 as users are forgetting to backup /var/lib, and are often putting
163 /home on a separate partition; furthermore, this gives users a place
164 to access their encrypted data for backup, rather than hiding the
165 data below $HOME, LP: #371719
166
167 [ Tyler Hicks ]
168 * src/libecryptfs/cipher_list.c, src/libecryptfs/module_mgr.c:
169 add blowfish/56-bytes to the list of ciphers we officially support,
170 LP: #402790
171
172 -- Dustin Kirkland <kirkland@ubuntu.com> Tue, 21 Jul 2009 23:57:33 -0500
173
174ecryptfs-utils (76) released; urgency=low
175
176 [ Dustin Kirkland ]
177 * src/utils/ecryptfs-setup-swap: switch from vol_id to blkid,
178 LP: #376486
179 * debian/ecryptfs-utils.postinst, src/utils/ecryptfs-setup-private:
180 don't echo mount passphrase if running in bootstrap mode; prune
181 potential leakages from install log, LP: #383650
182 * SECURITY UPDATE: mount passphrase recorded in install log (LP: #383650).
183 - debian/ecryptfs-utils.postinst: prune private information from
184 installer log
185 - src/utils/ecryptfs-setup-private: don't echo passphrase if running in
186 bootstrap mode
187 - CVE-2009-1296
188 * src/utils/ecryptfs-setup-private: make some of the lanuage more readable,
189 (thanks, anrxc)
190 * README, configure.ac, debian/control, debian/rules,
191 doc/sourceforge_webpage/README, src/libecryptfs-swig/libecryptfs.py,
192 src/libecryptfs-swig/libecryptfs_wrap.c,
193 src/libecryptfs/key_management.c, src/libecryptfs/libecryptfs.pc.in,
194 src/libecryptfs/main.c, src/pam_ecryptfs/Makefile.am,
195 src/utils/manager.c, src/utils/mount.ecryptfs.c: move build from gcrypt
196 to nss (this change has been pending for some time)
197 * src/utils/ecryptfs-dot-private: dropped, was too hacky
198 * ecryptfs-mount-private.1, ecryptfs-setup-private.1: align the
199 documentation and implementation of the wrapping-independent feature,
200 LP: #383746
201 * src/utils/ecryptfs-umount-private: use keyctl list @u, since keyctl show
202 stopped working, LP: #400484, #395082
203 * src/utils/mount.ecryptfs_private.c: fix counter file locking; solves
204 a longstanding bug about "random" umount caused by cronjobs, LP: #358573
205
206 [ Michal Hlavinka (edits by Dustin Kirkland) ]
207 * doc/manpage/ecryptfs-mount-private.1,
208 doc/manpage/ecryptfs-rewrite-file.1,
209 doc/manpage/ecryptfs-setup-private.1, doc/manpage/ecryptfs.7,
210 doc/manpage/mount.ecryptfs_private.1,
211 doc/manpage/umount.ecryptfs_private.1: documentation updated to note
212 possible ecryptfs group membership requirements; Fix ecrypfs.7 man
213 page and key_mod_openssl's error message; fix typo
214 * src/libecryptfs/decision_graph.c: put a finite limit (5 tries) on
215 interactive input; fix memory leaks when asking questions
216 * src/libecryptfs/module_mgr.c: Don't error out with EINVAL when
217 verbosity=0 and some options are missing.
218 * src/utils/umount.ecryptfs.c: no error for missing key when removing it
219 * src/libecryptfs-swig/libecryptfs.i: fix compile werror, cast char*
220 * src/utils/ecryptfs_add_passphrase.c: fix/test/use return codes;
221 return nonzero for --fnek when not supported but used
222 * src/include/ecryptfs.h, src/key_mod/ecryptfs_key_mod_openssl.c,
223 src/libecryptfs/module_mgr.c: refuse mounting with too small rsa
224 key (key_mod_openssl)
225 * src/utils/ecryptfs_insert_wrapped_passphrase_into_keyring.c: fix return
226 codes
227 * src/utils/ecryptfs-rewrite-file: polish output
228 * src/libecryptfs/key_management.c: inform about full keyring; insert fnek
229 sig into keyring if fnek support check fails; don't fail if key already
230 exists in keyring
231 * src/utils/ecryptfs-setup-private: if the ecryptfs group exists, restrict
232 ecryptfs-setup-private to members of this group
233 * src/pam_ecryptfs/pam_ecryptfs.c: dynamically load ecryptfs module by
234 checking ecryptfs version
235 * src/libecryptfs/decision_graph.c, src/utils/io.c,
236 src/utils/mount.ecryptfs.c: fix EOF handling, LP: #371587
237 * src/desktop/Makefile.am: make desktop files trusted, LP: #371426
238
239 [ Dustin Kirkland and Daniel Baumann ]
240 * debian/control, debian/copyright, debian/ecryptfs-utils.dirs,
241 debian/ecryptfs-utils.install, debian/ecryptfs-utils.postinst,
242 debian/rules, ecryptfs-utils.pam-auth-update: sync Ubuntu's
243 packaging with Debian; drop dpatch, drop libssl build dep, clean
244 up extraneous debhelper bits, match cflags; remaining diff is only
245 ecryptfs-utils.prerm
246
247 [ Arfrever Frehtes Taifersar Arahesis ]
248 * key_mod/ecryptfs_key_mod_gpg.c,
249 key_mod/ecryptfs_key_mod_pkcs11_helper.c,
250 libecryptfs/key_management.c, utils/ecryptfs_unwrap_passphrase.c:
251 Fix warnings, initialize a few variables, drop unused ones
252
253 [ David Hicks ]
254 * src/lib/key_management.c: fix stray semicolon that prevents .ecryptfsrc
255 files from working properly, LP: #372709
256
257 [ Michael Rooney ]
258 * src/python/ecryptfsapi.py: added python api
259
260 -- Dustin Kirkland <kirkland@ubuntu.com> Mon, 20 Jul 2009 12:12:30 -0500
261
262ecryptfs-utils (75) released; urgency=low
263
264 [ Dustin Kirkland ]
265 * debian/rules: drop hackery that moves stuff /usr/share/ecryptfs-utils
266 * src/utils/mount.ecryptfs_private.c: update inline documentation
267 * debian/changelog, src/libecryptfs/cmd_ln_parser.c,
268 src/libecryptfs/key_management.c, src/pam_ecryptfs/pam_ecryptfs.c,
269 src/utils/ecryptfs_add_passphrase.c,
270 src/utils/ecryptfs_insert_wrapped_passphrase_into_keyring.c,
271 src/utils/ecryptfs_rewrap_passphrase.c,
272 src/utils/ecryptfs_unwrap_passphrase.c,
273 src/utils/ecryptfs_wrap_passphrase.c: silence some useless logging,
274 LP: #313330
275 * include/ecryptfs.h, libecryptfs/key_management.c,
276 utils/ecryptfs_insert_wrapped_passphrase_into_keyring.c,
277 utils/ecryptfs_unwrap_passphrase.c: if the file to unwrap is
278 unspecified, try to use the default ~/.ecryptfs/wrapped-passphrase
279 before bailing out, LP: #359997
280 * src/utils/ecryptfs-setup-private: unix_chkpwd is not always present
281 (eg, gentoo), LP: #332341
282
283 [ Tyler Hicks ]
284 * doc/manpage/ecryptfs.7: ecryptfs_encrypted_view option desription
285 was wrong LP: #328761
286
287 [ Michal Hlavinka ]
288 * decision_graph.c: fix uninitialized return code
289 * mount.ecryptfs.c: don't pass verbosity option to kernel
290
291 [ anrxc & Dustin Kirkland ]
292 * doc/Makefile.am, src/desktop/Makefile.am: fix automake installation from
293 /usr/share to /usr/share/ecryptfs-utils
294
295 [ Daniel Baumann & Dustin Kirkland ]
296 * debian/rules, debian/control: sync differences between Debian & Ubuntu's
297 packaging
298
299 [ Arfrever Frehtes Taifersar Arahesis ]
300 * src/key_mod/ecryptfs_key_mod_gpg.c,
301 src/key_mod/ecryptfs_key_mod_pkcs11_helper.c: fix implicit declations
302
303 [ Frédéric Guihéry ]
304 * key_mod/ecryptfs_key_mod_tspi.c, utils/ecryptfs_generate_tpm_key.c:
305 the SRK password should be set to 20 bytes of NULL (wellknown
306 password), in order for different tools to request key protection
307 with the Storage Root Key
308
309 -- Dustin Kirkland <kirkland@ubuntu.com> Fri, 01 May 2009 15:07:38 -0500
310
311ecryptfs-utils (74) released; urgency=low
2312
3 [ Michal Hlavinka ]313 [ Michal Hlavinka ]
4 * Changes for RH/Fedora release314 * Changes for RH/Fedora release
5315
=== modified file 'debian/control'
--- debian/control 2009-02-18 21:30:21 +0000
+++ debian/control 2010-02-17 20:48:18 +0000
@@ -1,19 +1,47 @@
1Source: ecryptfs-utils1Source: ecryptfs-utils
2Section: misc2Section: misc
3Priority: optional3Priority: optional
4Maintainer: Ubuntu Core Developers <ubuntu-devel-discuss@lists.ubuntu.com>4Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
5XSBC-Original-Maintainer: Daniel Baumann <daniel@debian.org>5XSBC-Original-Maintainer: Daniel Baumann <daniel@debian.org>
6Build-Depends: debhelper (>= 7), dpatch, autotools-dev, autoconf, automake, libtool, libgcrypt11-dev, libgpg-error-dev, libgpgme11-dev, libkeyutils-dev, libopencryptoki-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc], libpam0g-dev, libpkcs11-helper1-dev, libssl-dev, libtspi-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc], pkg-config, python-dev, swig6Build-Depends:
7Standards-Version: 3.8.07 debhelper (>= 7),
8 autotools-dev,
9 autoconf,
10 automake,
11 libtool,
12 libgcrypt11-dev,
13 libgpg-error-dev,
14 libgpgme11-dev,
15 libkeyutils-dev,
16 libnss3-dev,
17 libopencryptoki-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc],
18 libpam0g-dev,
19 libpkcs11-helper1-dev,
20 libtspi-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc],
21 pkg-config,
22 python-dev,
23 swig
24Standards-Version: 3.8.3
8Homepage: https://launchpad.net/ecryptfs25Homepage: https://launchpad.net/ecryptfs
9Vcs-Browser: http://git.debian.net/?p=debian/ecryptfs-utils.git26Vcs-Bzr: https://code.launchpad.net/~ecryptfs/ecryptfs/ecryptfs-utils
10Vcs-Git: git://git.debian.net/git/debian/ecryptfs-utils.git27Vcs-Browser: http://bazaar.launchpad.net/~ecryptfs/ecryptfs/ecryptfs-utils/files
1128
12Package: ecryptfs-utils29Package: ecryptfs-utils
13Section: misc30Section: misc
14Architecture: any31Architecture: any
15Depends: ${shlibs:Depends}, ${misc:Depends}, libpam-runtime (>= 1.0.1-2ubuntu1), keyutils, libnss3-1d32Depends:
16Suggests: opencryptoki, cryptsetup33 ${misc:Depends},
34 ${shlibs:Depends},
35 keyutils,
36 libnss3-1d,
37 libpam-runtime (>= 1.0.1-6),
38 gettext-base
39Recommends:
40 lsof,
41 rsync
42Suggests:
43 cryptsetup,
44 opencryptoki
17Description: ecryptfs cryptographic filesystem (utilities)45Description: ecryptfs cryptographic filesystem (utilities)
18 eCryptfs is a POSIX-compliant enterprise-class stacked cryptographic filesystem46 eCryptfs is a POSIX-compliant enterprise-class stacked cryptographic filesystem
19 for Linux.47 for Linux.
@@ -33,7 +61,9 @@
33Package: libecryptfs061Package: libecryptfs0
34Section: libs62Section: libs
35Architecture: any63Architecture: any
36Depends: ${shlibs:Depends}, ${misc:Depends}64Depends:
65 ${misc:Depends},
66 ${shlibs:Depends}
37Description: ecryptfs cryptographic filesystem (library)67Description: ecryptfs cryptographic filesystem (library)
38 eCryptfs is a POSIX-compliant enterprise-class stacked cryptographic filesystem68 eCryptfs is a POSIX-compliant enterprise-class stacked cryptographic filesystem
39 for Linux.69 for Linux.
@@ -43,7 +73,17 @@
43Package: libecryptfs-dev73Package: libecryptfs-dev
44Section: libdevel74Section: libdevel
45Architecture: any75Architecture: any
46Depends: libecryptfs0 (= ${binary:Version}), libgcrypt11-dev, libgpg-error-dev, libgpgme11-dev, libkeyutils-dev, libopencryptoki-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc], libpam0g-dev, libpkcs11-helper1-dev, libtspi-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc]76Depends:
77 ${misc:Depends},
78 libecryptfs0 (= ${binary:Version}),
79 libgcrypt11-dev,
80 libgpg-error-dev,
81 libgpgme11-dev,
82 libkeyutils-dev,
83 libopencryptoki-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc],
84 libpam0g-dev,
85 libpkcs11-helper1-dev,
86 libtspi-dev [alpha amd64 arm armel hppa ia64 i386 m68k mips mipsel powerpc sparc]
47Description: ecryptfs cryptographic filesystem (development)87Description: ecryptfs cryptographic filesystem (development)
48 eCryptfs is a POSIX-compliant enterprise-class stacked cryptographic filesystem88 eCryptfs is a POSIX-compliant enterprise-class stacked cryptographic filesystem
49 for Linux.89 for Linux.
5090
=== modified file 'debian/copyright'
--- debian/copyright 2009-02-13 15:57:24 +0000
+++ debian/copyright 2010-02-17 20:48:18 +0000
@@ -1,11 +1,16 @@
1Authors:1Authors:
2 Phillip Hellewell <hacker@byu.net>2 Phillip Hellewell <hacker@byu.net>
3 Michael A. Halcrow <mhalcrow@us.ibm.com>3 Michael A. Halcrow <mike@halcrow.us>
4 Dustin Kirkland <kirkland@ubuntu.com>4 Dustin Kirkland <kirkland@canonical.com>
5Download: https://launchpad.net/ecryptfs/trunk5 Tyler Hicks <tyhicks@linux.vnet.ibm.com>
6
7Upstream-Contact: Dustin Kirkland <kirkland@canonical.com>
8Upstream-Homepage: https://launchpad.net/ecryptfs
69
7Files: *10Files: *
8Copyright: 2004-2008 International Business Machines Corp.11Copyright:
12 (C) 2004-2009 International Business Machines Corp.
13 (C) 2008-2009 Canonical, Ltd.
9License: GPL-2+14License: GPL-2+
10 This program is free software; you can redistribute it and/or15 This program is free software; you can redistribute it and/or
11 modify it under the terms of the GNU General Public License16 modify it under the terms of the GNU General Public License
@@ -46,7 +51,7 @@
46 can be found in /usr/share/common-licenses/GPL-2 file.51 can be found in /usr/share/common-licenses/GPL-2 file.
4752
48Files: debian/*53Files: debian/*
49Copyright: (C) 2007-2008 Daniel Baumann <daniel@debian.org>54Copyright: (C) 2007-2009 Daniel Baumann <daniel@debian.org>
50License: GPL-2+55License: GPL-2+
51 This program is free software; you can redistribute it and/or56 This program is free software; you can redistribute it and/or
52 modify it under the terms of the GNU General Public License57 modify it under the terms of the GNU General Public License
5358
=== removed file 'debian/ecryptfs-utils.dirs'
--- debian/ecryptfs-utils.dirs 2009-03-24 21:15:49 +0000
+++ debian/ecryptfs-utils.dirs 1970-01-01 00:00:00 +0000
@@ -1,2 +0,0 @@
1usr/share/pam-configs
2usr/share/ecryptfs-utils
30
=== added file 'debian/ecryptfs-utils.ecryptfs-utils-restore.upstart'
--- debian/ecryptfs-utils.ecryptfs-utils-restore.upstart 1970-01-01 00:00:00 +0000
+++ debian/ecryptfs-utils.ecryptfs-utils-restore.upstart 2010-02-17 20:48:18 +0000
@@ -0,0 +1,26 @@
1# eCryptfs restore
2description "eCryptfs"
3author "Dustin Kirkland <kirkland@canonical.com>"
4
5start on runlevel [2345]
6task
7
8# This task is necessary in support of ecryptfs-migrate-home.
9#
10# The administrator is strongly advised that the migrated user must
11# log in before reboot in order for the migration to take effect, as
12# the data in /dev/shm will be lost.
13#
14# The code below moves the /dev/shm data to /var/tmp to persist across
15# boots and prevent users from locking themselves out of their system,
16# however, it's slightly less secure, as these files should not be written
17# to disk, if possible.
18
19script
20 for i in /var/tmp/.ecryptfs-*; do
21 u=$(echo "$i" | sed "s:^/var/tmp/.ecryptfs-::")
22 if [ "$(stat -c %U $i)" = "$u" ]; then
23 mv -n "$i" /dev/shm
24 fi
25 done
26end script
027
=== added file 'debian/ecryptfs-utils.ecryptfs-utils-save.upstart'
--- debian/ecryptfs-utils.ecryptfs-utils-save.upstart 1970-01-01 00:00:00 +0000
+++ debian/ecryptfs-utils.ecryptfs-utils-save.upstart 2010-02-17 20:48:18 +0000
@@ -0,0 +1,26 @@
1# eCryptfs save
2description "eCryptfs"
3author "Dustin Kirkland <kirkland@canonical.com>"
4
5start on runlevel [!2345]
6task
7
8# This task is necessary in support of ecryptfs-migrate-home.
9#
10# The administrator is strongly advised that the migrated user must
11# log in before reboot in order for the migration to take effect, as
12# the data in /dev/shm will be lost.
13#
14# The code below moves the /dev/shm data to /var/tmp to persist across
15# boots and prevent users from locking themselves out of their system,
16# however, it's slightly less secure, as these files should not be written
17# to disk, if possible.
18
19script
20 for i in /dev/shm/.ecryptfs-*; do
21 u=$(echo "$i" | sed "s:^/dev/shm/.ecryptfs-::")
22 if [ "$(stat -c %U $i)" = "$u" ]; then
23 mv -n "$i" /var/tmp
24 fi
25 done
26end script
027
=== modified file 'debian/ecryptfs-utils.install'
--- debian/ecryptfs-utils.install 2009-02-13 15:57:24 +0000
+++ debian/ecryptfs-utils.install 2010-02-17 20:48:18 +0000
@@ -3,5 +3,6 @@
3/usr/bin3/usr/bin
4/usr/lib/ecryptfs4/usr/lib/ecryptfs
5/usr/share/doc5/usr/share/doc
6/usr/share/ecryptfs-utils
6/usr/share/man7/usr/share/man
7/usr/share/pam-configs/ecryptfs-utils8../../debian/lintian/ecryptfs-utils usr/share/lintian/overrides
89
=== modified file 'debian/ecryptfs-utils.postinst'
--- debian/ecryptfs-utils.postinst 2009-02-13 15:57:24 +0000
+++ debian/ecryptfs-utils.postinst 2010-02-17 20:48:18 +0000
@@ -1,44 +1,20 @@
1#!/bin/sh -e
2
3auth=0c1295085dca124e6ba5a3cea7993c22
4account=9f04221fe44762047894adeb96ffd069
5session=2e9a42f2a3b6573891ff9e6bf0c31c9e
6password=4cf59ec48caad2a06ea2e183d8bc007a
7
8force=
9if dpkg --compare-versions "$2" lt-nl 53-1ubuntu6; then
10 # If we're upgrading from an older ecryptfs-utils,
11 # and the pam configuration precisely matches that
12 # which was written by auth-client-config, we can
13 # safely force the pam-auth-update.
14 force=--force
15 for type in auth account session password
16 do
17 sum="$(md5sum /etc/pam.d/common-$type 2>/dev/null | awk '{ print $1 }')"
18 [ "$sum" = "$(eval echo \$$type)" ] || force=
19 done
20fi
21pam-auth-update --package $force
22
23#DEBHELPER#
24
25exit 0
26#!/bin/sh1#!/bin/sh
272
28set -e3set -e
294
30case "${1}" in5case "${1}" in
31 configure)6 configure)
32 # Basically, if a user chooses to encrypt their entire home7 [ -e /var/log/installer/syslog ] && sed -i '/user-setup: YOU SHOULD RECORD THIS/,+2 d' /var/log/installer/syslog
33 # directory, we're going to need someplace to put their8 pam-auth-update --package
34 # ~/.ecryptfs directory that's available prior to mounting their9 # Try to migrate encrypted Private counters from /tmp to /dev/shm, if sane
35 # home directory. Classic chicken/egg bootstrapping.10 for i in $(ls /home); do
3611 if [ -f "/tmp/ecryptfs-$i-Private" ] && [ ! -e "/dev/shm/ecryptfs-$i-Private" ]; then
37 if [ ! -d /var/lib/ecryptfs ]12 o=$(stat -c %U "/tmp/ecryptfs-$i-Private")
38 then13 if [ $i = $o ]; then
39 mkdir -p /var/lib/ecryptfs14 mv -f /tmp/ecryptfs-$i-Private /dev/shm
40 chmod 1777 /var/lib/ecryptfs15 fi
41 fi16 fi
17 done
42 ;;18 ;;
4319
44 abort-upgrade|abort-remove|abort-deconfigure)20 abort-upgrade|abort-remove|abort-deconfigure)
4521
=== modified file 'debian/libecryptfs0.shlibs'
--- debian/libecryptfs0.shlibs 2009-02-13 15:57:24 +0000
+++ debian/libecryptfs0.shlibs 2010-02-17 20:48:18 +0000
@@ -1,1 +1,1 @@
1libecryptfs 0 libecryptfs0 (>= 48)1libecryptfs 0 libecryptfs0 (>= 77)
22
=== added directory 'debian/lintian'
=== renamed file 'debian/ecryptfs-utils.lintian-overides' => 'debian/lintian/ecryptfs-utils'
--- debian/ecryptfs-utils.lintian-overides 2009-02-13 15:57:24 +0000
+++ debian/lintian/ecryptfs-utils 2010-02-17 20:48:18 +0000
@@ -1,1 +1,14 @@
1# This setuid is required for encrypted-home and encrypted-private;
2# Other distros or sysadmins could perhaps make it 4750, and create
3# an ecryptfs group, adding permitted users to this group (though
4# we're not doing this in Ubuntu).
1ecryptfs-utils: setuid-binary sbin/mount.ecryptfs_private 4755 root/root5ecryptfs-utils: setuid-binary sbin/mount.ecryptfs_private 4755 root/root
6
7# The *.desktop files need to be executable
8ecryptfs-utils: executable-not-elf-or-script ./usr/share/ecryptfs-utils/ecryptfs-mount-private.desktop
9ecryptfs-utils: executable-not-elf-or-script ./usr/share/ecryptfs-utils/ecryptfs-setup-private.desktop
10ecryptfs-utils: executable-not-elf-or-script ./usr/share/ecryptfs-utils/ecryptfs-record-passphrase
11
12# We're not creating these files, but rather moving them, and the utilities
13# that use them provide the necessary owernship checks
14ecryptfs-utils: possibly-insecure-handling-of-tmp-files-in-maintainer-script postinst:9
215
=== added directory 'debian/local'
=== renamed file 'debian/ecryptfs-utils.pam-auth-update' => 'debian/local/ecryptfs-utils.pam-auth-update'
--- debian/ecryptfs-utils.pam-auth-update 2009-02-13 15:57:24 +0000
+++ debian/local/ecryptfs-utils.pam-auth-update 2010-02-17 20:48:18 +0000
@@ -3,10 +3,10 @@
3Priority: 03Priority: 0
4Auth-Type: Additional4Auth-Type: Additional
5Auth-Final:5Auth-Final:
6 optional pam_ecryptfs.so unwrap6 optional pam_ecryptfs.so unwrap
7Session-Type: Additional7Session-Type: Additional
8Session-Final:8Session-Final:
9 optional pam_ecryptfs.so unwrap9 optional pam_ecryptfs.so unwrap
10Password-Type: Additional10Password-Type: Additional
11Password-Final:11Password-Final:
12 optional pam_ecryptfs.so12 optional pam_ecryptfs.so
1313
=== added directory 'debian/po'
=== added file 'debian/po/POTFILES.sh'
--- debian/po/POTFILES.sh 1970-01-01 00:00:00 +0000
+++ debian/po/POTFILES.sh 2010-02-17 20:48:18 +0000
@@ -0,0 +1,5 @@
1src/utils/ecryptfs-mount-private
2src/utils/ecryptfs-rewrite-file
3src/utils/ecryptfs-setup-private
4src/utils/ecryptfs-setup-swap
5src/utils/ecryptfs-umount-private
06
=== added file 'debian/po/ecryptfs-utils.pot'
--- debian/po/ecryptfs-utils.pot 1970-01-01 00:00:00 +0000
+++ debian/po/ecryptfs-utils.pot 2010-02-17 20:48:18 +0000
@@ -0,0 +1,407 @@
1# SOME DESCRIPTIVE TITLE.
2# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
3# This file is distributed under the same license as the PACKAGE package.
4# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
5#
6#, fuzzy
7msgid ""
8msgstr ""
9"Project-Id-Version: PACKAGE VERSION\n"
10"Report-Msgid-Bugs-To: \n"
11"POT-Creation-Date: 2009-07-23 18:15-0500\n"
12"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
13"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
14"Language-Team: LANGUAGE <LL@li.org>\n"
15"MIME-Version: 1.0\n"
16"Content-Type: text/plain; charset=CHARSET\n"
17"Content-Transfer-Encoding: 8bit\n"
18
19#: src/utils/ecryptfs-mount-private:19
20msgid "Enter your login passphrase:"
21msgstr ""
22
23#: src/utils/ecryptfs-mount-private:24
24msgid "Enter your wrapping passphrase:"
25msgstr ""
26
27#: src/utils/ecryptfs-mount-private:49 src/utils/ecryptfs-mount-private:55
28#: src/utils/ecryptfs-mount-private:60 src/utils/ecryptfs-rewrite-file:24
29#: src/utils/ecryptfs-setup-private:84 src/utils/ecryptfs-setup-private:264
30#: src/utils/ecryptfs-setup-private:272 src/utils/ecryptfs-setup-private:282
31#: src/utils/ecryptfs-setup-private:313 src/utils/ecryptfs-setup-swap:25
32msgid "ERROR:"
33msgstr ""
34
35#: src/utils/ecryptfs-mount-private:49
36msgid "Your passphrase is incorrect"
37msgstr ""
38
39#: src/utils/ecryptfs-mount-private:55 src/utils/ecryptfs-setup-private:289
40msgid "Too many incorrect password attempts, exiting"
41msgstr ""
42
43#: src/utils/ecryptfs-mount-private:60
44msgid "Encrypted private directory is not setup properly"
45msgstr ""
46
47#: src/utils/ecryptfs-mount-private:65 src/utils/ecryptfs-mount-private:66
48#: src/utils/ecryptfs-rewrite-file:30 src/utils/ecryptfs-setup-private:276
49#: src/utils/ecryptfs-setup-private:344 src/utils/ecryptfs-setup-private:349
50#: src/utils/ecryptfs-setup-swap:30 src/utils/ecryptfs-umount-private:21
51#: src/utils/ecryptfs-umount-private:22
52msgid "INFO:"
53msgstr ""
54
55#: src/utils/ecryptfs-mount-private:65
56msgid "Your private directory has been mounted."
57msgstr ""
58
59#: src/utils/ecryptfs-mount-private:66 src/utils/ecryptfs-umount-private:22
60msgid "To see this change in your current shell:"
61msgstr ""
62
63#: src/utils/ecryptfs-rewrite-file:23
64msgid "[FAILED]"
65msgstr ""
66
67#: src/utils/ecryptfs-rewrite-file:30
68msgid "Rewriting"
69msgstr ""
70
71#: src/utils/ecryptfs-rewrite-file:32
72msgid "File does not exist"
73msgstr ""
74
75#: src/utils/ecryptfs-rewrite-file:36
76msgid "[EXCLUDED]"
77msgstr ""
78
79#: src/utils/ecryptfs-rewrite-file:43
80msgid "Could not create tempdir"
81msgstr ""
82
83#: src/utils/ecryptfs-rewrite-file:47 src/utils/ecryptfs-rewrite-file:52
84#: src/utils/ecryptfs-rewrite-file:66
85msgid "Could not rename"
86msgstr ""
87
88#: src/utils/ecryptfs-rewrite-file:57
89msgid "Could not create tempfile"
90msgstr ""
91
92#: src/utils/ecryptfs-rewrite-file:61
93msgid "Could not copy"
94msgstr ""
95
96#: src/utils/ecryptfs-rewrite-file:70
97msgid "[OK]"
98msgstr ""
99
100#: src/utils/ecryptfs-rewrite-file:73
101msgid "rewrites succeeded"
102msgstr ""
103
104#: src/utils/ecryptfs-setup-private:14
105msgid "Enter your login passphrase"
106msgstr ""
107
108#: src/utils/ecryptfs-setup-private:104
109msgid "Can't get ecryptfs version, ecryptfs kernel module not loaded?"
110msgstr ""
111
112#: src/utils/ecryptfs-setup-private:131
113msgid "Enter your wrapping passphrase"
114msgstr ""
115
116#: src/utils/ecryptfs-setup-private:155
117msgid "You must be root to bootstrap encrypt a home directory"
118msgstr ""
119
120#: src/utils/ecryptfs-setup-private:178 src/utils/ecryptfs-setup-private:183
121msgid "ERROR: "
122msgstr ""
123
124#: src/utils/ecryptfs-setup-private:178
125msgid "You must provide a username"
126msgstr ""
127
128#: src/utils/ecryptfs-setup-private:183 src/utils/ecryptfs-setup-private:191
129msgid "User does not exist"
130msgstr ""
131
132#: src/utils/ecryptfs-setup-private:197
133msgid "User needs to be a member of ecryptfs group"
134msgstr ""
135
136#: src/utils/ecryptfs-setup-private:204
137msgid "User home directory does not exist"
138msgstr ""
139
140#: src/utils/ecryptfs-setup-private:223
141msgid "wrapped-passphrase file already exists, use --force to overwrite."
142msgstr ""
143
144#: src/utils/ecryptfs-setup-private:226
145msgid "file already exists, use --force to overwrite."
