mirror of
https://github.com/ceph/ceph-csi.git
synced 2024-11-21 22:00:19 +00:00
cephfs: return ErrBadAuth
during keyFn retry
fscrypt will infinitely retry the keyFn during an auth failure,
preventing the csi driver from progressing when configured with
an invalid passphrase
See also:
8c12cd64ab/actions/callback.go (L102-L106)
Signed-off-by: Michael Fritch <mfritch@suse.com>
This commit is contained in:
parent
b8ab1c8bd8
commit
2368df7e69
@ -58,6 +58,11 @@ var policyV2Support = []util.KernelVersion{
|
||||
},
|
||||
}
|
||||
|
||||
// error values
|
||||
var (
|
||||
ErrBadAuth = errors.New("key authentication check failed")
|
||||
)
|
||||
|
||||
func AppendEncyptedSubdirectory(dir string) string {
|
||||
return path.Join(dir, FscryptSubdir)
|
||||
}
|
||||
@ -97,6 +102,10 @@ func createKeyFuncFromVolumeEncryption(
|
||||
volID string,
|
||||
) (func(fscryptactions.ProtectorInfo, bool) (*fscryptcrypto.Key, error), error) {
|
||||
keyFunc := func(info fscryptactions.ProtectorInfo, retry bool) (*fscryptcrypto.Key, error) {
|
||||
if retry {
|
||||
return nil, ErrBadAuth
|
||||
}
|
||||
|
||||
passphrase, err := getPassphrase(ctx, encryption, volID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
@ -375,7 +384,7 @@ func Unlock(
|
||||
return err
|
||||
}
|
||||
|
||||
// A proper set up fscrypy directory requires metadata and a kernel policy:
|
||||
// A proper set up fscrypt directory requires metadata and a kernel policy:
|
||||
|
||||
// 1. Do we have a metadata directory (.fscrypt) set up?
|
||||
metadataDirExists := false
|
||||
|
Loading…
Reference in New Issue
Block a user