From 4234812d1a202e3463400f495e84f63d806ec953 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Attila=20F=C3=BCl=C3=B6p?= Date: Sun, 14 Nov 2021 18:08:45 +0100 Subject: [PATCH] pam_zfs_key: tests: check if zfs load-key works on short passphrases MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pam_zfs_key pam module does not enforce a minimum password length while changing the user password and thus the users home dataset passphrase. To not end up with a dateset `zfs load-key` can't load the key for, `zfs load-key` should not enforce a minimum passphrase length. This adds a test for that. Reviewed-by: Felix Dörre Reviewed-by: Brian Behlendorf Signed-off-by: Attila Fülöp Closes #12765 Closes #12651 Closes #12656 --- tests/runfiles/linux.run | 2 +- .../tests/functional/pam/Makefile.am | 1 + .../functional/pam/pam_short_password.ksh | 84 +++++++++++++++++++ 3 files changed, 86 insertions(+), 1 deletion(-) create mode 100755 tests/zfs-tests/tests/functional/pam/pam_short_password.ksh diff --git a/tests/runfiles/linux.run b/tests/runfiles/linux.run index eab9c5dc77..58eefec319 100644 --- a/tests/runfiles/linux.run +++ b/tests/runfiles/linux.run @@ -125,7 +125,7 @@ tests = ['umount_unlinked_drain'] tags = ['functional', 'mount'] [tests/functional/pam:Linux] -tests = ['pam_basic', 'pam_nounmount'] +tests = ['pam_basic', 'pam_nounmount', 'pam_short_password'] tags = ['functional', 'pam'] [tests/functional/procfs:Linux] diff --git a/tests/zfs-tests/tests/functional/pam/Makefile.am b/tests/zfs-tests/tests/functional/pam/Makefile.am index 4d9ae17084..be881faccf 100644 --- a/tests/zfs-tests/tests/functional/pam/Makefile.am +++ b/tests/zfs-tests/tests/functional/pam/Makefile.am @@ -4,4 +4,5 @@ dist_pkgdata_SCRIPTS = \ cleanup.ksh \ pam_basic.ksh \ pam_nounmount.ksh \ + pam_short_password.ksh \ utilities.kshlib diff --git a/tests/zfs-tests/tests/functional/pam/pam_short_password.ksh b/tests/zfs-tests/tests/functional/pam/pam_short_password.ksh new file mode 100755 index 0000000000..1f72c9468a --- /dev/null +++ b/tests/zfs-tests/tests/functional/pam/pam_short_password.ksh @@ -0,0 +1,84 @@ +#!/bin/ksh -p +# +# CDDL HEADER START +# +# The contents of this file are subject to the terms of the +# Common Development and Distribution License (the "License"). +# You may not use this file except in compliance with the License. +# +# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE +# or http://www.opensolaris.org/os/licensing. +# See the License for the specific language governing permissions +# and limitations under the License. +# +# When distributing Covered Code, include this CDDL HEADER in each +# file and include the License file at usr/src/OPENSOLARIS.LICENSE. +# If applicable, add the following below this CDDL HEADER, with the +# fields enclosed by brackets "[]" replaced with your own identifying +# information: Portions Copyright [yyyy] [name of copyright owner] +# +# CDDL HEADER END +# + +# +# Copyright 2021 Attila Fülöp +# + + +. $STF_SUITE/tests/functional/pam/utilities.kshlib + +if [[ -z pamservice ]]; then + pamservice=pam_zfs_key_test +fi + +# DESCRIPTION: +# If we set the encryption passphrase for a dataset via pam_zfs_key, a minimal +# passphrase length isn't enforced. This leads to a non-loadable key if +# `zfs load-key` enforces a minimal length. Make sure this isn't the case. + +log_mustnot ismounted "$TESTPOOL/pam/${username}" +keystatus unavailable + +genconfig "homes=$TESTPOOL/pam runstatedir=${runstatedir}" + +# Load keys and mount userdir. +echo "testpass" | pamtester ${pamservice} ${username} open_session +references 1 +log_must ismounted "$TESTPOOL/pam/${username}" +keystatus available + +# Change user and dataset password to short one. +printf "short\nshort\n" | pamtester ${pamservice} ${username} chauthtok + +# Unmount and unload key. +log_must pamtester ${pamservice} ${username} close_session +references 0 +log_mustnot ismounted "$TESTPOOL/pam/${username}" +keystatus unavailable + +# Check if password change succeeded. +echo "testpass" | pamtester ${pamservice} ${username} open_session +references 1 +log_mustnot ismounted "$TESTPOOL/pam/${username}" +keystatus unavailable +log_must pamtester ${pamservice} ${username} close_session +references 0 + +echo "short" | pamtester ${pamservice} ${username} open_session +references 1 +log_must ismounted "$TESTPOOL/pam/${username}" +keystatus available + + +# Finally check if `zfs load-key` succeeds with the short password. +log_must pamtester ${pamservice} ${username} close_session +references 0 +log_mustnot ismounted "$TESTPOOL/pam/${username}" +keystatus unavailable + +echo "short" | zfs load-key "$TESTPOOL/pam/${username}" +keystatus available +zfs unload-key "$TESTPOOL/pam/${username}" +keystatus unavailable + +log_pass "done."