Usually when closing a crypto device (eg: dm-crypt with LUKS) the volume key is not required, as it requires root privileges anyway, and root can deny access to a disk in many ways regardless. Requiring the volume key to lock the device is a peculiarity of the OPAL specification. Given we might already have saved the key if the user requested it via the 'IOC_OPAL_SAVE' ioctl, we can use that key to lock the device if no key was provided here and the locking range matches, and the user sets the appropriate flag with 'IOC_OPAL_SAVE'. This allows integrating OPAL with tools and libraries that are used to the common behaviour and do not ask for the volume key when closing a device. Callers can always pass a non-zero key and it will be used regardless, as before.
Showing the changes to include/uapi (1 of 2 files). Show all
Unified · Split
| @@ -44,6 +44,11 @@ enum opal_lock_state { · 43 unmodified lines | ||
| 44 | 44 | OPAL_LK = 0x04, /* 0100 */ |
| 45 | 45 | }; |
| 46 | 46 | |
| 47 | +enum opal_lock_flags { | |
| 48 | + /* IOC_OPAL_SAVE will also store the provided key for locking */ | |
| 49 | + OPAL_SAVE_FOR_LOCK = 0x01, | |
| 50 | +}; | |
| 51 | + | |
| 47 | 52 | struct opal_key { |
| 48 | 53 | __u8 lr; |
| 49 | 54 | __u8 key_len; |
| @@ -76,7 +81,8 @@ struct opal_user_lr_setup { · 26 unmodified lines | ||
| 76 | 81 | struct opal_lock_unlock { |
| 77 | 82 | struct opal_session_info session; |
| 78 | 83 | __u32 l_state; |
| 79 | − __u8 __align[4]; | |
| 84 | + __u16 flags; | |
| 85 | + __u8 __align[2]; | |
| 80 | 86 | }; |
| 81 | 87 | |
| 82 | 88 | struct opal_new_pw { |