Repository navigation
Add luks-slots --owner, a read-only owner slot query - #659
Merged
Merged
Conversation
luks-slots --owner prints the owner slot encrypt.state records once the root's LUKS header holds a key there, and changes nothing. omarchy-drive-password can then refuse, before any change, a password that opens another slot, such as a recovery key an earlier Mac setup added. A missing or invalid record fails with a message on stderr.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Agreed with the upstream runtime work (omacom#13362):
omarchy-drive-passwordwill runsudo omarchy-lifecycle-dispatch luks-slots --ownerbefore any change and refuse a password that opens another slot, such as a recovery key an earlier Mac setup added (follows #657).luks-slots --ownerreadsowner_slotfrom/boot/omarchy/encrypt.state, checks it is a slot number (0-31) and that the root's LUKS header holds a key there, and prints exactly that number. It writes nothing. It fails with a message on stderr whenencrypt.stateis missing, records no owner slot, records a non-numeric or out-of-range one, the header can't be read, or the header has no key in that slot (a keyring token with that number doesn't count).--ownertakes no other arguments;owner=/recovery=recording is unchanged.Release order: this
omarchy-mac-bootmust publish with or before the runtime whoseomarchy-drive-passwordcalls--owner. An olderluks-slotswould reject--owneras an unknown argument, so the password change would stop. Noted on omacom/omarchy-pkgs#673.Tested in an Arch container:
packages/omarchy-mac/boot/test/allpasses. New cases cover a valid recorded slot, a missing file, a missing record, non-numeric and out-of-range records, a slot absent from the header, a token standing in for a slot, an unreadable header and extra arguments. Each case checks that no file under the fixture's boot, etc, var or dev trees changed. The dispatch, drive-password, re-key journal and provision-owner shell tests pass.