cryptohome: Remove KeyPrivilege::mount usage as the value is always |true|
Due to non usage, KeyPrivilege::mount usage is being removed to make
way for AuthSessions.
BUG=chromium:1140235
TEST=FEATURES=test emerge-nami cryptohome
Change-Id: I06a50ce6054a4f4abd198bd576eec8fb0a2cfe8c
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform2/+/2486543
Tested-by: Hardik Goyal <hardikgoyal@chromium.org>
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Reviewed-by: Leo Lai <cylai@google.com>
Commit-Queue: Leo Lai <cylai@google.com>
Auto-Submit: Hardik Goyal <hardikgoyal@chromium.org>
diff --git a/cryptohome/cryptohome.cc b/cryptohome/cryptohome.cc
index bd1bb1b..2578be9 100644
--- a/cryptohome/cryptohome.cc
+++ b/cryptohome/cryptohome.cc
@@ -1289,7 +1289,6 @@
LOG(INFO) << "Adding restricted key";
cryptohome::KeyPrivileges* privs = data->mutable_privileges();
- privs->set_mount(true);
privs->set_authorized_update(true);
privs->set_update(false);
privs->set_add(false);
diff --git a/cryptohome/homedirs.cc b/cryptohome/homedirs.cc
index fb04208..b1fba9f 100644
--- a/cryptohome/homedirs.cc
+++ b/cryptohome/homedirs.cc
@@ -1192,8 +1192,7 @@
key_data = &(vk->serialized().key_data());
// legacy keys are full privs
if (!vk->serialized().key_data().privileges().add() ||
- !vk->serialized().key_data().privileges().remove() ||
- !vk->serialized().key_data().privileges().mount()) {
+ !vk->serialized().key_data().privileges().remove()) {
LOG(ERROR) << "Migrate: key lacks sufficient privileges()";
return false;
}
diff --git a/cryptohome/mount.cc b/cryptohome/mount.cc
index 5fb0f6e..3e47a0e 100644
--- a/cryptohome/mount.cc
+++ b/cryptohome/mount.cc
@@ -398,22 +398,6 @@
LOG(ERROR) << "Failed to clear user keyring";
}
- // Before we use the matching keyset, make sure it isn't being misused.
- // Note, privileges don't protect against information leakage, they are
- // just software/DAC policy enforcement mechanisms.
- //
- // In the future we may provide some assurance by wrapping privileges
- // with the wrapped_key, but that is still of limited benefit.
- if (serialized.has_key_data() && // legacy keys are full privs
- !serialized.key_data().privileges().mount()) {
- // TODO(wad): Convert to CRYPTOHOME_ERROR_AUTHORIZATION_KEY_DENIED
- // TODO(wad): Expose the safe-printable label rather than the Chrome
- // supplied one for log output.
- LOG(ERROR) << "Mount attempt with unprivileged key.";
- *mount_error = MOUNT_ERROR_UNPRIVILEGED_KEY;
- return false;
- }
-
// Checks whether migration from ecryptfs to dircrypto is needed, and returns
// an error when necessary. Do this after the check by DecryptVaultKeyset,
// because a correct credential is required before switching to migration UI.
diff --git a/cryptohome/mount_unittest.cc b/cryptohome/mount_unittest.cc
index 4187720..67b5fd1 100644
--- a/cryptohome/mount_unittest.cc
+++ b/cryptohome/mount_unittest.cc
@@ -636,47 +636,6 @@
expected_creds.passkey() == arg.passkey();
}
-TEST_P(MountTest, MountCryptohomeNoPrivileges) {
- // Check that Mount only works if the mount permission is given.
- InsertTestUsers(&kDefaultUsers[10], 1);
- EXPECT_CALL(platform_, DirectoryExists(kImageDir))
- .WillRepeatedly(Return(true));
- EXPECT_TRUE(DoMountInit());
-
- TestUser* user = &helper_.users[0];
- user->key_data.set_label("my key!");
- user->use_key_data = true;
- user->key_data.mutable_privileges()->set_mount(false);
- // Regenerate the serialized vault keyset.
- user->GenerateCredentials(ShouldTestEcryptfs());
- Credentials credentials(user->username, user->passkey);
- // Let the legacy key iteration work here.
-
- user->InjectUserPaths(&platform_, chronos_uid_, chronos_gid_, shared_gid_,
- kDaemonGid, ShouldTestEcryptfs());
- user->InjectKeyset(&platform_, true);
-
- if (ShouldTestEcryptfs()) {
- EXPECT_CALL(platform_, ClearUserKeyring()).WillOnce(Return(true));
- }
-
- EXPECT_CALL(platform_, CreateDirectory(user->vault_mount_path))
- .WillRepeatedly(Return(true));
-
- EXPECT_CALL(platform_,
- CreateDirectory(MountHelper::GetNewUserPath(user->username)))
- .WillRepeatedly(Return(true));
- EXPECT_CALL(platform_, FileExists(base::FilePath(kLockedToSingleUserFile)))
- .WillRepeatedly(Return(false));
-
- EXPECT_CALL(platform_, RestoreSELinuxContexts(_, _)).Times(0);
-
- MountError error = MOUNT_ERROR_NONE;
- EXPECT_FALSE(mount_->MountCryptohome(credentials, GetDefaultMountArgs(), true,
- &error));
- EXPECT_EQ(MOUNT_ERROR_UNPRIVILEGED_KEY, error);
-}
-
TEST_P(MountTest, MountCryptohomeHasPrivileges) {
// Check that Mount only works if the mount permission is given.
InsertTestUsers(&kDefaultUsers[10], 1);
@@ -687,7 +646,6 @@
TestUser* user = &helper_.users[0];
user->key_data.set_label("my key!");
user->use_key_data = true;
- user->key_data.mutable_privileges()->set_mount(true);
// Regenerate the serialized vault keyset.
user->GenerateCredentials(ShouldTestEcryptfs());
Credentials credentials(user->username, user->passkey);
diff --git a/cryptohome/service.cc b/cryptohome/service.cc
index ef2e727..1815a8d 100644
--- a/cryptohome/service.cc
+++ b/cryptohome/service.cc
@@ -2321,14 +2321,6 @@
if (request->create().copy_authorization_key()) {
Key* auth_key = request->mutable_create()->add_keys();
*auth_key = authorization->key();
- // Don't allow a key creation and mount if the key lacks
- // the privileges.
- if (!auth_key->data().privileges().mount()) {
- LOG(ERROR) << "Auth key denied";
- reply.set_error(CRYPTOHOME_ERROR_AUTHORIZATION_KEY_DENIED);
- SendReply(context, reply);
- return;
- }
}
int keys_size = request->create().keys_size();
if (keys_size == 0) {
diff --git a/cryptohome/userdataauth.cc b/cryptohome/userdataauth.cc
index f02ea9b..34b9343 100644
--- a/cryptohome/userdataauth.cc
+++ b/cryptohome/userdataauth.cc
@@ -1331,15 +1331,6 @@
if (request.create().copy_authorization_key()) {
Key* auth_key = request.mutable_create()->add_keys();
*auth_key = request.authorization().key();
- // Don't allow a key creation and mount if the key lacks
- // the privileges.
- if (!auth_key->data().privileges().mount()) {
- LOG(ERROR) << "Auth key denied";
- reply.set_error(user_data_auth::CryptohomeErrorCode::
- CRYPTOHOME_ERROR_AUTHORIZATION_KEY_DENIED);
- std::move(on_done).Run(reply);
- return;
- }
}
// Sanity check for |request.create.keys|.
