| commit | 59dffa63af63ac1021f372e4505fb8c1b9084906 | [log] [tgz] |
|---|---|---|
| author | John Edward Broadbent <jebr@google.com> | Thu Jan 13 17:41:32 2022 -0800 |
| committer | John Broadbent <jebr@google.com> | Tue Jan 25 21:06:45 2022 +0000 |
| tree | 1d65c84c7ac356e483920889341b218a8725fe2c | |
| parent | 6978676100aa65c551e00ea58c6a891223f25be5 [diff] |
Add crypto Erase to eStorageD. The goal is to erase the keys that are used to decrypt the drive. After the keys are erased it will not be possible to decrypt the drive, even if the password can be recalled. The data is forever inaccessible. Testing: $ systemctl stop emmc.service $ /eStoraged -b /dev/mmcblk0 & $ busctl call xyz.openbmc_project.eStoraged.mmcblk0 /xyz/openbmc_project/storage/mmcblk0 xyz.openbmc_project.Inventory.Item.Volume FormatLuks ays 3 1 2 3 xyz.openbmc_project.Inventory.Item.Volume.FilesystemType.ext4 $ busctl call xyz.openbmc_project.eStoraged.mmcblk0 /xyz/openbmc_project/storage/mmcblk0 xyz.openbmc_project.Inventory.Item.Volume Lock $ busctl call xyz.openbmc_project.eStoraged.mmcblk0 /xyz/openbmc_project/storage/mmcblk0 xyz.openbmc_project.Inventory.Item.Volume Erase s xyz.openbmc_project.Inventory.Item.Volume.EraseMethod.CryptoErase $ busctl call xyz.openbmc_project.eStoraged.mmcblk0 /xyz/openbmc_project/storage/mmcblk0 xyz.openbmc_project.Inventory.Item.Volume Unlock ay 3 1 2 3 Call failed: The operation failed internally. Signed-off-by: John Edward Broadbent <jebr@google.com> Change-Id: I3221e82a92c1b555e2379b19c9e1d5b6e4b02f9b
This daemon serves as an abstraction for an encrypted storage device, encapsulating the security functionality and providing a D-Bus interface to manage the encrypted filesystem on the device. Using the D-Bus interface, other software components can interact with eStoraged to do things like create a new encrypted filesystem, wipe its contents, lock/unlock the device, or change the password.