|
| 1 | +/*! |
| 2 | +
|
| 3 | +# Linux (keyutils) store with Secret Service backing |
| 4 | +
|
| 5 | +This store, contributed by [@soywod](https://github.com/soywod), |
| 6 | +uses the [keyutils module](crate::keyutils) as a cache |
| 7 | +available to headless processes, while using the |
| 8 | +[secret-service module](crate::secret_service) |
| 9 | +to provide credential storage beyond reboot. |
| 10 | +The expected usage pattern |
| 11 | +for this module is as follows: |
| 12 | +
|
| 13 | +- Processes that run on headless systems are built with `keyutils` support via the |
| 14 | + `linux-native` feature of this crate. After each reboot, these processes |
| 15 | + are either launched after the keyutils cache has been reloaded from the secret service, |
| 16 | + or (if launched immediately) they wait until the keyutils cache has been reloaded. |
| 17 | +- A headed "configuration" process is built with this module that allows its user |
| 18 | + to configure the credentials needed by the headless processes. After each reboot, |
| 19 | + this process unlocks the secret service (see both the keyutils and secret-service |
| 20 | + module for information about how this can be done headlessly, if desired) and then |
| 21 | + accesses each of the configured credentials (which loads them into keyutils). At |
| 22 | + that point the headless clients can be started (or become active, if already started). |
| 23 | +
|
| 24 | +This store works by creating a keyutils entry and a secret-service entry for |
| 25 | +each of its entries. Because keyutils entries don't have attributes, entries |
| 26 | +in this store don't expose attributes either. Because keyutils entries can't |
| 27 | +store empty passwords/secrets, this store's entries can't either. |
| 28 | +
|
| 29 | +See the documentation for the `keyutils` and `secret-service` modules if you |
| 30 | +want details about how the underlying storage is handled. |
| 31 | + */ |
| 32 | + |
| 33 | +use log::debug; |
| 34 | + |
| 35 | +use super::credential::{ |
| 36 | + Credential, CredentialApi, CredentialBuilder, CredentialBuilderApi, CredentialPersistence, |
| 37 | +}; |
| 38 | +use super::error::{Error, Result}; |
| 39 | +use super::keyutils::KeyutilsCredential; |
| 40 | +use super::secret_service::{SsCredential, SsCredentialBuilder}; |
| 41 | + |
| 42 | +/// Representation of a keyutils-persistent credential. |
| 43 | +/// |
| 44 | +/// The credential owns a [KeyutilsCredential] for in-memory usage and |
| 45 | +/// a [SsCredential] for persistence. |
| 46 | +#[derive(Debug, Clone)] |
| 47 | +pub struct KeyutilsPersistentCredential { |
| 48 | + keyutils: KeyutilsCredential, |
| 49 | + ss: SsCredential, |
| 50 | +} |
| 51 | + |
| 52 | +impl CredentialApi for KeyutilsPersistentCredential { |
| 53 | + /// Set a password in the underlying store |
| 54 | + fn set_password(&self, password: &str) -> Result<()> { |
| 55 | + self.set_secret(password.as_bytes()) |
| 56 | + } |
| 57 | + |
| 58 | + /// Set a secret in the underlying store |
| 59 | + /// |
| 60 | + /// It sets first the secret in keyutils, then in |
| 61 | + /// secret-service. If the latter set fails, the former |
| 62 | + /// is reverted. |
| 63 | + fn set_secret(&self, secret: &[u8]) -> Result<()> { |
| 64 | + let prev_secret = self.keyutils.get_secret(); |
| 65 | + self.keyutils.set_secret(secret)?; |
| 66 | + |
| 67 | + if let Err(err) = self.ss.set_secret(secret) { |
| 68 | + debug!("Failed set of secret-service: {err}; reverting keyutils"); |
| 69 | + match prev_secret { |
