google / fscrypt / 521

Committed 09 May 2020 10:21PM UTC coverage: 32.202% (-1.2%) from 33.407%

Build # 521

Build Type

Pull #219

travis-ci

Committed by

web-flow

Commit Message

<a href="https://github.com/google/fscrypt/commit/<a class=hub.com/google/fscrypt/commit/91a6cee4dc249e85b217df6f097389f34f94f9e6">91a6cee4d<a href="https://github.com/google/fscrypt/commit/91a6cee4dc249e85b217df6f097389f34f94f9e6">">Merge </a><a class="double-link" href="https://github.com/google/fscrypt/commit/<a class="double-link" href="https://github.com/google/fscrypt/commit/181600d6327ed34a3f62eda0dd03a6d2ae49e5f9">181600d63</a>">181600d63</a><a href="https://github.com/google/fscrypt/commit/91a6cee4dc249e85b217df6f097389f34f94f9e6"> into 1cdefc21b">1cdefc21b</a>

Pull Request Pull Request #219: Improve error messages and suggestions

Run Details

496 of 496 new or added lines in 18 files covered. (100.0%)

1698 of 5273 relevant lines covered (32.2%)

995.63 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

55.71

/actions/context.go

/*
 * context.go - top-level interface to fscrypt packages
 *
 * Copyright 2017 Google Inc.
 * Author: Joe Richey (joerichey@google.com)
 *
 * Licensed under the Apache License, Version 2.0 (the "License"); you may not
 * use this file except in compliance with the License. You may obtain a copy of
 * the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 * License for the specific language governing permissions and limitations under
 * the License.
 */

// Package actions is the high-level interface to the fscrypt packages. The
// functions here roughly correspond with commands for the tool in cmd/fscrypt.
// All of the actions include a significant amount of logging, so that good
// output can be provided for cmd/fscrypt's verbose mode.
// The top-level actions currently include:
//        - Creating a new config file
//        - Creating a context on which to perform actions
//        - Creating, unlocking, and modifying Protectors
//        - Creating, unlocking, and modifying Policies
package actions

import (
        "log"
        "os/user"

        "github.com/pkg/errors"

        "github.com/google/fscrypt/filesystem"
        "github.com/google/fscrypt/keyring"
        "github.com/google/fscrypt/metadata"
        "github.com/google/fscrypt/util"
)

// ErrLocked indicates that the key hasn't been unwrapped yet.
var ErrLocked = errors.New("key needs to be unlocked first")

// Context contains the necessary global state to perform most of fscrypt's
// actions.
type Context struct {
        // Config is the struct loaded from the global config file. It can be
        // modified after being loaded to customise parameters.
        Config *metadata.Config
        // Mount is the filesystem relative to which all Protectors and Policies
        // are added, edited, removed, and applied, and to which policies using
        // the filesystem keyring are provisioned.
        Mount *filesystem.Mount
        // TargetUser is the user for whom protectors are created, and to whose
        // keyring policies using the user keyring are provisioned.  It's also
        // the user for whom the keys are claimed in the filesystem keyring when
        // v2 policies are provisioned.
        TargetUser *user.User
}

// NewContextFromPath makes a context for the filesystem containing the
// specified path and whose Config is loaded from the global config file. On
// success, the Context contains a valid Config and Mount. The target user
// defaults to the current effective user if none is specified.
func NewContextFromPath(path string, targetUser *user.User) (*Context, error) {
        ctx, err := newContextFromUser(targetUser)
        if err != nil {
                return nil, err
        }
        if ctx.Mount, err = filesystem.FindMount(path); err != nil {
                return nil, err
        }

        log.Printf("%s is on %s filesystem %q (%s)", path,
                ctx.Mount.FilesystemType, ctx.Mount.Path, ctx.Mount.Device)
        return ctx, nil
}

// NewContextFromMountpoint makes a context for the filesystem at the specified
// mountpoint and whose Config is loaded from the global config file. On
// success, the Context contains a valid Config and Mount. The target user
// defaults to the current effective user if none is specified.
func NewContextFromMountpoint(mountpoint string, targetUser *user.User) (*Context, error) {
        ctx, err := newContextFromUser(targetUser)
        if err != nil {
                return nil, err
        }
        if ctx.Mount, err = filesystem.GetMount(mountpoint); err != nil {
                return nil, err
        }

        log.Printf("found %s filesystem %q (%s)", ctx.Mount.FilesystemType,
                ctx.Mount.Path, ctx.Mount.Device)
        return ctx, nil
}

