Merge a050031d05 into 321c202e7c

man/daemon.xml

@@ -684,15 +684,6 @@ fi</programlisting>
     <citerefentry><refentrytitle>file-hierarchy</refentrytitle><manvolnum>7</manvolnum></citerefentry>.</para>
   </refsect1>
 
-  <refsect1>
-    <title>Notes</title>
-
-    <para>
-       All example codes in this page are licensed under <literal>MIT No Attribution</literal>
-      (SPDX-License-Identifier: MIT-0).
-    </para>
-  </refsect1>
-
   <refsect1>
     <title>See Also</title>
     <para><simplelist type="inline">

man/systemd-system.conf.xml

@@ -302,7 +302,7 @@
         and running in an initrd equivalent to true, otherwise false. This implements a restricted subset of
         the per-unit setting of the same name, see
         <citerefentry><refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum></citerefentry> for
-        details: currently, the <literal>full</literal> or <literal>strict</literal> values are not
+        details: currently, the <literal>full</literal> or <literal>struct</literal> values are not
         supported.</para>
 
         <xi:include href="version-info.xml" xpointer="v256"/></listitem>

src/cryptsetup/cryptsetup-pkcs11.c

@@ -16,7 +16,6 @@
 #include "fileio.h"
 #include "format-util.h"
 #include "hexdecoct.h"
-#include "iovec-util.h"
 #include "macro.h"
 #include "memory-util.h"
 #include "parse-util.h"
@@ -32,7 +31,8 @@ int decrypt_pkcs11_key(
                 const char *key_file,         /* We either expect key_file and associated parameters to be set (for file keys) … */
                 size_t key_file_size,
                 uint64_t key_file_offset,
-                const struct iovec *key_data, /* … or literal keys via key_data */
+                const void *key_data,         /* … or key_data and key_data_size (for literal keys) */
+                size_t key_data_size,
                 usec_t until,
                 AskPasswordFlags askpw_flags,
                 void **ret_decrypted_key,
@@ -47,15 +47,15 @@ int decrypt_pkcs11_key(
 
         assert(friendly_name);
         assert(pkcs11_uri);
-        assert(key_file || iovec_is_set(key_data));
+        assert(key_file || key_data);
         assert(ret_decrypted_key);
         assert(ret_decrypted_key_size);
 
         /* The functions called here log about all errors, except for EAGAIN which means "token not found right now" */
 
-        if (iovec_is_set(key_data)) {
+        if (key_data) {
-                data.encrypted_key = (void*) key_data->iov_base;
+                data.encrypted_key = (void*) key_data;
-                data.encrypted_key_size = key_data->iov_len;
+                data.encrypted_key_size = key_data_size;
 
                 data.free_encrypted_key = false;
         } else {

src/cryptsetup/cryptsetup-pkcs11.h

@@ -16,7 +16,8 @@ int decrypt_pkcs11_key(
                 const char *key_file,
                 size_t key_file_size,
                 uint64_t key_file_offset,
-                const struct iovec *key_data,
+                const void *key_data,
+                size_t key_data_size,
                 usec_t until,
                 AskPasswordFlags askpw_flags,
                 void **ret_decrypted_key,
@@ -38,7 +39,8 @@ static inline int decrypt_pkcs11_key(
                 const char *key_file,
                 size_t key_file_size,
                 uint64_t key_file_offset,
-                const struct iovec *key_data,
+                const void *key_data,
+                size_t key_data_size,
                 usec_t until,
                 AskPasswordFlags askpw_flags,
                 void **ret_decrypted_key,

src/cryptsetup/cryptsetup.c

@@ -1471,7 +1471,8 @@ static int attach_luks_or_plain_or_bitlk_by_fido2(
                 struct crypt_device *cd,
                 const char *name,
                 const char *key_file,
-                const struct iovec *key_data,
+                const void *key_data,
+                size_t key_data_size,
                 usec_t until,
                 uint32_t flags,
                 bool pass_volume_key) {
@@ -1488,7 +1489,7 @@ static int attach_luks_or_plain_or_bitlk_by_fido2(
         assert(name);
         assert(arg_fido2_device || arg_fido2_device_auto);
 
-        if (arg_fido2_cid && !key_file && !iovec_is_set(key_data))
+        if (arg_fido2_cid && !key_file && !key_data)
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
                                         "FIDO2 mode with manual parameters selected, but no keyfile specified, refusing.");
 
@@ -1512,7 +1513,7 @@ static int attach_luks_or_plain_or_bitlk_by_fido2(
                                                 arg_fido2_rp_id,
                                                 arg_fido2_cid, arg_fido2_cid_size,
                                                 key_file, arg_keyfile_size, arg_keyfile_offset,
-                                                key_data,
+                                                key_data, key_data_size,
                                                 until,
                                                 arg_fido2_manual_flags,
                                                 "cryptsetup.fido2-pin",
@@ -1622,7 +1623,8 @@ static int attach_luks_or_plain_or_bitlk_by_pkcs11(
                 struct crypt_device *cd,
                 const char *name,
                 const char *key_file,
-                const struct iovec *key_data,
+                const void *key_data,
+                size_t key_data_size,
                 usec_t until,
                 uint32_t flags,
                 bool pass_volume_key) {
@@ -1633,7 +1635,6 @@ static int attach_luks_or_plain_or_bitlk_by_pkcs11(
         _cleanup_(erase_and_freep) void *decrypted_key = NULL;
         _cleanup_(sd_event_unrefp) sd_event *event = NULL;
         _cleanup_free_ void *discovered_key = NULL;
-        struct iovec discovered_key_data = {};
         int keyslot = arg_key_slot, r;
         const char *uri = NULL;
         bool use_libcryptsetup_plugin = use_token_plugins();
@@ -1652,13 +1653,13 @@ static int attach_luks_or_plain_or_bitlk_by_pkcs11(
                                 return r;
 