146msgstr ""
147
148#: src/utils/ecryptfs-setup-private:230 src/utils/ecryptfs-setup-private:231
149msgid "is already mounted"
150msgstr ""
151
152#: src/utils/ecryptfs-setup-private:238 src/utils/ecryptfs-setup-private:242
153msgid "must be empty before proceeding"
154msgstr ""
155
156#: src/utils/ecryptfs-setup-private:264
157msgid "Wrapping passphrases must match"
158msgstr ""
159
160#: src/utils/ecryptfs-setup-private:272
161msgid "You must provide a login passphrase"
162msgstr ""
163
164#: src/utils/ecryptfs-setup-private:276
165msgid "Skipping password verification"
166msgstr ""
167
168#: src/utils/ecryptfs-setup-private:298
169msgid "Enter your mount passphrase [leave blank to generate one]: "
170msgstr ""
171
172#: src/utils/ecryptfs-setup-private:308
173msgid "Enter your mount passphrase (again): "
174msgstr ""
175
176#: src/utils/ecryptfs-setup-private:313
177msgid "Mount passphrases do not match"
178msgstr ""
179
180#: src/utils/ecryptfs-setup-private:321
181msgid "Too many incorrect passphrase attempts, exiting"
182msgstr ""
183
184#: src/utils/ecryptfs-setup-private:327
185msgid ""
186"YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION."
187msgstr ""
188
189#: src/utils/ecryptfs-setup-private:329
190msgid "THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME."
191msgstr ""
192
193#: src/utils/ecryptfs-setup-private:336
194msgid "Could not create crypt directory"
195msgstr ""
196
197#: src/utils/ecryptfs-setup-private:337
198msgid "Could not create mount directory"
199msgstr ""
200
201#: src/utils/ecryptfs-setup-private:344
202msgid "will not be mounted on login"
203msgstr ""
204
205#: src/utils/ecryptfs-setup-private:346
206msgid "Could not setup ecryptfs auto-mount"
207msgstr ""
208
209#: src/utils/ecryptfs-setup-private:349
210msgid "will not be unmounted on logout"
211msgstr ""
212
213#: src/utils/ecryptfs-setup-private:351
214msgid "Could not setup ecryptfs auto-umount"
215msgstr ""
216
217#: src/utils/ecryptfs-setup-private:355
218msgid "Could not remove ecryptfs wrapping-independent"
219msgstr ""
220
221#: src/utils/ecryptfs-setup-private:357
222msgid "Could not setup ecryptfs wrapping-independent"
223msgstr ""
224
225#: src/utils/ecryptfs-setup-private:365
226msgid "Could not backup existing data"
227msgstr ""
228
229#: src/utils/ecryptfs-setup-private:381
230msgid "Could not wrap passphrase"
231msgstr ""
232
233#: src/utils/ecryptfs-setup-private:389
234msgid "Could not add passphrase to the current keyring"
235msgstr ""
236
237#: src/utils/ecryptfs-setup-private:393
238msgid "Could not obtain the key signature"
239msgstr ""
240
241#: src/utils/ecryptfs-setup-private:396
242msgid "Could not create signature file"
243msgstr ""
244
245#: src/utils/ecryptfs-setup-private:399
246msgid "Could not create mountpoint file"
247msgstr ""
248
249#: src/utils/ecryptfs-setup-private:403
250msgid "Done configuring."
251msgstr ""
252
253#: src/utils/ecryptfs-setup-private:433
254msgid "Testing mount/write/umount/read..."
255msgstr ""
256
257#: src/utils/ecryptfs-setup-private:434
258msgid "Could not mount private ecryptfs directory"
259msgstr ""
260
261#: src/utils/ecryptfs-setup-private:435
262msgid "Could not create empty file"
263msgstr ""
264
265#: src/utils/ecryptfs-setup-private:436
266msgid "Could not generate random data"
267msgstr ""
268
269#: src/utils/ecryptfs-setup-private:437
270msgid "Could not write encrypted file"
271msgstr ""
272
273#: src/utils/ecryptfs-setup-private:438
274msgid "Could not read encrypted file"
275msgstr ""
276
277#: src/utils/ecryptfs-setup-private:439
278msgid "Could not unmount private ecryptfs directory"
279msgstr ""
280
281#: src/utils/ecryptfs-setup-private:440
282msgid "Could not mount private ecryptfs directory (2)"
283msgstr ""
284
285#: src/utils/ecryptfs-setup-private:441
286msgid "Could not read encrypted file (2)"
287msgstr ""
288
289#: src/utils/ecryptfs-setup-private:445
290msgid "Could not unmount private ecryptfs directory (2)"
291msgstr ""
292
293#: src/utils/ecryptfs-setup-private:447
294msgid "Testing failed."
295msgstr ""
296
297#: src/utils/ecryptfs-setup-private:449
298msgid "Testing succeeded."
299msgstr ""
300
301#: src/utils/ecryptfs-setup-private:453
302msgid "Logout, and log back in to begin using your encrypted directory."
303msgstr ""
304
305#: src/utils/ecryptfs-setup-swap:34
306msgid "WARNING:"
307msgstr ""
308
309#: src/utils/ecryptfs-setup-swap:39
310msgid "Usage:"
311msgstr ""
312
313#: src/utils/ecryptfs-setup-swap:60
314msgid "Please install"
315msgstr ""
316
317#: src/utils/ecryptfs-setup-swap:63
318msgid "This program must be run with 'sudo', or as root"
319msgstr ""
320
321#: src/utils/ecryptfs-setup-swap:70
322msgid "You do not currently have any swap space defined."
323msgstr ""
324
325#: src/utils/ecryptfs-setup-swap:72
326msgid "You can create a swap file by doing:"
327msgstr ""
328
329#: src/utils/ecryptfs-setup-swap:77
330msgid "And then re-run"
331msgstr ""
332
333#: src/utils/ecryptfs-setup-swap:81
334msgid "You have more than one swap space defined."
335msgstr ""
336
337#: src/utils/ecryptfs-setup-swap:82
338msgid "only supports setting up a single swap space"
339msgstr ""
340
341#: src/utils/ecryptfs-setup-swap:89
342msgid "does not appear to be swap space"
343msgstr ""
344
345#: src/utils/ecryptfs-setup-swap:94
346msgid "already appears to be encrypted."
347msgstr ""
348
349#: src/utils/ecryptfs-setup-swap:103
350msgid "already has an entry in /etc/crypttab."
351msgstr ""
352
353#: src/utils/ecryptfs-setup-swap:107
354msgid "already has an entry in /etc/fstab."
355msgstr ""
356
357#: src/utils/ecryptfs-setup-swap:113
358msgid "There appears to be a cryptswap entry in /etc/cryptab; aborting."
359msgstr ""
360
361#: src/utils/ecryptfs-setup-swap:118
362msgid "There appears to be a cryptswap entry in /etc/fstab; aborting."
363msgstr ""
364
365#: src/utils/ecryptfs-setup-swap:124
366msgid "Commented out your unencrypted swap from /etc/fstab"
367msgstr ""
368
369#: src/utils/ecryptfs-setup-swap:126
370msgid "Your swap space isn't currently listed in /etc/fstab"
371msgstr ""
372
373#: src/utils/ecryptfs-setup-swap:134
374msgid ""
375"An encrypted swap is required to help ensure that encrypted files are not "
376"leaked to disk in an unencrypted format."
377msgstr ""
378
379#: src/utils/ecryptfs-setup-swap:136
380msgid ""
381"HOWEVER, THE SWAP ENCRYPTION CONFIGURATION PRODUCED BY THIS PROGRAM WILL "
382"BREAK HIBERNATE/RESUME ON THIS SYSTEM!"
383msgstr ""
384
385#: src/utils/ecryptfs-setup-swap:138
386msgid "NOTE: Your suspend/resume capabilities will not be affected."
387msgstr ""
388
389#: src/utils/ecryptfs-setup-swap:140
390msgid "Do you want to proceed with encrypting your swap?"
391msgstr ""
392
393#: src/utils/ecryptfs-setup-swap:145
394msgid "Aborting."
395msgstr ""
396
397#: src/utils/ecryptfs-setup-swap:153
398msgid "Setting up swap:"
399msgstr ""
400
401#: src/utils/ecryptfs-setup-swap:170
402msgid "Successfully setup encrypted swap!"
403msgstr ""
404
405#: src/utils/ecryptfs-umount-private:21
406msgid "Your private directory has been unmounted."
407msgstr ""
0408
=== added file 'debian/po/fr.po'
--- debian/po/fr.po 1970-01-01 00:00:00 +0000
+++ debian/po/fr.po 2010-02-17 20:48:18 +0000
@@ -0,0 +1,389 @@
1#: src/utils/ecryptfs-mount-private:19
2msgid "Enter your login passphrase:"
3msgstr ""
4
5#: src/utils/ecryptfs-mount-private:24
6msgid "Enter your wrapping passphrase:"
7msgstr ""
8
9#: src/utils/ecryptfs-mount-private:49 src/utils/ecryptfs-mount-private:55
10#: src/utils/ecryptfs-mount-private:60 src/utils/ecryptfs-rewrite-file:24
11#: src/utils/ecryptfs-setup-private:84 src/utils/ecryptfs-setup-private:264
12#: src/utils/ecryptfs-setup-private:272 src/utils/ecryptfs-setup-private:282
13#: src/utils/ecryptfs-setup-private:313 src/utils/ecryptfs-setup-swap:25
14msgid "ERROR:"
15msgstr ""
16
17#: src/utils/ecryptfs-mount-private:49
18msgid "Your passphrase is incorrect"
19msgstr ""
20
21#: src/utils/ecryptfs-mount-private:55 src/utils/ecryptfs-setup-private:289
22msgid "Too many incorrect password attempts, exiting"
23msgstr ""
24
25#: src/utils/ecryptfs-mount-private:60
26msgid "Encrypted private directory is not setup properly"
27msgstr ""
28
29#: src/utils/ecryptfs-mount-private:65 src/utils/ecryptfs-mount-private:66
30#: src/utils/ecryptfs-rewrite-file:30 src/utils/ecryptfs-setup-private:276
31#: src/utils/ecryptfs-setup-private:344 src/utils/ecryptfs-setup-private:349
32#: src/utils/ecryptfs-setup-swap:30 src/utils/ecryptfs-umount-private:21
33#: src/utils/ecryptfs-umount-private:22
34msgid "INFO:"
35msgstr ""
36
37#: src/utils/ecryptfs-mount-private:65
38msgid "Your private directory has been mounted."
39msgstr ""
40
41#: src/utils/ecryptfs-mount-private:66 src/utils/ecryptfs-umount-private:22
42msgid "To see this change in your current shell:"
43msgstr ""
44
45#: src/utils/ecryptfs-rewrite-file:23
46msgid "[FAILED]"
47msgstr ""
48
49#: src/utils/ecryptfs-rewrite-file:30
50msgid "Rewriting"
51msgstr ""
52
53#: src/utils/ecryptfs-rewrite-file:32
54msgid "File does not exist"
55msgstr ""
56
57#: src/utils/ecryptfs-rewrite-file:36
58msgid "[EXCLUDED]"
59msgstr ""
60
61#: src/utils/ecryptfs-rewrite-file:43
62msgid "Could not create tempdir"
63msgstr ""
64
65#: src/utils/ecryptfs-rewrite-file:47 src/utils/ecryptfs-rewrite-file:52
66#: src/utils/ecryptfs-rewrite-file:66
67msgid "Could not rename"
68msgstr ""
69
70#: src/utils/ecryptfs-rewrite-file:57
71msgid "Could not create tempfile"
72msgstr ""
73
74#: src/utils/ecryptfs-rewrite-file:61
75msgid "Could not copy"
76msgstr ""
77
78#: src/utils/ecryptfs-rewrite-file:70
79msgid "[OK]"
80msgstr ""
81
82#: src/utils/ecryptfs-rewrite-file:73
83msgid "rewrites succeeded"
84msgstr ""
85
86#: src/utils/ecryptfs-setup-private:14
87msgid "Enter your login passphrase"
88msgstr ""
89
90#: src/utils/ecryptfs-setup-private:104
91msgid "Can't get ecryptfs version, ecryptfs kernel module not loaded?"
92msgstr ""
93
94#: src/utils/ecryptfs-setup-private:131
95msgid "Enter your wrapping passphrase"
96msgstr ""
97
98#: src/utils/ecryptfs-setup-private:155
99msgid "You must be root to bootstrap encrypt a home directory"
100msgstr ""
101
102#: src/utils/ecryptfs-setup-private:178 src/utils/ecryptfs-setup-private:183
103msgid "ERROR: "
104msgstr ""
105
106#: src/utils/ecryptfs-setup-private:178
107msgid "You must provide a username"
108msgstr ""
109
110#: src/utils/ecryptfs-setup-private:183 src/utils/ecryptfs-setup-private:191
111msgid "User does not exist"
112msgstr ""
113
114#: src/utils/ecryptfs-setup-private:197
115msgid "User needs to be a member of ecryptfs group"
116msgstr ""
117
118#: src/utils/ecryptfs-setup-private:204
119msgid "User home directory does not exist"
120msgstr ""
121
122#: src/utils/ecryptfs-setup-private:223
123msgid "wrapped-passphrase file already exists, use --force to overwrite."
124msgstr ""
125
126#: src/utils/ecryptfs-setup-private:226
127msgid "file already exists, use --force to overwrite."
128msgstr ""
129
130#: src/utils/ecryptfs-setup-private:230 src/utils/ecryptfs-setup-private:231
131msgid "is already mounted"
132msgstr ""
133
134#: src/utils/ecryptfs-setup-private:238 src/utils/ecryptfs-setup-private:242
135msgid "must be empty before proceeding"
136msgstr ""
137
138#: src/utils/ecryptfs-setup-private:264
139msgid "Wrapping passphrases must match"
140msgstr ""
141
142#: src/utils/ecryptfs-setup-private:272
143msgid "You must provide a login passphrase"
144msgstr ""
145
146#: src/utils/ecryptfs-setup-private:276
147msgid "Skipping password verification"
148msgstr ""
149
150#: src/utils/ecryptfs-setup-private:298
151msgid "Enter your mount passphrase [leave blank to generate one]: "
152msgstr ""
153
154#: src/utils/ecryptfs-setup-private:308
155msgid "Enter your mount passphrase (again): "
156msgstr ""
157
158#: src/utils/ecryptfs-setup-private:313
159msgid "Mount passphrases do not match"
160msgstr ""
161
162#: src/utils/ecryptfs-setup-private:321
163msgid "Too many incorrect passphrase attempts, exiting"
164msgstr ""
165
166#: src/utils/ecryptfs-setup-private:327
167msgid ""
168"YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION."
169msgstr ""
170
171#: src/utils/ecryptfs-setup-private:329
172msgid "THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME."
173msgstr ""
174
175#: src/utils/ecryptfs-setup-private:336
176msgid "Could not create crypt directory"
177msgstr ""
178
179#: src/utils/ecryptfs-setup-private:337
180msgid "Could not create mount directory"
181msgstr ""
182
183#: src/utils/ecryptfs-setup-private:344
184msgid "will not be mounted on login"
185msgstr ""
186
187#: src/utils/ecryptfs-setup-private:346
188msgid "Could not setup ecryptfs auto-mount"
189msgstr ""
190
191#: src/utils/ecryptfs-setup-private:349
192msgid "will not be unmounted on logout"
193msgstr ""
194
195#: src/utils/ecryptfs-setup-private:351
196msgid "Could not setup ecryptfs auto-umount"
197msgstr ""
198
199#: src/utils/ecryptfs-setup-private:355
200msgid "Could not remove ecryptfs wrapping-independent"
201msgstr ""
202
203#: src/utils/ecryptfs-setup-private:357
204msgid "Could not setup ecryptfs wrapping-independent"
205msgstr ""
206
207#: src/utils/ecryptfs-setup-private:365
208msgid "Could not backup existing data"
209msgstr ""
210
211#: src/utils/ecryptfs-setup-private:381
212msgid "Could not wrap passphrase"
213msgstr ""
214
215#: src/utils/ecryptfs-setup-private:389
216msgid "Could not add passphrase to the current keyring"
217msgstr ""
218
219#: src/utils/ecryptfs-setup-private:393
220msgid "Could not obtain the key signature"
221msgstr ""
222
223#: src/utils/ecryptfs-setup-private:396
224msgid "Could not create signature file"
225msgstr ""
226
227#: src/utils/ecryptfs-setup-private:399
228msgid "Could not create mountpoint file"
229msgstr ""
230
231#: src/utils/ecryptfs-setup-private:403
232msgid "Done configuring."
233msgstr ""
234
235#: src/utils/ecryptfs-setup-private:433
236msgid "Testing mount/write/umount/read..."
237msgstr ""
238
239#: src/utils/ecryptfs-setup-private:434
240msgid "Could not mount private ecryptfs directory"
241msgstr ""
242
243#: src/utils/ecryptfs-setup-private:435
244msgid "Could not create empty file"
245msgstr ""
246
247#: src/utils/ecryptfs-setup-private:436
248msgid "Could not generate random data"
249msgstr ""
250
251#: src/utils/ecryptfs-setup-private:437
252msgid "Could not write encrypted file"
253msgstr ""
254
255#: src/utils/ecryptfs-setup-private:438
256msgid "Could not read encrypted file"
257msgstr ""
258
259#: src/utils/ecryptfs-setup-private:439
260msgid "Could not unmount private ecryptfs directory"
261msgstr ""
262
263#: src/utils/ecryptfs-setup-private:440
264msgid "Could not mount private ecryptfs directory (2)"
265msgstr ""
266
267#: src/utils/ecryptfs-setup-private:441
268msgid "Could not read encrypted file (2)"
269msgstr ""
270
271#: src/utils/ecryptfs-setup-private:445
272msgid "Could not unmount private ecryptfs directory (2)"
273msgstr ""
274
275#: src/utils/ecryptfs-setup-private:447
276msgid "Testing failed."
277msgstr ""
278
279#: src/utils/ecryptfs-setup-private:449
280msgid "Testing succeeded."
281msgstr ""
282
283#: src/utils/ecryptfs-setup-private:453
284msgid "Logout, and log back in to begin using your encrypted directory."
285msgstr ""
286
287#: src/utils/ecryptfs-setup-swap:34
288msgid "WARNING:"
289msgstr ""
290
291#: src/utils/ecryptfs-setup-swap:39
292msgid "Usage:"
293msgstr ""
294
295#: src/utils/ecryptfs-setup-swap:60
296msgid "Please install"
297msgstr ""
298
299#: src/utils/ecryptfs-setup-swap:63
300msgid "This program must be run with 'sudo', or as root"
301msgstr ""
302
303#: src/utils/ecryptfs-setup-swap:70
304msgid "You do not currently have any swap space defined."
305msgstr ""
306
307#: src/utils/ecryptfs-setup-swap:72
308msgid "You can create a swap file by doing:"
309msgstr ""
310
311#: src/utils/ecryptfs-setup-swap:77
312msgid "And then re-run"
313msgstr ""
314
315#: src/utils/ecryptfs-setup-swap:81
316msgid "You have more than one swap space defined."
317msgstr ""
318
319#: src/utils/ecryptfs-setup-swap:82
320msgid "only supports setting up a single swap space"
321msgstr ""
322
323#: src/utils/ecryptfs-setup-swap:89
324msgid "does not appear to be swap space"
325msgstr ""
326
327#: src/utils/ecryptfs-setup-swap:94
328msgid "already appears to be encrypted."
329msgstr ""
330
331#: src/utils/ecryptfs-setup-swap:103
332msgid "already has an entry in /etc/crypttab."
333msgstr ""
334
335#: src/utils/ecryptfs-setup-swap:107
336msgid "already has an entry in /etc/fstab."
337msgstr ""
338
339#: src/utils/ecryptfs-setup-swap:113
340msgid "There appears to be a cryptswap entry in /etc/cryptab; aborting."
341msgstr ""
342
343#: src/utils/ecryptfs-setup-swap:118
344msgid "There appears to be a cryptswap entry in /etc/fstab; aborting."
345msgstr ""
346
347#: src/utils/ecryptfs-setup-swap:124
348msgid "Commented out your unencrypted swap from /etc/fstab"
349msgstr ""
350
351#: src/utils/ecryptfs-setup-swap:126
352msgid "Your swap space isn't currently listed in /etc/fstab"
353msgstr ""
354
355#: src/utils/ecryptfs-setup-swap:134
356msgid ""
357"An encrypted swap is required to help ensure that encrypted files are not "
358"leaked to disk in an unencrypted format."
359msgstr ""
360
361#: src/utils/ecryptfs-setup-swap:136
362msgid ""
363"HOWEVER, THE SWAP ENCRYPTION CONFIGURATION PRODUCED BY THIS PROGRAM WILL "
364"BREAK HIBERNATE/RESUME ON THIS SYSTEM!"
365msgstr ""
366
367#: src/utils/ecryptfs-setup-swap:138
368msgid "NOTE: Your suspend/resume capabilities will not be affected."
369msgstr ""
370
371#: src/utils/ecryptfs-setup-swap:140
372msgid "Do you want to proceed with encrypting your swap?"
373msgstr ""
374
375#: src/utils/ecryptfs-setup-swap:145
376msgid "Aborting."
377msgstr ""
378
379#: src/utils/ecryptfs-setup-swap:153
380msgid "Setting up swap:"
381msgstr ""
382
383#: src/utils/ecryptfs-setup-swap:170
384msgid "Successfully setup encrypted swap!"
385msgstr ""
386
387#: src/utils/ecryptfs-umount-private:21
388msgid "Your private directory has been unmounted."
389msgstr ""
0390
=== modified file 'debian/rules'
--- debian/rules 2009-04-22 00:07:59 +0000
+++ debian/rules 2010-02-17 20:48:18 +0000
@@ -1,43 +1,63 @@
1#!/usr/bin/make -f1#!/usr/bin/make -f
22
3include /usr/share/dpatch/dpatch.make3PKG=ecryptfs-utils
4PO_DIR=debian/po
45
5DEB_BUILD_ARCH ?= $(shell dpkg-architecture -qDEB_BUILD_ARCH)
6DEB_HOST_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)6DEB_HOST_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_HOST_GNU_TYPE)
7DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)7DEB_BUILD_GNU_TYPE ?= $(shell dpkg-architecture -qDEB_BUILD_GNU_TYPE)
88
9CFLAGS = -Wall -g9ifneq ($(DEB_HOST_GNU_TYPE),$(DEB_BUILD_GNU_TYPE))
1010 CROSS=CC=$(DEB_HOST_GNU_TYPE)-gcc
11ifneq (,$(findstring noopt,$(DEB_BUILD_OPTIONS)))
12 CFLAGS += -O0
13else11else
14 CFLAGS += -O212 CROSS=
15endif13endif
1614
15DEB_BUILD_ARCH ?= $(shell dpkg-architecture -qDEB_BUILD_ARCH)
16
17ifneq ($(DEB_BUILD_ARCH),s390)17ifneq ($(DEB_BUILD_ARCH),s390)
18 TPMFLAGS = --enable-opencryptoki18 TPMFLAGS = --enable-opencryptoki
19endif19endif
2020
21clean: unpatch21install-po: update-pot
22 for po in ${PO_DIR}/*.po ; do \
23 lang=$${po#po/}; lang=$${lang%.po}; \
24 mkdir -p ${PO_DIR}/locale/$${lang}/LC_MESSAGES/; \
25 msgfmt $${po} -o ${PO_DIR}/locale/$${lang}/LC_MESSAGES/${PKG}.mo ; \
26 done
27
28update-pot:
29 rm -f ${PO_DIR}/${PKG}.pot
30 xgettext -o ${PO_DIR}/${PKG}.pot -L Shell -f ${PO_DIR}/POTFILES.sh
31 for po in ${PO_DIR}/*.po ; do \
32 msgmerge $${po} ${PO_DIR}/${PKG}.pot -o $${po} ; \
33 done
34
35clean:
22 dh_testdir36 dh_testdir
23 dh_testroot37 dh_testroot
24 rm -f build-stamp38 rm -f build-stamp
25 rm -f config.guess config.sub39 rm -f config.guess config.sub
40 for po in ${PO_DIR}/*.po ; do \
41 lang=$${po#po/}; lang=$${lang%.po}; \
42 rm -f ${PO_DIR}/locale/$${lang}/LC_MESSAGES/${PKG}.mo ; \
43 done
44
2645
27 [ ! -f Makefile ] || $(MAKE) distclean46 [ ! -f Makefile ] || $(MAKE) distclean
2847
29 dh_clean48 dh_clean
3049
31config.status: configure patch50config.status: configure
32 dh_testdir51 dh_testdir
3352
53ifneq "$(wildcard /usr/share/misc/config.guess)" ""
54 cp -f /usr/share/misc/config.guess config.guess
55endif
34ifneq "$(wildcard /usr/share/misc/config.sub)" ""56ifneq "$(wildcard /usr/share/misc/config.sub)" ""
35 cp -f /usr/share/misc/config.sub config.sub57 cp -f /usr/share/misc/config.sub config.sub
36endif58endif
37ifneq "$(wildcard /usr/share/misc/config.guess)" ""59
38 cp -f /usr/share/misc/config.guess config.guess60 ./configure $(CROSS) --prefix=/usr --libdir=\$${prefix}/lib --mandir=\$${prefix}/share/man --enable-static --enable-gpg --enable-nss --disable-gui --enable-pam --disable-openssl --disable-pkcs11-helper --disable-tspi $(TPMFLAGS) CFLAGS="$(CFLAGS)"
39endif
40 CFLAGS="$(CFLAGS)" ./configure --host=$(DEB_HOST_GNU_TYPE) --build=$(DEB_BUILD_GNU_TYPE) --prefix=/usr --libdir=\$${prefix}/lib --mandir=\$${prefix}/share/man --enable-static --enable-gpg --disable-gui --enable-pam --disable-openssl --disable-pkcs11-helper --disable-tspi $(TPMFLAGS)
4161
42build: build-stamp62build: build-stamp
43build-stamp: config.status63build-stamp: config.status
@@ -47,17 +67,14 @@
4767
48 touch build-stamp68 touch build-stamp
4969
50install: build70install: build install-po
51 dh_testdir71 dh_testdir
52 dh_testroot72 dh_testroot
53 dh_prep73 dh_prep
54 dh_installdirs
5574
56 $(MAKE) DESTDIR=$(CURDIR)/debian/tmp install75 $(MAKE) DESTDIR=$(CURDIR)/debian/tmp install
57 install -m 644 -D $(CURDIR)/debian/ecryptfs-utils.pam-auth-update $(CURDIR)/debian/tmp/usr/share/pam-configs/ecryptfs-utils
5876
59 mv debian/tmp/usr/share/ecryptfs-* debian/ecryptfs-utils/usr/share/ecryptfs-utils77 install -D -m 0644 debian/local/ecryptfs-utils.pam-auth-update debian/ecryptfs-utils/usr/share/pam-configs/ecryptfs-utils
60 mv debian/tmp/usr/share/doc/ecryptfs-utils/ecryptfs-mount-private.txt debian/ecryptfs-utils/usr/share/ecryptfs-utils/ecryptfs-mount-private.txt
6178
62 chmod 4755 debian/tmp/sbin/mount.ecryptfs_private79 chmod 4755 debian/tmp/sbin/mount.ecryptfs_private
6380
@@ -65,12 +82,14 @@
6582
66binary: binary-arch83binary: binary-arch
6784
68binary-arch: build install85binary-arch: install
69 dh_testdir86 dh_testdir
70 dh_testroot87 dh_testroot
71 dh_installchangelogs ChangeLog88 dh_installchangelogs ChangeLog
72 dh_installdocs89 dh_installdocs
73 dh_install --fail-missing --sourcedir=debian/tmp90 dh_install --fail-missing --sourcedir=debian/tmp
91 dh_installinit --noscripts --error-handler=true --name=ecryptfs-utils-save
92 dh_installinit --noscripts --error-handler=true --name=ecryptfs-utils-restore
74 dh_lintian93 dh_lintian
75 dh_link94 dh_link
76 dh_strip95 dh_strip
7796
=== modified file 'doc/Makefile.am'
--- doc/Makefile.am 2009-02-03 08:50:36 +0000
+++ doc/Makefile.am 2010-02-17 20:48:18 +0000
@@ -18,5 +18,4 @@
18dist_noinst_DATA += ecryptfs-pkcs11-helper-doc.txt18dist_noinst_DATA += ecryptfs-pkcs11-helper-doc.txt
19endif19endif
2020
21dist_doc_DATA += ecryptfs-mount-private.txt21dist_pkgdata_DATA = ecryptfs-mount-private.txt
22dist_noinst_DATA += ecryptfs-mount-private.txt
2322
=== modified file 'doc/ecryptfs-mount-private.txt'
--- doc/ecryptfs-mount-private.txt 2009-02-03 08:50:36 +0000
+++ doc/ecryptfs-mount-private.txt 2010-02-17 20:48:18 +0000
@@ -6,4 +6,4 @@
6or6or
77
8From the command line, run:8From the command line, run:
9 $ ecryptfs-mount-private9 ecryptfs-mount-private
1010
=== modified file 'doc/manpage/Makefile.am'
--- doc/manpage/Makefile.am 2009-03-20 19:29:14 +0000
+++ doc/manpage/Makefile.am 2010-02-17 20:48:18 +0000
@@ -21,10 +21,13 @@
21 ecryptfs-rewrap-passphrase.1 \21 ecryptfs-rewrap-passphrase.1 \
22 ecryptfs-rewrite-file.1 \22 ecryptfs-rewrite-file.1 \
23 ecryptfs-setup-private.1 \23 ecryptfs-setup-private.1 \
24 ecryptfs-setup-swap.1 \
25 ecryptfs-stat.1 \
24 ecryptfs-umount-private.1 \26 ecryptfs-umount-private.1 \
25 ecryptfs-unwrap-passphrase.1 \27 ecryptfs-unwrap-passphrase.1 \
26 ecryptfs-wrap-passphrase.1 \28 ecryptfs-wrap-passphrase.1 \
27 mount.ecryptfs.8 \29 mount.ecryptfs.8 \
30 umount.ecryptfs.8 \
28 mount.ecryptfs_private.1 \31 mount.ecryptfs_private.1 \
29 pam_ecryptfs.8 \32 pam_ecryptfs.8 \
30 umount.ecryptfs_private.133 umount.ecryptfs_private.1
3134
=== modified file 'doc/manpage/ecryptfs-mount-private.1'
--- doc/manpage/ecryptfs-mount-private.1 2009-02-03 08:50:36 +0000
+++ doc/manpage/ecryptfs-mount-private.1 2010-02-17 20:48:18 +0000
@@ -6,7 +6,7 @@
6\fBecryptfs-mount-private\fP6\fBecryptfs-mount-private\fP
77
8.SH DESCRIPTION8.SH DESCRIPTION
9\fBecryptfs-mount-private\fP is a wrapper script for the \fBmount.ecryptfs_private\fP utility that will interactively prompt for the user's login password, if necessary.9\fBecryptfs-mount-private\fP is a wrapper script for the \fBmount.ecryptfs_private\fP utility that will interactively prompt for the user's login password, if necessary. You need to be a member of \fBecryptfs\fB group to use this.
