2022-11-01 18:33:54 +00:00
|
|
|
use crate::{
|
|
|
|
action::{darwin::NIX_VOLUME_MOUNTD_DEST, Action, ActionDescription, ActionState},
|
|
|
|
execute_command,
|
|
|
|
};
|
|
|
|
use rand::Rng;
|
2022-10-19 20:32:15 +00:00
|
|
|
use std::path::{Path, PathBuf};
|
2022-11-01 18:33:54 +00:00
|
|
|
use tokio::process::Command;
|
2022-10-18 18:03:19 +00:00
|
|
|
|
|
|
|
#[derive(Debug, serde::Deserialize, serde::Serialize, Clone)]
|
|
|
|
pub struct EncryptVolume {
|
2022-10-19 20:32:15 +00:00
|
|
|
disk: PathBuf,
|
2022-11-01 18:33:54 +00:00
|
|
|
name: String,
|
2022-10-18 18:03:19 +00:00
|
|
|
action_state: ActionState,
|
|
|
|
}
|
|
|
|
|
|
|
|
impl EncryptVolume {
|
|
|
|
#[tracing::instrument(skip_all)]
|
2022-10-19 20:32:15 +00:00
|
|
|
pub async fn plan(
|
|
|
|
disk: impl AsRef<Path>,
|
2022-11-01 18:33:54 +00:00
|
|
|
name: impl AsRef<str>,
|
2022-10-26 21:14:53 +00:00
|
|
|
) -> Result<Self, Box<dyn std::error::Error + Send + Sync>> {
|
2022-11-01 18:33:54 +00:00
|
|
|
let name = name.as_ref().to_owned();
|
2022-10-18 18:03:19 +00:00
|
|
|
Ok(Self {
|
2022-11-01 18:33:54 +00:00
|
|
|
name,
|
2022-10-19 20:32:15 +00:00
|
|
|
disk: disk.as_ref().to_path_buf(),
|
2022-10-18 18:03:19 +00:00
|
|
|
action_state: ActionState::Uncompleted,
|
|
|
|
})
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
#[async_trait::async_trait]
|
2022-10-28 19:44:07 +00:00
|
|
|
#[typetag::serde(name = "encrypt_volume")]
|
2022-10-26 22:13:42 +00:00
|
|
|
impl Action for EncryptVolume {
|
2022-11-23 17:18:38 +00:00
|
|
|
fn tracing_synopsis(&self) -> String {
|
|
|
|
format!(
|
|
|
|
"Encrypt volume `{}` on disk `{}`",
|
|
|
|
self.name,
|
|
|
|
self.disk.display()
|
|
|
|
)
|
|
|
|
}
|
|
|
|
|
|
|
|
fn execute_description(&self) -> Vec<ActionDescription> {
|
|
|
|
vec![ActionDescription::new(self.tracing_synopsis(), vec![])]
|
2022-10-18 18:03:19 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#[tracing::instrument(skip_all, fields(
|
2022-10-19 20:32:15 +00:00
|
|
|
disk = %self.disk.display(),
|
2022-10-18 18:03:19 +00:00
|
|
|
))]
|
2022-10-26 21:14:53 +00:00
|
|
|
async fn execute(&mut self) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
|
2022-10-19 20:32:15 +00:00
|
|
|
let Self {
|
2022-11-01 18:33:54 +00:00
|
|
|
disk,
|
|
|
|
name,
|
2022-11-23 17:18:38 +00:00
|
|
|
action_state: _,
|
2022-10-19 20:32:15 +00:00
|
|
|
} = self;
|
2022-10-18 18:03:19 +00:00
|
|
|
|
2022-11-01 18:33:54 +00:00
|
|
|
// Generate a random password.
|
|
|
|
let password: String = {
|
|
|
|
const CHARSET: &[u8] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZ\
|
|
|
|
abcdefghijklmnopqrstuvwxyz\
|
|
|
|
0123456789)(*&^%$#@!~";
|
|
|
|
const PASSWORD_LEN: usize = 32;
|
|
|
|
let mut rng = rand::thread_rng();
|
|
|
|
|
|
|
|
(0..PASSWORD_LEN)
|
|
|
|
.map(|_| {
|
|
|
|
let idx = rng.gen_range(0..CHARSET.len());
|
|
|
|
CHARSET[idx] as char
|
|
|
|
})
|
|
|
|
.collect()
|
|
|
|
};
|
|
|
|
|
|
|
|
let disk_str = disk.to_str().expect("Could not turn disk into string"); /* Should not reasonably ever fail */
|
|
|
|
|
2022-11-01 22:31:31 +00:00
|
|
|
execute_command(Command::new("/usr/sbin/diskutil").arg("mount").arg(&name)).await?;
|
|
|
|
|
2022-11-01 18:33:54 +00:00
|
|
|
// Add the password to the user keychain so they can unlock it later.
