Merge ~paelzer/ubuntu/+source/libpam-mount:lp-1804408-LUKS2-support-cosmic into ubuntu/+source/libpam-mount:ubuntu/cosmic-devel

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

PPA available at: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3635

I added autopkgtests as I realized what I wrote for the bug would almost already make a good test.
For Disco I'd not upload the tests as Delta, but instead open them as MP/Bug to Debian to be included there. Only if there is no activity I'd consider adding a Delta.

But lets get a review here first :-)

The PPA worked on my box as outlined in the SRU template.

Tests will run soon (the PPA just rebuilds) and will be available in Bileto then.

[Christian Ehrhardt  (paelzer)]

I added an dep8 test for some extra confidence
Result example:
Cosmic with fix: http://paste.ubuntu.com/p/nfwBTqBdP9/
Cosmic without: http://paste.ubuntu.com/p/2rzYZJ3RYJ/
Bionic with fix: http://paste.ubuntu.com/p/WwFDY99dNh/

[Christian Ehrhardt  (paelzer)]

For Disco I submitted the test to Debian https://salsa.debian.org/debian/libpam-mount/merge_requests/1

[Christian Ehrhardt  (paelzer)]

There is no Debian bug (and there won't be as it is fixed in latest).
I'll remove the line.

be1116b... by Christian Ehrhardt  on 2019-02-07

there is no Debian bug for lp 1804408, remove Bug-Debian

Signed-off-by: Christian Ehrhardt <email address hidden>

[Andreas Hasenack (ahasenack)]

+1, just some suggestions inside.

I was also going to suggest that the script be made idempotent, that helps a lot when iterating over it with enhancements or changes without having to clean up manually before each new run, but that makes it a bit more complicated than needed at this time (check user before adding, or remove user at the end, add traps, etc).

review: Approve

fed41c5... by Christian Ehrhardt  on 2019-02-07

d/t/local-luks: also check for an active mount

Signed-off-by: Christian Ehrhardt <email address hidden>

056f420... by Christian Ehrhardt  on 2019-02-07

changelog: mark dep8 bug as fixed by the new autopkgtest

Signed-off-by: Christian Ehrhardt <email address hidden>

diff --git a/debian/changelog b/debian/changelog
index 2797541..3d4a0c5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+libpam-mount (2.16-5ubuntu0.1) cosmic; urgency=medium
+
+  * d/p/0015-Use-crypt_get_type-to-get-type-and-support-CRYPT_LUK.patch:
+    allow more than just LUKS1 by detecting the type (LP: #1804408)
+  * d/tests/control, d/tests/local-luks: add autopkgtest for luks1/luks2
+    automount on user login. (LP: #1679327)
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 06 Feb 2019 09:56:49 +0100
+
 libpam-mount (2.16-5) unstable; urgency=medium
 