                         uri = discovered_uri;
-                        discovered_key_data = IOVEC_MAKE(discovered_key, discovered_key_size);
+                        key_data = discovered_key;
-                        key_data = &discovered_key_data;
+                        key_data_size = discovered_key_size;
                 }
         } else {
                 uri = arg_pkcs11_uri;
 
-                if (!key_file && !iovec_is_set(key_data))
+                if (!key_file && !key_data)
                         return log_error_errno(SYNTHETIC_ERRNO(EINVAL), "PKCS#11 mode selected but no key file specified, refusing.");
         }
 
@@ -1681,7 +1682,7 @@ static int attach_luks_or_plain_or_bitlk_by_pkcs11(
                                         friendly,
                                         uri,
                                         key_file, arg_keyfile_size, arg_keyfile_offset,
-                                        key_data,
+                                        key_data, key_data_size,
                                         until,
                                         arg_ask_password_flags,
                                         &decrypted_key, &decrypted_key_size);
@@ -2230,9 +2231,9 @@ static int attach_luks_or_plain_or_bitlk(
         if (token_type == TOKEN_TPM2)
                 return attach_luks_or_plain_or_bitlk_by_tpm2(cd, name, key_file, key_data, until, flags, pass_volume_key);
         if (token_type == TOKEN_FIDO2)
-                return attach_luks_or_plain_or_bitlk_by_fido2(cd, name, key_file, key_data, until, flags, pass_volume_key);
+                return attach_luks_or_plain_or_bitlk_by_fido2(cd, name, key_file, key_data->iov_base, key_data->iov_len, until, flags, pass_volume_key);
         if (token_type == TOKEN_PKCS11)
-                return attach_luks_or_plain_or_bitlk_by_pkcs11(cd, name, key_file, key_data, until, flags, pass_volume_key);
+                return attach_luks_or_plain_or_bitlk_by_pkcs11(cd, name, key_file, key_data->iov_base, key_data->iov_len, until, flags, pass_volume_key);
         if (key_data)
                 return attach_luks_or_plain_or_bitlk_by_key_data(cd, name, key_data, flags, pass_volume_key);
         if (key_file)

src/shared/cryptsetup-fido2.c

@@ -24,7 +24,8 @@ int acquire_fido2_key(
                 const char *key_file,
                 size_t key_file_size,
                 uint64_t key_file_offset,
-                const struct iovec *key_data,
+                const void *key_data,
+                size_t key_data_size,
                 usec_t until,
                 Fido2EnrollFlags required,
                 const char *askpw_credential,
@@ -44,10 +45,10 @@ int acquire_fido2_key(
                                         "Local verification is required to unlock this volume, but the 'headless' parameter was set.");
 
         assert(cid);
-        assert(key_file || iovec_is_set(key_data));
+        assert(key_file || key_data);
 
-        if (iovec_is_set(key_data))
+        if (key_data)
-                salt = *key_data;
+                salt = IOVEC_MAKE(key_data, key_data_size);
         else {
                 if (key_file_size > 0)
                         log_debug("Ignoring 'keyfile-size=' option for a FIDO2 salt file.");
@@ -251,7 +252,7 @@ int acquire_fido2_key_auto(
                                 /* key_file= */ NULL, /* salt is read from LUKS header instead of key_file */
                                 /* key_file_size= */ 0,
                                 /* key_file_offset= */ 0,
-                                &IOVEC_MAKE(salt, salt_size),
+                                salt, salt_size,
                                 until,
                                 required,
                                 "cryptsetup.fido2-pin",

src/shared/cryptsetup-fido2.h

@@ -20,7 +20,8 @@ int acquire_fido2_key(
                 const char *key_file,
                 size_t key_file_size,
                 uint64_t key_file_offset,
-                const struct iovec *key_data,
+                const void *key_data,
+                size_t key_data_size,
                 usec_t until,
                 Fido2EnrollFlags required,
                 const char *askpw_credential,
@@ -51,7 +52,8 @@ static inline int acquire_fido2_key(
                 const char *key_file,
                 size_t key_file_size,
                 uint64_t key_file_offset,
-                const struct iovec *key_data,
+                const void *key_data,
+                size_t key_data_size,
                 usec_t until,
                 Fido2EnrollFlags required,
                 const char *askpw_credential,

src/sysupdate/updatectl.c

@@ -1414,7 +1414,7 @@ static int verb_enable(int argc, char **argv, void *userdata) {
                                        "SetFeatureEnabled",
                                        &error,
                                        /* reply= */ NULL,
-                                       "sit",
+                                       "sbt",
                                        *feature,
                                        (int) enable,
                                        UINT64_C(0));