// newContextFromUser makes a context with the corresponding target user, and
// whose Config is loaded from the global config file. If the target user is
// nil, the effective user is used.
func newContextFromUser(targetUser *user.User) (*Context, error) {
        var err error
        if targetUser == nil {
                if targetUser, err = util.EffectiveUser(); err != nil {
                        return nil, err
                }
        }

        ctx := &Context{TargetUser: targetUser}
        if ctx.Config, err = getConfig(); err != nil {
                return nil, err
        }

        log.Printf("creating context for user %q", targetUser.Username)
        return ctx, nil
}

// checkContext verifies that the context contains a valid config and a mount
// which is being used with fscrypt.
func (ctx *Context) checkContext() error {
        if err := ctx.Config.CheckValidity(); err != nil {
                return &ErrBadConfig{ctx.Config, err}
        }
        return ctx.Mount.CheckSetup()
}

func (ctx *Context) getKeyringOptions() *keyring.Options {
        return &keyring.Options{
                Mount:                     ctx.Mount,
                User:                      ctx.TargetUser,
                UseFsKeyringForV1Policies: ctx.Config.GetUseFsKeyringForV1Policies(),
        }
}

// getProtectorOption returns the ProtectorOption for the protector on the
// context's mountpoint with the specified descriptor.
func (ctx *Context) getProtectorOption(protectorDescriptor string) *ProtectorOption {
        mnt, data, err := ctx.Mount.GetProtector(protectorDescriptor)
        if err != nil {
                return &ProtectorOption{ProtectorInfo{}, nil, err}
        }

        info := ProtectorInfo{data}
        // No linked path if on the same mountpoint
        if mnt == ctx.Mount {
                return &ProtectorOption{info, nil, nil}
        }
        return &ProtectorOption{info, mnt, nil}
}

// ProtectorOptions creates a slice of all the options for all of the Protectors
// on the Context's mountpoint.
func (ctx *Context) ProtectorOptions() ([]*ProtectorOption, error) {
        if err := ctx.checkContext(); err != nil {
                return nil, err
        }
        descriptors, err := ctx.Mount.ListProtectors()
        if err != nil {
                return nil, err
        }

        options := make([]*ProtectorOption, len(descriptors))
        for i, descriptor := range descriptors {
                options[i] = ctx.getProtectorOption(descriptor)
        }
        return options, nil
}

