[PATCH 3/3] Use BlockDev's crypto plugin to do LUKS escrow
Vratislav Podzimek
vpodzime at redhat.com
Mon Feb 16 14:47:49 UTC 2015
This way we can get rid of the optional python-volume_key and python-nss
dependencies.
Signed-off-by: Vratislav Podzimek <vpodzime at redhat.com>
---
blivet/formats/luks.py | 64 ++------------------------------------------------
blivet/osinstall.py | 11 ---------
2 files changed, 2 insertions(+), 73 deletions(-)
diff --git a/blivet/formats/luks.py b/blivet/formats/luks.py
index dcb6da5..a5abc4d 100644
--- a/blivet/formats/luks.py
+++ b/blivet/formats/luks.py
@@ -23,11 +23,6 @@
import os
from gi.repository import BlockDev as blockdev
-try:
- import volume_key
-except ImportError:
- volume_key = None
-
from ..storage_log import log_method_call
from ..errors import LUKSError
from ..devicelibs import crypto
@@ -287,65 +282,10 @@ class LUKS(DeviceFormat):
passphrase=self.__passphrase,
key_file=self._key_file)
- def _escrowVolumeIdent(self, vol):
- """ Return an escrow packet filename prefix for a volume_key.Volume. """
- label = vol.label
- if label is not None:
- label = label.replace("/", "_")
- uuid = vol.uuid
- if uuid is not None:
- uuid = uuid.replace("/", "_")
- # uuid is never None on LUKS volumes
- if label is not None and uuid is not None:
- volume_ident = "%s-%s" % (label, uuid)
- elif uuid is not None:
- volume_ident = uuid
- elif label is not None:
- volume_ident = label
- else:
- volume_ident = "_unknown"
- return volume_ident
-
def escrow(self, directory, backupPassphrase):
log.debug("escrow: escrowVolume start for %s", self.device)
- if volume_key is None:
- raise LUKSError("Missing key escrow support libraries")
-
- vol = volume_key.Volume.open(self.device)
- volume_ident = self._escrowVolumeIdent(vol)
-
- ui = volume_key.UI()
- # This callback is not expected to be used, let it always fail
- ui.generic_cb = lambda unused_prompt, unused_echo: None
- def known_passphrase_cb(unused_prompt, failed_attempts):
- if failed_attempts == 0:
- return self.__passphrase
- return None
- ui.passphrase_cb = known_passphrase_cb
-
- log.debug("escrow: getting secret")
- vol.get_secret(volume_key.SECRET_DEFAULT, ui)
- log.debug("escrow: creating packet")
- default_packet = vol.create_packet_assymetric_from_cert_data \
- (volume_key.SECRET_DEFAULT, self.escrow_cert, ui)
- log.debug("escrow: packet created")
- with open("%s/%s-escrow" % (directory, volume_ident), "wb") as f:
- f.write(default_packet)
- log.debug("escrow: packet written")
-
- if self.add_backup_passphrase:
- log.debug("escrow: adding backup passphrase")
- vol.add_secret(volume_key.SECRET_PASSPHRASE, backupPassphrase)
- log.debug("escrow: creating backup packet")
- backup_passphrase_packet = \
- vol.create_packet_assymetric_from_cert_data \
- (volume_key.SECRET_PASSPHRASE, self.escrow_cert, ui)
- log.debug("escrow: backup packet created")
- with open("%s/%s-escrow-backup-passphrase" %
- (directory, volume_ident), "wb") as f:
- f.write(backup_passphrase_packet)
- log.debug("escrow: backup packet written")
-
+ blockdev.crypto_escrow_device(self.device, self.__passphrase, self.escrow_cert,
+ directory, backupPassphrase)
log.debug("escrow: escrowVolume done for %s", repr(self.device))
diff --git a/blivet/osinstall.py b/blivet/osinstall.py
index 8d4fc63..f2d1961 100644
--- a/blivet/osinstall.py
+++ b/blivet/osinstall.py
@@ -43,11 +43,6 @@ from .i18n import _
import logging
log = logging.getLogger("blivet")
-try:
- import nss.nss
-except ImportError:
- nss = None
-
def releaseFromRedhatRelease(fn):
"""
Attempt to identify the installation of a Linux distribution via
@@ -1083,12 +1078,6 @@ def writeEscrowPackets(storage):
log.debug("escrow: writeEscrowPackets start")
- if not nss:
- log.error("escrow: no nss python module -- aborting")
- return
-
- nss.nss.nss_init_nodb() # Does nothing if NSS is already initialized
-
backupPassphrase = generateBackupPassphrase()
try:
--
2.1.0
More information about the anaconda-patches
mailing list