1010
11.SH FILES11.SH FILES
12\fI~/.Private\fP - underlying directory containing encrypted data12\fI~/.Private\fP - underlying directory containing encrypted data
@@ -17,7 +17,7 @@
1717
18\fI~/.ecryptfs/wrapped-passphrase\fP - file containing the wrapped passphrase18\fI~/.ecryptfs/wrapped-passphrase\fP - file containing the wrapped passphrase
1919
20\fI~/.ecryptfs/wrapped-independent\fP - this file exists if the wrapping passphrase is independent from login passphrase20\fI~/.ecryptfs/wrapping-independent\fP - this file exists if the wrapping passphrase is independent from login passphrase
2121
22.SH SEE ALSO22.SH SEE ALSO
23.PD 023.PD 0
2424
=== modified file 'doc/manpage/ecryptfs-rewrite-file.1'
--- doc/manpage/ecryptfs-rewrite-file.1 2009-03-20 22:12:06 +0000
+++ doc/manpage/ecryptfs-rewrite-file.1 2010-02-17 20:48:18 +0000
@@ -6,7 +6,7 @@
6\fBecryptfs-rewrite-file [file1] [file2] [file3] ...\fP6\fBecryptfs-rewrite-file [file1] [file2] [file3] ...\fP
77
8.SH DESCRIPTION8.SH DESCRIPTION
9This script takes one or more files/directories/symlinks as arguments, moves each of them to a temporary file, and the moves them back to the original name. This causes the file to be rewritten (and reencrypted) in the lower filesystem.9This script takes one or more files/directories/symlinks as arguments, moves each of them to a temporary file, and then moves them back to the original name. This causes the file to be rewritten (and reencrypted) in the lower filesystem.
1010
11This script may be combined with \fBfind\fP(1) and \fBxargs\fP(1) to rewrite an entire eCryptfs mountpoint, unmount, and sync:11This script may be combined with \fBfind\fP(1) and \fBxargs\fP(1) to rewrite an entire eCryptfs mountpoint, unmount, and sync:
1212
1313
=== modified file 'doc/manpage/ecryptfs-setup-private.1'
--- doc/manpage/ecryptfs-setup-private.1 2009-03-18 22:00:04 +0000
+++ doc/manpage/ecryptfs-setup-private.1 2010-02-17 20:48:18 +0000
@@ -43,7 +43,7 @@
4343
4444
45.SH DESCRIPTION45.SH DESCRIPTION
46\fBecryptfs-setup-private\fP is a program that sets up a private cryptographic mountpoint for a non-root user.46\fBecryptfs-setup-private\fP is a program that sets up a private cryptographic mountpoint for a non-root user, who is a member of \fBecryptfs\fP group.
4747
48Be sure to properly escape your parameters according to your shell's special character nuances, and also surround the parameters by double quotes, if necessary. Any of the parameters may be:48Be sure to properly escape your parameters according to your shell's special character nuances, and also surround the parameters by double quotes, if necessary. Any of the parameters may be:
4949
@@ -78,7 +78,7 @@
7878
79\fI~/.ecryptfs/wrapped-passphrase\fP - file containing the mount passphrase, wrapped with the login passphrase79\fI~/.ecryptfs/wrapped-passphrase\fP - file containing the mount passphrase, wrapped with the login passphrase
8080
81\fI~/.ecryptfs/wrapped-independent\fP - this file exists if the wrapping passphrase is independent from login passphrase81\fI~/.ecryptfs/wrapping-independent\fP - this file exists if the wrapping passphrase is independent from login passphrase
8282
83.SH SEE ALSO83.SH SEE ALSO
84.PD 084.PD 0
8585
=== added file 'doc/manpage/ecryptfs-setup-swap.1'
--- doc/manpage/ecryptfs-setup-swap.1 1970-01-01 00:00:00 +0000
+++ doc/manpage/ecryptfs-setup-swap.1 2010-02-17 20:48:18 +0000
@@ -0,0 +1,29 @@
1.TH ecryptfs-setup-swap 1 2009-08-17 ecryptfs-utils "eCryptfs"
2.SH NAME
3ecryptfs-setup-swap \- ensure that any swap space is encrypted
4
5.SH SYNOPSIS
6\fBecryptfs-setup-swap\fP [-f|--force]
7
8.SH DESCRIPTION
9This script will detect existing swap partitions or swap files, and encrypt them, using cryptsetup.
10
11Encrypted swap is essential to securing any system using eCryptfs, since decrypted file contents will exist in the system's memory, which may be swapped to disk at any time. If the system swap space is not also encrypted, it is possible that decrypted files could be written to disk in clear text.
12
13Note that most Linux distributions do not yet support resuming from an encrypted swap space, and thus hibernate/resume will not work. Suspend/resume is unaffected.
14
15Upon running the utility, the user will be informed of the hibernate/resume break, and asked to confirm the behavior. The -f|--force option can be used to bypass this interactive prompt.
16
17.SH SEE ALSO
18.PD 0
19.TP
20\fBcryptsetup\fP(8)
21
22.TP
23\fIhttp://launchpad.net/ecryptfs/\fP
24.PD
25
26.SH AUTHOR
27This manpage and the utility was written by Dustin Kirkland <kirkland@canonical.com> for Ubuntu systems (but may be used by others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.
28
29On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
030
=== added file 'doc/manpage/ecryptfs-stat.1'
--- doc/manpage/ecryptfs-stat.1 1970-01-01 00:00:00 +0000
+++ doc/manpage/ecryptfs-stat.1 2010-02-17 20:48:18 +0000
@@ -0,0 +1,18 @@
1.TH ecryptfs-setup-swap 1 2009-08-17 ecryptfs-utils "eCryptfs"
2.SH NAME
3ecryptfs-stat \- Present statistics on encrypted eCryptfs file attributes
4
5.SH SYNOPSIS
6\fBecryptfs-stat\fP filename
7
8.SH DESCRIPTION
9This program will present statistics on encrypted eCryptfs file and its attributes.
10
11.TP
12\fIhttp://launchpad.net/ecryptfs/\fP
13.PD
14
15.SH AUTHOR
16This manpage was written by Dustin Kirkland <kirkland@canonical.com> for Ubuntu systems (but may be used by others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.
17
18On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
019
=== modified file 'doc/manpage/ecryptfs.7'
--- doc/manpage/ecryptfs.7 2009-04-21 23:20:27 +0000
+++ doc/manpage/ecryptfs.7 2010-02-17 20:48:18 +0000
@@ -34,7 +34,7 @@
34Do not check the mount key signature against the values in the user's ~/.ecryptfs/sig-cache.txt file. This is useful for such things as non-interactive setup scripts, so that the mount helper does not stop and prompt the user in the event that the key sig is not in the cache.34Do not check the mount key signature against the values in the user's ~/.ecryptfs/sig-cache.txt file. This is useful for such things as non-interactive setup scripts, so that the mount helper does not stop and prompt the user in the event that the key sig is not in the cache.
35.TP35.TP
36.B ecryptfs_encrypted_view36.B ecryptfs_encrypted_view
37This option, when set, will have eCryptfs return the encrypted versions of the lower files, rather than decrypt encrypted files and return the decrypted data from the lower files. This options is useful for such things as backup utilities.37This option provides a unified encrypted file format of the eCryptfs files in the lower mount point. Currently, it is only useful if the lower mount point contains files with the metadata stored in the extended attribute. Upon a file read in the upper mount point, the encrypted version of the file will be presented with the metadata in the file header instead of the xattr. Files cannot be opened for writing when this option is enabled.
38.TP38.TP
39.B ecryptfs_xattr39.B ecryptfs_xattr
40Store the metadata in the extended attribute of the lower files rather than the header region of the lower files.40Store the metadata in the extended attribute of the lower files rather than the header region of the lower files.
@@ -79,7 +79,7 @@
79The filename should be the filename of a file containing an RSA SSL key.79The filename should be the filename of a file containing an RSA SSL key.
80.TP80.TP
81.B openssl_passwd_file=(filename)81.B openssl_passwd_file=(filename)
82The password should be specified in a file with passwd=(openssl-password). It is highly reccomended that the file be stored on a secure medium such as a personal usb key.82The password should be specified in a file with openssl_passwd=(openssl-password). It is highly reccomended that the file be stored on a secure medium such as a personal usb key.
83.TP83.TP
84.B openssl_passwd_fd=(file descriptor)84.B openssl_passwd_fd=(file descriptor)
85The password is specified through the specified file descriptor.85The password is specified through the specified file descriptor.
@@ -93,15 +93,13 @@
9393
94.PP94.PP
9595
96The following command will layover mount eCryptfs on /secret with a passphrase contained in a file stored on secure media mounted at /mnt/secureusb/.96The following command will layover mount eCryptfs on /secret with a passphrase contained in a file stored on secure media mounted at /mnt/usb/.
9797
98\fBmount -t ecryptfs -o98\fBmount -t ecryptfs -o key=passphrase:passphrase_passwd_file=/mnt/usb/file.txt /secret /secret\fP
99key=passphrase:passphrase_passwd_file=/mnt/secureusb/passwd_file.txt
100/secret /secret\fP
10199
102.PP100.PP
103101
104Where passwd_file.txt contains the contents102Where file.txt contains the contents
105\fB"passphrase_passwd=[passphrase]"\fP.103\fB"passphrase_passwd=[passphrase]"\fP.
106104
107.SH SEE ALSO105.SH SEE ALSO
@@ -119,6 +117,8 @@
119.SH NOTES117.SH NOTES
120Do not run eCryptfs in verbose-mode unless you are doing so for the sole purpose of development, since secret values will be written out to the system log in that case. Make certain that your eCryptfs mount covers all locations where your applications may write sensitive data. In addition, use dm-crypt to encrypt your swap space with a random key on boot, or see \fBecryptfs-setup-swap\fP(1).118Do not run eCryptfs in verbose-mode unless you are doing so for the sole purpose of development, since secret values will be written out to the system log in that case. Make certain that your eCryptfs mount covers all locations where your applications may write sensitive data. In addition, use dm-crypt to encrypt your swap space with a random key on boot, or see \fBecryptfs-setup-swap\fP(1).
121119
120Passphrases have a maximum length of 64 characters.
121
122.SH BUGS122.SH BUGS
123Please post bug reports to the eCryptfs bug tracker on Launchpad.net: https://bugs.launchpad.net/ecryptfs/+filebug.123Please post bug reports to the eCryptfs bug tracker on Launchpad.net: https://bugs.launchpad.net/ecryptfs/+filebug.
124124
@@ -128,131 +128,3 @@
128This manpage was (re-)written by Dustin Kirkland <kirkland@canonical.com> for Ubuntu systems (but may be used by others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.128This manpage was (re-)written by Dustin Kirkland <kirkland@canonical.com> for Ubuntu systems (but may be used by others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.
129129
130On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.130On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
131.\" Automatically generated by Pod::Man v1.37, Pod::Parser v1.35
132.\"
133.\" Standard preamble:
134.\" ========================================================================
135.de Sh \" Subsection heading
136.br
137.if t .Sp
138.ne 5
139.PP
140\fB\\$1\fR
141.PP
142..
143.de Sp \" Vertical space (when we can't use .PP)
144.if t .sp .5v
145.if n .sp
146..
147.de Vb \" Begin verbatim text
148.ft CW
149.nf
150.ne \\$1
151..
152.de Ve \" End verbatim text
153.ft R
154.fi
155..
156.\" Set up some character translations and predefined strings. \*(-- will
157.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
158.\" double quote, and \*(R" will give a right double quote. | will give a
159.\" real vertical bar. \*(C+ will give a nicer C++. Capital omega is used to
160.\" do unbreakable dashes and therefore won't be available. \*(C` and \*(C'
161.\" expand to `' in nroff, nothing in troff, for use with C<>.
162.tr \(*W-|\(bv\*(Tr
163.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
164.ie n \{\
165. ds -- \(*W-
166. ds PI pi
167. if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
168. if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch
169. ds L" ""
170. ds R" ""
171. ds C` ""
172. ds C' ""
173'br\}
174.el\{\
175. ds -- \|\(em\|
176. ds PI \(*p
177. ds L" ``
178. ds R" ''
179'br\}
180.\"
181.\" If the F register is turned on, we'll generate index entries on stderr for
182.\" titles (.TH), headers (.SH), subsections (.Sh), items (.Ip), and index
183.\" entries marked with X<> in POD. Of course, you'll have to process the
184.\" output yourself in some meaningful fashion.
185.if \nF \{\
186. de IX
187. tm Index:\\$1\t\\n%\t"\\$2"
188..
189. nr % 0
190. rr F
191.\}
192.\"
193.\" For nroff, turn off justification. Always turn off hyphenation; it makes
194.\" way too many mistakes in technical documents.
195.hy 0
196.if n .na
197.\"
198.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
199.\" Fear. Run. Save yourself. No user-serviceable parts.
200. \" fudge factors for nroff and troff
201.if n \{\
202. ds #H 0
203. ds #V .8m
204. ds #F .3m
205. ds #[ \f1
206. ds #] \fP
207.\}
208.if t \{\
209. ds #H ((1u-(\\\\n(.fu%2u))*.13m)
210. ds #V .6m
211. ds #F 0
212. ds #[ \&
213. ds #] \&
214.\}
215. \" simple accents for nroff and troff
216.if n \{\
217. ds ' \&
218. ds ` \&
219. ds ^ \&
220. ds , \&
221. ds ~ ~
222. ds /
223.\}
224.if t \{\
225. ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
226. ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
227. ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
228. ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
229. ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
230. ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
231.\}
232. \" troff and (daisy-wheel) nroff accents
233.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
234.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
235.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
236.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
237.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
238.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
239.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
240.ds ae a\h'-(\w'a'u*4/10)'e
241.ds Ae A\h'-(\w'A'u*4/10)'E
242. \" corrections for vroff
243.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
244.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
245. \" for low resolution devices (crt and lpr)
246.if \n(.H>23 .if \n(.V>19 \
247\{\
248. ds : e
249. ds 8 ss
250. ds o a
251. ds d- d\h'-1'\(ga
252. ds D- D\h'-1'\(hy
253. ds th \o'bp'
254. ds Th \o'LP'
255. ds ae ae
256. ds Ae AE
257.\}
258.rm #[ #] #H #V #F C
259131
=== modified file 'doc/manpage/mount.ecryptfs_private.1'
--- doc/manpage/mount.ecryptfs_private.1 2009-02-23 21:31:11 +0000
+++ doc/manpage/mount.ecryptfs_private.1 2010-02-17 20:48:18 +0000
@@ -8,7 +8,7 @@
8\fBNOTE:\fP This program will \fBnot\fP dynamically load the relevant keys. For this reason, it is recommended that users use \fBecryptfs-mount-private\fP(1) instead!8\fBNOTE:\fP This program will \fBnot\fP dynamically load the relevant keys. For this reason, it is recommended that users use \fBecryptfs-mount-private\fP(1) instead!
99
10.SH DESCRIPTION10.SH DESCRIPTION
11\fBmount.ecryptfs_private\fP is a mount helper utility for non-root users to cryptographically mount a private directory, ~/Private.11\fBmount.ecryptfs_private\fP is a mount helper utility for non-root users, who are members of \fBecryptfs\fP group, to cryptographically mount a private directory, ~/Private.
1212
13If, and only if:13If, and only if:
14 - the private mount passphrase is in their kernel keyring, and14 - the private mount passphrase is in their kernel keyring, and
1515
=== added file 'doc/manpage/umount.ecryptfs.8'
--- doc/manpage/umount.ecryptfs.8 1970-01-01 00:00:00 +0000
+++ doc/manpage/umount.ecryptfs.8 2010-02-17 20:48:19 +0000
@@ -0,0 +1,23 @@
1.TH umount.ecryptfs 8 2009-08-17 ecryptfs-utils "eCryptfs"
2.SH NAME
3umount.ecryptfs \- eCryptfs umount helper.
4
5.SH SYNOPSIS
6\fBumount\fP [\fIecryptfs\ mount\ point\fP]
7
8.SH DESCRIPTION
9\fBumount.ecryptfs\fP is an eCryptfs umount helper, that will also unlink keys from the keyring.
10
11.SH "SEE ALSO"
12.PD 0
13.TP
14\fBmount.ecryptfs\fP(8), \fBmount\fP(8)
15
16.TP
17\fIhttp://launchpad.net/ecryptfs/\fP
18.PD
19
20.SH AUTHOR
21This manpage was written by Dustin Kirkland <kirkland@canonical.com> for Ubuntu systems (but may be used by others). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation.
22
23On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL.
024
=== modified file 'doc/manpage/umount.ecryptfs_private.1'
--- doc/manpage/umount.ecryptfs_private.1 2009-02-23 21:31:11 +0000
+++ doc/manpage/umount.ecryptfs_private.1 2010-02-17 20:48:19 +0000
@@ -14,7 +14,7 @@
14Force the unmount, ignoring the value of the mount counter in \fI/tmp/ecryptfs-USERNAME-Private\fP14Force the unmount, ignoring the value of the mount counter in \fI/tmp/ecryptfs-USERNAME-Private\fP
1515
16.SH DESCRIPTION16.SH DESCRIPTION
17\fBumount.ecryptfs_private\fP is a mount helper utility for non-root users to unmount a cryptographically mounted private directory, ~/Private.17\fBumount.ecryptfs_private\fP is a mount helper utility for non-root users, who ares members of \fBecryptfs\fP group, to unmount a cryptographically mounted private directory, ~/Private.
1818
19If, and only if:19If, and only if:
20 - the private mount passphrase is in their kernel keyring, and20 - the private mount passphrase is in their kernel keyring, and
2121
=== modified file 'doc/sourceforge_webpage/README'
--- doc/sourceforge_webpage/README 2009-02-03 08:50:36 +0000
+++ doc/sourceforge_webpage/README 2010-02-17 20:48:19 +0000
@@ -38,11 +38,6 @@
38 1.0 or higher)38 1.0 or higher)
39 - Finding its way into some distro's39 - Finding its way into some distro's
40 - Obtainable from <http://people.redhat.com/~dhowells/keyutils> 40 - Obtainable from <http://people.redhat.com/~dhowells/keyutils>
41 - libgcrypt
42 - Part of most distro's; install the development package
43 - If you need to build from source, you probably will want these:
44 - <ftp://ftp.gnupg.org/gcrypt/libgpg-error>
45 - <ftp://ftp.gnupg.org/gcrypt/libgcrypt>
4641
4742
48KERNEL BUILD OPTIONS43KERNEL BUILD OPTIONS
4944
=== added directory 'lintian'
=== added file 'lintian/ecryptfs-utils'
--- lintian/ecryptfs-utils 1970-01-01 00:00:00 +0000
+++ lintian/ecryptfs-utils 2010-02-17 20:48:19 +0000
@@ -0,0 +1,12 @@
1# This setuid is required for encrypted-home and encrypted-private;
2# Other distros or sysadmins could perhaps make it 4750, and create
3# an ecryptfs group, adding permitted users to this group (though
4# we're not doing this in Ubuntu).
5ecryptfs-utils: setuid-binary sbin/mount.ecryptfs_private 4755 root/root
6
7# The *.desktop files should be executable
8ecryptfs-utils: executable-not-elf-or-script
9
10# We're not creating these files, but rather moving them, and the utilities
11# that use them provide the necessary owernship checks.
12ecryptfs-utils: possibly-insecure-handling-of-tmp-files-in-maintainer-script
013
=== modified file 'scripts/build-ubuntu.sh'
--- scripts/build-ubuntu.sh 2009-03-24 20:39:50 +0000
+++ scripts/build-ubuntu.sh 2010-02-17 20:48:19 +0000
@@ -7,5 +7,5 @@
7cd ubuntu7cd ubuntu
8tar zxvf *.orig.tar.gz8tar zxvf *.orig.tar.gz
9cd ecryptfs-utils*/9cd ecryptfs-utils*/
10cp -a ../../ecryptfs/debian .10cp -a ../../upstream/debian .
11debuild -uc -us11debuild -uc -us
1212
=== modified file 'scripts/release.sh'
--- scripts/release.sh 2009-04-22 00:17:57 +0000
+++ scripts/release.sh 2010-02-17 20:48:19 +0000
@@ -8,7 +8,7 @@
8 exit 18 exit 1
9}9}
1010
11head -n1 debian/changelog | grep "unreleased" || error "This version must be 'unreleased'"11head -n1 debian/changelog | grep -i "unreleased" || error "This version must be 'unreleased'"
1212
1313
14rm -f ./ecryptfs-utils*.tar.*14rm -f ./ecryptfs-utils*.tar.*
@@ -36,5 +36,9 @@
36echo "TO MAKE THE RELEASE OFFICIAL, UPLOAD:"36echo "TO MAKE THE RELEASE OFFICIAL, UPLOAD:"
37echo -n " "37echo -n " "
38ls ../ecryptfs-utils*.orig.tar.gz38ls ../ecryptfs-utils*.orig.tar.gz
39echo "----> https://launchpad.net/ecryptfs/trunk"39echo "----> https://launchpad.net/ecryptfs/trunk/+addrelease"
40echo
41echo " dch --release released"
42echo " debcommit --release"
43echo " bzr push lp:ecryptfs"
40echo44echo
4145
=== modified file 'src/desktop/Makefile.am'
--- src/desktop/Makefile.am 2009-04-07 22:33:58 +0000
+++ src/desktop/Makefile.am 2010-02-17 20:48:19 +0000
@@ -1,3 +1,4 @@
1MAINTAINERCLEANFILES = $(srcdir)/Makefile.in1MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
22
3dist_dataroot_DATA = ecryptfs-mount-private.desktop ecryptfs-setup-private.desktop ecryptfs-record-passphrase3eudatarootdir = $(datarootdir)/ecryptfs-utils
4dist_eudataroot_SCRIPTS = ecryptfs-mount-private.desktop ecryptfs-setup-private.desktop ecryptfs-record-passphrase
45
=== modified file 'src/desktop/ecryptfs-mount-private.desktop' (properties changed: -x to +x)
=== modified file 'src/desktop/ecryptfs-record-passphrase' (properties changed: -x to +x)
--- src/desktop/ecryptfs-record-passphrase 2009-04-07 22:33:58 +0000
+++ src/desktop/ecryptfs-record-passphrase 2010-02-17 20:48:19 +0000
@@ -6,13 +6,16 @@
6Terminal: True6Terminal: True
7Command: "sh -c 'ecryptfs-unwrap-passphrase $HOME/.ecryptfs/wrapped-passphrase 2>/dev/null && echo [Enter] && head -n1 && touch $HOME/.ecryptfs/.wrapped-passphrase.recorded '"7Command: "sh -c 'ecryptfs-unwrap-passphrase $HOME/.ecryptfs/wrapped-passphrase 2>/dev/null && echo [Enter] && head -n1 && touch $HOME/.ecryptfs/.wrapped-passphrase.recorded '"
8Description: To encrypt your home directory or "Private" folder, a strong8Description: To encrypt your home directory or "Private" folder, a strong
9 passphrase has been autogenerated. Usually your directory is unlocked9 passphrase has been automatically generated. Usually your directory is unlocked
10 with your user password, but if you ever need to manually recover this10 with your user password, but if you ever need to manually recover this
11 directory, you will need this passphrase. Please print or write it down and11 directory, you will need this passphrase. Please print or write it down and
12 store it in a safe location.12 store it in a safe location.
13 .13 .
14 You can run the "ecryptfs-unwrap-passphrase" command now to do this. Enter14 If you click "Run this action now", enter your login password at the "Passphrase"
15 your user password at the "Passphrase" prompt.15 prompt and you can display your randomly generated passphrase.
16 .
17 Otherwise, you will need to run "ecryptfs-unwrap-passphrase" from the command
18 line to retrive and record your generated passphrase.
16Description-de: Um Ihr Heimat- oder "Private"-Verzeichnis zu verschlüsseln,19Description-de: Um Ihr Heimat- oder "Private"-Verzeichnis zu verschlüsseln,
17 wurde automatisch ein starkes Passwort geniert. Normalerweise wird Ihr20 wurde automatisch ein starkes Passwort geniert. Normalerweise wird Ihr
18 Verzeichnis mit Ihrem Benutzerpasswort freigegeben, aber wenn Sie jemals21 Verzeichnis mit Ihrem Benutzerpasswort freigegeben, aber wenn Sie jemals
1922
=== modified file 'src/desktop/ecryptfs-setup-private.desktop' (properties changed: -x to +x)
=== modified file 'src/include/ecryptfs.h'
--- src/include/ecryptfs.h 2009-02-06 13:20:40 +0000
+++ src/include/ecryptfs.h 2010-02-17 20:48:19 +0000
@@ -512,6 +512,7 @@
512 uint32_t version);512 uint32_t version);
513int get_string(char *val, int len, int echo);513int get_string(char *val, int len, int echo);
514int get_string_stdin(char **val, char *prompt, int echo);514int get_string_stdin(char **val, char *prompt, int echo);
515int stack_pop(struct val_node **head);
515int stack_pop_val(struct val_node **head, void **val);516int stack_pop_val(struct val_node **head, void **val);
516int ecryptfs_mount(char *source, char *target, unsigned long flags, char *opts);517int ecryptfs_mount(char *source, char *target, unsigned long flags, char *opts);
517int ecryptfs_get_current_kernel_ciphers(518int ecryptfs_get_current_kernel_ciphers(
@@ -581,6 +582,7 @@
581int ecryptfs_insert_wrapped_passphrase_into_keyring(582int ecryptfs_insert_wrapped_passphrase_into_keyring(
582 char *auth_tok_sig, char *filename, char *wrapping_passphrase,583 char *auth_tok_sig, char *filename, char *wrapping_passphrase,
583 char *salt);584 char *salt);
585char *ecryptfs_get_wrapped_passphrase_filename();
584struct ecryptfs_key_mod_ops *passphrase_get_key_mod_ops(void);586struct ecryptfs_key_mod_ops *passphrase_get_key_mod_ops(void);
585int ecryptfs_validate_keyring(void);587int ecryptfs_validate_keyring(void);
586#define ECRYPTFS_SHM_KEY 0x3c81b7f5588#define ECRYPTFS_SHM_KEY 0x3c81b7f5
@@ -630,5 +632,8 @@
630char *ecryptfs_get_passphrase(char *prompt);632char *ecryptfs_get_passphrase(char *prompt);
631int ecryptfs_run_daemon(struct ecryptfs_messaging_ctx *mctx);633int ecryptfs_run_daemon(struct ecryptfs_messaging_ctx *mctx);
632634
635#define ECRYPTFS_PRIVATE_DIR "Private"
636char *ecryptfs_fetch_private_mnt(char *pw_dir);
637int ecryptfs_private_is_mounted(char *dev, char *mnt, char *sig, int mounting);
633638
634#endif639#endif
635640
=== modified file 'src/key_mod/ecryptfs_key_mod_gpg.c'
--- src/key_mod/ecryptfs_key_mod_gpg.c 2009-04-22 09:05:00 +0000
+++ src/key_mod/ecryptfs_key_mod_gpg.c 2010-02-17 20:48:19 +0000
@@ -18,6 +18,7 @@
18 * 02111-1307, USA.18 * 02111-1307, USA.