1	/*
2	* context.go - top-level interface to fscrypt packages
3	*
4	* Copyright 2017 Google Inc.
5	* Author: Joe Richey (joerichey@google.com)
6	*
7	* Licensed under the Apache License, Version 2.0 (the "License"); you may not
8	* use this file except in compliance with the License. You may obtain a copy of
9	* the License at
10	*
11	* http://www.apache.org/licenses/LICENSE-2.0
12	*
13	* Unless required by applicable law or agreed to in writing, software
14	* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15	* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
16	* License for the specific language governing permissions and limitations under
17	* the License.
18	*/
19
20	// Package actions is the high-level interface to the fscrypt packages. The
21	// functions here roughly correspond with commands for the tool in cmd/fscrypt.
22	// All of the actions include a significant amount of logging, so that good
23	// output can be provided for cmd/fscrypt's verbose mode.
24	// The top-level actions currently include:
25	// - Creating a new config file
26	// - Creating a context on which to perform actions
27	// - Creating, unlocking, and modifying Protectors
28	// - Creating, unlocking, and modifying Policies
29	package actions
30
31	import (
32	"log"
33	"os/user"
34
35	"github.com/pkg/errors"
36
37	"github.com/google/fscrypt/filesystem"
38	"github.com/google/fscrypt/keyring"
39	"github.com/google/fscrypt/metadata"
40	"github.com/google/fscrypt/util"
41	)
42
43	// ErrLocked indicates that the key hasn't been unwrapped yet.
44	var ErrLocked = errors.New("key needs to be unlocked first")
45
46	// Context contains the necessary global state to perform most of fscrypt's
47	// actions.
48	type Context struct {
49	// Config is the struct loaded from the global config file. It can be
50	// modified after being loaded to customise parameters.
51	Config *metadata.Config
52	// Mount is the filesystem relative to which all Protectors and Policies
53	// are added, edited, removed, and applied, and to which policies using
54	// the filesystem keyring are provisioned.
55	Mount *filesystem.Mount
56	// TargetUser is the user for whom protectors are created, and to whose
57	// keyring policies using the user keyring are provisioned. It's also
58	// the user for whom the keys are claimed in the filesystem keyring when
59	// v2 policies are provisioned.
60	TargetUser *user.User
61	}
62
63	// NewContextFromPath makes a context for the filesystem containing the
64	// specified path and whose Config is loaded from the global config file. On
65	// success, the Context contains a valid Config and Mount. The target user
66	// defaults to the current effective user if none is specified.
67	func NewContextFromPath(path string, targetUser user.User) (Context, error) {	×
68	ctx, err := newContextFromUser(targetUser)	×
69	if err != nil {	×
70	return nil, err	×
71	}	×
72	if ctx.Mount, err = filesystem.FindMount(path); err != nil {	×
73	return nil, err	×
74	}	×
75
76	log.Printf("%s is on %s filesystem %q (%s)", path,	×
77	ctx.Mount.FilesystemType, ctx.Mount.Path, ctx.Mount.Device)	×
78	return ctx, nil	×
79	}
80
81	// NewContextFromMountpoint makes a context for the filesystem at the specified
82	// mountpoint and whose Config is loaded from the global config file. On
83	// success, the Context contains a valid Config and Mount. The target user
84	// defaults to the current effective user if none is specified.
85	func NewContextFromMountpoint(mountpoint string, targetUser user.User) (Context, error) {	2✔
86	ctx, err := newContextFromUser(targetUser)	2✔
87	if err != nil {	3✔
88	return nil, err	1✔
89	}	1✔
90	if ctx.Mount, err = filesystem.GetMount(mountpoint); err != nil {	1✔
91	return nil, err	×
92	}	×
93
94	log.Printf("found %s filesystem %q (%s)", ctx.Mount.FilesystemType,	1✔
95	ctx.Mount.Path, ctx.Mount.Device)	1✔
96	return ctx, nil	1✔
97	}
98
99	// newContextFromUser makes a context with the corresponding target user, and
100	// whose Config is loaded from the global config file. If the target user is
101	// nil, the effective user is used.
102	func newContextFromUser(targetUser user.User) (Context, error) {	2✔
103	var err error	2✔
104	if targetUser == nil {	4✔
105	if targetUser, err = util.EffectiveUser(); err != nil {	2✔
106	return nil, err	×
107	}	×
108	}
109
110	ctx := &Context{TargetUser: targetUser}	2✔
111	if ctx.Config, err = getConfig(); err != nil {	3✔
112	return nil, err	1✔
113	}	1✔
114
115	log.Printf("creating context for user %q", targetUser.Username)	1✔
116	return ctx, nil	1✔
117	}
118
119	// checkContext verifies that the context contains a valid config and a mount
120	// which is being used with fscrypt.
121	func (ctx *Context) checkContext() error {	43✔
122	if err := ctx.Config.CheckValidity(); err != nil {	43✔
123	return &ErrBadConfig{ctx.Config, err}	×
124	}	×
125	return ctx.Mount.CheckSetup()	43✔
126	}
127
128	func (ctx Context) getKeyringOptions() keyring.Options {	×
129	return &keyring.Options{	×
130	Mount: ctx.Mount,	×
131	User: ctx.TargetUser,	×
132	UseFsKeyringForV1Policies: ctx.Config.GetUseFsKeyringForV1Policies(),	×
133	}	×
134	}	×
135
136	// getProtectorOption returns the ProtectorOption for the protector on the
137	// context's mountpoint with the specified descriptor.
138	func (ctx Context) getProtectorOption(protectorDescriptor string) ProtectorOption {	9✔
139	mnt, data, err := ctx.Mount.GetProtector(protectorDescriptor)	9✔
140	if err != nil {	9✔
141	return &ProtectorOption{ProtectorInfo{}, nil, err}	×
142	}	×
143
144	info := ProtectorInfo{data}	9✔
145	// No linked path if on the same mountpoint	9✔
146	if mnt == ctx.Mount {	18✔
147	return &ProtectorOption{info, nil, nil}	9✔
148	}	9✔
149	return &ProtectorOption{info, mnt, nil}	×
150	}
151
152	// ProtectorOptions creates a slice of all the options for all of the Protectors
153	// on the Context's mountpoint.
154	func (ctx Context) ProtectorOptions() ([]ProtectorOption, error) {	17✔
155	if err := ctx.checkContext(); err != nil {	17✔
156	return nil, err	×
157	}	×
158	descriptors, err := ctx.Mount.ListProtectors()	17✔
159	if err != nil {	17✔
160	return nil, err	×
161	}	×
162
163	options := make([]*ProtectorOption, len(descriptors))	17✔
164	for i, descriptor := range descriptors {	25✔
165	options[i] = ctx.getProtectorOption(descriptor)	8✔
166	}	8✔
167	return options, nil	17✔
168	}

google / fscrypt / 521

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous