← Back to branch summary

~ubuntu-branches/ubuntu/raring/ecryptfs-utils/raring

« back to all changes in this revision

Viewing changes to src/utils/ecryptfs-verify

  • Committer: Package Import Robot
  • Author(s): Dustin Kirkland
  • Date: 2011-10-27 10:55:04 UTC
  • mfrom: (1.1.38)
  • Revision ID: package-import@ubuntu.com-20111027105504-0e0sxt3m6mvcrs82
Tags: 93-0ubuntu1
https://launchpad.net/bugs/845738
https://launchpad.net/bugs/882267
https://launchpad.net/bugs/882314
* src/utils/ecryptfs-verify, src/utils/Makefile.am:
  - add an ecryptfs-verify utility, LP: #845738
* src/testcases/write-read.sh:
  - added a write/read test utility
* doc/manpage/ecryptfs-mount-private.1, doc/manpage/ecryptfs-setup-
  private.1, doc/manpage/mount.ecryptfs_private.1,
  doc/manpage/umount.ecryptfs_private.1: LP: #882267
  - remove inaccurate documentation about being a member of the ecryptfs
    group
* src/utils/ecryptfs-setup-private: LP: #882314
  - fix preseeded encrypted home Ubuntu installations (thanks Timo!)
* oneiric

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/utils/ecryptfs-verify
 
1
#!/bin/sh -e
 
2
#    ecryptfs-verify
 
3
#    Copyright (C) 2011 Dustin Kirkland <kirkland@ubuntu.com>
 
4
#
 
5
#    Authors: Dustin Kirkland <kirkland@ubuntu.com>
 
6
#
 
7
#    This program is free software; you can redistribute it and/or modify
 
8
#    it under the terms of the GNU General Public License as published by
 
9
#    the Free Software Foundation; version 2 of the License.
 
10
#
 
11
#    This program is distributed in the hope that it will be useful,
 
12
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
 
13
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 
14
#    GNU General Public License for more details.
 
15
#
 
16
#    You should have received a copy of the GNU General Public License
 
17
#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
18
 
 
19
error() {
 
20
        echo `gettext "ERROR:"` "$@" 1>&2
 
21
        echo `gettext "ERROR:"` "Configuration invalid" 1>&2
 
22
        exit 1
 
23
}
 
24
 
 
25
info() {
 
26
        echo `gettext "INFO:"` "$@"
 
27
}
 
28
 
 
29
usage() {
 
30
        echo "
 
31
Usage:
 
32
ecryptfs-verify [-h|--home] [-p|--private] [-e|--filenames-encrypted] [-n|--filenames-not-encrypted] [-u|--user USER] [--help]
 
33
 
 
34
 -h|--home                      True if HOME is correctly configured for
 
35
                                encryption, False otherwise
 
36
 
 
37
 -p|--private                   True if a non-HOME directory is correctly
 
38
                                configured for encryption, False otherwise
 
39
 
 
40
 -e|--filenames-encrypted       True if filenames are set for encryption,
 
41
                                False otherwise
 
42
 
 
43
 -n|--filenames-not-encrypted   True if filenames are not encrypted,
 
44
                                False otherwise
 
45
 
 
46
 -u|--user USER                 By default, the current user's configuration
 
47
                                is checked, override with this option
 
48
 
 
49
 --help                         This usage information
 
50
 
 
51
 Note that options are additive.  ALL checks must pass in order for this
 
52
 program to exit 0.  Any failing check will cause this program to exit
 
53
 non-zero.
 
54
 
 
55
"
 
56
        return 1
 
57
}
 
58
 
 
59
ecryptfs_exists() {
 
60
        local dotecryptfs="$1/.ecryptfs"
 
61
        if [ -d "$dotecryptfs" ]; then
 
62
                info "[$dotecryptfs] exists"
 
63
        else
 
64
                error "[$dotecryptfs] does not exist"
 
65
        fi
 
66
        return 0
 
67
}
 
68
 
 
69
sigfile_valid() {
 
70
        local sigfile="$1/.ecryptfs/Private.sig"
 
71
        if [ -f "$sigfile" ]; then
 
72
                info "[$sigfile] exists"
 
73
        else
 
74
                error "[$sigfile] does not exist"
 
75
        fi
 
76
        local c=$(wc -l "$sigfile" | awk '{print $1}')
 
77
        if [ "$c" = "1" ] || [ "$c" = "2" ]; then
 
78
                info "[$sigfile] contains [$c] signatures"
 
79
        else
 
80
                error "[$sigfile] does not contain exactly 1 or 2 lines"
 
81
        fi
 
82
        return 0
 
83
}
 
84
 
 
85
mountfile_valid() {
 
86
        local mountfile="$1/.ecryptfs/Private.mnt"
 
87
        if [ -f "$mountfile" ]; then
 
88
                info "[$mountfile] exists"
 
89
        else
 
90
                error "[$mountfile] does not exist"
 
91
        fi
 
92
        local m=$(cat "$mountfile")
 
93
        if [ -d "$m" ]; then
 
94
                info "[$m] is a directory"
 
95
        else
 
96
                error "[$m] is not a directory"
 
97
        fi
 
98
        return 0
 
99
}
 
100
 
 
101
automount_true() {
 
102
        local home="$1"
 
103
        local automount="$1/.ecryptfs/auto-mount"
 
104
        if [ -f "$automount" ]; then
 
105
                info "[$automount] Automount is set"
 
106
        else
 
107
                error "[$home/.ecryptfs/auto-mount] does not exist"
 
108
        fi
 
109
        return 0
 
110
}
 
111
 
 
112
owns_mountpoint() {
 
113
        local owner=$(stat -c "%U" "$2")
 
114
        if [ "$owner" = "$1" ]; then
 
115
                info "Ownership [$owner] of mount point [$2] is correct"
 
116
        else
 
117
                error "Invalid owner [$owner] of mount point [$2]"
 
118
        fi
 
119
}
 
120
 
 
121
mount_is_home() {
 
122
        local home="$1"
 
123
        local mountfile="$home/.ecryptfs/Private.mnt"
 
124
        local m=$(cat "$mountfile")
 
125
        if [ "$m" = "$home" ]; then
 
126
                info "Mount point [$m] is the user's home"
 
127
        else
 
128
                error "Mount point [$m] is not the user's home [$home]"
 
129
        fi
 
130
        owns_mountpoint "$user" "$m"
 
131
        return 0
 
132
}
 
133
 
 
134
mount_is_private() {
 
135
        local home="$1"
 
136
        local mountfile="$home/.ecryptfs/Private.mnt"
 
137
        local m=$(cat "$mountfile")
 
138
        if [ "$m" != "$home" ]; then
 
139
                info "Mount point [$m] is not the user's home [$home]"
 
140
        else
 
141
                error "Mount point [$m] is the user's home"
 
142
        fi
 
143
        if [ -d "$m" ]; then
 
144
                info "Mount point [$m] is a valid directory"
 
145
        else
 
146
                error "[$m] is not a valid mount point"
 
147
        fi
 
148
        owns_mountpoint "$user" "$m"
 
149
        return 0
 
150
}
 
151
 
 
152
filenames_encrypted() {
 
153
        local sigfile="$1/.ecryptfs/Private.sig"
 
154
        local c=$(wc -l "$sigfile" | awk '{print $1}')
 
155
        if [ "$c" = "2" ]; then
 
156
                info "Filenames are encrypted"
 
157
        else
 
158
                error "Filenames are not encrypted"
 
159
        fi
 
160
        return 0
 
161
}
 
162
 
 
163
filenames_not_encrypted() {
 
164
        local sigfile="$1/.ecryptfs/Private.sig"
 
165
        local c=$(wc -l "$sigfile" | awk '{print $1}')
 
166
        if [ "$c" = "1" ]; then
 
167
                info "Filenames are not encrypted"
 
168
        else
 
169
                error "Filenames are encrypted"
 
170
        fi
 
171
        return 0
 
172
}
 
173
 
 
174
home="$HOME"
 
175
user="$USER"
 
176
checks=
 
177
while [ ! -z "$1" ]; do
 
178
        case "$1" in
 
179
                -h|--home)
 
180
                        checks="$checks check_home"
 
181
                        shift
 
182
                ;;
 
183
                -p|--private)
 
184
                        checks="$checks check_private"
 
185
                        shift
 
186
                ;;
 
187
                -e|--filenames-encrypted)
 
188
                        checks="$checks check_filenames_encrypted"
 
189
                        shift
 
190
                ;;
 
191
                -n|--filenames-not-encrypted)
 
192
                        checks="$checks check_filenames_not_encrypted"
 
193
                        shift
 
194
                ;;
 
195
                --help)
 
196
                        usage
 
197
                ;;
 
198
                -u|--user)
 
199
                        user="$2"
 
200
                        home=$(getent passwd "$user" | awk -F: '{print $6}')
 
201
                        if [ ! -d "$home" ]; then
 
202
                                error "Invalid home directory [$home] of [$user]"
 
203
                        fi
 
204
                        shift 2
 
205
                ;;
 
206
        esac
 
207
done
 
208
 
 
209
if [ -z "$checks" ]; then
 
210
        error "No checks given"
 
211
fi
 
212
 
 
213
for i in $checks; do
 
214
        case "$i" in
 
215
                check_home)
 
216
                        ecryptfs_exists "$home"
 
217
                        sigfile_valid "$home"
 
218
                        mountfile_valid "$home"
 
219
                        automount_true "$home"
 
220
                        mount_is_home "$home"
 
221
                ;;
 
222
                check_private)
 
223
                        ecryptfs_exists "$home"
 
224
                        sigfile_valid "$home"
 
225
                        mountfile_valid "$home"
 
226
                        mount_is_private "$home"
 
227
                ;;
 
228
                check_filenames_encrypted)
 
229
                        ecryptfs_exists "$home"
 
230
                        sigfile_valid "$home"
 
231
                        filenames_encrypted "$home"
 
232
                ;;
 
233
                check_filenames_not_encrypted)
 
234
                        ecryptfs_exists "$home"
 
235
                        sigfile_valid "$home"
 
236
                        filenames_not_encrypted "$home"
 
237
                ;;
 
238
                *)
 
239
                        error "Invalid check [$i]"
 
240
                ;;
 
241
        esac
 
242
done
 
243
 
 
244
info "Configuration valid"
 
245
exit 0