mirrors/libguestfs
1
0
Fork 0
mirror of https://github.com/libguestfs/libguestfs.git synced 2026-03-21 22:53:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Introduce a --key option in tools that accept keys

Browse Source 
The majority of the tools have already options (--echo-keys &
--keys-from-stdin) to deal with LUKS credentials, although there is no
way to automatically provide credentials.  --keys-from-stdin is
suboptimal, because it is a usable solution only when there is just one
device to open, and no other input passed via stdin to the tool (like
the commands for guestfish).

To overcome this limitation, introduce a new --key option in tools:
* --key /dev/device:file:/filename/with/key
* --key /dev/device:string:the-actual-key
this way it is possible to pass all the credentials needed for the
specific devices to open, with no risk of conflict with stdin, and also
in a secure way (when using the "file" way).

On the technical side: this adds a new "key_store" API for the C tools,
making sure it is used only when needed.  Partially mirror it also for
the OCaml tools, although there will be a conversion to the C API
because the decryption helpers used are in the common C parts.
This commit is contained in:
Pino Toscano
2018-09-18 17:32:07 +02:00
parent ec438b7b85
commit 4b1e5b0c3f
44 changed files with 599 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
fish/fish.c
View File

@@ -132,6 +132,7 @@ usage (int status)
" --format[=raw|..] Force disk format for -a option\n"
" --help Display brief help\n"
" -i|--inspector Automatically mount filesystems\n"
" --key selector Specify a LUKS key\n"
" --keys-from-stdin Read passphrases from stdin\n"
" --listen Listen for remote commands\n"
" --live Connect to a live virtual machine\n"
@@ -198,6 +199,7 @@ main (int argc, char *argv[])
{ "format", 2, 0, 0 },
{ "help", 0, 0, HELP_OPTION },
{ "inspector", 0, 0, 'i' },
{ "key", 1, 0, 0 },
{ "keys-from-stdin", 0, 0, 0 },
{ "listen", 0, 0, 0 },
{ "live", 0, 0, 0 },
@@ -230,6 +232,7 @@ main (int argc, char *argv[])
int option_index;
struct sigaction sa;
int next_prepared_drive = 1;
struct key_store *ks = NULL;
initialize_readline ();
init_event_handlers ();
@@ -293,6 +296,8 @@ main (int argc, char *argv[])
exit (EXIT_FAILURE);
} else if (STREQ (long_options[option_index].name, "no-dest-paths")) {
complete_dest_paths = 0;
} else if (STREQ (long_options[option_index].name, "key")) {
OPTION_key;
} else
error (EXIT_FAILURE, 0,
_("unknown long option: %s (%d)"),
@@ -496,6 +501,7 @@ main (int argc, char *argv[])
/* Free up data structures, no longer needed after this point. */
free_drives (drvs);
free_mps (mps);
free_key_store (ks);
/* Remote control? */
if (remote_control_listen && remote_control)

17
fish/guestfish.pod
View File

@@ -280,6 +280,23 @@ Using this flag is mostly equivalent to using the C<inspect-os>
command and then using other commands to mount the filesystems that
were found.
=item B<--key> SELECTOR
Specify a key for LUKS, to automatically open a LUKS device when using
the inspection. C<SELECTOR> can be in one of the following formats:
=over 4
=item B<--key> C<DEVICE>:key:KEY_STRING
Use the specified C<KEY_STRING> as passphrase.
=item B<--key> C<DEVICE>:file:FILENAME
Read the passphrase from F<FILENAME>.
=back
=item B<--keys-from-stdin>
Read key or passphrase parameters from stdin. The default is