| 70 | + Ok(ref secret) => self.keyutils.set_secret(secret), |
| 71 | + Err(Error::NoEntry) => self.keyutils.delete_credential(), |
| 72 | + Err(err) => Err(err), |
| 73 | + }?; |
| 74 | + |
| 75 | + return Err(err); |
| 76 | + } |
| 77 | + |
| 78 | + Ok(()) |
| 79 | + } |
| 80 | + |
| 81 | + /// Retrieve a password from the underlying store |
| 82 | + /// |
| 83 | + /// The password is retrieved from keyutils. In case of error, the |
| 84 | + /// password is retrieved from secret-service instead (and |
| 85 | + /// keyutils is updated). |
| 86 | + fn get_password(&self) -> Result<String> { |
| 87 | + match self.keyutils.get_password() { |
| 88 | + Ok(password) => { |
| 89 | + return Ok(password); |
| 90 | + } |
| 91 | + Err(err) => { |
| 92 | + debug!("Failed get from keyutils: {err}; trying secret service") |
| 93 | + } |
| 94 | + } |
| 95 | + |
| 96 | + let password = self.ss.get_password().map_err(ambiguous_to_no_entry)?; |
| 97 | + self.keyutils.set_password(&password)?; |
| 98 | + |
| 99 | + Ok(password) |
| 100 | + } |
| 101 | + |
| 102 | + /// Retrieve a secret from the underlying store |
| 103 | + /// |
| 104 | + /// The secret is retrieved from keyutils. In case of error, the |
| 105 | + /// secret is retrieved from secret-service instead (and keyutils |
| 106 | + /// is updated). |
| 107 | + fn get_secret(&self) -> Result<Vec<u8>> { |
| 108 | + match self.keyutils.get_secret() { |
| 109 | + Ok(secret) => { |
| 110 | + return Ok(secret); |
| 111 | + } |
| 112 | + Err(err) => { |
| 113 | + debug!("Failed get from keyutils: {err}; trying secret service") |
| 114 | + } |
| 115 | + } |
| 116 | + |
| 117 | + let secret = self.ss.get_secret().map_err(ambiguous_to_no_entry)?; |
| 118 | + self.keyutils.set_secret(&secret)?; |
| 119 | + |
| 120 | + Ok(secret) |
| 121 | + } |
| 122 | + |
| 123 | + /// Delete a password from the underlying store. |
| 124 | + /// |
| 125 | + /// The credential is deleted from both keyutils and |
| 126 | + /// secret-service. |
| 127 | + fn delete_credential(&self) -> Result<()> { |
| 128 | + if let Err(err) = self.keyutils.delete_credential() { |
| 129 | + debug!("cannot delete keyutils credential: {err}"); |
| 130 | + } |
| 131 | + |
| 132 | + self.ss.delete_credential() |
| 133 | + } |
| 134 | + |
| 135 | + fn as_any(&self) -> &dyn std::any::Any { |
| 136 | + self |
| 137 | + } |
| 138 | + |
| 139 | + fn debug_fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { |
| 140 | + std::fmt::Debug::fmt(self, f) |
| 141 | + } |
| 142 | +} |
| 143 | + |
| 144 | +impl KeyutilsPersistentCredential { |
| 145 | + /// Create the platform credential for a Keyutils entry. |
| 146 | + /// |
| 147 | + /// This just passes the arguments to the underlying two stores |
| 148 | + /// and wraps their results with an entry that holds both. |
| 149 | + pub fn new_with_target(target: Option<&str>, service: &str, user: &str) -> Result<Self> { |
| 150 | + let ss = SsCredential::new_with_target(target, service, user)?; |
| 151 | + let keyutils = KeyutilsCredential::new_with_target(target, service, user)?; |
| 152 | + Ok(Self { keyutils, ss }) |
| 153 | + } |
| 154 | +} |
| 155 | + |
| 156 | +/// The builder for keyutils-persistent credentials |
| 157 | +#[derive(Debug, Default)] |
| 158 | +pub struct KeyutilsPersistentCredentialBuilder {} |
| 159 | + |
| 160 | +/// Returns an instance of the keyutils-persistent credential builder. |
| 161 | +/// |
| 162 | +/// If keyutils-persistent is the default credential store, this is |
| 163 | +/// called once when an entry is first created. |
| 164 | +pub fn default_credential_builder() -> Box<CredentialBuilder> { |
