vbatts/grub
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Allow GRUB to mount ext2/3/4 filesystems that have the encryption feature.

Browse source 
On such a filesystem, inodes may have EXT4_ENCRYPT_FLAG set.
For a regular file, this means its contents are encrypted; for a
directory, this means the filenames in its directory entries are
encrypted; and for a symlink, this means its target is encrypted.  Since
GRUB cannot decrypt encrypted contents or filenames, just issue an error
if it would need to do so.  This is sufficient to allow unencrypted boot
files to co-exist with encrypted files elsewhere on the filesystem.

(Note that encrypted regular files and symlinks will not normally be
encountered outside an encrypted directory; however, it's possible via
hard links, so they still need to be handled.)

Tested by booting from an ext4 /boot partition on which I had run
'tune2fs -O encrypt'.  I also verified that the expected error messages
are printed when trying to access encrypted directories, files, and
symlinks from the GRUB command line.  Also ran 'sudo ./grub-fs-tester
ext4_encrypt'; note that this requires e2fsprogs v1.43+ and Linux v4.1+.

Signed-off-by: Eric Biggers <ebiggers@google.com>
This commit is contained in:
Eric Biggers 2017-06-29 13:27:49 +00:00 • committed by Vincent Batts
parent da4e8334b2
commit 4aaa6b639d
3 changed files with 33 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
tests/ext234_test.in
View file

@ -30,3 +30,4 @@ fi
"@builddir@/grub-fs-tester" ext3
"@builddir@/grub-fs-tester" ext4
"@builddir@/grub-fs-tester" ext4_metabg
"@builddir@/grub-fs-tester" ext4_encrypt

10
tests/util/grub-fs-tester.in
View file

@ -156,6 +156,12 @@ for LOGSECSIZE in $(range "$MINLOGSECSIZE" "$MAXLOGSECSIZE" 1); do
# Could go further but what's the point?
MAXBLKSIZE=$((65536*1024))
;;
xext4_encrypt)
# OS LIMITATION: Linux currently only allows the 'encrypt' feature
# in combination with block_size = PAGE_SIZE (4096 bytes on x86).
MINBLKSIZE=$(getconf PAGE_SIZE)
MAXBLKSIZE=$MINBLKSIZE
;;
xext*)
MINBLKSIZE=1024
if [ $MINBLKSIZE -lt $SECSIZE ]; then
@ -796,6 +802,10 @@ for LOGSECSIZE in $(range "$MINLOGSECSIZE" "$MAXLOGSECSIZE" 1); do
MKE2FS_DEVICE_SECTSIZE=$SECSIZE "mkfs.ext4" -O meta_bg,^resize_inode -b $BLKSIZE -L "$FSLABEL" -q "${MOUNTDEVICE}"
MOUNTFS=ext4
;;
xext4_encrypt)
MKE2FS_DEVICE_SECTSIZE=$SECSIZE "mkfs.ext4" -O encrypt -b $BLKSIZE -L "$FSLABEL" -q "${MOUNTDEVICE}"
MOUNTFS=ext4
;;
xext*)
MKE2FS_DEVICE_SECTSIZE=$SECSIZE "mkfs.$fs" -b $BLKSIZE -L "$FSLABEL" -q "${MOUNTDEVICE}" ;;
xxfs)