New issue
Advanced search Search tips

Issue 741786 link

Starred by 3 users

Issue metadata

Status: Fixed
Owner:
Closed: Sep 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 3
Type: Bug

Blocked on:
issue 764540



Sign in to add a comment

Run cryptohome as non-root user

Project Member Reported by mpdenton@google.com, Jul 12 2017

Issue description

For security reasons we should run cryptohome as a non-root user.
 
Project Member

Comment 1 by sheriffbot@chromium.org, Jul 13 2017

Labels: Hotlist-Google
Project Member

Comment 2 by bugdroid1@chromium.org, Jul 19 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/eclass-overlay/+/0d3c12451a22acb0838ecb4aa8438222ac225553

commit 0d3c12451a22acb0838ecb4aa8438222ac225553
Author: Matthew Denton <mpdenton@google.com>
Date: Wed Jul 19 04:50:33 2017

Add cryptohome user for the cryptohome service.

Creates a cryptohome user, and group, for cryptohome to run as.

BUG= chromium:741786 
TEST=emerge-${BOARD} cryptohome

Change-Id: Idf12a097e072cea51e0dc53998b93ae0578c9afc
Reviewed-on: https://chromium-review.googlesource.com/569182
Commit-Ready: Matthew Denton <mpdenton@google.com>
Tested-by: Greg Kerr <kerrnel@chromium.org>
Tested-by: Matthew Denton <mpdenton@google.com>
Reviewed-by: Greg Kerr <kerrnel@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[add] https://crrev.com/0d3c12451a22acb0838ecb4aa8438222ac225553/profiles/base/accounts/user/cryptohome
[add] https://crrev.com/0d3c12451a22acb0838ecb4aa8438222ac225553/profiles/base/accounts/group/cryptohome

Project Member

Comment 3 by bugdroid1@chromium.org, Jul 20 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/f7ff65bd0e20ce532d97cc511e1c0ff1749ae91d

commit f7ff65bd0e20ce532d97cc511e1c0ff1749ae91d
Author: Matthew Denton <mpdenton@google.com>
Date: Thu Jul 20 07:36:56 2017

Update cryptohome ebuild to create cryptohome user

Updated the cryptohome ebuild file with a pkg_preinst to create the
new user and group "cryptohome".

BUG= chromium:741786 
TEST=emerge-${BOARD} cryptohome
CQ-DEPEND=CL:569016

Change-Id: Iae66830d36d48d73f39f27efe245b1e3f4c2695b
Reviewed-on: https://chromium-review.googlesource.com/569066
Commit-Ready: Matthew Denton <mpdenton@google.com>
Tested-by: Greg Kerr <kerrnel@chromium.org>
Reviewed-by: Greg Kerr <kerrnel@chromium.org>

[modify] https://crrev.com/f7ff65bd0e20ce532d97cc511e1c0ff1749ae91d/chromeos-base/cryptohome/cryptohome-9999.ebuild

Project Member

Comment 4 by bugdroid1@chromium.org, Jul 20 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/autotest/+/0be215d51744c5a682ab6d5b70f24f4505f0e2f3

commit 0be215d51744c5a682ab6d5b70f24f4505f0e2f3
Author: Matthew Denton <mpdenton@google.com>
Date: Thu Jul 20 07:36:56 2017

Add cryptohome to the baseline accounts test.

This adds cryptohome to the baseline accounts test to note its new
group.

BUG= chromium:741786 
TEST=emerge-${BOARD} cryptohome
CQ-DEPEND=CL:569066

Change-Id: I2ea6404bf14bf3dbdd686de6f0be3f6bbd82b786
Reviewed-on: https://chromium-review.googlesource.com/569016
Commit-Ready: Matthew Denton <mpdenton@google.com>
Tested-by: Matthew Denton <mpdenton@google.com>
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>

[modify] https://crrev.com/0be215d51744c5a682ab6d5b70f24f4505f0e2f3/client/site_tests/security_AccountsBaseline/baseline.group
[modify] https://crrev.com/0be215d51744c5a682ab6d5b70f24f4505f0e2f3/client/site_tests/security_AccountsBaseline/baseline.passwd

Project Member

Comment 5 by bugdroid1@chromium.org, Aug 4 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/3bb107b6d68d92f23927b99643934be3554a6668

commit 3bb107b6d68d92f23927b99643934be3554a6668
Author: Matthew Denton <mpdenton@google.com>
Date: Fri Aug 04 22:39:04 2017

upstart: Create dircrypto keyring with owner "cryptohome"

This CL creates the dircrypto keyring with owner user and group as
"cryptohome". This is necessary in order to run cryptohome as non-root
user "cryptohome", as cryptohome needs to create keys in the dircrypto
keyring. The keyring was originally owned (and could only be modified
by) root.

BUG= chromium:741786 
TEST=pre-cq
CQ-DEPEND=CL:568778,CL:596670

Change-Id: I0e5152e150fdca1ac4208aae68c4b5c2457003f0
Reviewed-on: https://chromium-review.googlesource.com/590705
Commit-Ready: Matthew Denton <mpdenton@google.com>
Tested-by: Shuqian Zhao <shuqianz@chromium.org>
Tested-by: Matthew Denton <mpdenton@google.com>
Reviewed-by: Ryo Hashimoto <hashimoto@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/3bb107b6d68d92f23927b99643934be3554a6668/sys-apps/upstart/files/upstart-1.2-dircrypto.patch
[rename] https://crrev.com/3bb107b6d68d92f23927b99643934be3554a6668/sys-apps/upstart/upstart-1.2-r20.ebuild

Project Member

Comment 6 by bugdroid1@chromium.org, Aug 4 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/autotest/+/2f972f0c098113976403925fadd77b43c754b76f

commit 2f972f0c098113976403925fadd77b43c754b76f
Author: Matthew Denton <mpdenton@google.com>
Date: Fri Aug 04 22:39:05 2017

Update security tests for non-root cryptohomed

This updates the security_SandboxedServices, security_ProfilePermissions,
and security_StatefulPermissions tests to reflect the fact that cryptohomed
runs and mounts directories under the "cryptohome" user instead of "root".

