[PATCH 3/3] Use BlockDev's crypto plugin to do LUKS escrow

Vratislav Podzimek vpodzime at redhat.com
Mon Feb 16 14:47:49 UTC 2015


This way we can get rid of the optional python-volume_key and python-nss
dependencies.

Signed-off-by: Vratislav Podzimek <vpodzime at redhat.com>
---
 blivet/formats/luks.py | 64 ++------------------------------------------------
 blivet/osinstall.py    | 11 ---------
 2 files changed, 2 insertions(+), 73 deletions(-)

diff --git a/blivet/formats/luks.py b/blivet/formats/luks.py
index dcb6da5..a5abc4d 100644
--- a/blivet/formats/luks.py
+++ b/blivet/formats/luks.py
@@ -23,11 +23,6 @@
 import os
 from gi.repository import BlockDev as blockdev
 
-try:
-    import volume_key
-except ImportError:
-    volume_key = None
-
 from ..storage_log import log_method_call
 from ..errors import LUKSError
 from ..devicelibs import crypto
@@ -287,65 +282,10 @@ class LUKS(DeviceFormat):
                                         passphrase=self.__passphrase,
                                         key_file=self._key_file)
 
-    def _escrowVolumeIdent(self, vol):
-        """ Return an escrow packet filename prefix for a volume_key.Volume. """
-        label = vol.label
-        if label is not None:
-            label = label.replace("/", "_")
-        uuid = vol.uuid
-        if uuid is not None:
-            uuid = uuid.replace("/", "_")
-        # uuid is never None on LUKS volumes
-        if label is not None and uuid is not None:
-            volume_ident = "%s-%s" % (label, uuid)
-        elif uuid is not None:
-            volume_ident = uuid
-        elif label is not None:
-            volume_ident = label
-        else:
-            volume_ident = "_unknown"
-        return volume_ident
-
     def escrow(self, directory, backupPassphrase):
         log.debug("escrow: escrowVolume start for %s", self.device)
-        if volume_key is None:
-            raise LUKSError("Missing key escrow support libraries")
-
-        vol = volume_key.Volume.open(self.device)
-        volume_ident = self._escrowVolumeIdent(vol)
-
-        ui = volume_key.UI()
-        # This callback is not expected to be used, let it always fail
-        ui.generic_cb = lambda unused_prompt, unused_echo: None
-        def known_passphrase_cb(unused_prompt, failed_attempts):
-            if failed_attempts == 0:
-                return self.__passphrase
-            return None
-        ui.passphrase_cb = known_passphrase_cb
-
-        log.debug("escrow: getting secret")
-        vol.get_secret(volume_key.SECRET_DEFAULT, ui)
-        log.debug("escrow: creating packet")
-        default_packet = vol.create_packet_assymetric_from_cert_data \
-            (volume_key.SECRET_DEFAULT, self.escrow_cert, ui)
-        log.debug("escrow: packet created")
-        with open("%s/%s-escrow" % (directory, volume_ident), "wb") as f:
-            f.write(default_packet)
-        log.debug("escrow: packet written")
-
-        if self.add_backup_passphrase:
-            log.debug("escrow: adding backup passphrase")
-            vol.add_secret(volume_key.SECRET_PASSPHRASE, backupPassphrase)
-            log.debug("escrow: creating backup packet")
-            backup_passphrase_packet = \
-                vol.create_packet_assymetric_from_cert_data \
-                (volume_key.SECRET_PASSPHRASE, self.escrow_cert, ui)
-            log.debug("escrow: backup packet created")
-            with open("%s/%s-escrow-backup-passphrase" %
-                      (directory, volume_ident), "wb") as f:
-                f.write(backup_passphrase_packet)
-            log.debug("escrow: backup packet written")
-
+        blockdev.crypto_escrow_device(self.device, self.__passphrase, self.escrow_cert,
+                                      directory, backupPassphrase)
         log.debug("escrow: escrowVolume done for %s", repr(self.device))
 
 
diff --git a/blivet/osinstall.py b/blivet/osinstall.py
index 8d4fc63..f2d1961 100644
--- a/blivet/osinstall.py
+++ b/blivet/osinstall.py
@@ -43,11 +43,6 @@ from .i18n import _
 import logging
 log = logging.getLogger("blivet")
 
-try:
-    import nss.nss
-except ImportError:
-    nss = None
-
 def releaseFromRedhatRelease(fn):
     """
     Attempt to identify the installation of a Linux distribution via
@@ -1083,12 +1078,6 @@ def writeEscrowPackets(storage):
 
     log.debug("escrow: writeEscrowPackets start")
 
-    if not nss:
-        log.error("escrow: no nss python module -- aborting")
-        return
-
-    nss.nss.nss_init_nodb() # Does nothing if NSS is already initialized
-
     backupPassphrase = generateBackupPassphrase()
 
     try:
-- 
2.1.0



More information about the anaconda-patches mailing list