From owner-svn-src-head@FreeBSD.ORG Wed Oct 22 23:41:16 2014 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 02C083E1; Wed, 22 Oct 2014 23:41:16 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id E240B63D; Wed, 22 Oct 2014 23:41:15 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id s9MNfFXw048413; Wed, 22 Oct 2014 23:41:15 GMT (envelope-from cperciva@FreeBSD.org) Received: (from cperciva@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id s9MNfFDA048412; Wed, 22 Oct 2014 23:41:15 GMT (envelope-from cperciva@FreeBSD.org) Message-Id: <201410222341.s9MNfFDA048412@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: cperciva set sender to cperciva@FreeBSD.org using -f From: Colin Percival Date: Wed, 22 Oct 2014 23:41:15 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r273489 - head/sys/geom/eli X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Oct 2014 23:41:16 -0000 Author: cperciva Date: Wed Oct 22 23:41:15 2014 New Revision: 273489 URL: https://svnweb.freebsd.org/changeset/base/273489 Log: Populate the GELI passphrase cache with the kern.geom.eli.passphrase variable (if any) provided in the boot environment. Unset it from the kernel environment after doing this, so that the passphrase is no longer present in kernel memory once we enter userland. This will make it possible to provide a GELI passphrase via the boot loader; FreeBSD's loader does not yet do this, but GRUB (and PCBSD) will have support for this soon. Tested by: kmoore Modified: head/sys/geom/eli/g_eli.c Modified: head/sys/geom/eli/g_eli.c ============================================================================== --- head/sys/geom/eli/g_eli.c Wed Oct 22 23:35:56 2014 (r273488) +++ head/sys/geom/eli/g_eli.c Wed Oct 22 23:41:15 2014 (r273489) @@ -93,6 +93,25 @@ SYSCTL_UINT(_kern_geom_eli, OID_AUTO, bo &g_eli_boot_passcache, 0, "Passphrases are cached during boot process for possible reuse"); static void +fetch_loader_passphrase(void * dummy) +{ + char * env_passphrase; + + KASSERT(dynamic_kenv, ("need dynamic kenv")); + + if ((env_passphrase = kern_getenv("kern.geom.eli.passphrase")) != NULL) { + /* Extract passphrase from the environment. */ + strlcpy(cached_passphrase, env_passphrase, + sizeof(cached_passphrase)); + freeenv(env_passphrase); + + /* Wipe the passphrase from the environment. */ + kern_unsetenv("kern.geom.eli.passphrase"); + } +} +SYSINIT(geli_fetch_loader_passphrase, SI_SUB_KMEM + 1, SI_ORDER_ANY, + fetch_loader_passphrase, NULL); +static void zero_boot_passcache(void * dummy) {