GKaszewski/k-os
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(storage): per-app/owner/system encryption live: gatekeeper hands seed + fresh flag, storage unlocks layer, init seeds areas from factory/ (empties on new key); rmdir op; test-qemu checks sealed home + reboot persistence

Browse Source
This commit is contained in:
Gabriel Kaszewski
2026-10-28 00:07:41 +01:00
parent e8191be160
commit 9dc751c466
20 changed files with 344 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
crates/servers/gatekeeper/src/lib.rs
View File

@@ -18,7 +18,7 @@ use alloc::vec;
use keystore::{Block, KdfParams};
use libkos::syscall::{self, Received};
use types::bounded::CapSlot;
use types::gatekeeper::{KEY, UNLOCK, reply};
use types::gatekeeper::{KEY, SEED, UNLOCK, reply};
/// Where init's manifest put them: its own endpoint (devices arrive on
/// it, then init's calls), then the terminal.
@@ -53,9 +53,10 @@ pub fn run() -> ! {
};
let mut memory = vec![Block::default(); KdfParams::DEFAULT.memory_kib as usize];
libkos::println!("gatekeeper: waiting for the owner");
let key = flow::run(
let mut random = devices::Hardware(random);
let unlocked = flow::run(
&mut devices::Disk(keystore),
&mut devices::Hardware(random),
&mut random,
&mut devices::Terminal(TERMINAL),
KdfParams::DEFAULT,
&mut memory,
@@ -65,14 +66,19 @@ pub fn run() -> ! {
*b = Block::default();
}
drop(memory);
match key {
Ok(key) => {
match unlocked {
Ok(flow::Unlocked { key, fresh }) => {
libkos::println!("gatekeeper: unlocked");
libkos::terminal::clear(TERMINAL);
let word = |i: usize| usize::from_le_bytes(key.0[i * 8..i * 8 + 8].try_into().unwrap_or([0; 8]));
if answer(UNLOCK, [reply::OK, 0, 0, 0]) {
let _ = answer(KEY, [word(0), word(1), word(2), word(3)]);
let words = |b: &[u8; 32]| core::array::from_fn::<usize, 4, _>(|i| usize::from_le_bytes(b[i * 8..i * 8 + 8].try_into().unwrap_or([0; 8])));
let mut seed = [0u8; 32];
let seeded = keystore::Random::fill(&mut random, &mut seed);
if seeded && answer(UNLOCK, [reply::OK, usize::from(fresh), 0, 0]) && answer(KEY, words(&key.0)) {
let _ = answer(SEED, words(&seed));
} else if !seeded {
let _ = answer(UNLOCK, [reply::FAILED, 0, 0, 0]);
}
seed.fill(0);
}
Err(why) => {
libkos::println!("gatekeeper: cannot go on: {:?}", why);