ich777/linux_media
1
0
Fork 0
mirror of https://github.com/tbsdtv/linux_media.git synced 2025-07-24 05:01:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

sed-opal: allow using IOC_OPAL_SAVE for locking too

Browse Source 
Usually when closing a crypto device (eg: dm-crypt with LUKS) the
volume key is not required, as it requires root privileges anyway, and
root can deny access to a disk in many ways regardless. Requiring the
volume key to lock the device is a peculiarity of the OPAL
specification.

Given we might already have saved the key if the user requested it via
the 'IOC_OPAL_SAVE' ioctl, we can use that key to lock the device if no
key was provided here and the locking range matches, and the user sets
the appropriate flag with 'IOC_OPAL_SAVE'. This allows integrating OPAL
with tools and libraries that are used to the common behaviour and do
not ask for the volume key when closing a device.

Callers can always pass a non-zero key and it will be used regardless,
as before.

Suggested-by: Štěpán Horáček <stepan.horacek@gmail.com>
Signed-off-by: Luca Boccassi <bluca@debian.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Christian Brauner <brauner@kernel.org>
Link: https://lore.kernel.org/r/20221206092913.4625-1-luca.boccassi@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Luca Boccassi
2022-12-06 09:29:13 +00:00
committed by Jens Axboe
parent 37754595e9
commit c1f480b2d0
2 changed files with 46 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
include/uapi/linux/sed-opal.h
View File

@@ -44,6 +44,11 @@ enum opal_lock_state {
OPAL_LK = 0x04, /* 0100 */
};
enum opal_lock_flags {
/* IOC_OPAL_SAVE will also store the provided key for locking */
OPAL_SAVE_FOR_LOCK = 0x01,
};
struct opal_key {
__u8 lr;
__u8 key_len;
@@ -76,7 +81,8 @@ struct opal_user_lr_setup {
struct opal_lock_unlock {
struct opal_session_info session;
__u32 l_state;
__u8 __align[4];
__u16 flags;
__u8 __align[2];
};
struct opal_new_pw {