|
2022-11-01 22:31:31 +00:00
|
|
|
execute_command(
|
2022-11-01 18:33:54 +00:00
|
|
|
Command::new("/usr/bin/security").args([
|
|
|
|
"add-generic-password",
|
|
|
|
"-a",
|
2022-11-01 22:31:31 +00:00
|
|
|
name.as_str(),
|
2022-11-01 18:33:54 +00:00
|
|
|
"-s",
|
|
|
|
name.as_str(),
|
|
|
|
"-l",
|
|
|
|
format!("{} encryption password", disk_str).as_str(),
|
|
|
|
"-D",
|
|
|
|
"Encrypted volume password",
|
|
|
|
"-j",
|
|
|
|
format!(
|
|
|
|
"Added automatically by the Nix installer for use by {NIX_VOLUME_MOUNTD_DEST}"
|
|
|
|
)
|
|
|
|
.as_str(),
|
|
|
|
"-w",
|
|
|
|
password.as_str(),
|
|
|
|
"-T",
|
|
|
|
"/System/Library/CoreServices/APFSUserAgent",
|
|
|
|
"-T",
|
|
|
|
"/System/Library/CoreServices/CSUserAgent",
|
|
|
|
"-T",
|
|
|
|
"/usr/bin/security",
|
|
|
|
"/Library/Keychains/System.keychain",
|
|
|
|
]),
|
|
|
|
)
|
|
|
|
.await?;
|
|
|
|
|
|
|
|
// Encrypt the mounted volume
|
|
|
|
execute_command(Command::new("/usr/sbin/diskutil").args([
|
|
|
|
"apfs",
|
|
|
|
"encryptVolume",
|
2022-11-01 22:31:31 +00:00
|
|
|
name.as_str(),
|
2022-11-01 18:33:54 +00:00
|
|
|
"-user",
|
|
|
|
"disk",
|
|
|
|
"-passphrase",
|
|
|
|
password.as_str(),
|
|
|
|
]))
|
|
|
|
.await?;
|
2022-10-18 18:03:19 +00:00
|
|
|
|
2022-11-01 22:31:31 +00:00
|
|
|
execute_command(
|
|
|
|
Command::new("/usr/sbin/diskutil")
|
|
|
|
.arg("unmount")
|
|
|
|
.arg("force")
|
|
|
|
.arg(&name),
|
|
|
|
)
|
|
|
|
.await?;
|
|
|
|
|
2022-10-18 18:03:19 +00:00
|
|
|
Ok(())
|
|
|
|
}
|
|
|
|
|
2022-11-23 17:18:38 +00:00
|
|
|
fn revert_description(&self) -> Vec<ActionDescription> {
|
|
|
|
vec![ActionDescription::new(
|
|
|
|
format!(
|
|
|
|
"Remove encryption keys for volume `{}`",
|
|
|
|
self.disk.display()
|
|
|
|
),
|
|
|
|
vec![],
|
|
|
|
)]
|
2022-10-18 18:03:19 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#[tracing::instrument(skip_all, fields(
|
2022-10-19 20:32:15 +00:00
|
|
|
disk = %self.disk.display(),
|
2022-10-18 18:03:19 +00:00
|
|
|
))]
|
2022-10-26 21:14:53 +00:00
|
|
|
async fn revert(&mut self) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
|
2022-10-19 20:32:15 +00:00
|
|
|
let Self {
|
2022-11-01 22:31:31 +00:00
|
|
|
disk,
|
|
|
|
name,
|
2022-11-23 17:18:38 +00:00
|
|
|
action_state: _,
|
2022-10-19 20:32:15 +00:00
|
|
|
} = self;
|
2022-11-01 22:31:31 +00:00
|
|
|
|
|
|
|
let disk_str = disk.to_str().expect("Could not turn disk into string"); /* Should not reasonably ever fail */
|
|
|
|
|
|
|
|
// TODO: This seems very rough and unsafe
|
|
|
|
execute_command(
|
|
|
|
Command::new("/usr/bin/security").args([
|
|
|
|
"delete-generic-password",
|
|
|
|
"-a",
|
|
|
|
name.as_str(),
|
|
|
|
"-s",
|
|
|
|
name.as_str(),
|
|
|
|
"-l",
|
|
|
|
format!("{} encryption password", disk_str).as_str(),
|
|
|
|
"-D",
|
|
|
|
"Encrypted volume password",
|
|
|
|
"-j",
|
|
|
|
format!(
|
|
|
|
"Added automatically by the Nix installer for use by {NIX_VOLUME_MOUNTD_DEST}"
|
|
|
|
)
|
|
|
|
.as_str(),
|
|
|
|
]),
|
|
|
|
)
|
|
|
|
.await?;
|
2022-10-18 18:03:19 +00:00
|
|
|
|
|
|
|
Ok(())
|
|
|
|
}
|
2022-11-08 18:18:05 +00:00
|
|
|
|
|
|
|
fn action_state(&self) -> ActionState {
|
|
|
|
self.action_state
|
|
|
|
}
|
2022-11-23 17:18:38 +00:00
|
|
|
|
|
|
|
fn set_action_state(&mut self, action_state: ActionState) {
|
|
|
|
self.action_state = action_state;
|
|
|
|
}
|
2022-10-18 18:03:19 +00:00
|
|
|
}
|
|
|
|
|
2022-10-26 22:13:42 +00:00
|
|
|
#[derive(Debug, thiserror::Error)]
|
2022-10-18 18:03:19 +00:00
|
|
|
pub enum EncryptVolumeError {
|
|
|
|
#[error("Failed to execute command")]
|
2022-10-26 22:13:42 +00:00
|
|
|
Command(#[source] std::io::Error),
|
2022-10-18 18:03:19 +00:00
|
|
|
}
|