   * Upload to unstable.
diff --git a/debian/patches/0015-Use-crypt_get_type-to-get-type-and-support-CRYPT_LUK.patch b/debian/patches/0015-Use-crypt_get_type-to-get-type-and-support-CRYPT_LUK.patch
new file mode 100644
index 0000000..de3095c
--- /dev/null
+++ b/debian/patches/0015-Use-crypt_get_type-to-get-type-and-support-CRYPT_LUK.patch
@@ -0,0 +1,49 @@
+From: Jochen Sprickerhof <[e-mail]>
+Date: Sun, 30 Sep 2018 18:48:33 +0200
+Subject: Use crypt_get_type to get type and support CRYPT_LUKS2 as well
+
+Origin: debian, https://git.launchpad.net/ubuntu/+source/libpam-mount/plain/debian/patches/0015-Use-crypt_get_type-to-get-type-and-support-CRYPT_LUK.patch
+
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1804408
+Last-Update: 2019-02-06
+
+---
+ src/crypto-dmc.c | 4 ++--
+ src/ehd.c        | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/crypto-dmc.c b/src/crypto-dmc.c
+index d0ab6ca..4754c2d 100644
+--- a/src/crypto-dmc.c
++++ b/src/crypto-dmc.c
+@@ -48,7 +48,7 @@ EXPORT_SYMBOL int ehd_is_luks(const char *path, bool blkdev)
+ 
+ 	ret = crypt_init(&cd, device);
+ 	if (ret == 0) {
+-		ret = crypt_load(cd, CRYPT_LUKS1, NULL);
++		ret = crypt_load(cd, crypt_get_type(cd), NULL);
+ 		if (ret == -EINVAL)
+ 			ret = false;
+ 		else if (ret == 0)
+@@ -106,7 +106,7 @@ static bool dmc_run(const struct ehd_mount_request *req,
+ #endif
+ 	}
+ 
+-	ret = crypt_load(cd, CRYPT_LUKS1, NULL);
++	ret = crypt_load(cd, crypt_get_type(cd), NULL);
+ 	if (ret == 0) {
+ 		ret = crypt_activate_by_passphrase(cd, mt->crypto_name,
+ 		      CRYPT_ANY_SLOT, req->key_data, req->key_size, flags);
+diff --git a/src/ehd.c b/src/ehd.c
+index 07c8099..b550613 100644
+--- a/src/ehd.c
++++ b/src/ehd.c
+@@ -309,7 +309,7 @@ static int ehd_init_volume_luks(struct ehd_mount_request *rq,
+ 		        lower_dev, strerror(-ret));
+ 		goto out;
+ 	}
+-	ret = crypt_format(cd, CRYPT_LUKS1, cipher, cipher_mode, NULL, NULL,
++	ret = crypt_format(cd, crypt_get_type(cd), cipher, cipher_mode, NULL, NULL,
+ 	      (cont->keybits + CHAR_BIT - 1) / CHAR_BIT, &format_params);
+ 	if (ret < 0) {
+ 		fprintf(stderr, "crypt_format: %s\n", strerror(-ret));
diff --git a/debian/patches/series b/debian/patches/series
index 22fcc9d..8c1dfdc 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -12,3 +12,4 @@
 013-fix-doc-target
 014-allow-luserconf-outside-home
 0014-Don-t-compare-source-when-checking-if-it-s-already-m.patch
+0015-Use-crypt_get_type-to-get-type-and-support-CRYPT_LUK.patch
diff --git a/debian/tests/control b/debian/tests/control
new file mode 100644
index 0000000..7a02d06
--- /dev/null
+++ b/debian/tests/control
@@ -0,0 +1,3 @@
+Tests: local-luks
+Depends: @, cryptsetup, openssl, openssh-client, openssh-server
+Restrictions: allow-stderr, needs-root, isolation-machine
diff --git a/debian/tests/local-luks b/debian/tests/local-luks
new file mode 100644
index 0000000..9471fd8
--- /dev/null
+++ b/debian/tests/local-luks
@@ -0,0 +1,61 @@
+#!/bin/bash
+set -uxe
+mkdir /etc/pam_mount_keys/
+echo -n alice > /etc/pam_mount_keys/alice.key
+echo "libpam-mount is working" > testfile
+
+createluks()
+{
+    local id=${1}
+    local type=${2}
+    local tdir=$(mktemp --directory)
+
+    fallocate -l 100M "/tmp/disk-l${id}.img"
+    cryptsetup luksFormat --batch-mode --verbose --force-password --key-file=/etc/pam_mount_keys/alice.key --type "${type}" "/tmp/disk-l${id}.img"
+    cryptsetup open --type "${type}" --batch-mode --verbose --key-file=/etc/pam_mount_keys/alice.key "/tmp/disk-l${id}.img" "img-luks${id}"
+    mkfs.ext4 -L "IMG-LUKS${id}" "/dev/mapper/img-luks${id}"
+    mount "/dev/mapper/img-luks${id}" "${tdir}"
+    cp testfile "${tdir}"
+    umount "/dev/mapper/img-luks${id}"
+    cryptsetup close "img-luks${id}"
+}
+
+checkluks()
+{
+    local id=${1}
+    local bckp=$(mktemp)
+
+    # backup and modify configuration
+    cp /etc/security/pam_mount.conf.xml "${bckp}"
+    sed -i -e 's/debug enable="0"/debug enable="1"/' /etc/security/pam_mount.conf.xml
+    sed -i -e "/<!-- Volume definitions -->/a<volume user='alice' path='/tmp/disk-l${id}.img' mountpoint='~/img-luks${id}' fstype='crypt' fskeycipher='none' fskeyhash='md5' fskeypath='/etc/pam_mount_keys/alice.key' />" /etc/security/pam_mount.conf.xml
+
+    # smoke tests the mount and if not working print debug from journal
+    ssh -o "StrictHostKeyChecking=no" -i test.key alice@localhost "ls -laF ~/img-luks${id}/testfile" || journalctl -xe -u ssh --no-pager
+
+    # make sure we are using an actual mount
+    ssh -o "StrictHostKeyChecking=no" -i test.key alice@localhost "mount" | grep img-luks${id}
+
+    # compare data on encrypted disk
+    ssh -o "StrictHostKeyChecking=no" -i test.key alice@localhost "cat ~/img-luks${id}/testfile" > "luks${id}"
+    cmp testfile "luks${id}"
+
+    # restore configuration
+    cp "${bckp}" /etc/security/pam_mount.conf.xml
+}
+
+# create user alice with PW alice
+sudo useradd -G users -m --password "$(openssl passwd -1 alice)" -s /bin/bash alice
+ssh-keygen -t rsa -N "" -f test.key
+mkdir -p ~alice/.ssh
+chown alice:alice ~alice/.ssh
+cp test.key.pub ~alice/.ssh/authorized_keys
+mkdir -p /home/alice/img-luks1 /home/alice/img-luks2
+chown alice:alice ~alice/.ssh/authorized_keys /home/alice/img-luks1 /home/alice/img-luks2
+
+# create LUKS devices with known content
+createluks 1 luks
+createluks 2 luks2
+
+checkluks 1
+checkluks 2