eCryptfs

pam_ecryptfs doesn't live well with pam_keyinit

Bug #715066 reported by Arkadiusz Miśkiewicz
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
eCryptfs
Fix Released
Medium
Dustin Kirkland 

Bug Description

Linux PAM package contains pam_keyinit module which can manage (grant and revoke) session keys for a user.

pam_ecryptfs doesn't deal with that well.

For example pam_ecryptfs reports: "Error attempting to add filename encryption key to user session keyring; rc = [1]". where 1 AFAIK means that the key already exists. That's because pam_keyinit added it already.

From looking into code:
A) ecryptfs_insert_wrapped_passphrase_into_keyring() calls
B) ecryptfs_add_passphrase_key_to_keyring().

If B) returns non zero then it is treated as an error but "1" means key
already exits. Maybe 1 should also be treated as "ok" ?

Anyway with pam_keyinit I wasn't able to setup ecryptfs to correctly encrypt $HOME.

Mine keyinit usage is:
session optional pam_keyinit.so revoke debug (system-auth)
or
session optional pam_keyinit.so force revoke (sshd)
as first session module.

Dustin Kirkland  (kirkland)
Changed in ecryptfs:
status: New → Triaged
importance: Undecided → Medium
Revision history for this message
Dustin Kirkland  (kirkland) wrote :

Howdy! Thanks for this bug report.

I think you're right about handling (b)'s exit code better. If it's already there, then the end desired effect is what you wanted.

I'm marking Triaged/Medium.

Revision history for this message
Dustin Kirkland  (kirkland) wrote :

Actually:

/**
 * This is the common functionality used to put a password generated key into
 * the keyring, shared by both non-interactive and interactive signature
 * generation code.
 *
 * Returns 0 on add, 1 on pre-existed, negative on failure.
 */
int ecryptfs_add_passphrase_key_to_keyring(char *auth_tok_sig, char *passphrase,
                                           char *salt)
{
...

So I think we just need to test the return code for <0.

Changed in ecryptfs:
assignee: nobody → Dustin Kirkland (kirkland)
status: Triaged → In Progress
Revision history for this message
Dustin Kirkland  (kirkland) wrote :

Committed revision 587.

Changed in ecryptfs:
status: In Progress → Fix Committed
Dustin Kirkland  (kirkland)
Changed in ecryptfs:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.