SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test: cryptenroll-varlink: Add tests for handing in a recovery key

Browse Source 
This adds two new tests to test the validation of the recovery key
passed to `Enroll()` and the generation of a recovery key by `MakeRecoveryKey()`.
This commit is contained in:
Julian Sparber
2026-09-23 09:30:28 +02:00
committed by Luca Boccassi
parent 9569d72182
commit 4b259b5630
1 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/units/TEST-70-TPM2.cryptenroll.sh
+18 -3
View File
@@ -113,6 +113,20 @@ cryptsetup luksFormat -q --pbkdf pbkdf2 --pbkdf-force-iterations 1000 --use-uran
varlinkctl call "$VL_ADDRESS" io.systemd.CryptEnroll.Enroll \
"{\"node\":\"$VL_IMAGE\",\"mechanism\":\"recovery\",\"unlockKeyFile\":\"/tmp/password\"}" | grep recoveryKey >/dev/null
# Enroll a recovery key generated via MakeRecoveryKey(), unlocking via key file (cf. systemd-cryptenroll --unlock-key-file= --recovery-key)
RECOVERY_KEY=$(varlinkctl call "$VL_ADDRESS" io.systemd.CryptEnroll.MakeRecoveryKey "{}" | jq -e -r '.recoveryKey')
RESULT_RECOVERY_KEY=$(varlinkctl call "$VL_ADDRESS" io.systemd.CryptEnroll.Enroll \
"{\"node\":\"$VL_IMAGE\",\"mechanism\":\"recovery\",\"recoveryKey\":\"$RECOVERY_KEY\",\"unlockKeyFile\":\"/tmp/password\"}" | jq -e -r '.recoveryKey')
test "$RECOVERY_KEY" = "$RESULT_RECOVERY_KEY"
# Ensure that the enrolled recovery key works
echo -n "$RECOVERY_KEY" | cryptsetup open --type=luks2 --test-passphrase --key-file=- "$VL_IMAGE"
# Fail to enroll a malformed recovery key, unlocking via key file (cf. systemd-cryptenroll --unlock-key-file= --recovery-key)
(! varlinkctl call "$VL_ADDRESS" io.systemd.CryptEnroll.Enroll \
"{\"node\":\"$VL_IMAGE\",\"mechanism\":\"recovery\",\"recoveryKey\":\"SOME_RANDOM_KEY\",\"unlockKeyFile\":\"/tmp/password\"}" | grep recoveryKey >/dev/null)
# Enroll a password, unlocking via key file (cf. NEWPASSWORD=… systemd-cryptenroll --unlock-key-file= --password)
varlinkctl call "$VL_ADDRESS" io.systemd.CryptEnroll.Enroll \
"{\"node\":\"$VL_IMAGE\",\"mechanism\":\"password\",\"unlockKeyFile\":\"/tmp/password\",\"password\":\"varlinkpassword\"}"
@@ -121,9 +135,10 @@ varlinkctl call "$VL_ADDRESS" io.systemd.CryptEnroll.Enroll \
varlinkctl --push-fd=3 call "$VL_ADDRESS" io.systemd.CryptEnroll.Enroll \
"{\"node\":\"$VL_IMAGE\",\"mechanism\":\"password\",\"unlockKeyFileDescriptor\":0,\"password\":\"fdpassword\"}" 3</tmp/password
# List enrolled slots (must be called with 'more'); we should see the password and recovery slots
varlinkctl call --more "$VL_ADDRESS" io.systemd.CryptEnroll.ListSlots "{\"node\":\"$VL_IMAGE\"}" | grep '"type":"recovery"' >/dev/null
varlinkctl call --more "$VL_ADDRESS" io.systemd.CryptEnroll.ListSlots "{\"node\":\"$VL_IMAGE\"}" | grep '"type":"password"' >/dev/null
# List enrolled slots (must be called with 'more'); we should see the password and the two recovery slots we enrolled
SLOTS=$(varlinkctl call --more "$VL_ADDRESS" io.systemd.CryptEnroll.ListSlots "{\"node\":\"$VL_IMAGE\"}")
test "$(grep -c '"type":"recovery"' <<<"$SLOTS")" -eq 2
grep '"type":"password"' <<<"$SLOTS" >/dev/null
# Enroll combined with a wipe of the recovery key slot (cf. systemd-cryptenroll --wipe-slot=recovery --password).
# The recovery key slot just got wiped, so it should be reported back in the (non-empty) wipedSlots output.