19 */19 */
2020
21#include "config.h"
21#include <fcntl.h>22#include <fcntl.h>
22#include <pwd.h>23#include <pwd.h>
23#include <stdio.h>24#include <stdio.h>
@@ -29,7 +30,6 @@
29#include <gpgme.h>30#include <gpgme.h>
30#include <sys/types.h>31#include <sys/types.h>
31#include <sys/stat.h>32#include <sys/stat.h>
32#include "config.h"
33#include "../include/ecryptfs.h"33#include "../include/ecryptfs.h"
34#include "../include/decision_graph.h"34#include "../include/decision_graph.h"
3535
@@ -131,7 +131,7 @@
131131
132int ecryptfs_gpg_encrypt(char *to, int size, char *from, unsigned char *blob)132int ecryptfs_gpg_encrypt(char *to, int size, char *from, unsigned char *blob)
133{133{
134 int rc;134 int rc = 0;
135135
136/* gpg_op_encrypt(...); */136/* gpg_op_encrypt(...); */
137out:137out:
@@ -251,7 +251,7 @@
251 struct val_node **head, void **foo)251 struct val_node **head, void **foo)
252{252{
253 struct key_mod_gpg *key_mod_gpg = (struct key_mod_gpg *)(*foo);253 struct key_mod_gpg *key_mod_gpg = (struct key_mod_gpg *)(*foo);
254 int i;254 int i = 0;
255 gpgme_error_t err;255 gpgme_error_t err;
256 int rc = 0;256 int rc = 0;
257 gpgme_key_t key;257 gpgme_key_t key;
@@ -283,10 +283,7 @@
283283
284static int generate_name_val_list(struct ecryptfs_name_val_pair *head)284static int generate_name_val_list(struct ecryptfs_name_val_pair *head)
285{285{
286 struct stat buf;
287 int i = 0;
288 uid_t id = getuid();286 uid_t id = getuid();
289 struct passwd *pw = getpwuid(id);
290 int rc = 0;287 int rc = 0;
291288
292 head->next = NULL;289 head->next = NULL;
@@ -304,6 +301,7 @@
304 destroy_key_mod_gpg(key_mod_gpg);301 destroy_key_mod_gpg(key_mod_gpg);
305 free(key_mod_gpg);302 free(key_mod_gpg);
306 }303 }
304 return 0;
307}305}
308306
309307
@@ -312,7 +310,6 @@
312{310{
313 struct key_mod_gpg *key_mod_gpg;311 struct key_mod_gpg *key_mod_gpg;
314 gpgme_error_t err;312 gpgme_error_t err;
315 gpgme_keylist_result_t keylist_res;
316 int rc = 0;313 int rc = 0;
317314
318 (*foo) = NULL;315 (*foo) = NULL;
@@ -329,7 +326,7 @@
329 if ((err = gpgme_op_keylist_start(key_mod_gpg->ctx, "", 0))) {326 if ((err = gpgme_op_keylist_start(key_mod_gpg->ctx, "", 0))) {
330 printf("Error attempting to start keylist\n");327 printf("Error attempting to start keylist\n");
331 rc = -EINVAL;328 rc = -EINVAL;
332 gpgme_release(ctx);329 gpgme_release(key_mod_gpg->ctx);
333 free(key_mod_gpg);330 free(key_mod_gpg);
334 goto out;331 goto out;
335 }332 }
336333
=== modified file 'src/key_mod/ecryptfs_key_mod_openssl.c'
--- src/key_mod/ecryptfs_key_mod_openssl.c 2009-04-22 09:05:00 +0000
+++ src/key_mod/ecryptfs_key_mod_openssl.c 2010-02-17 20:48:19 +0000
@@ -550,6 +550,30 @@
550 return rc;550 return rc;
551}551}
552552
553static int limit_key_size(struct val_node **params,
554 struct ecryptfs_subgraph_ctx *subgraph_ctx)
555{
556 char *buf;
557 int rc;
558 RSA *rsa = NULL;
559
560 if ((rc=ecryptfs_openssl_read_key(&rsa,
561 (unsigned char *)subgraph_ctx->key_mod->blob)))
562 return rc;
563 /* 41 is for padding and 3 are for additional data send from
564 * kernel (1 for cipher type and 2 for checksum */
565 if ((rc = asprintf(&buf, "max_key_bytes=%d",
566 RSA_size(rsa)-41-3)) == -1) {
567 rc = -ENOMEM;
568 goto out;
569 }
570
571 rc = stack_push(params, buf);
572out:
573 RSA_free(rsa);
574 return rc;
575}
576
553/**577/**
554 *578 *
555 * 579 *
@@ -575,6 +599,7 @@
575 syslog(LOG_ERR, "Error processing OpenSSL key; rc = [%d]", rc);599 syslog(LOG_ERR, "Error processing OpenSSL key; rc = [%d]", rc);
576 goto out;600 goto out;
577 }601 }
602 limit_key_size(mnt_params, subgraph_ctx);
578 ecryptfs_openssl_destroy_subgraph_ctx(subgraph_ctx);603 ecryptfs_openssl_destroy_subgraph_ctx(subgraph_ctx);
579 free(subgraph_ctx);604 free(subgraph_ctx);
580 (*foo) = NULL;605 (*foo) = NULL;
@@ -629,7 +654,7 @@
629 walker = walker->next;654 walker = walker->next;
630 }655 }
631 if (!walker) {656 if (!walker) {
632 syslog(LOG_ERR, "%s: No passwd option found in file\n",657 syslog(LOG_ERR, "%s: No openssl_passwd option found in file\n",
633 __FUNCTION__);658 __FUNCTION__);
634 rc = MOUNT_ERROR;659 rc = MOUNT_ERROR;
635 goto out;660 goto out;
@@ -639,6 +664,7 @@
639 syslog(LOG_ERR, "Error processing OpenSSL key; rc = [%d]", rc);664 syslog(LOG_ERR, "Error processing OpenSSL key; rc = [%d]", rc);
640 goto out;665 goto out;
641 }666 }
667 limit_key_size(mnt_params, subgraph_ctx);
642 ecryptfs_openssl_destroy_subgraph_ctx(subgraph_ctx);668 ecryptfs_openssl_destroy_subgraph_ctx(subgraph_ctx);
643 free(subgraph_ctx);669 free(subgraph_ctx);
644 (*foo) = NULL;670 (*foo) = NULL;
@@ -727,7 +753,7 @@
727 .display_opts = NULL,753 .display_opts = NULL,
728 .default_val = NULL,754 .default_val = NULL,
729 .suggested_val = NULL,755 .suggested_val = NULL,
730 .flags = ECRYPTFS_PARAM_FLAG_MASK_OUTPUT,756 .flags = ECRYPTFS_PARAM_FLAG_MASK_OUTPUT | VERIFY_VALUE,
731 .num_transitions = 1,757 .num_transitions = 1,
732 .tl = {{.val = NULL,758 .tl = {{.val = NULL,
733 .pretty_val = NULL,759 .pretty_val = NULL,
734760
=== modified file 'src/key_mod/ecryptfs_key_mod_pkcs11_helper.c'
--- src/key_mod/ecryptfs_key_mod_pkcs11_helper.c 2009-04-22 09:05:00 +0000
+++ src/key_mod/ecryptfs_key_mod_pkcs11_helper.c 2010-02-17 20:48:19 +0000
@@ -20,6 +20,7 @@
20 * 02111-1307, USA.20 * 02111-1307, USA.
21 */21 */
2222
23#include "config.h"
23#include <fcntl.h>24#include <fcntl.h>
24#include <pwd.h>25#include <pwd.h>
25#include <stdio.h>26#include <stdio.h>
@@ -28,11 +29,12 @@
28#include <errno.h>29#include <errno.h>
29#include <stdlib.h>30#include <stdlib.h>
30#include <unistd.h>31#include <unistd.h>
32#include <openssl/err.h>
33#include <openssl/pem.h>
31#include <openssl/x509.h>34#include <openssl/x509.h>
32#include <sys/types.h>35#include <sys/types.h>
33#include <sys/stat.h>36#include <sys/stat.h>
34#include <pkcs11-helper-1.0/pkcs11h-certificate.h>37#include <pkcs11-helper-1.0/pkcs11h-certificate.h>
35#include "config.h"
36#include "../include/ecryptfs.h"38#include "../include/ecryptfs.h"
37#include "../include/decision_graph.h"39#include "../include/decision_graph.h"
3840
@@ -590,7 +592,6 @@
590 char dn[1024] = {0};592 char dn[1024] = {0};
591 char serial[1024] = {0};593 char serial[1024] = {0};
592 char *ser = NULL;594 char *ser = NULL;
593 char *ssh_key = NULL;
594 size_t ser_len = 0;595 size_t ser_len = 0;
595 int n;596 int n;
596597
@@ -1536,7 +1537,6 @@
1536 struct ecryptfs_ctx *ctx = &_ctx;1537 struct ecryptfs_ctx *ctx = &_ctx;
1537 struct ecryptfs_name_val_pair nvp_head;1538 struct ecryptfs_name_val_pair nvp_head;
1538 struct val_node *dummy_mnt_params;1539 struct val_node *dummy_mnt_params;
1539 uid_t id;
1540 struct passwd *pw;1540 struct passwd *pw;
1541 char *rcfile_fullpath = NULL;1541 char *rcfile_fullpath = NULL;
1542 int fd;1542 int fd;
@@ -1647,6 +1647,7 @@
1647 if (pkcs11h_key_param_nodes[PKCS11H_KEY_TOK_ID].suggested_val)1647 if (pkcs11h_key_param_nodes[PKCS11H_KEY_TOK_ID].suggested_val)
1648 free(pkcs11h_key_param_nodes[PKCS11H_KEY_TOK_ID].suggested_val);1648 free(pkcs11h_key_param_nodes[PKCS11H_KEY_TOK_ID].suggested_val);
1649 pkcs11h_terminate ();1649 pkcs11h_terminate ();
1650 return 0;
1650}1651}
16511652
1652static struct ecryptfs_key_mod_ops ecryptfs_pkcs11h_ops = {1653static struct ecryptfs_key_mod_ops ecryptfs_pkcs11h_ops = {
16531654
=== modified file 'src/key_mod/ecryptfs_key_mod_tspi.c'
--- src/key_mod/ecryptfs_key_mod_tspi.c 2009-02-09 15:33:25 +0000
+++ src/key_mod/ecryptfs_key_mod_tspi.c 2010-02-17 20:48:19 +0000
@@ -317,6 +317,7 @@
317 struct tspi_data tspi_data;317 struct tspi_data tspi_data;
318 struct ecryptfs_tspi_connect_ticket *ticket;318 struct ecryptfs_tspi_connect_ticket *ticket;
319 int rc = 0;319 int rc = 0;
320 BYTE wellknown[] = TSS_WELL_KNOWN_SECRET;
320321
321 pthread_mutex_lock(&encrypt_lock);322 pthread_mutex_lock(&encrypt_lock);
322 (*to_size) = 0;323 (*to_size) = 0;
@@ -345,8 +346,9 @@
345 rc = -EIO;346 rc = -EIO;
346 goto out;347 goto out;
347 }348 }
348 if ((result = Tspi_Policy_SetSecret(h_srk_policy, TSS_SECRET_MODE_PLAIN,349 if ((result = Tspi_Policy_SetSecret(h_srk_policy,
349 0, NULL))350 TSS_SECRET_MODE_SHA1,
351 sizeof(wellknown), wellknown))
350 != TSS_SUCCESS) {352 != TSS_SUCCESS) {
351 syslog(LOG_ERR, "Tspi_Policy_SetSecret failed: [%s]\n",353 syslog(LOG_ERR, "Tspi_Policy_SetSecret failed: [%s]\n",
352 Trspi_Error_String(result));354 Trspi_Error_String(result));
@@ -415,6 +417,7 @@
415 struct ecryptfs_tspi_connect_ticket *ticket;417 struct ecryptfs_tspi_connect_ticket *ticket;
416 TSS_RESULT result;418 TSS_RESULT result;
417 int rc = 0;419 int rc = 0;
420 BYTE wellknown[] = TSS_WELL_KNOWN_SECRET;
418421
419 pthread_mutex_lock(&decrypt_lock);422 pthread_mutex_lock(&decrypt_lock);
420 ecryptfs_tspi_deserialize(&tspi_data, blob);423 ecryptfs_tspi_deserialize(&tspi_data, blob);
@@ -442,7 +445,8 @@
442 goto out;445 goto out;
443 }446 }
444 if ((result = Tspi_Policy_SetSecret(h_srk_policy,447 if ((result = Tspi_Policy_SetSecret(h_srk_policy,
445 TSS_SECRET_MODE_PLAIN, 0, NULL))448 TSS_SECRET_MODE_SHA1,
449 sizeof(wellknown), wellknown))
446 != TSS_SUCCESS) {450 != TSS_SUCCESS) {
447 syslog(LOG_ERR, "Tspi_Policy_SetSecret failed: [%s]\n",451 syslog(LOG_ERR, "Tspi_Policy_SetSecret failed: [%s]\n",
448 Trspi_Error_String(result));452 Trspi_Error_String(result));
449453
=== modified file 'src/libecryptfs-swig/libecryptfs.i'
--- src/libecryptfs-swig/libecryptfs.i 2009-02-03 08:50:36 +0000
+++ src/libecryptfs-swig/libecryptfs.i 2010-02-17 20:48:19 +0000
@@ -9,7 +9,7 @@
9#include "../include/ecryptfs.h"9#include "../include/ecryptfs.h"
1010
11%typemap(out) binary_data {11%typemap(out) binary_data {
12 $result = PyString_FromStringAndSize($1.data,$1.size);12 $result = PyString_FromStringAndSize((char *)($1.data),$1.size);
13}13}
1414
15extern binary_data ecryptfs_passphrase_blob(char *salt, char *passphrase);15extern binary_data ecryptfs_passphrase_blob(char *salt, char *passphrase);
1616
=== modified file 'src/libecryptfs-swig/libecryptfs.py'
--- src/libecryptfs-swig/libecryptfs.py 2009-02-03 08:50:36 +0000
+++ src/libecryptfs-swig/libecryptfs.py 2010-02-17 20:48:19 +0000
@@ -1,5 +1,5 @@
1# This file was automatically generated by SWIG (http://www.swig.org).1# This file was automatically generated by SWIG (http://www.swig.org).
2# Version 1.3.312# Version 1.3.36
3#3#
4# Don't modify this file, modify the SWIG interface instead.4# Don't modify this file, modify the SWIG interface instead.
5# This file is compatible with both classic and new-style classes.5# This file is compatible with both classic and new-style classes.
66
=== modified file 'src/libecryptfs-swig/libecryptfs_wrap.c'
--- src/libecryptfs-swig/libecryptfs_wrap.c 2009-02-03 08:50:36 +0000
+++ src/libecryptfs-swig/libecryptfs_wrap.c 2010-02-17 20:48:19 +0000
@@ -1,6 +1,6 @@
1/* ----------------------------------------------------------------------------1/* ----------------------------------------------------------------------------
2 * This file was automatically generated by SWIG (http://www.swig.org).2 * This file was automatically generated by SWIG (http://www.swig.org).
3 * Version 1.3.313 * Version 1.3.36
4 * 4 *
5 * This file is not intended to be easily readable and contains a number of 5 * This file is not intended to be easily readable and contains a number of
6 * coding conventions designed to improve portability and efficiency. Do not make6 * coding conventions designed to improve portability and efficiency. Do not make
@@ -17,14 +17,14 @@
1717
18/* template workaround for compilers that cannot correctly implement the C++ standard */18/* template workaround for compilers that cannot correctly implement the C++ standard */
19#ifndef SWIGTEMPLATEDISAMBIGUATOR19#ifndef SWIGTEMPLATEDISAMBIGUATOR
20# if defined(__SUNPRO_CC)20# if defined(__SUNPRO_CC) && (__SUNPRO_CC <= 0x560)
21# if (__SUNPRO_CC <= 0x560)21# define SWIGTEMPLATEDISAMBIGUATOR template
22# define SWIGTEMPLATEDISAMBIGUATOR template22# elif defined(__HP_aCC)
23# else23/* Needed even with `aCC -AA' when `aCC -V' reports HP ANSI C++ B3910B A.03.55 */
24# define SWIGTEMPLATEDISAMBIGUATOR 24/* If we find a maximum version that requires this, the test would be __HP_aCC <= 35500 for A.03.55 */
25# endif25# define SWIGTEMPLATEDISAMBIGUATOR template
26# else26# else
27# define SWIGTEMPLATEDISAMBIGUATOR 27# define SWIGTEMPLATEDISAMBIGUATOR
28# endif28# endif
29#endif29#endif
3030
@@ -52,6 +52,12 @@
52# endif52# endif
53#endif53#endif
5454
55#ifndef SWIG_MSC_UNSUPPRESS_4505
56# if defined(_MSC_VER)
57# pragma warning(disable : 4505) /* unreferenced local function has been removed */
58# endif
59#endif
60
55#ifndef SWIGUNUSEDPARM61#ifndef SWIGUNUSEDPARM
56# ifdef __cplusplus62# ifdef __cplusplus
57# define SWIGUNUSEDPARM(p)63# define SWIGUNUSEDPARM(p)
@@ -107,6 +113,12 @@
107# define _CRT_SECURE_NO_DEPRECATE113# define _CRT_SECURE_NO_DEPRECATE
108#endif114#endif
109115
116/* Deal with Microsoft's attempt at deprecating methods in the standard C++ library */
117#if !defined(SWIG_NO_SCL_SECURE_NO_DEPRECATE) && defined(_MSC_VER) && !defined(_SCL_SECURE_NO_DEPRECATE)
118# define _SCL_SECURE_NO_DEPRECATE
119#endif
120
121
110122
111/* Python.h has to appear first */123/* Python.h has to appear first */
112#include <Python.h>124#include <Python.h>
@@ -120,7 +132,7 @@
120132
121/* This should only be incremented when either the layout of swig_type_info changes,133/* This should only be incremented when either the layout of swig_type_info changes,
122 or for whatever reason, the runtime changes incompatibly */134 or for whatever reason, the runtime changes incompatibly */
123#define SWIG_RUNTIME_VERSION "3"135#define SWIG_RUNTIME_VERSION "4"
124136
125/* define SWIG_TYPE_TABLE_NAME as "SWIG_TYPE_TABLE" */137/* define SWIG_TYPE_TABLE_NAME as "SWIG_TYPE_TABLE" */
126#ifdef SWIG_TYPE_TABLE138#ifdef SWIG_TYPE_TABLE
@@ -155,6 +167,7 @@
155167
156/* Flags for pointer conversions */168/* Flags for pointer conversions */
157#define SWIG_POINTER_DISOWN 0x1169#define SWIG_POINTER_DISOWN 0x1
170#define SWIG_CAST_NEW_MEMORY 0x2
158171
159/* Flags for new pointer objects */172/* Flags for new pointer objects */
160#define SWIG_POINTER_OWN 0x1173#define SWIG_POINTER_OWN 0x1
@@ -295,10 +308,10 @@
295extern "C" {308extern "C" {
296#endif309#endif
297310
298typedef void *(*swig_converter_func)(void *);311typedef void *(*swig_converter_func)(void *, int *);
299typedef struct swig_type_info *(*swig_dycast_func)(void **);312typedef struct swig_type_info *(*swig_dycast_func)(void **);
300313
301/* Structure to store inforomation on one type */314/* Structure to store information on one type */
302typedef struct swig_type_info {315typedef struct swig_type_info {
303 const char *name; /* mangled name of this type */316 const char *name; /* mangled name of this type */
304 const char *str; /* human readable name of this type */317 const char *str; /* human readable name of this type */
@@ -343,7 +356,7 @@
343 while ((*f2 == ' ') && (f2 != l2)) ++f2;356 while ((*f2 == ' ') && (f2 != l2)) ++f2;
344 if (*f1 != *f2) return (*f1 > *f2) ? 1 : -1;357 if (*f1 != *f2) return (*f1 > *f2) ? 1 : -1;
345 }358 }
346 return (l1 - f1) - (l2 - f2);359 return (int)((l1 - f1) - (l2 - f2));
347}360}
348361
349/*362/*
@@ -425,8 +438,8 @@
425 Cast a pointer up an inheritance hierarchy438 Cast a pointer up an inheritance hierarchy
426*/439*/
427SWIGRUNTIMEINLINE void *440SWIGRUNTIMEINLINE void *
428SWIG_TypeCast(swig_cast_info *ty, void *ptr) {441SWIG_TypeCast(swig_cast_info *ty, void *ptr, int *newmemory) {
429 return ((!ty) || (!ty->converter)) ? ptr : (*ty->converter)(ptr);442 return ((!ty) || (!ty->converter)) ? ptr : (*ty->converter)(ptr, newmemory);
430}443}
431444
432/* 445/*
@@ -850,7 +863,7 @@
850 Py_DECREF(old_str);863 Py_DECREF(old_str);
851 Py_DECREF(value);864 Py_DECREF(value);
852 } else {865 } else {
853 PyErr_Format(PyExc_RuntimeError, mesg);866 PyErr_SetString(PyExc_RuntimeError, mesg);
854 }867 }
855}868}
856869
@@ -1090,14 +1103,14 @@
1090/* Unpack the argument tuple */1103/* Unpack the argument tuple */
10911104
1092SWIGINTERN int1105SWIGINTERN int
1093SWIG_Python_UnpackTuple(PyObject *args, const char *name, int min, int max, PyObject **objs)1106SWIG_Python_UnpackTuple(PyObject *args, const char *name, Py_ssize_t min, Py_ssize_t max, PyObject **objs)
1094{1107{
1095 if (!args) {1108 if (!args) {
1096 if (!min && !max) {1109 if (!min && !max) {
1097 return 1;1110 return 1;
1098 } else {1111 } else {
1099 PyErr_Format(PyExc_TypeError, "%s expected %s%d arguments, got none", 1112 PyErr_Format(PyExc_TypeError, "%s expected %s%d arguments, got none",
1100 name, (min == max ? "" : "at least "), min);1113 name, (min == max ? "" : "at least "), (int)min);
1101 return 0;1114 return 0;
1102 }1115 }
1103 } 1116 }
@@ -1105,14 +1118,14 @@
1105 PyErr_SetString(PyExc_SystemError, "UnpackTuple() argument list is not a tuple");1118 PyErr_SetString(PyExc_SystemError, "UnpackTuple() argument list is not a tuple");
1106 return 0;1119 return 0;
1107 } else {1120 } else {
1108 register int l = PyTuple_GET_SIZE(args);1121 register Py_ssize_t l = PyTuple_GET_SIZE(args);
1109 if (l < min) {1122 if (l < min) {
1110 PyErr_Format(PyExc_TypeError, "%s expected %s%d arguments, got %d", 1123 PyErr_Format(PyExc_TypeError, "%s expected %s%d arguments, got %d",
1111 name, (min == max ? "" : "at least "), min, l);1124 name, (min == max ? "" : "at least "), (int)min, (int)l);
1112 return 0;1125 return 0;
1113 } else if (l > max) {1126 } else if (l > max) {
1114 PyErr_Format(PyExc_TypeError, "%s expected %s%d arguments, got %d", 1127 PyErr_Format(PyExc_TypeError, "%s expected %s%d arguments, got %d",
1115 name, (min == max ? "" : "at most "), max, l);1128 name, (min == max ? "" : "at most "), (int)max, (int)l);
1116 return 0;1129 return 0;
1117 } else {1130 } else {
1118 register int i;1131 register int i;
@@ -1410,7 +1423,7 @@
1410{1423{
1411 PySwigObject *sobj = (PySwigObject *) v;1424 PySwigObject *sobj = (PySwigObject *) v;
1412 PyObject *next = sobj->next;1425 PyObject *next = sobj->next;
1413 if (sobj->own) {1426 if (sobj->own == SWIG_POINTER_OWN) {
1414 swig_type_info *ty = sobj->ty;1427 swig_type_info *ty = sobj->ty;
1415 PySwigClientData *data = ty ? (PySwigClientData *) ty->clientdata : 0;1428 PySwigClientData *data = ty ? (PySwigClientData *) ty->clientdata : 0;
1416 PyObject *destroy = data ? data->destroy : 0;1429 PyObject *destroy = data ? data->destroy : 0;
@@ -1428,12 +1441,13 @@
1428 res = ((*meth)(mself, v));1441 res = ((*meth)(mself, v));
1429 }1442 }
1430 Py_XDECREF(res);1443 Py_XDECREF(res);
1431 } else {1444 }
1445#if !defined(SWIG_PYTHON_SILENT_MEMLEAK)
1446 else {
1432 const char *name = SWIG_TypePrettyName(ty);1447 const char *name = SWIG_TypePrettyName(ty);
1433#if !defined(SWIG_PYTHON_SILENT_MEMLEAK)1448 printf("swig/python detected a memory leak of type '%s', no destructor found.\n", (name ? name : "unknown"));
1434 printf("swig/python detected a memory leak of type '%s', no destructor found.\n", name);1449 }
1435#endif1450#endif
1436 }
1437 } 1451 }
1438 Py_XDECREF(next);1452 Py_XDECREF(next);
1439 PyObject_DEL(v);1453 PyObject_DEL(v);
@@ -1591,9 +1605,11 @@
1591 (unaryfunc)0, /*nb_float*/1605 (unaryfunc)0, /*nb_float*/
1592 (unaryfunc)PySwigObject_oct, /*nb_oct*/1606 (unaryfunc)PySwigObject_oct, /*nb_oct*/
1593 (unaryfunc)PySwigObject_hex, /*nb_hex*/1607 (unaryfunc)PySwigObject_hex, /*nb_hex*/
1594#if PY_VERSION_HEX >= 0x020200001608#if PY_VERSION_HEX >= 0x02050000 /* 2.5.0 */
1595 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 /* nb_inplace_add -> nb_inplace_true_divide */ 1609 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 /* nb_inplace_add -> nb_index */
1596#elif PY_VERSION_HEX >= 0x020000001610#elif PY_VERSION_HEX >= 0x02020000 /* 2.2.0 */
1611 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 /* nb_inplace_add -> nb_inplace_true_divide */
1612#elif PY_VERSION_HEX >= 0x02000000 /* 2.0.0 */
1597 0,0,0,0,0,0,0,0,0,0,0 /* nb_inplace_add -> nb_inplace_or */1613 0,0,0,0,0,0,0,0,0,0,0 /* nb_inplace_add -> nb_inplace_or */
1598#endif1614#endif
1599 };1615 };
@@ -1936,7 +1952,7 @@
19361952
1937SWIGRUNTIME int1953SWIGRUNTIME int
1938SWIG_Python_AcquirePtr(PyObject *obj, int own) {1954SWIG_Python_AcquirePtr(PyObject *obj, int own) {
1939 if (own) {1955 if (own == SWIG_POINTER_OWN) {
1940 PySwigObject *sobj = SWIG_Python_GetSwigThis(obj);1956 PySwigObject *sobj = SWIG_Python_GetSwigThis(obj);
1941 if (sobj) {1957 if (sobj) {
1942 int oldown = sobj->own;1958 int oldown = sobj->own;
@@ -1957,6 +1973,8 @@
1957 return SWIG_OK;1973 return SWIG_OK;
1958 } else {1974 } else {
1959 PySwigObject *sobj = SWIG_Python_GetSwigThis(obj);1975 PySwigObject *sobj = SWIG_Python_GetSwigThis(obj);
1976 if (own)
1977 *own = 0;
1960 while (sobj) {1978 while (sobj) {
1961 void *vptr = sobj->ptr;1979 void *vptr = sobj->ptr;
1962 if (ty) {1980 if (ty) {
@@ -1970,7 +1988,15 @@
1970 if (!tc) {1988 if (!tc) {
1971 sobj = (PySwigObject *)sobj->next;1989 sobj = (PySwigObject *)sobj->next;
1972 } else {1990 } else {
1973 if (ptr) *ptr = SWIG_TypeCast(tc,vptr);1991 if (ptr) {
1992 int newmemory = 0;
1993 *ptr = SWIG_TypeCast(tc,vptr,&newmemory);
1994 if (newmemory == SWIG_CAST_NEW_MEMORY) {
1995 assert(own);
1996 if (own)
1997 *own = *own | SWIG_CAST_NEW_MEMORY;
1998 }
1999 }
1974 break;2000 break;
1975 }2001 }
1976 }2002 }
@@ -1980,7 +2006,8 @@
1980 }2006 }
1981 }2007 }
1982 if (sobj) {2008 if (sobj) {
1983 if (own) *own = sobj->own;2009 if (own)
2010 *own = *own | sobj->own;
1984 if (flags & SWIG_POINTER_DISOWN) {2011 if (flags & SWIG_POINTER_DISOWN) {
1985 sobj->own = 0;2012 sobj->own = 0;
1986 }2013 }
@@ -2045,8 +2072,13 @@
2045 }2072 }
2046 if (ty) {2073 if (ty) {
2047 swig_cast_info *tc = SWIG_TypeCheck(desc,ty);2074 swig_cast_info *tc = SWIG_TypeCheck(desc,ty);
2048 if (!tc) return SWIG_ERROR;2075 if (tc) {
2049 *ptr = SWIG_TypeCast(tc,vptr);2076 int newmemory = 0;
2077 *ptr = SWIG_TypeCast(tc,vptr,&newmemory);
2078 assert(!newmemory); /* newmemory handling not yet implemented */
2079 } else {
2080 return SWIG_ERROR;
2081 }
2050 } else {2082 } else {
2051 *ptr = vptr;2083 *ptr = vptr;
2052 }2084 }
@@ -2469,7 +2501,7 @@
24692501
2470#define SWIG_name "_libecryptfs"2502#define SWIG_name "_libecryptfs"
24712503
2472#define SWIGVERSION 0x010331 2504#define SWIGVERSION 0x010336
2473#define SWIG_VERSION SWIGVERSION2505#define SWIG_VERSION SWIGVERSION
24742506
24752507
@@ -2567,7 +2599,6 @@
2567 PyObject *resultobj = 0;2599 PyObject *resultobj = 0;
2568 char *arg1 = (char *) 0 ;2600 char *arg1 = (char *) 0 ;
2569 char *arg2 = (char *) 0 ;2601 char *arg2 = (char *) 0 ;
2570 binary_data result;
2571 int res1 ;2602 int res1 ;
2572 char *buf1 = 0 ;2603 char *buf1 = 0 ;
2573 int alloc1 = 0 ;2604 int alloc1 = 0 ;
@@ -2576,6 +2607,7 @@
2576 int alloc2 = 0 ;2607 int alloc2 = 0 ;
2577 PyObject * obj0 = 0 ;2608 PyObject * obj0 = 0 ;
2578 PyObject * obj1 = 0 ;2609 PyObject * obj1 = 0 ;
2610 binary_data result;
2579 2611
2580 if (!PyArg_ParseTuple(args,(char *)"OO:ecryptfs_passphrase_blob",&obj0,&obj1)) SWIG_fail;2612 if (!PyArg_ParseTuple(args,(char *)"OO:ecryptfs_passphrase_blob",&obj0,&obj1)) SWIG_fail;
2581 res1 = SWIG_AsCharPtrAndSize(obj0, &buf1, NULL, &alloc1);2613 res1 = SWIG_AsCharPtrAndSize(obj0, &buf1, NULL, &alloc1);
@@ -2590,7 +2622,7 @@
2590 arg2 = (char *)(buf2);2622 arg2 = (char *)(buf2);
2591 result = ecryptfs_passphrase_blob(arg1,arg2);2623 result = ecryptfs_passphrase_blob(arg1,arg2);
2592 {2624 {
2593 resultobj = PyString_FromStringAndSize((char *)(&result)->data,(&result)->size);2625 resultobj = PyString_FromStringAndSize((char *)((&result)->data),(&result)->size);
2594 }2626 }
2595 if (alloc1 == SWIG_NEWOBJ) free((char*)buf1);2627 if (alloc1 == SWIG_NEWOBJ) free((char*)buf1);
2596 if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);2628 if (alloc2 == SWIG_NEWOBJ) free((char*)buf2);
@@ -2605,11 +2637,11 @@
2605SWIGINTERN PyObject *_wrap_ecryptfs_passphrase_sig_from_blob(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {2637SWIGINTERN PyObject *_wrap_ecryptfs_passphrase_sig_from_blob(PyObject *SWIGUNUSEDPARM(self), PyObject *args) {
2606 PyObject *resultobj = 0;2638 PyObject *resultobj = 0;
2607 char *arg1 = (char *) 0 ;2639 char *arg1 = (char *) 0 ;
2608 binary_data result;
2609 int res1 ;2640 int res1 ;
2610 char *buf1 = 0 ;2641 char *buf1 = 0 ;
2611 int alloc1 = 0 ;2642 int alloc1 = 0 ;
2612 PyObject * obj0 = 0 ;2643 PyObject * obj0 = 0 ;
2644 binary_data result;
2613 2645
2614 if (!PyArg_ParseTuple(args,(char *)"O:ecryptfs_passphrase_sig_from_blob",&obj0)) SWIG_fail;2646 if (!PyArg_ParseTuple(args,(char *)"O:ecryptfs_passphrase_sig_from_blob",&obj0)) SWIG_fail;
2615 res1 = SWIG_AsCharPtrAndSize(obj0, &buf1, NULL, &alloc1);2647 res1 = SWIG_AsCharPtrAndSize(obj0, &buf1, NULL, &alloc1);
@@ -2619,7 +2651,7 @@
2619 arg1 = (char *)(buf1);2651 arg1 = (char *)(buf1);
2620 result = ecryptfs_passphrase_sig_from_blob(arg1);2652 result = ecryptfs_passphrase_sig_from_blob(arg1);
2621 {2653 {
2622 resultobj = PyString_FromStringAndSize((char *)(&result)->data,(&result)->size);2654 resultobj = PyString_FromStringAndSize((char *)((&result)->data),(&result)->size);
2623 }2655 }
2624 if (alloc1 == SWIG_NEWOBJ) free((char*)buf1);2656 if (alloc1 == SWIG_NEWOBJ) free((char*)buf1);
2625 return resultobj;2657 return resultobj;
@@ -2633,15 +2665,15 @@
2633 PyObject *resultobj = 0;2665 PyObject *resultobj = 0;
2634 char *arg1 = (char *) 0 ;2666 char *arg1 = (char *) 0 ;
2635 char *arg2 = (char *) 0 ;2667 char *arg2 = (char *) 0 ;
2668 int res1 ;
2669 char *buf1 = 0 ;
2670 int alloc1 = 0 ;
2671 int res2 ;
2672 char *buf2 = 0 ;
2673 int alloc2 = 0 ;
2674 PyObject * obj0 = 0 ;
2675 PyObject * obj1 = 0 ;
2636 int result;2676 int result;
2637 int res1 ;
2638 char *buf1 = 0 ;
2639 int alloc1 = 0 ;
2640 int res2 ;
2641 char *buf2 = 0 ;
2642 int alloc2 = 0 ;
2643 PyObject * obj0 = 0 ;
2644 PyObject * obj1 = 0 ;
2645 2677
2646 if (!PyArg_ParseTuple(args,(char *)"OO:ecryptfs_add_blob_to_keyring",&obj0,&obj1)) SWIG_fail;2678 if (!PyArg_ParseTuple(args,(char *)"OO:ecryptfs_add_blob_to_keyring",&obj0,&obj1)) SWIG_fail;
2647 res1 = SWIG_AsCharPtrAndSize(obj0, &buf1, NULL, &alloc1);2679 res1 = SWIG_AsCharPtrAndSize(obj0, &buf1, NULL, &alloc1);
@@ -2754,7 +2786,7 @@
2754SWIG_InitializeModule(void *clientdata) {2786SWIG_InitializeModule(void *clientdata) {
2755 size_t i;2787 size_t i;
2756 swig_module_info *module_head, *iter;2788 swig_module_info *module_head, *iter;
2757 int found;2789 int found, init;
2758 2790
2759 clientdata = clientdata;2791 clientdata = clientdata;
2760 2792
@@ -2764,6 +2796,9 @@
2764 swig_module.type_initial = swig_type_initial;2796 swig_module.type_initial = swig_type_initial;
2765 swig_module.cast_initial = swig_cast_initial;2797 swig_module.cast_initial = swig_cast_initial;
2766 swig_module.next = &swig_module;2798 swig_module.next = &swig_module;
2799 init = 1;
2800 } else {
2801 init = 0;
2767 }2802 }
2768 2803
2769 /* Try and load any already created modules */2804 /* Try and load any already created modules */
@@ -2792,6 +2827,12 @@
2792 module_head->next = &swig_module;2827 module_head->next = &swig_module;
2793 }2828 }
2794 2829
2830 /* When multiple interpeters are used, a module could have already been initialized in
2831 a different interpreter, but not yet have a pointer in this interpreter.