| 165 | + Box::new(KeyutilsPersistentCredentialBuilder {}) |
| 166 | +} |
| 167 | + |
| 168 | +impl CredentialBuilderApi for KeyutilsPersistentCredentialBuilder { |
| 169 | + /// Build a [KeyutilsPersistentCredential] for the given target, service, and user. |
| 170 | + fn build(&self, target: Option<&str>, service: &str, user: &str) -> Result<Box<Credential>> { |
| 171 | + Ok(Box::new(SsCredential::new_with_target( |
| 172 | + target, service, user, |
| 173 | + )?)) |
| 174 | + } |
| 175 | + |
| 176 | + /// Return the underlying builder object with an `Any` type so that it can |
| 177 | + /// be downgraded to a [KeyutilsPersistentCredentialBuilder] for platform-specific processing. |
| 178 | + fn as_any(&self) -> &dyn std::any::Any { |
| 179 | + self |
| 180 | + } |
| 181 | + |
| 182 | + /// Return the persistence of this store. |
| 183 | + /// |
| 184 | + /// This store's persistence derives from that of the secret service. |
| 185 | + fn persistence(&self) -> CredentialPersistence { |
| 186 | + SsCredentialBuilder {}.persistence() |
| 187 | + } |
| 188 | +} |
| 189 | + |
| 190 | +/// Replace any Ambiguous error with a NoEntry one |
| 191 | +fn ambiguous_to_no_entry(err: Error) -> Error { |
| 192 | + if let Error::Ambiguous(_) = err { |
| 193 | + return Error::NoEntry; |
| 194 | + }; |
| 195 | + |
| 196 | + err |
| 197 | +} |
| 198 | + |
| 199 | +#[cfg(test)] |
| 200 | +mod tests { |
| 201 | + use crate::{Entry, Error}; |
| 202 | + |
| 203 | + use super::KeyutilsPersistentCredential; |
| 204 | + |
| 205 | + fn entry_new(service: &str, user: &str) -> Entry { |
| 206 | + crate::tests::entry_from_constructor( |
| 207 | + KeyutilsPersistentCredential::new_with_target, |
| 208 | + service, |
| 209 | + user, |
| 210 | + ) |
| 211 | + } |
| 212 | + |
| 213 | + #[test] |
| 214 | + fn test_invalid_parameter() { |
| 215 | + let credential = KeyutilsPersistentCredential::new_with_target(Some(""), "service", "user"); |
| 216 | + assert!( |
| 217 | + matches!(credential, Err(Error::Invalid(_, _))), |
| 218 | + "Created entry with empty target" |
| 219 | + ); |
| 220 | + } |
| 221 | + |
| 222 | + #[test] |
| 223 | + fn test_empty_service_and_user() { |
| 224 | + crate::tests::test_empty_service_and_user(entry_new); |
| 225 | + } |
| 226 | + |
| 227 | + #[test] |
| 228 | + fn test_missing_entry() { |
| 229 | + crate::tests::test_missing_entry(entry_new); |
| 230 | + } |
| 231 | + |
| 232 | + #[test] |
| 233 | + fn test_empty_password() { |
| 234 | + let entry = entry_new("empty password service", "empty password user"); |
| 235 | + assert!( |
| 236 | + matches!(entry.set_password(""), Err(Error::Invalid(_, _))), |
| 237 | + "Able to set empty password" |
| 238 | + ); |
| 239 | + } |
| 240 | + |
| 241 | + #[test] |
| 242 | + fn test_round_trip_ascii_password() { |
| 243 | + crate::tests::test_round_trip_ascii_password(entry_new); |
| 244 | + } |
| 245 | + |
| 246 | + #[test] |
| 247 | + fn test_round_trip_non_ascii_password() { |
| 248 | + crate::tests::test_round_trip_non_ascii_password(entry_new); |
| 249 | + } |
| 250 | + |
| 251 | + #[test] |
| 252 | + fn test_round_trip_random_secret() { |
| 253 | + crate::tests::test_round_trip_random_secret(entry_new); |
| 254 | + } |
| 255 | + |
| 256 | + #[test] |
| 257 | + fn test_update() { |
| 258 | + crate::tests::test_update(entry_new); |
| 259 | + } |
| 260 | + |
| 261 | + #[test] |
| 262 | + fn test_noop_get_update_attributes() { |
| 263 | + crate::tests::test_noop_get_update_attributes(entry_new); |
| 264 | + } |
| 265 | +} |
0 commit comments