GKaszewski/k-os
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(users): keystore v2 (8 slots, per-user salt+name tag, owner admin key opens sealed user dir, per-user duress); gatekeeper login by name+passcode, owner menu (add/remove/guests), passcode change, guest sessions

Browse Source
This commit is contained in:
Gabriel Kaszewski
2026-10-28 00:29:07 +01:00
parent 9dc751c466
commit 29a25bd8c2
9 changed files with 1232 additions and 417 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
crates/types/src/gatekeeper.rs
View File

@@ -1,17 +1,34 @@
//! Init and the gatekeeper: after handing it the keystore and randomness
//! (device setup calls), init calls `UNLOCK`, which returns once the owner
//! is authenticated (`OK`, word 1 non-zero if the master key is new: a
//! fresh device or one just wiped) or the gatekeeper cannot go on
//! (`FAILED`); then `KEY`, whose reply is the 32-byte master key in its four
//! words, and `SEED`, 32 fresh random bytes from the hardware for storage's
//! randomness this boot. The gatekeeper then exits. Only the unbadged
//! holder (init) is answered.
//! (device setup calls), init calls `UNLOCK`, which returns once someone
//! is in (`OK`) or the gatekeeper cannot go on (`FAILED`). Then:
//! - `KEY`: the 32-byte master key of whoever signed in, in four words;
//! - `SEED`: 32 fresh random bytes from the hardware for storage this boot;
//! - `NAME`: their name, as a text message (`types::log`);
//! - `REMOVED`, until it says `DONE`: the id of a user removed just now,
//! whose files are to go.
//!
//! The gatekeeper then exits. Only the unbadged holder (init) is answered.
pub const UNLOCK: usize = 1;
pub const KEY: usize = 2;
pub const SEED: usize = 3;
pub const NAME: usize = 4;
pub const REMOVED: usize = 5;
/// `UNLOCK`'s reply: `[OK, flags, user id, role]`.
pub mod unlocked {
/// The keystore is new (first boot, or just wiped): no earlier user's
/// files can be opened any more.
pub const FRESH: usize = 1;
/// A guest: no user id, a key nobody keeps.
pub const GUEST: usize = 2;
pub const OWNER: usize = 1;
pub const STANDARD: usize = 2;
}
pub mod reply {
pub const OK: usize = 0;
pub const FAILED: usize = 1;
/// `REMOVED` has no more.
pub const DONE: usize = 2;
}