2832 In this case, we do not want to continue adding types... everything should be
2833 set up already */
2834 if (init == 0) return;
2835
2795 /* Now work on filling in swig_module.types */2836 /* Now work on filling in swig_module.types */
2796#ifdef SWIGRUNTIME_DEBUG2837#ifdef SWIGRUNTIME_DEBUG
2797 printf("SWIG_InitializeModule: size %d\n", swig_module.size);2838 printf("SWIG_InitializeModule: size %d\n", swig_module.size);
27982839
=== modified file 'src/libecryptfs/cipher_list.c'
--- src/libecryptfs/cipher_list.c 2009-04-22 09:05:00 +0000
+++ src/libecryptfs/cipher_list.c 2010-02-17 20:48:19 +0000
@@ -338,7 +338,7 @@
338 {"tea", "tea.ko", 8, 16, 16, 7, 0},338 {"tea", "tea.ko", 8, 16, 16, 7, 0},
339 {"xeta", "tea.ko", 8, 16, 16, 9, 0},339 {"xeta", "tea.ko", 8, 16, 16, 9, 0},
340 {"xtea", "tea.ko", 8, 16, 16, 8, 0},340 {"xtea", "tea.ko", 8, 16, 16, 8, 0},
341 {"blowfish", "blowfish.ko", 16, 16, 32, 2, 1},341 {"blowfish", "blowfish.ko", 16, 16, 56, 2, 1},
342 {"twofish", "twofish.ko", 16, 16, 32, 4, 1},342 {"twofish", "twofish.ko", 16, 16, 32, 4, 1},
343 {"khazad", "khazad.ko", 8, 16, 16, 11, 0},343 {"khazad", "khazad.ko", 8, 16, 16, 11, 0},
344 {"cast5", "cast5.ko", 8, 5, 16, 14, 1},344 {"cast5", "cast5.ko", 8, 5, 16, 14, 1},
345345
=== modified file 'src/libecryptfs/cmd_ln_parser.c'
--- src/libecryptfs/cmd_ln_parser.c 2009-04-22 09:05:00 +0000
+++ src/libecryptfs/cmd_ln_parser.c 2010-02-17 20:48:19 +0000
@@ -200,7 +200,7 @@
200200
201 fd = open(fullpath, O_RDONLY);201 fd = open(fullpath, O_RDONLY);
202 if (fd == -1) {202 if (fd == -1) {
203 rc = -EIO;203 rc = -errno;
204 goto out;204 goto out;
205 }205 }
206 rc = parse_options_file(fd, nvp_list_head);206 rc = parse_options_file(fd, nvp_list_head);
207207
=== modified file 'src/libecryptfs/decision_graph.c'
--- src/libecryptfs/decision_graph.c 2009-04-23 16:31:05 +0000
+++ src/libecryptfs/decision_graph.c 2010-02-17 20:48:19 +0000
@@ -209,8 +209,15 @@
209 struct ecryptfs_name_val_pair *nvp_head,209 struct ecryptfs_name_val_pair *nvp_head,
210 struct val_node **mnt_params, void **foo)210 struct val_node **mnt_params, void **foo)
211{211{
212 static int repeated = 0;
213 static struct param_node *lastnode = NULL;
212 int i, rc;214 int i, rc;
213215
216 if (current != lastnode)
217 repeated = 0;
218
219 lastnode = current;
220
214 for (i = 0; i < current->num_transitions; i++) {221 for (i = 0; i < current->num_transitions; i++) {
215 struct transition_node *tn = &current->tl[i];222 struct transition_node *tn = &current->tl[i];
216 struct ecryptfs_name_val_pair *nvp = nvp_head->next;223 struct ecryptfs_name_val_pair *nvp = nvp_head->next;
@@ -275,11 +282,17 @@
275 trans_func_tok_id =282 trans_func_tok_id =
276 tn->trans_func(ctx, current,283 tn->trans_func(ctx, current,
277 mnt_params, foo);284 mnt_params, foo);
278 if (trans_func_tok_id == WRONG_VALUE && 285 if (trans_func_tok_id == WRONG_VALUE) {
279 (ctx->verbosity || 286 if (ctx->verbosity ||
280 (current->flags & STDIN_REQUIRED))) {287 (current->flags & STDIN_REQUIRED)) {
281 *next = current;288 if (++repeated >= 5)
282 return 0;289 return -EINVAL;
290 else {
291 *next = current;
292 return 0;
293 }
294 } else
295 return -EINVAL;
283 }296 }
284 if (trans_func_tok_id == MOUNT_ERROR || 297 if (trans_func_tok_id == MOUNT_ERROR ||
285 trans_func_tok_id < 0)298 trans_func_tok_id < 0)
@@ -289,6 +302,8 @@
289 else return -EINVAL;302 else return -EINVAL;
290 }303 }
291 }304 }
305 if (current->num_transitions)
306 return MOUNT_ERROR;
292 return NULL_TOK;307 return NULL_TOK;
293}308}
294309
@@ -560,10 +575,13 @@
560 }575 }
561 prompt[i] = '\0';576 prompt[i] = '\0';
562get_value:577get_value:
563 rc = (ctx->get_string)578 if ((rc = (ctx->get_string)
564 (&(node->val), prompt,579 (&(node->val), prompt,
565 (node->flags580 (node->flags
566 & ECRYPTFS_PARAM_FLAG_ECHO_INPUT));581 & ECRYPTFS_PARAM_FLAG_ECHO_INPUT)))) {
582 free(prompt);
583 return rc;
584 }
567 val = atoi(node->val);585 val = atoi(node->val);
568 if (val > 0 && val <= node->num_transitions) {586 if (val > 0 && val <= node->num_transitions) {
569 free(node->val);587 free(node->val);
@@ -627,26 +645,34 @@
627 (&(node->val), prompt,645 (&(node->val), prompt,
628 (node->flags646 (node->flags
629 & ECRYPTFS_PARAM_FLAG_ECHO_INPUT));647 & ECRYPTFS_PARAM_FLAG_ECHO_INPUT));
648 free(prompt);
649 if (rc)
650 goto out;
630 if (node->val[0] == '\0' && 651 if (node->val[0] == '\0' &&
631 (node->flags & ECRYPTFS_NONEMPTY_VALUE_REQUIRED)) {652 (node->flags & ECRYPTFS_NONEMPTY_VALUE_REQUIRED)) {
632 fprintf(stderr,"Wrong input, non-empty value "653 fprintf(stderr,"Wrong input, non-empty value "
633 "required!\n");654 "required!\n");
634 goto obtain_value;655 goto obtain_value;
635 }656 }
636 free(prompt);
637 if (node->flags & VERIFY_VALUE) {657 if (node->flags & VERIFY_VALUE) {
638 rc = asprintf(&verify_prompt, "Verify %s",658 rc = asprintf(&verify_prompt, "Verify %s",
639 node->prompt);659 node->prompt);
640 if (rc == -1)660 if (rc == -1)
641 return MOUNT_ERROR;661 return -ENOMEM;
642 rc = (ctx->get_string)662 rc = (ctx->get_string)
643 (&verify, verify_prompt,663 (&verify, verify_prompt,
644 (node->flags664 (node->flags
645 & ECRYPTFS_PARAM_FLAG_ECHO_INPUT));665 & ECRYPTFS_PARAM_FLAG_ECHO_INPUT));
666 free(verify_prompt);
646 if (rc)667 if (rc)
647 return MOUNT_ERROR;668 return -EIO;
648 if (strcmp(verify, node->val))669 rc = strcmp(verify, node->val);
670 free(verify);
671 if (rc) {
672 free(node->val);
673 node->val = NULL;
649 goto obtain_value;674 goto obtain_value;
675 }
650 }676 }
651 if (node->val[0] == '\0') {677 if (node->val[0] == '\0') {
652 free(node->val);678 free(node->val);
653679
=== modified file 'src/libecryptfs/key_management.c'
--- src/libecryptfs/key_management.c 2009-04-22 09:36:25 +0000
+++ src/libecryptfs/key_management.c 2010-02-17 20:48:19 +0000
@@ -18,13 +18,10 @@
18 * 02111-1307, USA.18 * 02111-1307, USA.
19 */19 */
2020
21#include "config.h"
21#include <errno.h>22#include <errno.h>
22#ifdef ENABLE_NSS
23#include <nss.h>23#include <nss.h>
24#include <pk11func.h>24#include <pk11func.h>
25#else
26#include <gcrypt.h>
27#endif /* #ifdef ENABLE_NSS */
28#include <keyutils.h>25#include <keyutils.h>
29#ifndef S_SPLINT_S26#ifndef S_SPLINT_S
30#include <stdio.h>27#include <stdio.h>
@@ -38,7 +35,7 @@
38#include <sys/mman.h>35#include <sys/mman.h>
39#include <sys/types.h>36#include <sys/types.h>
40#include <sys/stat.h>37#include <sys/stat.h>
41#include "config.h"38#include <pwd.h>
42#include "../include/ecryptfs.h"39#include "../include/ecryptfs.h"
4340
44#ifndef ENOKEY41#ifndef ENOKEY
@@ -166,8 +163,6 @@
166 rc = (int)keyctl_search(KEY_SPEC_USER_KEYRING, "user", auth_tok_sig, 0);163 rc = (int)keyctl_search(KEY_SPEC_USER_KEYRING, "user", auth_tok_sig, 0);
167 if (rc != -1) { /* we already have this key in keyring; we're done */164 if (rc != -1) { /* we already have this key in keyring; we're done */
168 rc = 1;165 rc = 1;
169 syslog(LOG_WARNING, "Passphrase key already in keyring;"
170 " rc = [%d]\n", rc);
171 goto out;166 goto out;
172 } else if ((rc == -1) && (errno != ENOKEY)) {167 } else if ((rc == -1) && (errno != ENOKEY)) {
173 int errnum = errno;168 int errnum = errno;
@@ -180,11 +175,11 @@
180 rc = add_key("user", auth_tok_sig, (void *)auth_tok,175 rc = add_key("user", auth_tok_sig, (void *)auth_tok,
181 sizeof(struct ecryptfs_auth_tok), KEY_SPEC_USER_KEYRING);176 sizeof(struct ecryptfs_auth_tok), KEY_SPEC_USER_KEYRING);
182 if (rc == -1) {177 if (rc == -1) {
183 int errnum = errno;178 rc = -errno;
184
185 syslog(LOG_ERR, "Error adding key with sig [%s]; rc = [%d] "179 syslog(LOG_ERR, "Error adding key with sig [%s]; rc = [%d] "
186 "\"%m\"\n", auth_tok_sig, rc);180 "\"%m\"\n", auth_tok_sig, rc);
187 rc = (errnum < 0) ? errnum : errnum * -1;181 if (rc == -EDQUOT)
182 syslog(LOG_WARNING, "Error adding key to keyring - keyring is full\n");
188 goto out;183 goto out;
189 }184 }
190 rc = 0;185 rc = 0;
@@ -300,7 +295,6 @@
300 ECRYPTFS_AES_BLOCK_SIZE + 1];295 ECRYPTFS_AES_BLOCK_SIZE + 1];
301 int encrypted_passphrase_pos = 0;296 int encrypted_passphrase_pos = 0;
302 int decrypted_passphrase_pos = 0;297 int decrypted_passphrase_pos = 0;
303#ifdef ENABLE_NSS
304 int tmp1_outlen = 0;298 int tmp1_outlen = 0;
305 int tmp2_outlen = 0;299 int tmp2_outlen = 0;
306 SECStatus err;300 SECStatus err;
@@ -309,11 +303,6 @@
309 PK11SlotInfo *slot = NULL;303 PK11SlotInfo *slot = NULL;
310 PK11Context *enc_ctx = NULL;304 PK11Context *enc_ctx = NULL;
311 SECItem *sec_param = NULL;305 SECItem *sec_param = NULL;
312#else
313#warning Building against gcrypt instead of nss
314 gcry_cipher_hd_t gcry_handle;
315 gcry_error_t gcry_err;
316#endif /* #ifdef ENABLE_NSS */
317 int encrypted_passphrase_bytes;306 int encrypted_passphrase_bytes;
318 int decrypted_passphrase_bytes;307 int decrypted_passphrase_bytes;
319 int fd;308 int fd;
@@ -345,7 +334,6 @@
345 - (decrypted_passphrase_bytes334 - (decrypted_passphrase_bytes
346 % ECRYPTFS_AES_BLOCK_SIZE));335 % ECRYPTFS_AES_BLOCK_SIZE));
347 encrypted_passphrase_bytes = decrypted_passphrase_bytes;336 encrypted_passphrase_bytes = decrypted_passphrase_bytes;
348#ifdef ENABLE_NSS
349 NSS_NoDB_Init(NULL);337 NSS_NoDB_Init(NULL);
350 slot = PK11_GetBestSlot(CKM_AES_ECB, NULL);338 slot = PK11_GetBestSlot(CKM_AES_ECB, NULL);
351 key_item.data = (unsigned char *)wrapping_key;339 key_item.data = (unsigned char *)wrapping_key;
@@ -406,41 +394,6 @@
406 rc = - EIO;394 rc = - EIO;
407 goto out;395 goto out;
408 }396 }
409#else
410 if ((gcry_err = gcry_cipher_open(&gcry_handle, GCRY_CIPHER_AES,
411 GCRY_CIPHER_MODE_ECB, 0))) {
412 syslog(LOG_ERR, "Error attempting to initialize AES cipher; "
413 "gcry_error_t = [%d]\n", gcry_err);
414 rc = -EIO;
415 goto out;
416 }
417 if ((gcry_err = gcry_cipher_setkey(gcry_handle, wrapping_key,
418 ECRYPTFS_AES_KEY_BYTES))) {
419 syslog(LOG_ERR, "Error attempting to set AES key; "
420 "gcry_error_t = [%d]\n", gcry_err);
421 rc = -EIO;
422 gcry_cipher_close(gcry_handle);
423 goto out;
424 }
425 while (decrypted_passphrase_bytes > 0) {
426 if ((gcry_err = gcry_cipher_encrypt(
427 gcry_handle,
428 &encrypted_passphrase[encrypted_passphrase_pos],
429 ECRYPTFS_AES_BLOCK_SIZE,
430 &decrypted_passphrase[decrypted_passphrase_pos],
431 ECRYPTFS_AES_BLOCK_SIZE))) {
432 syslog(LOG_ERR, "Error attempting to encrypt block; "
433 "gcry_error = [%d]\n", gcry_err);
434 rc = -EIO;
435 gcry_cipher_close(gcry_handle);
436 goto out;
437 }
438 encrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
439 decrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
440 decrypted_passphrase_bytes -= ECRYPTFS_AES_BLOCK_SIZE;
441 }
442 gcry_cipher_close(gcry_handle);
443#endif /* #ifdef ENABLE_NSS */
444 unlink(filename);397 unlink(filename);
445 if ((fd = open(filename, (O_WRONLY | O_CREAT | O_EXCL),398 if ((fd = open(filename, (O_WRONLY | O_CREAT | O_EXCL),
446 (S_IRUSR | S_IWUSR))) == -1) {399 (S_IRUSR | S_IWUSR))) == -1) {
@@ -486,7 +439,6 @@
486 char encrypted_passphrase[ECRYPTFS_MAX_PASSPHRASE_BYTES + 1];439 char encrypted_passphrase[ECRYPTFS_MAX_PASSPHRASE_BYTES + 1];
487 int encrypted_passphrase_pos = 0;440 int encrypted_passphrase_pos = 0;
488 int decrypted_passphrase_pos = 0;441 int decrypted_passphrase_pos = 0;
489#ifdef ENABLE_NSS
490 int tmp1_outlen = 0;442 int tmp1_outlen = 0;
491 int tmp2_outlen = 0;443 int tmp2_outlen = 0;
492 SECStatus err;444 SECStatus err;
@@ -495,10 +447,6 @@
495 PK11SlotInfo *slot = NULL;447 PK11SlotInfo *slot = NULL;
496 PK11Context *enc_ctx = NULL;448 PK11Context *enc_ctx = NULL;
497 SECItem *sec_param = NULL;449 SECItem *sec_param = NULL;
498#else
499 gcry_cipher_hd_t gcry_handle;
500 gcry_error_t gcry_err;
501#endif /* #ifdef ENABLE_NSS */
502 int encrypted_passphrase_bytes;450 int encrypted_passphrase_bytes;
503 int fd;451 int fd;
504 ssize_t size;452 ssize_t size;
@@ -545,7 +493,6 @@
545 goto out;493 goto out;
546 }494 }
547 encrypted_passphrase_bytes = size;495 encrypted_passphrase_bytes = size;
548#ifdef ENABLE_NSS
549 NSS_NoDB_Init(NULL);496 NSS_NoDB_Init(NULL);
550 slot = PK11_GetBestSlot(CKM_AES_ECB, NULL);497 slot = PK11_GetBestSlot(CKM_AES_ECB, NULL);
551 key_item.data = (unsigned char *)wrapping_key;498 key_item.data = (unsigned char *)wrapping_key;
@@ -605,41 +552,6 @@
605 rc = - EIO;552 rc = - EIO;
606 goto out;553 goto out;
607 }554 }
608#else
609 if ((gcry_err = gcry_cipher_open(&gcry_handle, GCRY_CIPHER_AES,
610 GCRY_CIPHER_MODE_ECB, 0))) {
611 syslog(LOG_ERR, "Error attempting to initialize AES cipher; "
612 "gcry_error_t = [%d]\n", gcry_err);
613 rc = -EIO;
614 goto out;
615 }
616 if ((gcry_err = gcry_cipher_setkey(gcry_handle, wrapping_key,
617 ECRYPTFS_AES_KEY_BYTES))) {
618 syslog(LOG_ERR, "Error attempting to set AES key; "
619 "gcry_error_t = [%d]\n", gcry_err);
620 rc = -EIO;
621 gcry_cipher_close(gcry_handle);
622 goto out;
623 }
624 memset(decrypted_passphrase, 0, ECRYPTFS_MAX_PASSPHRASE_BYTES + 1);
625 while (encrypted_passphrase_bytes > 0) {
626 if ((gcry_err = gcry_cipher_decrypt(
627 gcry_handle,
628 &decrypted_passphrase[encrypted_passphrase_pos],
629 ECRYPTFS_AES_BLOCK_SIZE,
630 &encrypted_passphrase[decrypted_passphrase_pos],
631 ECRYPTFS_AES_BLOCK_SIZE))) {
632 syslog(LOG_ERR, "Error attempting to decrypt block; "
633 "gcry_error = [%d]\n", gcry_err);
634 rc = -EIO;
635 gcry_cipher_close(gcry_handle);
636 goto out;
637 }
638 encrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
639 decrypted_passphrase_pos += ECRYPTFS_AES_BLOCK_SIZE;
640 encrypted_passphrase_bytes -= ECRYPTFS_AES_BLOCK_SIZE;
641 }
642#endif /* #ifdef ENABLE_NSS */
643out:555out:
644 return rc;556 return rc;
645}557}
@@ -676,18 +588,20 @@
676 if ((rc = ecryptfs_add_passphrase_key_to_keyring(588 if ((rc = ecryptfs_add_passphrase_key_to_keyring(
677 auth_tok_sig,589 auth_tok_sig,
678 decrypted_passphrase,590 decrypted_passphrase,
679 ECRYPTFS_DEFAULT_SALT_FNEK_HEX))) {591 ECRYPTFS_DEFAULT_SALT_FNEK_HEX)) != 0) {
680 syslog(LOG_ERR,592 syslog(LOG_ERR,
681 "Error attempting to add filename encryption key to "593 "Error attempting to add filename encryption key to "
682 "user session keyring; rc = [%d]\n", rc);594 "user session keyring; rc = [%d]\n", rc);
595 goto out;
683 }596 }
684 }597 }
685 if ((rc = ecryptfs_add_passphrase_key_to_keyring(auth_tok_sig,598 if ((rc = ecryptfs_add_passphrase_key_to_keyring(auth_tok_sig,
686 decrypted_passphrase,599 decrypted_passphrase,
687 salt))) {600 salt)) != 0) {
688 syslog(LOG_ERR, "Error attempting to add passphrase key to "601 syslog(LOG_ERR, "Error attempting to add passphrase key to "
689 "user session keyring; rc = [%d]\n", rc);602 "user session keyring; rc = [%d]\n", rc);
690 }603 } else
604 rc = 0;
691out:605out:
692 return rc;606 return rc;
693}607}
@@ -744,10 +658,13 @@
744 rc = add_key("user", auth_tok_sig, (void *)auth_tok,658 rc = add_key("user", auth_tok_sig, (void *)auth_tok,
745 (sizeof(struct ecryptfs_auth_tok) + blob_size),659 (sizeof(struct ecryptfs_auth_tok) + blob_size),
746 KEY_SPEC_USER_KEYRING);660 KEY_SPEC_USER_KEYRING);
747 if (rc < 0)661 if (rc < 0) {
662 rc = -errno;
748 syslog(LOG_ERR, "Error adding key with sig [%s]; rc ="663 syslog(LOG_ERR, "Error adding key with sig [%s]; rc ="
749 " [%d]\n", auth_tok_sig, rc);664 " [%d]\n", auth_tok_sig, rc);
750 else rc = 0;665 if (rc == -EDQUOT)
666 syslog(LOG_WARNING, "Error adding key to keyring - keyring is full\n");
667 } else rc = 0;
751out:668out:
752 if (auth_tok != NULL) {669 if (auth_tok != NULL) {
753 memset(auth_tok, 0, (sizeof(struct ecryptfs_auth_tok) + blob_size));670 memset(auth_tok, 0, (sizeof(struct ecryptfs_auth_tok) + blob_size));
@@ -765,14 +682,14 @@
765 memset(&nvp_list_head, 0, sizeof(struct ecryptfs_name_val_pair));682 memset(&nvp_list_head, 0, sizeof(struct ecryptfs_name_val_pair));
766 rc = ecryptfs_parse_rc_file(&nvp_list_head);683 rc = ecryptfs_parse_rc_file(&nvp_list_head);
767 if (rc) {684 if (rc) {
768 if (rc != -EIO) {685 if (rc != -ENOENT) {
769 syslog(LOG_WARNING,686 syslog(LOG_WARNING,
770 "Error attempting to parse .ecryptfsrc file; "687 "Error attempting to parse .ecryptfsrc file; "
771 "rc = [%d]", rc);688 "rc = [%d]", rc);
772 }689 }
773 goto out;690 goto out;
774 }691 }
775 nvp = &nvp_list_head;692 nvp = nvp_list_head.next;
776 while (nvp) {693 while (nvp) {
777 if (strcmp(nvp->name, "salt") == 0) {694 if (strcmp(nvp->name, "salt") == 0) {
778 int valsize;695 int valsize;
@@ -780,7 +697,7 @@
780 if (!nvp->value)697 if (!nvp->value)
781 goto next_iteration;698 goto next_iteration;
782 valsize = strlen(nvp->value);699 valsize = strlen(nvp->value);
783 if (valsize != ECRYPTFS_SALT_SIZE_HEX);700 if (valsize != ECRYPTFS_SALT_SIZE_HEX)
784 goto next_iteration;701 goto next_iteration;
785 memcpy(salt_hex, nvp->value, ECRYPTFS_SALT_SIZE_HEX);702 memcpy(salt_hex, nvp->value, ECRYPTFS_SALT_SIZE_HEX);
786 goto out_free;703 goto out_free;
@@ -917,7 +834,8 @@
917 ecryptfs_enable_echo(&current_settings);834 ecryptfs_enable_echo(&current_settings);
918 p = strrchr(passphrase, '\n');835 p = strrchr(passphrase, '\n');
919 if (p) *p = '\0';836 if (p) *p = '\0';
920 printf("\n");837 if (prompt != NULL)
838 printf("\n");
921 if (strlen(passphrase) > ECRYPTFS_MAX_PASSWORD_LENGTH) {839 if (strlen(passphrase) > ECRYPTFS_MAX_PASSWORD_LENGTH) {
922 fprintf(stderr,"Passphrase is too long. Use at most %u "840 fprintf(stderr,"Passphrase is too long. Use at most %u "
923 "characters long passphrase.\n",841 "characters long passphrase.\n",
@@ -927,3 +845,23 @@
927 }845 }
928 return passphrase;846 return passphrase;
929}847}
848
849char *ecryptfs_get_wrapped_passphrase_filename() {
850 struct passwd *pwd = NULL;
851 struct stat s;
852 char *filename = NULL;
853 if ((pwd = getpwuid(getuid())) == NULL) {
854 perror("getpwuid");
855 return NULL;
856 }
857 if ((asprintf(&filename,
858 "%s/.ecryptfs/wrapped-passphrase", pwd->pw_dir) < 0)) {
859 perror("asprintf");
860 return NULL;
861 }
862 if (stat(filename, &s) != 0) {
863 perror("stat");
864 return NULL;
865 }
866 return filename;
867}
930868
=== modified file 'src/libecryptfs/libecryptfs.pc.in'
--- src/libecryptfs/libecryptfs.pc.in 2009-02-03 08:50:36 +0000
+++ src/libecryptfs/libecryptfs.pc.in 2010-02-17 20:48:19 +0000
@@ -6,5 +6,5 @@
6Name: libecryptfs6Name: libecryptfs
7Description: eCryptfs library7Description: eCryptfs library
8Version: @PACKAGE_VERSION@8Version: @PACKAGE_VERSION@
9Cflags: -I${includedir} @LIBGCRYPT_CFLAGS@ @KEYUTILS_CFLAGS@9Cflags: -I${includedir} @KEYUTILS_CFLAGS@
10Libs: @LIBGCRYPT_LIBS@ @KEYUTILS_LIBS@ -L${libdir} -lecryptfs10Libs: @KEYUTILS_LIBS@ -L${libdir} -lecryptfs
1111
=== modified file 'src/libecryptfs/main.c'
--- src/libecryptfs/main.c 2009-02-09 15:33:25 +0000
+++ src/libecryptfs/main.c 2010-02-17 20:48:19 +0000
@@ -21,12 +21,8 @@
2121
22#include "config.h"22#include "config.h"
23#include <errno.h>23#include <errno.h>
24#ifdef ENABLE_NSS
25#include <nss.h>24#include <nss.h>
26#include <pk11func.h>25#include <pk11func.h>
27#else
28#include <gcrypt.h>
29#endif /* #ifdef ENABLE_NSS */
30#include <mntent.h>26#include <mntent.h>
31#ifndef S_SPLINT_S27#ifndef S_SPLINT_S
32#include <stdio.h>28#include <stdio.h>
@@ -37,9 +33,10 @@
37#include <signal.h>33#include <signal.h>
38#include <sys/mount.h>34#include <sys/mount.h>
39#include <getopt.h>35#include <getopt.h>
36#include <sys/types.h>
40#include <keyutils.h>37#include <keyutils.h>
41#include <sys/types.h>
42#include <sys/ipc.h>38#include <sys/ipc.h>
39#include <sys/param.h>
43#include <sys/shm.h>40#include <sys/shm.h>
44#include <sys/sem.h>41#include <sys/sem.h>
45#include "../include/ecryptfs.h"42#include "../include/ecryptfs.h"
@@ -77,16 +74,8 @@
7774
78int do_hash(char *src, int src_size, char *dst, int algo)75int do_hash(char *src, int src_size, char *dst, int algo)
79{76{
80#ifdef ENABLE_NSS
81 SECStatus err;77 SECStatus err;
82#else
83 gcry_md_hd_t hd;
84 gcry_error_t err = 0;
85 unsigned char * hash;
86 unsigned int mdlen;
87#endif /* #ifdef ENABLE_NSS */
8878
89#ifdef ENABLE_NSS
90 NSS_NoDB_Init(NULL);79 NSS_NoDB_Init(NULL);
91 err = PK11_HashBuf(algo, (unsigned char *)dst, (unsigned char *)src,80 err = PK11_HashBuf(algo, (unsigned char *)dst, (unsigned char *)src,
92 src_size);81 src_size);
@@ -97,23 +86,115 @@
97 err = -EINVAL;86 err = -EINVAL;
98 goto out;87 goto out;
99 }88 }
100#else
101 err = gcry_md_open(&hd, algo, 0);
102 mdlen = gcry_md_get_algo_dlen(algo);
103 if (err) {
104 syslog(LOG_ERR, "Failed to open hash algo [%d]: "
105 "[%d]\n", algo, err);
106 goto out;
107 }
108 gcry_md_write(hd, src, src_size);
109 hash = gcry_md_read(hd, algo);
110 memcpy(dst, hash, mdlen);
111 gcry_md_close(hd);
112#endif /* #ifdef ENABLE_NSS */
113out:89out:
114 return (int)err;90 return (int)err;
115}91}
11692
93/* Read ecryptfs private mount from file
94 * Allocate and return a string
95 */
96char *ecryptfs_fetch_private_mnt(char *pw_dir) {
97 char *mnt_file = NULL;
98 char *mnt_default = NULL;
99 char *mnt = NULL;
100 FILE *fh = NULL;
101 /* Construct mnt file name */
102 if (asprintf(&mnt_default, "%s/%s", pw_dir, ECRYPTFS_PRIVATE_DIR) < 0
103 || mnt_default == NULL) {
104 perror("asprintf");
105 return NULL;
106 }
107 if (
108 asprintf(&mnt_file, "%s/.ecryptfs/%s.mnt", pw_dir, ECRYPTFS_PRIVATE_DIR) < 0
109 || mnt_file == NULL) {
110 perror("asprintf");
111 return NULL;
112 }
113 fh = fopen(mnt_file, "r");
114 if (fh == NULL) {
115 mnt = mnt_default;
116 } else {
117 flockfile(fh);
118 if ((mnt = (char *)malloc(MAXPATHLEN+1)) == NULL) {
119 perror("malloc");
120 return NULL;
121 }
122 if (fgets(mnt, MAXPATHLEN, fh) == NULL) {
123 mnt = mnt_default;
124 } else {
125 /* Ensure that mnt doesn't contain newlines */
126 mnt = strtok(mnt, "\n");
127 }
128 fclose(fh);
129 }
130 if (mnt_file != NULL)
131 free(mnt_file);
132 if (mnt_default != NULL && mnt != mnt_default)
133 free(mnt_default);
134 return mnt;
135}
136
137
138/* Check if an ecryptfs private device or mount point is mounted.
