Usually when closing a crypto device (eg: dm-crypt with LUKS) the volume key is not required, as it requires root privileges anyway, and root can deny access to a disk in many ways regardless. Requiring the volume key to lock the device is a peculiarity of the OPAL specification. Given we might already have saved the key if the user requested it via the 'IOC_OPAL_SAVE' ioctl, we can use that key to lock the device if no key was provided here and the locking range matches, and the user sets the appropriate flag with 'IOC_OPAL_SAVE'. This allows integrating OPAL with tools and libraries that are used to the common behaviour and do not ask for the volume key when closing a device. Callers can always pass a non-zero key and it will be used regardless, as before.
Showing the changes to include/uapi (1 of 2 files). Show all
Unified · Split
| @@ -44,6 +44,11 @@ enum opal_lock_state { · 43 unmodified lines | |||
| 44 | OPAL_LK = 0x04, /* 0100 */ | 44 | OPAL_LK = 0x04, /* 0100 */ |
| 45 | }; | 45 | }; |
| 46 | 46 | ||
| 47 | enum opal_lock_flags { | ||
| 48 | /* IOC_OPAL_SAVE will also store the provided key for locking */ | ||
| 49 | OPAL_SAVE_FOR_LOCK = 0x01, | ||
| 50 | }; | ||
| 51 | |||
| 47 | struct opal_key { | 52 | struct opal_key { |
| 48 | __u8 lr; | 53 | __u8 lr; |
| 49 | __u8 key_len; | 54 | __u8 key_len; |
| @@ -76,7 +81,8 @@ struct opal_user_lr_setup { · 26 unmodified lines | |||
| 76 | struct opal_lock_unlock { | 81 | struct opal_lock_unlock { |
| 77 | struct opal_session_info session; | 82 | struct opal_session_info session; |
| 78 | __u32 l_state; | 83 | __u32 l_state; |
| 79 | __u8 __align[4]; | 84 | __u16 flags; |
| 85 | __u8 __align[2]; | ||
| 80 | }; | 86 | }; |
| 81 | 87 | ||
| 82 | struct opal_new_pw { | 88 | struct opal_new_pw { |