139 * Return 1 if a filesystem in mtab matches dev && mnt && sig.
140 * Return 0 otherwise.
141 */
142int ecryptfs_private_is_mounted(char *dev, char *mnt, char *sig, int mounting) {
143 FILE *fh = NULL;
144 struct mntent *m = NULL;
145 char *opt = NULL;
146 int mounted;
147 if (asprintf(&opt, "ecryptfs_sig=%s", sig) < 0) {
148 perror("asprintf");
149 return 0;
150 }
151 fh = setmntent("/proc/mounts", "r");
152 if (fh == NULL) {
153 perror("setmntent");
154 return 0;
155 }
156 mounted = 0;
157 flockfile(fh);
158 while ((m = getmntent(fh)) != NULL) {
159 if (strcmp(m->mnt_type, "ecryptfs") != 0)
160 /* Skip if this entry is not an ecryptfs mount */
161 continue;
162 if (mounting == 1) {
163 /* If mounting, return "already mounted" if EITHER the
164 * dev or the mnt dir shows up in mtab/mounts;
165 * regardless of the signature of such mounts;
166 */
167 if (dev != NULL && strcmp(m->mnt_fsname, dev) == 0) {
168 mounted = 1;
169 break;
170 }
171 if (mnt != NULL && strcmp(m->mnt_dir, mnt) == 0) {
172 mounted = 1;
173 break;
174 }
175 } else {
176 /* Otherwise, we're unmounting, and we need to be
177 * very conservative in finding a perfect match
178 * to unmount. The device, mountpoint, and signature
179 * must *all* match perfectly.
180 */
181 if (
182 strcmp(m->mnt_fsname, dev) == 0 &&
183 strcmp(m->mnt_dir, mnt) == 0 &&
184 hasmntopt(m, opt) != NULL
185 ) {
186 mounted = 1;
187 break;
188 }
189 }
190 }
191 endmntent(fh);
192 if (opt != NULL)
193 free(opt);
194 return mounted;
195}
196
197
117/**198/**
118 * TODO: We need to support more hash algs199 * TODO: We need to support more hash algs
119 * @fekek: ECRYPTFS_MAX_KEY_BYTES bytes of allocated memory200 * @fekek: ECRYPTFS_MAX_KEY_BYTES bytes of allocated memory
@@ -133,11 +214,7 @@
133 char salt_and_passphrase[ECRYPTFS_MAX_PASSPHRASE_BYTES214 char salt_and_passphrase[ECRYPTFS_MAX_PASSPHRASE_BYTES
134 + ECRYPTFS_SALT_SIZE];215 + ECRYPTFS_SALT_SIZE];
135 int passphrase_size;216 int passphrase_size;
136#ifdef ENABLE_NSS
137 int alg = SEC_OID_SHA512;217 int alg = SEC_OID_SHA512;
138#else
139 int alg = GCRY_MD_SHA512;
140#endif /* #ifdef ENABLE_NSS */
141 int dig_len = SHA512_DIGEST_LENGTH;218 int dig_len = SHA512_DIGEST_LENGTH;
142 char buf[SHA512_DIGEST_LENGTH];219 char buf[SHA512_DIGEST_LENGTH];
143 int hash_iterations = ECRYPTFS_DEFAULT_NUM_HASH_ITERATIONS;220 int hash_iterations = ECRYPTFS_DEFAULT_NUM_HASH_ITERATIONS;
@@ -890,3 +967,4 @@
890{967{
891 return &ctx_ops;968 return &ctx_ops;
892}969}
970
893971
=== modified file 'src/libecryptfs/module_mgr.c'
--- src/libecryptfs/module_mgr.c 2009-04-21 17:59:16 +0000
+++ src/libecryptfs/module_mgr.c 2010-02-17 20:48:19 +0000
@@ -97,15 +97,20 @@
97 .trans_func = sig_param_node_callback}}97 .trans_func = sig_param_node_callback}}
98};98};
9999
100/* returns: 1 for str=="yes" or "y", 0 for "no" or "n", -1 elsewhere */100/* returns:
101static int is_yes(const char *str)101 * on_null for str == NULL
102 * 1 for str=="yes" or "y"
103 * 0 for str=="no" or "n"
104 * -1 elsewhere */
105static int is_yes(const char *str, int on_null)
102{106{
103 if (str) {107 if (str) {
104 if (!strcmp(str,"y") || !strcmp(str,"yes"))108 if (!strcmp(str,"y") || !strcmp(str,"yes"))
105 return 1;109 return 1;
106 if (!strcmp(str,"no") || !strcmp(str,"n"))110 if (!strcmp(str,"no") || !strcmp(str,"n"))
107 return 0;111 return 0;
108 }112 } else
113 return on_null;
109114
110 return -1;115 return -1;
111}116}
@@ -120,7 +125,7 @@
120{125{
121 int rc;126 int rc;
122127
123 if (((rc=is_yes(node->val)) == 1) || (node->flags & PARAMETER_SET)) {128 if (((rc=is_yes(node->val, 0)) == 1) || (node->flags & PARAMETER_SET)) {
124 rc = stack_push(head, opt_name);129 rc = stack_push(head, opt_name);
125 } else if (rc == -1)130 } else if (rc == -1)
126 rc = WRONG_VALUE;131 rc = WRONG_VALUE;
@@ -207,7 +212,7 @@
207static struct param_node filename_crypto_fnek_sig_param_node = {212static struct param_node filename_crypto_fnek_sig_param_node = {
208 .num_mnt_opt_names = 1,213 .num_mnt_opt_names = 1,
209 .mnt_opt_names = {"ecryptfs_fnek_sig"},214 .mnt_opt_names = {"ecryptfs_fnek_sig"},
210 .prompt = "Filname Encryption Key (FNEK) Signature",215 .prompt = "Filename Encryption Key (FNEK) Signature",
211 .val_type = VAL_STR,216 .val_type = VAL_STR,
212 .val = NULL,217 .val = NULL,
213 .display_opts = NULL,218 .display_opts = NULL,
@@ -227,7 +232,7 @@
227{232{
228 int yn, rc = 0;233 int yn, rc = 0;
229234
230 if (((yn=is_yes(node->val)) > 0)235 if (((yn=is_yes(node->val, 0)) > 0)
231 || (node->flags & PARAMETER_SET)) {236 || (node->flags & PARAMETER_SET)) {
232 int i;237 int i;
233 struct val_node *val_node;238 struct val_node *val_node;
@@ -407,6 +412,7 @@
407 {"twofish", 32, 2},412 {"twofish", 32, 2},
408 {"blowfish", 16, 1},413 {"blowfish", 16, 1},
409 {"blowfish", 32, 2},414 {"blowfish", 32, 2},
415 {"blowfish", 56, 2},
410 {"khazad", 16, 1},416 {"khazad", 16, 1},
411 {"arc4", 16, 1},417 {"arc4", 16, 1},
412 {"arc4", 32, 2},418 {"arc4", 32, 2},
@@ -432,15 +438,18 @@
432 return rc;438 return rc;
433}439}
434440
435static int init_ecryptfs_key_bytes_param_node(char *cipher_name)441static int init_ecryptfs_key_bytes_param_node(char *cipher_name,
442 int min, int max)
436{443{
437 int i;444 int i;
438 int rc = 0;445 int rc = 0;
439446
440 i = 0;447 i = 0;
441 while (supported_key_bytes[i].cipher_name) {448 while (supported_key_bytes[i].cipher_name) {
442 if (strcmp(cipher_name, supported_key_bytes[i].cipher_name)449 if ((supported_key_bytes[i].key_bytes >= min) &&
443 == 0) {450 (supported_key_bytes[i].key_bytes <= max) &&
451 (strcmp(cipher_name, supported_key_bytes[i].cipher_name)
452 == 0)) {
444 struct transition_node *tn;453 struct transition_node *tn;
445 454
446 tn = &ecryptfs_key_bytes_param_node.tl[455 tn = &ecryptfs_key_bytes_param_node.tl[
@@ -468,6 +477,11 @@
468 }477 }
469 i++;478 i++;
470 }479 }
480 if (ecryptfs_key_bytes_param_node.num_transitions == 0) {
481 syslog(LOG_ERR, "Error initializing key_bytes selection: "
482 "there is no posibility left for used params\n");
483 return -EINVAL;
484 }
471out:485out:
472 return rc;486 return rc;
473}487}
@@ -477,8 +491,40 @@
477{491{
478 char *opt;492 char *opt;
479 int rc;493 int rc;
480494 int min = 0, max = 999999;
481 rc = init_ecryptfs_key_bytes_param_node(node->val);495 struct val_node *tmp = *head, *tmpprev = NULL;
496
497 while (tmp) {
498 char *ptr;
499 int popval = 0;
500 if (tmp->val && (strstr(tmp->val,"max_key_bytes=") != NULL) &&
501 ((ptr=strchr(tmp->val,'=')) != NULL)) {
502 char *eptr;
503 max = strtol(++ptr, &eptr, 10);
504 if (eptr == ptr)
505 return -EINVAL;
506 popval = 1;
507 }
508 if (tmp->val && (strstr(tmp->val,"min_key_bytes=") != NULL) &&
509 ((ptr=strchr(tmp->val,'=')) != NULL)) {
510 char *eptr;
511 min = strtol(++ptr, &eptr, 10);
512 if (eptr == ptr)
513 return -EINVAL;
514 popval = 1;
515 }
516 if (popval) {
517 if (tmp == *head)
518 *head = (*head)->next;
519 stack_pop(&tmp);
520 if (tmpprev != NULL)
521 tmpprev->next = tmp;
522 }
523 tmpprev = tmp;
524 tmp = tmp->next;
525 }
526
527 rc = init_ecryptfs_key_bytes_param_node(node->val, min, max);
482 if (rc) {528 if (rc) {
483 syslog(LOG_ERR, "%s: Error initializing key_bytes param node; "529 syslog(LOG_ERR, "%s: Error initializing key_bytes param node; "
484 "rc = [%d]\n", __FUNCTION__, rc);530 "rc = [%d]\n", __FUNCTION__, rc);
485531
=== modified file 'src/pam_ecryptfs/Makefile.am'
--- src/pam_ecryptfs/Makefile.am 2009-02-03 08:50:36 +0000
+++ src/pam_ecryptfs/Makefile.am 2010-02-17 20:48:19 +0000
@@ -12,6 +12,6 @@
12endif12endif
1313
14pam_ecryptfs_la_SOURCES = pam_ecryptfs.c14pam_ecryptfs_la_SOURCES = pam_ecryptfs.c
15pam_ecryptfs_la_CFLAGS = $(AM_CFLAGS) $(LIBGCRYPT_CFLAGS)15pam_ecryptfs_la_CFLAGS = $(AM_CFLAGS)
16pam_ecryptfs_la_LIBADD = $(top_builddir)/src/libecryptfs/libecryptfs.la $(PAM_LIBS) $(LIBGCRYPT_LIBS)16pam_ecryptfs_la_LIBADD = $(top_builddir)/src/libecryptfs/libecryptfs.la $(PAM_LIBS)
17pam_ecryptfs_la_LDFLAGS = $(AM_LDFLAGS) -module -avoid-version -shared17pam_ecryptfs_la_LDFLAGS = $(AM_LDFLAGS) -module -avoid-version -shared
1818
=== modified file 'src/pam_ecryptfs/pam_ecryptfs.c'
--- src/pam_ecryptfs/pam_ecryptfs.c 2009-04-21 23:20:27 +0000
+++ src/pam_ecryptfs/pam_ecryptfs.c 2010-02-17 20:48:23 +0000
@@ -1,4 +1,5 @@
1/**1/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*-
2 *
2 * pam_ecryptfs.c: PAM module that sends the user's authentication3 * pam_ecryptfs.c: PAM module that sends the user's authentication
3 * tokens into the kernel keyring.4 * tokens into the kernel keyring.
4 *5 *
@@ -73,30 +74,48 @@
73 char *file_path;74 char *file_path;
74 int rc = 0;75 int rc = 0;
75 struct stat s;76 struct stat s;
76 if (asprintf(
77 &file_path, "%s/.ecryptfs/%s",
78 homedir,
79 ECRYPTFS_DEFAULT_WRAPPED_PASSPHRASE_FILENAME) == -1)
80 return -ENOMEM;
81 if (stat(file_path, &s) != 0) {
82 if (errno != ENOENT)
83 rc = -errno;
84 goto out;
85 }
86 free(file_path);
87 if (asprintf(&file_path, "%s/.ecryptfs/auto-mount", homedir) == -1)77 if (asprintf(&file_path, "%s/.ecryptfs/auto-mount", homedir) == -1)
88 return -ENOMEM;78 return -ENOMEM;
89 if (stat(file_path, &s) != 0) {79 if (stat(file_path, &s) != 0) {
90 if (errno != ENOENT)80 if (errno != ENOENT)
91 rc = -errno;81 rc = -errno;
92 goto out;82 goto out;
93 } 83 }
94 rc = 1;84 rc = 1;
95out:85out:
96 free(file_path);86 free(file_path);
97 return rc;87 return rc;
98}88}
9989
90static int wrap_passphrase_if_necessary(char *username, uid_t uid, char *wrapped_pw_filename, char *passphrase, char *salt)
91{
92 char *unwrapped_pw_filename = NULL;
93 struct stat s;
94 int rc = 0;
95
96 rc = asprintf(&unwrapped_pw_filename, "/dev/shm/.ecryptfs-%s", username);
97 if (rc == -1) {
98 syslog(LOG_ERR, "Unable to allocate memory\n");
99 return -ENOMEM;
100 }
101 /* If /dev/shm/.ecryptfs-$USER exists and owned by the user
102 and ~/.ecryptfs/wrapped-passphrase does not exist
103 and a passphrase is set:
104 wrap the unwrapped passphrase file */
105 if (stat(unwrapped_pw_filename, &s) == 0 && (s.st_uid == uid) &&
106 stat(wrapped_pw_filename, &s) != 0 &&
107 passphrase != NULL && *passphrase != '\0' &&
108 username != NULL && *username != '\0') {
109 setuid(uid);
110 rc = ecryptfs_wrap_passphrase_file(wrapped_pw_filename, passphrase, salt, unwrapped_pw_filename);
111 if (rc != 0) {
112 syslog(LOG_ERR, "Error wrapping cleartext password; " "rc = [%d]\n", rc);
113 }
114 return rc;
115 }
116 return 0;
117}
118
100PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,119PAM_EXTERN int pam_sm_authenticate(pam_handle_t *pamh, int flags, int argc,
101 const char **argv)120 const char **argv)
102{121{
@@ -108,8 +127,10 @@
108 char salt[ECRYPTFS_SALT_SIZE];127 char salt[ECRYPTFS_SALT_SIZE];
109 char salt_hex[ECRYPTFS_SALT_SIZE_HEX];128 char salt_hex[ECRYPTFS_SALT_SIZE_HEX];
110 char *auth_tok_sig;129 char *auth_tok_sig;
130 char *private_mnt = NULL;
111 pid_t child_pid, tmp_pid;131 pid_t child_pid, tmp_pid;
112 long rc;132 long rc;
133 uint32_t version;
113134
114 syslog(LOG_INFO, "%s: Called\n", __FUNCTION__);135 syslog(LOG_INFO, "%s: Called\n", __FUNCTION__);
115 rc = pam_get_user(pamh, &username, NULL);136 rc = pam_get_user(pamh, &username, NULL);
@@ -130,6 +151,18 @@
130 }151 }
131 if (!ecryptfs_pam_automount_set(homedir))152 if (!ecryptfs_pam_automount_set(homedir))
132 goto out;153 goto out;
154 private_mnt = ecryptfs_fetch_private_mnt(homedir);
155 if (ecryptfs_private_is_mounted(NULL, private_mnt, NULL, 1)) {
156 syslog(LOG_INFO, "%s: %s is already mounted\n", __FUNCTION__,
157 homedir);
158 /* If private/home is already mounted, then we can skip
159 costly loading of keys */
160 goto out;
161 }
162 /* we need side effect of this check:
163 load ecryptfs module if not loaded already */
164 if (ecryptfs_get_version(&version) != 0)
165 syslog(LOG_WARNING, "Can't check if kernel supports ecryptfs\n");
133 saved_uid = geteuid();166 saved_uid = geteuid();
134 seteuid(uid);167 seteuid(uid);
135 rc = pam_get_item(pamh, PAM_AUTHTOK, (const void **)&passphrase);168 rc = pam_get_item(pamh, PAM_AUTHTOK, (const void **)&passphrase);
@@ -147,7 +180,6 @@
147 }180 }
148 rc = ecryptfs_read_salt_hex_from_rc(salt_hex);181 rc = ecryptfs_read_salt_hex_from_rc(salt_hex);
149 if (rc) {182 if (rc) {
150 syslog(LOG_WARNING, "%s\n", ECRYPTFS_WARN_DEFAULT_SALT);
151 from_hex(salt, ECRYPTFS_DEFAULT_SALT_HEX, ECRYPTFS_SALT_SIZE);183 from_hex(salt, ECRYPTFS_DEFAULT_SALT_HEX, ECRYPTFS_SALT_SIZE);
152 } else184 } else
153 from_hex(salt, salt_hex, ECRYPTFS_SALT_SIZE);185 from_hex(salt, salt_hex, ECRYPTFS_SALT_SIZE);
@@ -166,7 +198,9 @@
166 if ((argc == 1)198 if ((argc == 1)
167 && (memcmp(argv[0], "unwrap\0", 7) == 0)) {199 && (memcmp(argv[0], "unwrap\0", 7) == 0)) {
168 char *wrapped_pw_filename;200 char *wrapped_pw_filename;
169 201 char *unwrapped_pw_filename;
202 struct stat s;
203
170 rc = asprintf(204 rc = asprintf(
171 &wrapped_pw_filename, "%s/.ecryptfs/%s",205 &wrapped_pw_filename, "%s/.ecryptfs/%s",
172 homedir,206 homedir,
@@ -176,6 +210,11 @@
176 rc = -ENOMEM;210 rc = -ENOMEM;
177 goto out_child;211 goto out_child;
178 }212 }
213 if (wrap_passphrase_if_necessary(username, uid, wrapped_pw_filename, passphrase, salt) == 0) {
214 syslog(LOG_INFO, "Passphrase file wrapped");
215 } else {
216 goto out_child;
217 }
179 rc = ecryptfs_insert_wrapped_passphrase_into_keyring(218 rc = ecryptfs_insert_wrapped_passphrase_into_keyring(
180 auth_tok_sig, wrapped_pw_filename, passphrase,219 auth_tok_sig, wrapped_pw_filename, passphrase,
181 salt);220 salt);
@@ -185,9 +224,6 @@
185 auth_tok_sig, passphrase, salt);224 auth_tok_sig, passphrase, salt);
186 }225 }
187 if (rc == 1) {226 if (rc == 1) {
188 syslog(LOG_WARNING, "There is already a key in the "
189 "user session keyring for the given "
190 "passphrase.\n");
191 goto out_child;227 goto out_child;
192 }228 }
193 if (rc) {229 if (rc) {
@@ -198,8 +234,8 @@
198 if (fork() == 0) {234 if (fork() == 0) {
199 if ((rc = ecryptfs_set_zombie_session_placeholder())) {235 if ((rc = ecryptfs_set_zombie_session_placeholder())) {
200 syslog(LOG_ERR, "Error attempting to create "236 syslog(LOG_ERR, "Error attempting to create "
201 "and register zombie process; "237 "and register zombie process; "
202 "rc = [%ld]\n", rc);238 "rc = [%ld]\n", rc);
203 }239 }
204 }240 }
205out_child:241out_child:
@@ -211,6 +247,8 @@
211 syslog(LOG_WARNING,247 syslog(LOG_WARNING,
212 "waitpid() returned with error condition\n");248 "waitpid() returned with error condition\n");
213out:249out:
250 if (private_mnt != NULL)
251 free(private_mnt);
214 return PAM_SUCCESS;252 return PAM_SUCCESS;
215}253}
216254
@@ -272,7 +310,7 @@
272 return 1;310 return 1;
273 }311 }
274 if (312 if (
275 (asprintf(&sigfile, "%s/.ecryptfs/%s.sig", pwd->pw_dir, 313 (asprintf(&sigfile, "%s/.ecryptfs/%s.sig", pwd->pw_dir,
276 PRIVATE_DIR) < 0) || sigfile == NULL) {314 PRIVATE_DIR) < 0) || sigfile == NULL) {
277 syslog(LOG_ERR, "Error allocating memory for sigfile name");315 syslog(LOG_ERR, "Error allocating memory for sigfile name");
278 return 1;316 return 1;
@@ -288,7 +326,7 @@
288 if ((pid = fork()) < 0) {326 if ((pid = fork()) < 0) {
289 syslog(LOG_ERR, "Error setting up private mount");327 syslog(LOG_ERR, "Error setting up private mount");
290 return 1;328 return 1;
291 } 329 }
292 if (pid == 0) {330 if (pid == 0) {
293 if (mount == 1) {331 if (mount == 1) {
294 if ((asprintf(&recorded,332 if ((asprintf(&recorded,
@@ -313,7 +351,7 @@
313 }351 }
314 /* run mount.ecryptfs_private as the user */352 /* run mount.ecryptfs_private as the user */
315 setresuid(pwd->pw_uid, pwd->pw_uid, pwd->pw_uid);353 setresuid(pwd->pw_uid, pwd->pw_uid, pwd->pw_uid);
316 execl("/sbin/mount.ecryptfs_private", 354 execl("/sbin/mount.ecryptfs_private",
317 "mount.ecryptfs_private", NULL);355 "mount.ecryptfs_private", NULL);
318 } else {356 } else {
319 if (stat(autofile, &s) != 0) {357 if (stat(autofile, &s) != 0) {
@@ -324,14 +362,12 @@
324 }362 }
325 /* run umount.ecryptfs_private as the user */363 /* run umount.ecryptfs_private as the user */
326 setresuid(pwd->pw_uid, pwd->pw_uid, pwd->pw_uid);364 setresuid(pwd->pw_uid, pwd->pw_uid, pwd->pw_uid);
327 execl("/sbin/umount.ecryptfs_private", 365 execl("/sbin/umount.ecryptfs_private",
328 "umount.ecryptfs_private", NULL);366 "umount.ecryptfs_private", NULL);
329 }367 }
330 return 1;368 return 1;
331 } else {369 } else {
332 waitpid(pid, &rc, 0);370 waitpid(pid, &rc, 0);
333 syslog(LOG_INFO,
334 "Mount of private directory return code [%d]", rc);
335 goto out;371 goto out;
336 }372 }
337out:373out:
@@ -374,12 +410,10 @@
374 char *old_passphrase = NULL;410 char *old_passphrase = NULL;
375 char *new_passphrase = NULL;411 char *new_passphrase = NULL;
376 char *wrapped_pw_filename;412 char *wrapped_pw_filename;
377 char *unwrapped_pw_filename;
378 char *name = NULL;413 char *name = NULL;
379 char salt[ECRYPTFS_SALT_SIZE];414 char salt[ECRYPTFS_SALT_SIZE];
380 char salt_hex[ECRYPTFS_SALT_SIZE_HEX];415 char salt_hex[ECRYPTFS_SALT_SIZE_HEX];
381 pid_t child_pid, tmp_pid;416 pid_t child_pid, tmp_pid;
382 struct stat s;
383 int rc = PAM_SUCCESS;417 int rc = PAM_SUCCESS;
384418
385 rc = pam_get_user(pamh, &username, NULL);419 rc = pam_get_user(pamh, &username, NULL);
@@ -434,36 +468,17 @@
434 rc = -ENOMEM;468 rc = -ENOMEM;
435 goto out;469 goto out;
436 }470 }
437 rc = asprintf(&unwrapped_pw_filename, "/dev/shm/.ecryptfs-%s", name);
438 if (rc == -1) {
439 syslog(LOG_ERR, "Unable to allocate memory\n");
440 rc = -ENOMEM;
441 goto out;
442 }
443 if ((rc = ecryptfs_read_salt_hex_from_rc(salt_hex))) {471 if ((rc = ecryptfs_read_salt_hex_from_rc(salt_hex))) {
444 syslog(LOG_WARNING, "%s\n", ECRYPTFS_WARN_DEFAULT_SALT);
445 from_hex(salt, ECRYPTFS_DEFAULT_SALT_HEX, ECRYPTFS_SALT_SIZE);472 from_hex(salt, ECRYPTFS_DEFAULT_SALT_HEX, ECRYPTFS_SALT_SIZE);
446 } else {473 } else {
447 from_hex(salt, salt_hex, ECRYPTFS_SALT_SIZE);474 from_hex(salt, salt_hex, ECRYPTFS_SALT_SIZE);
448 }475 }
449 /* If /dev/shm/.ecryptfs-$USER exists and owned by the user476 if (wrap_passphrase_if_necessary(username, uid, wrapped_pw_filename, new_passphrase, salt) == 0) {
450 and ~/.ecryptfs/wrapped-passphrase does not exist477 syslog(LOG_INFO, "Passphrase file wrapped");
451 and a new_passphrase is set:478 } else {
452 wrap the unwrapped passphrase file */
453 if (stat(unwrapped_pw_filename, &s) == 0 && (s.st_uid == uid) &&
454 stat(wrapped_pw_filename, &s) != 0 &&
455 new_passphrase != NULL && *new_passphrase != '\0' &&
456 name != NULL && *name != '\0') {
457 setuid(uid);
458 rc = ecryptfs_wrap_passphrase_file(wrapped_pw_filename,
459 new_passphrase, salt, unwrapped_pw_filename);
460 if (rc != 0) {
461 syslog(LOG_ERR,
462 "Error wrapping cleartext password; "
463 "rc = [%d]\n", rc);
464 }
465 goto out;479 goto out;
466 }480 }
481
467 seteuid(saved_uid);482 seteuid(saved_uid);
468 if (!old_passphrase || !new_passphrase || *new_passphrase == '\0') {483 if (!old_passphrase || !new_passphrase || *new_passphrase == '\0') {
469 syslog(LOG_WARNING, "eCryptfs PAM passphrase change module "484 syslog(LOG_WARNING, "eCryptfs PAM passphrase change module "
470485
=== added directory 'src/python'
=== added file 'src/python/__init__.py'
=== added file 'src/python/ecryptfsapi.py'
--- src/python/ecryptfsapi.py 1970-01-01 00:00:00 +0000
+++ src/python/ecryptfsapi.py 2010-02-17 20:48:23 +0000
@@ -0,0 +1,82 @@
1#!/usr/bin/env python
2#
3# ecryptfsapi.py, Copyright 2008, 2009 Michael Rooney <mrooney@ubuntu.com>
4# Date: 2009-05-28
5# Version: 0.4
6#
7# This is a python API for interacting with ecryptfs-utils and its
8# encrypted directories.
9#
10# This program is free software: you can redistribute it and/or modify
11# it under the terms of the GNU General Public License as published by
12# the Free Software Foundation, either version 3 of the License, or
13# (at your option) any later version.
14#
15# This program is distributed in the hope that it will be useful,
16# but WITHOUT ANY WARRANTY; without even the implied warranty of
17# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18# GNU General Public License for more details.
19#
20# You should have received a copy of the GNU General Public License
21# along with this program. If not, see <http://www.gnu.org/licenses/>.
22
23import commands, os
24
25AUTOMOUNT_FILE = os.path.expanduser("~/.ecryptfs/auto-mount")
26AUTOUMOUNT_FILE = os.path.expanduser("~/.ecryptfs/auto-umount")
27PRIVATE_LOCATION_FILE = os.path.expanduser("~/.ecryptfs/Private.mnt")
28PRIVATE_LOCATION = os.path.exists(PRIVATE_LOCATION_FILE) and open(PRIVATE_LOCATION_FILE).read().strip()
29
30def set_automount(doAuto):
31 """Enable or disable automounting for this user."""
32 if doAuto:
33 command = "touch %s" % AUTOMOUNT_FILE
34 #open(AUTOMOUNT_FILE, "w")
35 else:
36 command = "rm %s" % AUTOMOUNT_FILE
37 #os.remove(AUTOMOUNT_FILE)
38
39 return commands.getstatusoutput(command)
40
41def get_automount():
42 """Return whether or not automounting is enabled for this user."""
43 return os.path.exists(AUTOMOUNT_FILE)
44
45def set_autounmount(doAuto):
46 """Enable or disable automounting for this user."""
47 if doAuto:
48 command = "touch %s" % AUTOUMOUNT_FILE
49 else:
50 command = "rm %s" % AUTOUMOUNT_FILE
51
52 return commands.getstatusoutput(command)
53
54def get_autounmount():
55 """Return whether or not autounmounting is enabled for this user."""
56 return os.path.exists(AUTOUMOUNT_FILE)
57
58def set_mounted(doMount):
59 """Set the mounted (unencrypted) state of ~/Private."""
60 if doMount:
61 command = "/sbin/mount.ecryptfs_private"
62 else:
63 command = "/sbin/umount.ecryptfs_private"
64
65 return commands.getstatusoutput(command)
66
67def get_mounted():
68 """Return whether or not ~/Private is mounted (unencrypted)."""
69 if PRIVATE_LOCATION:
70 mounts = open("/proc/mounts").read()
71 return PRIVATE_LOCATION in mounts
72 else:
73 return False
74
75def needs_setup():
76 """
77 Return whether or not an encrypted directory has been set up by ecryptfs
78 for this user, either Home or Private.
79 """
80 encryptedHome = False #TODO: implement
81 encryptedPrivate = PRIVATE_LOCATION
82 return not (encryptedHome or encryptedPrivate)
083
=== modified file 'src/utils/Makefile.am'
--- src/utils/Makefile.am 2009-04-21 23:36:43 +0000
+++ src/utils/Makefile.am 2010-02-17 20:48:23 +0000
@@ -1,6 +1,6 @@
1MAINTAINERCLEANFILES = $(srcdir)/Makefile.in1MAINTAINERCLEANFILES = $(srcdir)/Makefile.in
22
3EXTRA_DIST=ecryptfsrc ecryptfs-rewrite-file ecryptfs-setup-private ecryptfs-setup-swap ecryptfs-mount-private ecryptfs-umount-private ecryptfs-dot-private3EXTRA_DIST=ecryptfsrc ecryptfs-rewrite-file ecryptfs-setup-private ecryptfs-setup-swap ecryptfs-mount-private ecryptfs-umount-private ecryptfs-migrate-home
44
5rootsbin_PROGRAMS=mount.ecryptfs \5rootsbin_PROGRAMS=mount.ecryptfs \
6 umount.ecryptfs \6 umount.ecryptfs \
@@ -16,7 +16,8 @@
16 ecryptfs-mount-private \16 ecryptfs-mount-private \
17 ecryptfs-umount-private \17 ecryptfs-umount-private \
18 ecryptfs-rewrite-file \18 ecryptfs-rewrite-file \
19 ecryptfs-dot-private19 ecryptfs-migrate-home
20bin2dir = $(bindir)
2021
21noinst_PROGRAMS=test22noinst_PROGRAMS=test
2223
@@ -55,7 +56,7 @@
55ecryptfs_generate_tpm_key_LDADD = $(TSPI_LIBS)56ecryptfs_generate_tpm_key_LDADD = $(TSPI_LIBS)
5657
57mount_ecryptfs_private_SOURCES = mount.ecryptfs_private.c58mount_ecryptfs_private_SOURCES = mount.ecryptfs_private.c
58mount_ecryptfs_private_LDADD = $(KEYUTILS_LIBS)59mount_ecryptfs_private_LDADD = $(top_builddir)/src/libecryptfs/libecryptfs.la $(KEYUTILS_LIBS)
5960
60ecryptfs_stat_SOURCES = ecryptfs-stat.c61ecryptfs_stat_SOURCES = ecryptfs-stat.c
61ecryptfs_stat_LDADD = $(top_builddir)/src/libecryptfs/libecryptfs.la62ecryptfs_stat_LDADD = $(top_builddir)/src/libecryptfs/libecryptfs.la
6263
=== removed file 'src/utils/ecryptfs-dot-private'
--- src/utils/ecryptfs-dot-private 2009-04-08 22:36:45 +0000
+++ src/utils/ecryptfs-dot-private 1970-01-01 00:00:00 +0000
@@ -1,34 +0,0 @@
1#!/bin/sh -e
2#
3# ecryptfs-dot-private
4# Copyright (C) 2009 Canonical Ltd.
5#
6# Authors: Dustin Kirkland <kirkland@canonical.com>
7#
8# This program is free software: you can redistribute it and/or modify
9# it under the terms of the GNU General Public License as published by
10# the Free Software Foundation, version 2 of the License.
11#
12# This program is distributed in the hope that it will be useful,
13# but WITHOUT ANY WARRANTY; without even the implied warranty of
14# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15# GNU General Public License for more details.
16#
17# You should have received a copy of the GNU General Public License
18
19if echo "$0" | grep -qs "ecryptfs"; then
20 echo "ERROR: This file must be sourced, rather than executed:"
21 echo
22 echo " . $0"
23 echo
24 exit 1
25fi
26
27# Hacky, umount.ecryptfs_private should be taught to exit 1 on
28# unsuccessful unmount, must check who else depends on this exit code.
29if /sbin/umount.ecryptfs_private | grep -v "Sessions still open"; then
30 cd "$HOME"/.Private
31else
32 echo "ERROR: Unable to access .Private, please close some sessions"
33fi
34/sbin/mount.ecryptfs_private
350
=== added file 'src/utils/ecryptfs-migrate-home'
--- src/utils/ecryptfs-migrate-home 1970-01-01 00:00:00 +0000
+++ src/utils/ecryptfs-migrate-home 2010-02-17 20:48:23 +0000
@@ -0,0 +1,195 @@
1#!/bin/sh
2# -*- sh-basic-offset: 4; sh-indentation: 4; tab-width: 4; indent-tabs-mode: t; sh-indent-comment: t; -*-
3# This script encrypts an user's home
4#
5# Written by Yan Li <yan.i.li@intel.com>, <yanli@gnome.org>
6# Copyright (C) 2010 Intel Corporation
7#
8# Modified by Dustin Kirkland <kirkland@canonical.com>
9#
10# This program is free software; you can redistribute it and/or
11# modify it under the terms of the GNU General Public License as
12# published by the Free Software Foundation; either version 2 of the
13# License, or (at your option) any later version.
14#
15# This program is distributed in the hope that it will be useful, but
16# WITHOUT ANY WARRANTY; without even the implied warranty of
17# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18# General Public License for more details.
19#
20# You should have received a copy of the GNU General Public License
21# along with this program; if not, write to the Free Software
22# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
23# 02111-1307, USA.
24
25set -e
26
27PRIVATE_DIR="Private"
28
29usage() {
30 echo "
31Usage:
32
33$0 -u USER
34
35 -u,--user Migrate USER's home directory to an encrypted home directory
36
37WARNING: Make a complete backup copy of the non-encrypted data to
38another system or external media. This script is dangerous and, in
39case of an error, could result in data lost, or lock you out of your
40system!
41
42This program must be executed by root.
43
44"
45 exit 1
46}
47
48error() {
49 echo "$(gettext 'ERROR: ')" "$@" 1>&2
50 exit 1
51}
52
53warning() {
54 echo "$(gettext 'WARNING: ')" "$@" 1>&2
55}
56
57info() {
58 echo "$(gettext 'INFO: ')" "$@" 1>&2
59}
60
61assert_dir_empty() {
62 local DIR="$1"
63 if [ -e "$DIR" ]; then
64 # if $DIR is a directory, make sure it's empty
65 if [ -d "$DIR" ]; then
66 ls=$(ls -A "$DIR" | wc -l)
67 if [ "$ls" != "0" ]; then
68 echo 1>&2 "If you already have some data in directory $DIR,"
69 echo 1>&2 "please move all of these files and directories out of the way, and"
70 echo 1>&2 "follow the instructions in:"
71 echo 1>&2 " ecryptfs-setup-private --undo"
72 echo 1>&2
73 error "$DIR is not empty, cannot continue."
74 fi
75 else
76 error "$DIR exists but is not an empty directory, cannot continue."
77 fi
78 fi
79}
80
81# get user home by username
82get_user_home () {
83 local USER_NAME="$1"
84 local USER_HOME=$(grep "^$USER_NAME:" /etc/passwd | cut -d":" -f 6)
85 if [ -z "$USER_HOME" ]; then
86 error "Cannot find the home directory of $USER_NAME."
87 fi
88 echo "$USER_HOME"
89}
90
91sanity_check () {
92 local USER_NAME="$1"
93 local USER_HOME="$2"
94 if [ -e "$USER_HOME/.ecryptfs" ]; then
95 error "$USER_HOME appears to be encrypted already."
96 fi
97 # Check for rsync
98 if ! which rsync >/dev/null 2>&1; then
99 error "Please install the rsync package."
100 fi
101 # Check free space: make sure we have sufficient disk space
102 # available. To make a full copy, we will need at least 2.5x the
103 # disk usage of the target home directory.
104 info "Checking disk space, this may take a few moments. Please be patient."
105 needed=$(du -s "$USER_HOME" | awk '{printf "%.0f", $1*2.5}')
106 free=$(df -P "$USER_HOME" | tail -n 1 | awk '{print $4}')
107 if [ $needed -gt $free ]; then
108 info "2.5x the size your current home directory is required to perform a migration."
109 info "Once the migration succeeds, you may recover most of this space by deleting the cleartext directory."
110 error "Not enough free disk space."
111 fi
112 assert_dir_empty "$USER_HOME/.$PRIVATE_DIR"
113 assert_dir_empty "$USER_HOME/.ecryptfs"
114 assert_dir_empty "/home/.ecryptfs/$USER_NAME"
115}
116
117encrypt_dir () {
118 local USER_NAME="$1"
119 local USER_HOME="$2"
120 if ! which lsof >/dev/null 2>&1; then
121 info "Please install lsof."
122 error "Can not tell whether $USER_HOME is in use or not."
123 fi
124 info "Checking for open files in $USER_HOME"
125 lsof=$(lsof +D "$USER_HOME" | wc -l)
126 if [ "$lsof" != "0" ]; then
127 info "The following files are in use:"
128 echo
129 lsof +D "$USER_HOME" | sed "s/^/ /"
130 echo
131 error "Cannot proceed."
132 fi
133 # start encryption
134 orig=$(mktemp /home/$USER_NAME.XXXXXXXX)
135 rm "$orig" && mv "$USER_HOME" "$orig"
136 chmod 700 "$orig"
137 mkdir -p -m 700 "$USER_HOME"
138 USER_GROUP=$(id -g "$USER_NAME")
139 chown "$USER_NAME:$USER_GROUP" "$USER_HOME" "$orig"
140 ECRYPTFS_SETUP_PRIVATE_ARGS=""
141 if [ -n "$LOGINPASS" ]; then
142 ECRYPTFS_SETUP_PRIVATE_ARGS="-l $LOGINPASS"
143 fi
144 if [ -n "$MOUNTPASS" ]; then
145 ECRYPTFS_SETUP_PRIVATE_ARGS="$ECRYPTFS_SETUP_PRIVATE_ARGS -m $MOUNTPASS"
146 fi
147 if ! ecryptfs-setup-private -u "$USER_NAME" -b $ECRYPTFS_SETUP_PRIVATE_ARGS; then
148 # too bad, something went wrong, we'll try to recover
149 rm -rf "$USER_HOME"
150 mv "$orig" "$USER_HOME"
151 exit 1
152 fi
153 info "Encrypted home has been set up, encrypting files now...this may take a while."
154 rsync -a "$orig/" "$USER_HOME/"
155 umount "$USER_HOME/"
156 echo
157 info "======================================================================"
158 info "The file encryption appears to have completed successfully, however,"
159 info "$USER_NAME MUST LOGIN IMMEDIATELY (BEFORE THE NEXT REBOOT) TO COMPLETE THE MIGRATION!!!"
160 info "======================================================================"
161 echo
162 info "If $USER_NAME can log in and read and write their files, then the migration is complete, and you should remove $orig."
163 echo
164 info "Otherwise, remove $USER_HOME and move $orig back to $USER_HOME."
165 echo
166}
167
168DO_ENCRYPT=
169while true; do
170 [ -z "$1" ] && break
171 case "$1" in
172 -u|--user)
173 DO_ENCRYPT=1
174 USER_NAME="$2"
175 shift 2
176 ;;
177 *)
178 usage
179 ;;
180 esac
181done
182
183if [ "$DO_ENCRYPT" != "1" ]; then
184 usage
185fi
186
187if [ "$(id -u)" != "0" ]; then
188 error "This program must be executed with root privileges"
189fi
190
191if [ "$DO_ENCRYPT" = "1" ]; then
192 USER_HOME=$(get_user_home "$USER_NAME")
193 sanity_check "$USER_NAME" "$USER_HOME"
194 encrypt_dir "$USER_NAME" "$USER_HOME" "$LOGINPASS" "$MOUNTPASS"
195fi
0196
=== modified file 'src/utils/ecryptfs-mount-private'
--- src/utils/ecryptfs-mount-private 2009-03-20 21:44:01 +0000
+++ src/utils/ecryptfs-mount-private 2010-02-17 20:48:23 +0000
@@ -15,12 +15,13 @@
15PRIVATE_DIR="Private"15PRIVATE_DIR="Private"
16WRAPPING_PASS="LOGIN"16WRAPPING_PASS="LOGIN"
17PW_ATTEMPTS=317PW_ATTEMPTS=3
18MESSAGE="Enter your login passphrase: "18TEXTDOMAIN="ecryptfs-utils"
19MESSAGE=`gettext "Enter your login passphrase:"`
1920
20if [ -f $HOME/.ecryptfs/wrapping-independent ]; then21if [ -f $HOME/.ecryptfs/wrapping-independent ]; then
21 # use a wrapping passphrase different from the login passphrase22 # use a wrapping passphrase different from the login passphrase
22 WRAPPING_PASS="INDEPENDENT"23 WRAPPING_PASS="INDEPENDENT"
23 MESSAGE="Enter your wrapping passphrase: "24 MESSAGE=`gettext "Enter your wrapping passphrase:"`
24fi25fi
2526
26WRAPPED_PASSPHRASE_FILE="$HOME/.ecryptfs/wrapped-passphrase"27WRAPPED_PASSPHRASE_FILE="$HOME/.ecryptfs/wrapped-passphrase"
@@ -45,24 +46,24 @@
45 if printf "%s\0" "$LOGINPASS" | ecryptfs-insert-wrapped-passphrase-into-keyring "$WRAPPED_PASSPHRASE_FILE" - ; then46 if printf "%s\0" "$LOGINPASS" | ecryptfs-insert-wrapped-passphrase-into-keyring "$WRAPPED_PASSPHRASE_FILE" - ; then
46 break47 break
47 else48 else
48 echo "ERROR: Your passphrase is incorrect"49 echo `gettext "ERROR:"` `gettext "Your passphrase is incorrect"`
49 tries=$(($tries + 1))50 tries=$(($tries + 1))
50 continue51 continue
51 fi52 fi
52 done53 done
53 if [ $tries -ge $PW_ATTEMPTS ]; then54 if [ $tries -ge $PW_ATTEMPTS ]; then
54 echo "ERROR: Too many incorrect password attempts, exiting"55 echo `gettext "ERROR:"` `gettext "Too many incorrect password attempts, exiting"`
55 exit 156 exit 1
56 fi57 fi
57 /sbin/mount.ecryptfs_private58 /sbin/mount.ecryptfs_private
58else59else
59 echo "ERROR: Encrypted $PRIVATE_DIR is not setup properly"60 echo `gettext "ERROR:"` `gettext "Encrypted private directory is not setup properly"`
60 exit 161 exit 1
61fi62fi
62if grep -qs "$HOME/.Private $PWD ecryptfs " /proc/mounts 2>/dev/null; then63if grep -qs "$HOME/.Private $PWD ecryptfs " /proc/mounts 2>/dev/null; then
63 echo64 echo
64 echo "INFO: Your private directory has been mounted."65 echo `gettext "INFO:"` `gettext "Your private directory has been mounted."`
65 echo "INFO: To see this change in your current shell:"66 echo `gettext "INFO:"` `gettext "To see this change in your current shell:"`
66 echo " cd $PWD"67 echo " cd $PWD"
67 echo68 echo
68fi69fi
6970
=== modified file 'src/utils/ecryptfs-rewrite-file'
--- src/utils/ecryptfs-rewrite-file 2009-03-20 22:11:25 +0000
+++ src/utils/ecryptfs-rewrite-file 2010-02-17 20:48:23 +0000
@@ -17,45 +17,59 @@
17# You should have received a copy of the GNU General Public License17# You should have received a copy of the GNU General Public License
18# along with this program. If not, see <http://www.gnu.org/licenses/>.18# along with this program. If not, see <http://www.gnu.org/licenses/>.
1919
20TEXTDOMAIN="ecryptfs-utils"
21
20error() {22error() {
21 echo23 echo `gettext "[FAILED]"`
22 echo "ERROR: $1" 1>&224 echo `gettext "ERROR:"` "$1" 1>&2
23}25}
24j=026j=0
27OKs=0
25for i in "$@"; do28for i in "$@"; do
26 [ "$i" = "." ] && continue
27 j=`expr $j + 1`29 j=`expr $j + 1`
28 echo -n "INFO: Rewriting [$j/$#] [$i] ... "30 echo -n `gettext "INFO:"` `gettext "Rewriting"` "[$j/$#] [$i] ... "
31 if [ ! -e "$i" ] ; then
32 error `gettext "File does not exist"`
33 continue
34 fi
35 if [ "$i" = "." ]; then
36 echo `gettext "[EXCLUDED]"` >&2
37 continue
38 fi
29 opt=39 opt=
30 if [ -d "$i" -a ! -h "$i" ]; then40 if [ -d "$i" -a ! -h "$i" ]; then
31 # A directory, re-encrypt the filename41 # A directory, re-encrypt the filename
32 temp1=`mktemp -d "$i".XXXXXXXXXX` || {42 temp1=`mktemp -d "$i".XXXXXXXXXX` || {
33 error "Could not create tempdir"43 error `gettext "Could not create tempdir"`
34 continue44 continue
35 }45 }
36 mv -f -T "$i" "$temp1" || {46 mv -f -T "$i" "$temp1" 2>/dev/null || {
37 error "Could not rename [$i] to [$temp1]"47 error `gettext "Could not rename"` "[$i] -> [$temp1]"
38 rmdir "$temp1"48 rmdir "$temp1"
39 continue49 continue
40 }50 }
41 mv -f "$temp1" "$i" || {51 mv -f "$temp1" "$i" 2>/dev/null || {
42 error "Could not rename [$temp1] to [$i]"52 error `gettext "Could not rename"` "[$temp1] -> [$i]"
43 }53 }
44 else54 else
45 # A file or symlink, re-encrypt the contents55 # A file or symlink, re-encrypt the contents
46 temp1=`mktemp "$i".XXXXXXXXXX` || {56 temp1=`mktemp "$i".XXXXXXXXXX` || {
47 error "Could not create tempfile"57 error `gettext "Could not create tempfile"`
48 continue58 continue
49 }59 }
50 cp -a "$i" "$temp1" || {60 cp -a "$i" "$temp1" 2>/dev/null || {
51 error "Could not copy [$i] to [$temp1]"61 error `gettext "Could not copy"` "[$i] -> [$temp1]"
52 rm -f "$temp1"62 rm -f "$temp1"
53 continue63 continue
54 }64 }
55 mv -f "$temp1" "$i" || {65 mv -f "$temp1" "$i" 2>/dev/null || {
56 error "Could not rename [$temp1] to [$i]"66 error `gettext "Could not rename"` "[$temp1] -> [$i]"
67 continue
57 }68 }
58 fi69 fi
59 echo "[OK]"70 echo `gettext "[OK]"`
71 OKs=$((OKs+1))
60done72done
73echo "$OKs/$j" `gettext "rewrites succeeded"`
74[ $OKs -ne $j ] && exit 1
61exit 075exit 0
6276
=== modified file 'src/utils/ecryptfs-setup-private'
--- src/utils/ecryptfs-setup-private 2009-03-24 19:38:23 +0000
+++ src/utils/ecryptfs-setup-private 2010-02-17 20:48:23 +0000
@@ -8,8 +8,10 @@
8# Copyright (C) 2007-2008 International Business Machines8# Copyright (C) 2007-2008 International Business Machines
9PRIVATE_DIR="Private"9PRIVATE_DIR="Private"
10WRAPPING_PASS="LOGIN"10WRAPPING_PASS="LOGIN"
11ECRYPTFS_DIR="/home/.ecryptfs"
11PW_ATTEMPTS=312PW_ATTEMPTS=3
12MESSAGE="Enter your login passphrase"13TEXTDOMAIN="ecryptfs-utils"
14MESSAGE="$(gettext 'Enter your login passphrase')"
13CIPHER="aes"15CIPHER="aes"
14KEYBYTES="16"16KEYBYTES="16"
15FNEK=17FNEK=
@@ -18,42 +20,43 @@
18GREP_OPTIONS=20GREP_OPTIONS=
1921
20usage() {22usage() {
21 echo23 echo "
22 echo "Usage:"24Usage:
23 echo " $0 [-f|--force] [-w|--wrapping] [--nopwcheck] [-n|--no-fnek]"25
24 echo " [-u|--username USER] [-l|--loginpass LOGINPASS]"26$0 [-f|--force] [-w|--wrapping] [--nopwcheck] [-n|--no-fnek]
25 echo " [-m|--mountpass MOUNTPASS]"27 [-u|--username USER] [-l|--loginpass LOGINPASS]
26 echo28 [-m|--mountpass MOUNTPASS]
27 echo " -f, --force Force overwriting of an existing setup"29
28 echo " -w, --wrapping Use an independent wrapping passphrase,"30 -f, --force Force overwriting of an existing setup
29 echo " different from the login passphrase"31 -w, --wrapping Use an independent wrapping passphrase,
30 echo " -n, --no-fnek Do not encrypt filenames; If this flag is"32 different from the login passphrase
31 echo " omitted, and the kernel supports filename"33 -n, --no-fnek Do not encrypt filenames; If this flag is
32 echo " encryption, then filenames will be encrypted"34 omitted, and the kernel supports filename
33 echo " -u, --username Username for encrypted private mountpoint,"35 encryption, then filenames will be encrypted
34 echo " defaults to yourself"36 -u, --username Username for encrypted private mountpoint,
35 echo " -l, --loginpass Login/Wrapping passphrase for USER,"37 defaults to yourself
36 echo " used to wrap MOUNTPASS"38 -l, --loginpass Login/Wrapping passphrase for USER,
37 echo " --nopwcheck Do not check the validity of the specified"39 used to wrap MOUNTPASS
38 echo " login password (useful for LDAP user accounts)"40 --nopwcheck Do not check the validity of the specified
39 echo " --noautomount Setup this user such that the encrypted private"41 login password (useful for LDAP user accounts)
40 echo " directory is not automatically mounted on login"42 --noautomount Setup this user such that the encrypted private
41 echo " --noautoumount Setup this user such that the encrypted private"43 directory is not automatically mounted on login
42 echo " directory is not automatically unmounted at"44 --noautoumount Setup this user such that the encrypted private
43 echo " logout"45 directory is not automatically unmounted at
44 echo " -m, --mountpass Passphrase for mounting the ecryptfs directory,"46 logout
45 echo " defaults to randomly generated $KEYBYTES bytes"47 -m, --mountpass Passphrase for mounting the ecryptfs directory,
46 echo " -b, --bootstrap Bootstrap a new user's entire home directory"48 defaults to randomly generated $KEYBYTES bytes
47 echo " Generates a random mount passphrase, which"49 -b, --bootstrap Bootstrap a new user's entire home directory
48 echo " will be wrapped when the new login passphrase"50 Generates a random mount passphrase, which
49 echo " is set. SHOULD ONLY BE CALLED FROM 'adduser'."51 will be wrapped when the new login passphrase
50 echo " --undo Provide instructions on how to undo an"52 is set. SHOULD ONLY BE CALLED FROM 'adduser'.
51 echo " encrypted private setup"53 --undo Provide instructions on how to undo an
52 echo54 encrypted private setup
53 echo " Be sure to properly escape your parameters according to your"55
54 echo " shell's special character nuances, and also surround the"56 Be sure to properly escape your parameters according to your
55 echo " parameters by double quotes, if necessary."57 shell's special character nuances, and also surround the
56 echo58 parameters by double quotes, if necessary.
59"
57 exit 160 exit 1
58}61}
5962
@@ -63,7 +66,7 @@
63you will need to very carefully perform the following actions manually:66you will need to very carefully perform the following actions manually:
6467
65 1. Obtain your Private directory mountpoint68 1. Obtain your Private directory mountpoint
66 $ PRIVATE=\`cat ~/.ecryptfs/Private.mnt 2>/dev/null || echo \$HOME/Private\`69 $ PRIVATE=\`cat ~/.ecryptfs/Private.mnt 2>/dev/null || echo \$HOME/$PRIVATE_DIR\`
67 2. Ensure that you have moved all relevant data out of your \$PRIVATE directory70 2. Ensure that you have moved all relevant data out of your \$PRIVATE directory
68 3. Unmount your encrypted private directory71 3. Unmount your encrypted private directory
69 $ ecryptfs-umount-private72 $ ecryptfs-umount-private
@@ -78,14 +81,15 @@
78}81}
7982
80error() {83error() {
81 echo "ERROR: $1" 1>&284 echo "$(gettext 'ERROR: ')" "$@" 1>&2
82 exit 185 exit 1
83}86}
8487
85error_testing() {88error_testing() {
86 rm -f "$1" >/dev/null89 rm -f "$1" >/dev/null
90 shift
87 /sbin/umount.ecryptfs_private >/dev/null91 /sbin/umount.ecryptfs_private >/dev/null
88 error "$2"92 error "$@"
89 exit 193 exit 1
90}94}
9195
@@ -98,7 +102,7 @@
98102
99filename_encryption_available() {103filename_encryption_available() {
100 version=$(cat /sys/fs/ecryptfs/version 2>/dev/null)104 version=$(cat /sys/fs/ecryptfs/version 2>/dev/null)
101 [ -z "$version" ] && error "Can't get ecryptfs version, ecryptfs kernel module not loaded?"105 [ -z "$version" ] && error "$(gettext 'Cannot get ecryptfs version, ecryptfs kernel module not loaded?')"
102 [ $(($version & 0x100)) -eq 0 ] && return 1106 [ $(($version & 0x100)) -eq 0 ] && return 1
103 return 0107 return 0
104}108}
@@ -125,7 +129,7 @@
125 ;;129 ;;
126 -w|--wrapping)130 -w|--wrapping)
127 WRAPPING_PASS="INDEPENDENT"131 WRAPPING_PASS="INDEPENDENT"
128 MESSAGE="Enter your wrapping passphrase"132 MESSAGE="$(gettext 'Enter your wrapping passphrase')"
129 shift 1133 shift 1
130 ;;134 ;;
131 -f|--force)135 -f|--force)
@@ -149,7 +153,7 @@
149 exit 0153 exit 0
150 ;;154 ;;
151 -b|--bootstrap)155 -b|--bootstrap)
152 [ `whoami` = "root" ] || error "You must be root to bootstrap encrypt a home directory"156 [ `whoami` = "root" ] || error "$(gettext 'You must be root to bootstrap encrypt a home directory')"
153 BOOTSTRAP=1157 BOOTSTRAP=1
154 MOUNTPASS=`random_passphrase $KEYBYTES`158 MOUNTPASS=`random_passphrase $KEYBYTES`
155 RANDOM_MOUNTPASS=1159 RANDOM_MOUNTPASS=1
@@ -168,16 +172,16 @@
168# Prompt for the USER name, if not on the command line and not in the env172# Prompt for the USER name, if not on the command line and not in the env
169if [ -z "$USER" ]; then173if [ -z "$USER" ]; then
170 while [ true ]; do174 while [ true ]; do
171 echo -n "Enter the username: "175 echo -n "$(gettext 'Enter the username: ')"
172 USER=`head -n1`176 USER=`head -n1`
173 echo177 echo
174 if [ -z "$USER" ]; then178 if [ -z "$USER" ]; then
175 echo "ERROR: You must provide a username"179 echo "$(gettext 'ERROR: ')" "$(gettext 'You must provide a username')"
176 continue180 continue
177 else181 else
178 # Verify that the user exists182 # Verify that the user exists
179 if ! id "$USER" >/dev/null; then183 if ! id "$USER" >/dev/null; then
180 echo "ERROR: User [$USER] does not exist"184 echo "$(gettext 'ERROR: ')" "$(gettext 'User does not exist')" " [$USER]"
181 continue185 continue
182 fi186 fi
183 break187 break
@@ -185,49 +189,61 @@
185 done189 done
186else190else
187 # Verify that the user exists191 # Verify that the user exists
188 id "$USER" >/dev/null || error "User [$USER] does not exist"192 id "$USER" >/dev/null || error "$(gettext 'User does not exist')" "[$USER]"
193fi
194
195# Obtain USER's primary group
196GROUP=$(id -g $USER)
197
198# Check if the ecryptfs group exists, and user is member of ecryptfs group
199if grep -qs "^ecryptfs:" /etc/group; then
200 if ! id "$USER" | grep -qs "\(ecryptfs\)"; then
201 error "$(gettext 'User needs to be a member of ecryptfs group')"
202 fi
189fi203fi
190204
191# Obtain the user's home directory205# Obtain the user's home directory
192HOME=`getent passwd "$USER" | awk -F: '{print $6}'`206HOME=`getent passwd "$USER" | awk -F: '{print $6}'`
193if [ ! -d "$HOME" ]; then207if [ ! -d "$HOME" ]; then
194 error "User home directory [$HOME] does not exist"208 error "$(gettext 'User home directory does not exist')" "[$HOME]"
195fi209fi
196210
197if [ "$BOOTSTRAP" = "1" ]; then211if [ "$BOOTSTRAP" = "1" ]; then
198 # If we want to encrypt the entire homedir, we need the .ecryptfs212 # If we want to encrypt the entire homedir, we need the .ecryptfs
199 # config dir elsewhere, but linked into the homedir213 # config dir elsewhere, but linked into the homedir
200 mkdir -p -m 700 /var/lib/ecryptfs/$USER214 mkdir -p -m 700 $ECRYPTFS_DIR/$USER/.ecryptfs
201 ln -sf /var/lib/ecryptfs/$USER $HOME/.ecryptfs215 ln -sf $ECRYPTFS_DIR/$USER/.ecryptfs $HOME/.ecryptfs
216 ln -sf $ECRYPTFS_DIR/$USER/.$PRIVATE_DIR $HOME/.$PRIVATE_DIR
202 MOUNTPOINT="$HOME"217 MOUNTPOINT="$HOME"
218 CRYPTDIR="$ECRYPTFS_DIR/$USER/.$PRIVATE_DIR"
203else219else
204 mkdir -m 700 $HOME/.ecryptfs220 mkdir -m 700 $HOME/.ecryptfs
205 MOUNTPOINT="$HOME/$PRIVATE_DIR"221 MOUNTPOINT="$HOME/$PRIVATE_DIR"
222 CRYPTDIR="$HOME/.$PRIVATE_DIR"
206fi223fi
207224
208# Check for previously setup private directory225# Check for previously setup private directory
209if [ -s "$HOME/.ecryptfs/wrapped-passphrase" -a "$FORCE" != "1" ]; then226if [ -s "$HOME/.ecryptfs/wrapped-passphrase" -a "$FORCE" != "1" ]; then
210 error "wrapped-passphrase file already exists, use --force to overwrite."227 error "$(gettext 'wrapped-passphrase file already exists, use --force to overwrite.')"
211fi228fi
212if [ -s "$HOME/.ecryptfs/$PRIVATE_DIR.sig" -a "$FORCE" != "1" ]; then229if [ -s "$HOME/.ecryptfs/$PRIVATE_DIR.sig" -a "$FORCE" != "1" ]; then
213 error "$PRIVATE_DIR.sig file already exists, use --force to overwrite."230 error "$PRIVATE_DIR.sig" "$(gettext 'file already exists, use --force to overwrite.')"
214fi231fi
215232
216# Check for active mounts233# Check for active mounts
217CRYPTDIR="$HOME/.$PRIVATE_DIR"234grep -qs "$MOUNTPOINT " /proc/mounts && error "[$MOUNTPOINT]" "$(gettext 'is already mounted')"
218grep -qs "$MOUNTPOINT " /proc/mounts && error "[$MOUNTPOINT] is already mounted"235grep -qs "$CRYPTDIR " /proc/mounts && error "[$CRYPTDIR]" "$(gettext 'is already mounted')"
219grep -qs "$CRYPTDIR " /proc/mounts && error "[$CRYPTDIR] is already mounted"
220236
221# Check that the mount point and encrypted directory are empty (skip symlinks).237# Check that the mount point and encrypted directory are empty (skip symlinks).
222# Perhaps one day we could provide a migration mode (using rsync or something),238# Perhaps one day we could provide a migration mode (using rsync or something),
223# but this would be VERY hard to do safely.239# but this would be VERY hard to do safely.
224count=`ls -Al "$MOUNTPOINT" 2>/dev/null | egrep -c "^[drwx-]{10}"`240count=`ls -Al "$MOUNTPOINT" 2>/dev/null | egrep -c "^[drwx-]{10}"`
225if [ "$count" != "0" ]; then241if [ "$count" != "0" ]; then
226 error "$MOUNTPOINT must be empty before proceeding"242 error "$MOUNTPOINT" "$(gettext 'must be empty before proceeding')"
227fi243fi
228count=`ls -Al "$CRYPTDIR" 2>/dev/null | egrep -c "^[dlrwx-]{10}"`244count=`ls -Al "$CRYPTDIR" 2>/dev/null | egrep -c "^[dlrwx-]{10}"`
229if [ "$count" != "0" ]; then245if [ "$count" != "0" ]; then
230 error "$CRYPTDIR must be empty before proceeding"246 error "$CRYPTDIR" "$(gettext 'must be empty before proceeding')"
231fi247fi
232248
233stty_orig=`stty -g`249stty_orig=`stty -g`
@@ -240,14 +256,16 @@
240 LOGINPASS=`head -n1`256 LOGINPASS=`head -n1`
241 stty $stty_orig257 stty $stty_orig
242 echo258 echo
243 if [ $WRAPPING_PASS != "LOGIN" ]; then259 if [ $WRAPPING_PASS != "LOGIN" -o ! -x /sbin/unix_chkpwd ]; then
260 # If we can't check the accuracy of the user's entered
261 # passphrase, force them to type it twice (matching)
244 stty -echo262 stty -echo
245 echo -n "$MESSAGE (again): "263 echo -n "$MESSAGE (again): "
246 LOGINPASS2=`head -n1`264 LOGINPASS2=`head -n1`
247 stty $stty_orig265 stty $stty_orig
248 echo266 echo
249 if [ "$LOGINPASS" != "$LOGINPASS2" ]; then267 if [ "$LOGINPASS" != "$LOGINPASS2" ]; then
250 echo "ERROR: Wrapping passphrases must match"268 echo "$(gettext 'ERROR: ')" "$(gettext 'Wrapping passphrases must match')"
251 else269 else
252 break270 break
253 fi271 fi
@@ -255,25 +273,24 @@
255 continue273 continue
256 fi274 fi
257 if [ -z "$LOGINPASS" ]; then275 if [ -z "$LOGINPASS" ]; then
258 echo "ERROR: You must provide a login passphrase"276 echo "$(gettext 'ERROR: ')" "$(gettext 'You must provide a login passphrase')"
259 tries=$(($tries + 1))277 tries=$(($tries + 1))
260 else278 else
261 if [ "$NOPWCHECK" = "1" ]; then279 if [ "$NOPWCHECK" = "1" ]; then
262 echo "INFO: Skipping password verification"280 echo "$(gettext 'INFO:')" "$(gettext 'Skipping password verification')"
263 break281 break
264 else282 else
265 if printf "%s\0" "$LOGINPASS" | /sbin/unix_chkpwd "$USER" nullok; then283 if printf "%s\0" "$LOGINPASS" | /sbin/unix_chkpwd "$USER" nullok; then
266 break284 break
267 else285 else
268 echo "ERROR: Your login passphrase is incorrect"286 echo "$(gettext 'ERROR: ')" "$(gettext 'Your login passphrase is incorrect')"
269 tries=$(($tries + 1))287 tries=$(($tries + 1))
270 fi288 fi
271 fi289 fi
272 fi290 fi
273 done291 done
274 if [ $tries -ge $PW_ATTEMPTS ]; then292 if [ $tries -ge $PW_ATTEMPTS ]; then
275 echo "ERROR: Too many incorrect password attempts, exiting"293 error "$(gettext 'Too many incorrect password attempts, exiting')"
276 exit 1
277 fi294 fi
278fi295fi
279296
@@ -282,7 +299,7 @@
282 tries=0299 tries=0
283 while [ $tries -lt $PW_ATTEMPTS ]; do300 while [ $tries -lt $PW_ATTEMPTS ]; do
284 stty -echo301 stty -echo
285 echo -n "Enter your mount passphrase [leave blank to generate one]: "302 echo -n "$(gettext 'Enter your mount passphrase [leave blank to generate one]: ')"
286 MOUNTPASS=`head -n1`303 MOUNTPASS=`head -n1`
287 stty $stty_orig304 stty $stty_orig
288 echo305 echo
@@ -292,12 +309,12 @@
292 break309 break
293 else310 else
294 stty -echo311 stty -echo
295 echo -n "Enter your mount passphrase (again): "312 echo -n "$(gettext 'Enter your mount passphrase (again): ')"
296 MOUNTPASS2=`head -n1`313 MOUNTPASS2=`head -n1`
297 stty $stty_orig314 stty $stty_orig
298 echo315 echo
299 if [ "$MOUNTPASS" != "$MOUNTPASS2" ]; then316 if [ "$MOUNTPASS" != "$MOUNTPASS2" ]; then
300 echo "ERROR: Mount passphrases do not match"317 echo "$(gettext 'ERROR: ')" "$(gettext 'Mount passphrases do not match')"
301 tries=$(($tries + 1))318 tries=$(($tries + 1))
302 else319 else
303 break320 break
@@ -305,58 +322,43 @@
305 fi322 fi
306 done323 done
307 if [ $tries -ge $PW_ATTEMPTS ]; then324 if [ $tries -ge $PW_ATTEMPTS ]; then
308 echo "ERROR: Too many incorrect passphrase attempts, exiting"325 error "$(gettext 'Too many incorrect passphrase attempts, exiting')"
309 exit 1
310 fi326 fi
311fi327fi
312328
313#echo
314#echo "Using username [$USER]"
315#echo "Using mount passphrase [$MOUNTPASS]"
316#echo "Using login passphrase [$LOGINPASS]"
317#echo "Using mount point [$MOUNTPOINT]"
318#echo "Using encrypted dir [$CRYPTDIR]"
319#echo
320#echo "This script will attempt to set up your system to mount"
321#echo "$MOUNTPOINT with eCryptfs automatically on login,"
322#echo "using your login passphrase."
323echo329echo
324echo "************************************************************************"330echo "************************************************************************"
325if [ "$RANDOM_MOUNTPASS" = "1" ]; then331echo "$(gettext 'YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IT IN A SAFE LOCATION.')"
326 echo "YOU SHOULD RECORD THIS MOUNT PASSPHRASE AND STORE IN A SAFE LOCATION:"332echo " ecryptfs-unwrap-passphrase ~/.ecryptfs/wrapped-passphrase"
327 echo "$MOUNTPASS"333echo "$(gettext 'THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME.')"
328else
329 echo "YOU SHOULD RECORD YOUR MOUNT PASSPHRASE AND STORE IN A SAFE LOCATION:"
330fi
331echo "THIS WILL BE REQUIRED IF YOU NEED TO RECOVER YOUR DATA AT A LATER TIME."
332echo "************************************************************************"334echo "************************************************************************"
333echo335echo
334336
335###############################################################################337###############################################################################
336338
337# Setup private directory in home339# Setup private directory in home
338mkdir -m 700 -p "$CRYPTDIR" || error "Could not create crypt directory [$CRYPTDIR]"340mkdir -m 700 -p "$CRYPTDIR" || error "$(gettext 'Could not create crypt directory')" "[$CRYPTDIR]"
339mkdir -m 700 -p "$MOUNTPOINT" || error "Could not create mount directory [$MOUNTPOINT]"341mkdir -m 700 -p "$MOUNTPOINT" || error "$(gettext 'Could not create mount directory')" "[$MOUNTPOINT]"
340ln -sf /usr/share/ecryptfs-utils/ecryptfs-mount-private.txt "$MOUNTPOINT"/README.txt342ln -sf /usr/share/ecryptfs-utils/ecryptfs-mount-private.txt "$MOUNTPOINT"/README.txt
341ln -sf /usr/share/ecryptfs-utils/ecryptfs-mount-private.desktop "$MOUNTPOINT"/Access-Your-Private-Data.desktop343ln -sf /usr/share/ecryptfs-utils/ecryptfs-mount-private.desktop "$MOUNTPOINT"/Access-Your-Private-Data.desktop
342chmod 500 "$MOUNTPOINT"344chmod 500 "$MOUNTPOINT"
343345
344# Setup ~/.ecryptfs directory346# Setup ~/.ecryptfs directory
345if [ "$NOAUTOMOUNT" = "1" ]; then347if [ "$NOAUTOMOUNT" = "1" ]; then
346 echo "INFO: $HOME/$PRIVATE_DIR will not be mounted on login"348 echo "$(gettext 'INFO:')" "$HOME/$PRIVATE_DIR" "$(gettext 'will not be mounted on login')"
347else349else
348 touch $HOME/.ecryptfs/auto-mount || error "Could not setup ecryptfs auto-mount"350 touch $HOME/.ecryptfs/auto-mount || error "$(gettext 'Could not setup ecryptfs auto-mount')"
349fi351fi
350if [ "$NOAUTOUMOUNT" = "1" ]; then352if [ "$NOAUTOUMOUNT" = "1" ]; then
351 echo "INFO: $HOME/$PRIVATE_DIR will not be unmounted on logout"353 echo "$(gettext 'INFO:')" "$HOME/$PRIVATE_DIR" "$(gettext 'will not be unmounted on logout')"
352else354else
353 touch $HOME/.ecryptfs/auto-umount || error "Could not setup ecryptfs auto-umount"355 touch $HOME/.ecryptfs/auto-umount || error "$(gettext 'Could not setup ecryptfs auto-umount')"
354fi356fi
355357
356if [ "$WRAPPING_PASS" = "LOGIN" ]; then358if [ "$WRAPPING_PASS" = "LOGIN" ]; then
357 rm -f $HOME/.ecryptfs/wrapping-independent || error "Could not remove ecryptfs wrapping-independent"359 rm -f $HOME/.ecryptfs/wrapping-independent || error "$(gettext 'Could not remove ecryptfs wrapping-independent')"
358else360else
359 touch $HOME/.ecryptfs/wrapping-independent || error "Could not setup ecryptfs wrapping-independent"361 touch $HOME/.ecryptfs/wrapping-independent || error "$(gettext 'Could not setup ecryptfs wrapping-independent')"
360fi362fi
361363
362364
@@ -364,7 +366,7 @@
364timestamp=`date +%Y%m%d%H%M%S`366timestamp=`date +%Y%m%d%H%M%S`
365for i in "$HOME/.ecryptfs/wrapped-passphrase" "$HOME/.ecryptfs/$PRIVATE_DIR.sig"; do367for i in "$HOME/.ecryptfs/wrapped-passphrase" "$HOME/.ecryptfs/$PRIVATE_DIR.sig"; do
366 if [ -s "$i" ]; then368 if [ -s "$i" ]; then
367 mv -f "$i" "$i.$timestamp" || error "Could not backup existing data [$i]"369 mv -f "$i" "$i.$timestamp" || error "(gettext 'Could not backup existing data')" "[$i]"
368 fi370 fi
369done371done
370372
@@ -380,7 +382,7 @@
380 printf "%s" "$MOUNTPASS" > "$temp"382 printf "%s" "$MOUNTPASS" > "$temp"
381 mv "$temp" "/dev/shm/.ecryptfs-$USER"383 mv "$temp" "/dev/shm/.ecryptfs-$USER"
382else384else
383 printf "%s\n%s" "$MOUNTPASS" "$LOGINPASS" | ecryptfs-wrap-passphrase "$HOME/.ecryptfs/wrapped-passphrase" - || error "Could not wrap passphrase"385 printf "%s\n%s" "$MOUNTPASS" "$LOGINPASS" | ecryptfs-wrap-passphrase "$HOME/.ecryptfs/wrapped-passphrase" - || error "$(gettext 'Could not wrap passphrase')"
384fi386fi
385umask $u387umask $u
386388
@@ -388,21 +390,21 @@
388# On subsequent logins, this should be handled by "pam_ecryptfs.so unwrap"390# On subsequent logins, this should be handled by "pam_ecryptfs.so unwrap"
389response=`printf "%s" "$MOUNTPASS" | ecryptfs-add-passphrase $FNEK -`391response=`printf "%s" "$MOUNTPASS" | ecryptfs-add-passphrase $FNEK -`
390if [ $? -ne 0 ]; then392if [ $? -ne 0 ]; then
391 error "Could not add passphrase to the current keyring"393 error "$(gettext 'Could not add passphrase to the current keyring')"
392fi394fi
393sig=`echo "$response" | grep "Inserted auth tok" | sed "s/^.*\[//" | sed "s/\].*$//"`395sig=`echo "$response" | grep "Inserted auth tok" | sed "s/^.*\[//" | sed "s/\].*$//"`
394if ! echo "$sig" | egrep -qs "^[0-9a-fA-F]{$KEYBYTES,$KEYBYTES}$"; then396if ! echo "$sig" | egrep -qs "^[0-9a-fA-F]{$KEYBYTES,$KEYBYTES}$"; then
395 error "Could not obtain the key signature"397 error "$(gettext 'Could not obtain the key signature')"
396fi398fi
397temp=`mktemp`399temp=`mktemp`
398echo "$sig" > "$temp" || error "Could not create signature file [$HOME/.ecryptfs/$PRIVATE_DIR.sig]"400echo "$sig" > "$temp" || error "$(gettext 'Could not create signature file')" "[$HOME/.ecryptfs/$PRIVATE_DIR.sig]"
399mv "$temp" "$HOME/.ecryptfs/$PRIVATE_DIR.sig"401mv "$temp" "$HOME/.ecryptfs/$PRIVATE_DIR.sig"
400temp=`mktemp`402temp=`mktemp`
401echo "$MOUNTPOINT" > "$temp" || error "Could not create mountpoint file [$HOME/.ecryptfs/$PRIVATE_DIR.mnt]"403echo "$MOUNTPOINT" > "$temp" || error "$(gettext 'Could not create mountpoint file')" "[$HOME/.ecryptfs/$PRIVATE_DIR.mnt]"
402mv "$temp" "$HOME/.ecryptfs/$PRIVATE_DIR.mnt"404mv "$temp" "$HOME/.ecryptfs/$PRIVATE_DIR.mnt"
403405
404echo406echo
405echo "Done configuring."407echo "$(gettext 'Done configuring.')"
406echo408echo
407409
408# Skip the tests if we're in bootstrap mode, but exit with the encrypted410# Skip the tests if we're in bootstrap mode, but exit with the encrypted
@@ -412,7 +414,9 @@
412 # and the calling 'adduser' is about to copy over /etc/skel414 # and the calling 'adduser' is about to copy over /etc/skel
413 # NOTE: it is the responsibility of 'adduser' to unmount!415 # NOTE: it is the responsibility of 'adduser' to unmount!
414 # And ensure that $USER owns the files/dirs we've created as root416 # And ensure that $USER owns the files/dirs we've created as root
415 chown $USER:$USER "$CRYPTDIR" /dev/shm/.ecryptfs-$USER417 chown $USER:$GROUP "$CRYPTDIR" /dev/shm/.ecryptfs-$USER
418 chown -R $USER:$GROUP $ECRYPTFS_DIR/$USER
419 chown -R $USER:$GROUP $MOUNTPOINT
416 if [ "$FNEK" = "--fnek" ]; then420 if [ "$FNEK" = "--fnek" ]; then
417 fnek_sig=`tail -n 1 "$HOME/.ecryptfs/$PRIVATE_DIR.sig"`421 fnek_sig=`tail -n 1 "$HOME/.ecryptfs/$PRIVATE_DIR.sig"`
418 sig=`head -n 1 "$HOME/.ecryptfs/$PRIVATE_DIR.sig"`422 sig=`head -n 1 "$HOME/.ecryptfs/$PRIVATE_DIR.sig"`
@@ -420,42 +424,37 @@
420 else424 else
421 sig_opt="ecryptfs_sig=$sig"425 sig_opt="ecryptfs_sig=$sig"
422 fi426 fi
427 # Do the mount, and provide some helpful symlinks
423 mount -i -t ecryptfs -o "rw,$sig_opt,ecryptfs_cipher=$CIPHER,ecryptfs_key_bytes=$KEYBYTES" "$CRYPTDIR" "$MOUNTPOINT" || error "Could not mount"428 mount -i -t ecryptfs -o "rw,$sig_opt,ecryptfs_cipher=$CIPHER,ecryptfs_key_bytes=$KEYBYTES" "$CRYPTDIR" "$MOUNTPOINT" || error "Could not mount"
424 ln -sf /var/lib/ecryptfs/$USER $MOUNTPOINT/.ecryptfs429 ln -sf $ECRYPTFS_DIR/$USER/.ecryptfs $MOUNTPOINT/.ecryptfs
425 for i in auto-mount \430 ln -sf $ECRYPTFS_DIR/$USER/.$PRIVATE_DIR $MOUNTPOINT/.$PRIVATE_DIR
426 auto-umount \431 chown -R $USER:$GROUP $ECRYPTFS_DIR/$USER
427 $PRIVATE_DIR.mnt \432 chown -R $USER:$GROUP $MOUNTPOINT
428 $PRIVATE_DIR.sig \
429 wrapped-passphrase;
430 do
431 [ -e $HOME/.ecryptfs/$i ] && chown $USER:$USER $MOUNTPOINT/.ecryptfs/$i
432 done
433 chown $USER:$USER /var/lib/ecryptfs/$USER
434 chown -h $USER:$USER $MOUNTPOINT/.ecryptfs
435 exit 0433 exit 0
436fi434fi
437435
438# Now let's perform some basic mount/write/umount/read sanity testing...436# Now let's perform some basic mount/write/umount/read sanity testing...
439echo "Testing mount/write/umount/read..."437echo "$(gettext 'Testing mount/write/umount/read...')"
440/sbin/mount.ecryptfs_private || error "Could not mount private ecryptfs directory"438/sbin/mount.ecryptfs_private || error "$(gettext 'Could not mount private ecryptfs directory')"
441temp=`mktemp "$MOUNTPOINT/ecryptfs.test.XXXXXX"` || error_testing "$temp" "Could not create empty file"439temp=`mktemp "$MOUNTPOINT/ecryptfs.test.XXXXXX"` || error_testing "$temp" "$(gettext 'Could not create empty file')"
442random_data=`head -c 16000 /dev/urandom | od -x` || error_testing "$temp" "Could not generate random data"440random_data=`head -c 16000 /dev/urandom | od -x` || error_testing "$temp" "$(gettext 'Could not generate random data')"
443echo "$random_data" > "$temp" || error_testing "$temp" "Could not write encrypted file"441echo "$random_data" > "$temp" || error_testing "$temp" "$(gettext 'Could not write encrypted file')"
444md5sum1=`md5sum "$temp"` || error_testing "$temp" "Could not read encrypted file"442md5sum1=`md5sum "$temp"` || error_testing "$temp" "$(gettext 'Could not read encrypted file')"
445/sbin/umount.ecryptfs_private || error_testing "$temp" "Could not unmount private ecryptfs directory"443/sbin/umount.ecryptfs_private || error_testing "$temp" "$(gettext 'Could not unmount private ecryptfs directory')"
446/sbin/mount.ecryptfs_private || error_testing "$temp" "Could not mount private ecryptfs directory (2)"444/sbin/mount.ecryptfs_private || error_testing "$temp" "$(gettext 'Could not mount private ecryptfs directory (2)')"
447md5sum2=`md5sum "$temp"` || error_testing "$temp" "Could not read encrypted file (2)"445md5sum2=`md5sum "$temp"` || error_testing "$temp" "$(gettext 'Could not read encrypted file (2)')"
448rm -f "$temp"446rm -f "$temp"
449# Use ecryptfs-umount-private on the final run, to clear the used keys447# Use ecryptfs-umount-private on the final run, to clear the used keys
450# out of the keyring448# out of the keyring
451ecryptfs-umount-private || error_testing "$temp" "Could not unmount private ecryptfs directory (2)"449ecryptfs-umount-private || error_testing "$temp" "$(gettext 'Could not unmount private ecryptfs directory (2)')"
452if [ "$md5sum1" != "$md5sum2" ]; then450if [ "$md5sum1" != "$md5sum2" ]; then
453 error "Testing failed."451 error "$(gettext 'Testing failed.')"
454else452else
455 echo "Testing succeeded."453 echo "$(gettext 'Testing succeeded.')"
456fi454fi
457455
458echo456echo
459echo "Logout, and log back in to begin using your encrypted directory."457echo "$(gettext 'Logout, and log back in to begin using your encrypted directory.')"
460echo458echo
459
461exit 0460exit 0
462461
=== modified file 'src/utils/ecryptfs-setup-swap'
--- src/utils/ecryptfs-setup-swap 2009-03-20 21:44:01 +0000
+++ src/utils/ecryptfs-setup-swap 2010-02-17 20:48:23 +0000
@@ -19,23 +19,25 @@
19# The cryptswap setup used here follows a guide published at:19# The cryptswap setup used here follows a guide published at:
20# * http://ubuntumagnet.com/2007/11/creating-encrypted-swap-file-ubuntu-using-cryptsetup20# * http://ubuntumagnet.com/2007/11/creating-encrypted-swap-file-ubuntu-using-cryptsetup
2121
22TEXTDOMAIN="ecryptfs-utils"
23
22error() {24error() {
23 echo "ERROR: $1" 1>&225 echo `gettext "ERROR:"` "$@" 1>&2
24 exit 126 exit 1
25}27}
2628
27info() {29info() {
28 echo "INFO: $1"30 echo `gettext "INFO:"` "$@"
29}31}
3032
31warning() {33warn() {
32 echo "WARNING: "34 echo `gettext "WARNING:"` "$@" 1>&2
33}35}
3436
35usage() {37usage() {
36 echo38 echo
37 echo "Usage:"39 echo `gettext "Usage:"`
38 echo " $0 [-f|--force]"40 echo " $0 [-f|--force] [-n|--no-reload]"
39 echo41 echo
40 exit 142 exit 1
41}43}
@@ -48,6 +50,10 @@
48 FORCE=150 FORCE=1
49 shift 151 shift 1
50 ;;52 ;;
53 -n|--no-reload)
54 NO_RELOAD=1
55 shift 1
56 ;;
51 *)57 *)
52 usage58 usage
53 ;;59 ;;
@@ -55,94 +61,83 @@
55done61done
5662
57# Ensure that cryptsetup is available63# Ensure that cryptsetup is available
58[ -x /sbin/cryptsetup ] || error "Please install 'cryptsetup'"64[ -x /sbin/cryptsetup ] || error `gettext "Please install"` "'cryptsetup'"
5965
60# Ensure that we're running with root privileges66# Ensure that we're running with root privileges
61[ -w /etc/passwd ] || error "This program must be run with 'sudo', or as root"67[ -w /etc/passwd ] || error `gettext "This program must be run with 'sudo', or as root"`
6268
63# Count swap spaces available69# Count swap spaces available
64# BUG: We only support setting up a single swap space at this time
65if [ $(grep -c "^/" /proc/swaps) -eq 0 ]; then70if [ $(grep -c "^/" /proc/swaps) -eq 0 ]; then
66 mem=$(grep "^MemTotal:" /proc/meminfo | awk '{print $2}')71 mem=$(grep "^MemTotal:" /proc/meminfo | awk '{print $2}')
67 swapsize=$((4*$mem))72 swapsize=$((4*$mem))
68 info "You do not currently have any swap space defined."73 info "You do not currently have any swap space defined."
69 echo74 echo
70 echo "You can create a swap file by doing:"75 echo `gettext "You can create a swap file by doing:"`
71 echo " $ sudo dd if=/dev/zero of=/swapfile count=$swapsize"76 echo " $ sudo dd if=/dev/zero of=/swapfile count=$swapsize"
72 echo " $ sudo mkswap /swapfile"77 echo " $ sudo mkswap /swapfile"
73 echo " $ sudo swapon /swapfile"78 echo " $ sudo swapon /swapfile"
74 echo79 echo
75 echo "And then re-run $0"80 echo `gettext "And then re-run"` "$0"
76 echo81 echo
77 exit 082 exit 0
78elif [ $(grep -c "^/" /proc/swaps) -gt 1 ]; then83fi
79 info "You have more than one swap space defined."84
80 error "$0 only supports setting up a single swap space"85swaps=$(grep "^/" /proc/swaps | awk '{print $1}')
81else86
82 swap=$(grep "^/" /proc/swaps | awk '{print $1}')87filtered_swaps=$(
83fi88for swap in $swaps; do
8489 # Make sure this is swap space
85# Make sure this is swap space90 if [ "$(blkid -o value -s TYPE $swap)" != "swap" ]; then
86if ! vol_id "$swap" | grep -qs "ID_FS_TYPE=swap"; then91 warn "[$swap]" `gettext "does not appear to be swap space, skipping."`
87 error "[$swap] does not appear to be swap space"92 continue
88fi93 fi
8994
90# Check if this this swap space is already setup for encryption95 if [ "${swap#/dev/ram}" != "$swap" ]; then
91if /sbin/dmsetup table "$swap" | grep -qs " crypt " 2>/dev/null; then96 warn "[$swap]" `gettext "is a RAM device, skipping."`
92 info "[$swap] already appears to be encrypted."97 continue
93 exit 098 fi
94else99
95 # keep going100 # Check if this swap space is already setup for encryption
96 /bin/true101 if /sbin/dmsetup table "$swap" 2>/dev/null | grep -qs " crypt "; then
97fi102 warn "[$swap]" `gettext "already appears to be encrypted, skipping."`
98103 continue
99base=$(basename "$swap")104 fi
100if grep -qs "^$base.*swap.*cipher" /etc/crypttab 2>/dev/null; then105
101 info "[$swap] already has an entry in /etc/crypttab."106 base=$(basename "$swap")
102 exit 0107 if grep -qs "^$base.*swap.*cipher" /etc/crypttab 2>/dev/null; then
103fi108 warn "[$swap]" `gettext "already has an entry in /etc/crypttab, skipping."`
104if grep -qs "$swap" /etc/initramfs-tools/conf.d/cryptroot 2>/dev/null; then109 continue
105 info "[$swap] already has an entry in /etc/fstab."110 fi
106 exit 0111 if grep -qs "$swap" /etc/initramfs-tools/conf.d/cryptroot 2>/dev/null; then
107fi112 warn "[$swap]" `gettext "already has an entry in /etc/crypttab, skipping."`
108113 continue
109# Ensure available dev mapper name 'cryptswap'114 fi
110if grep -qs "^cryptswap" /etc/crypttab; then115
111 error "There appears to be a cryptswap entry in /etc/cryptab; aborting."116 echo $swap
112fi117done
113118)
114# Ensure available fstab entry119swaps="$filtered_swaps"
115if grep -qs "^/dev/mapper/cryptswap" /etc/fstab; then120if [ -z "$swaps" ]; then
116 error "There appears to be a cryptswap entry in /etc/fstab; aborting."121 warn "There were no usable swap devices to be encrypted. Exiting."
117fi122 exit 0
118123fi
119# Ensure that the existing swap space exists in fstab
120if grep -qs "^$swap" /etc/fstab; then
121 sed -i "s:^$swap:\#$swap:" /etc/fstab
122 info "Commented out your unencrypted swap from /etc/fstab"
123else
124 info "Your swap space isn't currently listed in /etc/fstab"
125fi
126
127##########################################################################124##########################################################################
128# Warn the user about breaking hibernate mode125# Warn the user about breaking hibernate mode
129if [ "$FORCE" != 1 ]; then126if [ "$FORCE" != 1 ]; then
130 echo127 echo
131 warning128 echo `gettext "WARNING:"`
132 echo " An encrypted swap is required to help ensure that encrypted files"129 echo `gettext "An encrypted swap is required to help ensure that encrypted files are not leaked to disk in an unencrypted format."`
133 echo " are not leaked to disk in an unencrypted format."
134 echo
135 echo " HOWEVER, THE SWAP ENCRYPTION CONFIGURATION PRODUCED BY THIS PROGRAM"
136 echo " WILL BREAK HIBERNATE/RESUME ON THIS SYSTEM!"
137 echo
138 echo " NOTE: Your suspend/resume capabilities will not be affected."
139 echo
140 echo -n "Do you want to proceed with encrypting your swap [y/N]: "
The diff has been truncated for viewing.

Subscribers

People subscribed via source and target branches