BUG= chromium:741786 
TEST=ran these autotests against betty VM and heli testing device.
CQ-DEPEND=CL:590705,CL:568778

Change-Id: I67002e0f0546bd0cfeb0e063ff99b59333a479f7
Reviewed-on: https://chromium-review.googlesource.com/596670
Commit-Ready: Matthew Denton <mpdenton@google.com>
Tested-by: Matthew Denton <mpdenton@google.com>
Reviewed-by: Greg Kerr <kerrnel@chromium.org>

[modify] https://crrev.com/2f972f0c098113976403925fadd77b43c754b76f/client/site_tests/security_ProfilePermissions/security_ProfilePermissions.py
[modify] https://crrev.com/2f972f0c098113976403925fadd77b43c754b76f/client/site_tests/security_StatefulPermissions/security_StatefulPermissions.py
[modify] https://crrev.com/2f972f0c098113976403925fadd77b43c754b76f/client/site_tests/security_SandboxedServices/baseline

Project Member

Comment 7 by bugdroid1@chromium.org, Aug 4 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/38634c27935ff458b82b77171d7c0fb23918dc82

commit 38634c27935ff458b82b77171d7c0fb23918dc82
Author: Matthew Denton <mpdenton@google.com>
Date: Fri Aug 04 22:39:04 2017

cryptohome: Run cryptohome under minijial

Modified cryptohomed and cryptohome to run under the non-root user
"cryptohome". Modified chaps and cryptohome dbus conf files to
use cryptohome instead of root.

BUG= chromium:741786 
TEST=test_that platform_Cryptohome*
CQ-DEPEND=CL:569066,CL:569016,CL:590705,CL:596670

Change-Id: I35d3dc0eac95b7b66fd3f2cd47c5fcece08a33e3
Reviewed-on: https://chromium-review.googlesource.com/568778
Commit-Ready: Matthew Denton <mpdenton@google.com>
Tested-by: Shuqian Zhao <shuqianz@chromium.org>
Tested-by: Matthew Denton <mpdenton@google.com>
Reviewed-by: Greg Kerr <kerrnel@chromium.org>
Reviewed-by: Matthew Denton <mpdenton@google.com>

[modify] https://crrev.com/38634c27935ff458b82b77171d7c0fb23918dc82/cryptohome/cryptohomed.cc
[modify] https://crrev.com/38634c27935ff458b82b77171d7c0fb23918dc82/cryptohome/etc/Cryptohome.conf
[modify] https://crrev.com/38634c27935ff458b82b77171d7c0fb23918dc82/cryptohome/cryptohome.cc
[modify] https://crrev.com/38634c27935ff458b82b77171d7c0fb23918dc82/cryptohome/cryptohome.gyp
[modify] https://crrev.com/38634c27935ff458b82b77171d7c0fb23918dc82/cryptohome/platform.cc
[modify] https://crrev.com/38634c27935ff458b82b77171d7c0fb23918dc82/chaps/org.chromium.Chaps.conf.in

Project Member

Comment 8 by bugdroid1@chromium.org, Aug 16 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/a7d80037cc77b01101417bbed3d183be4f1be4c1

commit a7d80037cc77b01101417bbed3d183be4f1be4c1
Author: Matthew Denton <mpdenton@google.com>
Date: Wed Aug 16 03:21:05 2017

cryptohome: Use namespaces for cryptohome and cryptohomed

Modified cryptohome and cryptohomed to use namespaces and
no_new_privs. Also added a comment about deleting the
CAP_DAC_OVERRIDE capability.

BUG= chromium:741786 
TEST=test_that platform_Cryptohome*

Also ran changes on link (kernel 3.8) and buddy (kernel 3.14)
to ensure it works across kernel versions. All tests that worked
on base also worked with my change. These included:
login_Cryptohome login_CryptohomeIncognito login_CryptohomeOwnerQuery
platform_CryptohomeBadPerms platform_CryptohomeChangePassword
platform_CryptohomeFio platform_CryptohomeMigrateKey
platform_CryptohomeMount platform_CryptohomeMultiple
platform_CryptohomeNonDirs platform_CryptohomeTestAuth
platform_CryptohomeTPMReOwn security_StatefulPermissions
security_SandboxedServices security_ProfilePermissions cheets_StartAndroid

Change-Id: I1ec1ee70b9b460c1be55acc0007d6a6fbd447939
Reviewed-on: https://chromium-review.googlesource.com/602882
Commit-Ready: Matthew Denton <mpdenton@google.com>
Tested-by: Matthew Denton <mpdenton@google.com>
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>

[modify] https://crrev.com/a7d80037cc77b01101417bbed3d183be4f1be4c1/cryptohome/cryptohome.cc
[modify] https://crrev.com/a7d80037cc77b01101417bbed3d183be4f1be4c1/cryptohome/cryptohomed.cc

Blockedon: 764540

Comment 10 by gwendal@google.com, Sep 13 2017

There is a problem with change with running as non-root: cache is not dropped at logout, we can see user content after she logs out. See crbug/764540
It looks like a performance regression was filed as well: crbug.com/757729
Cc: vapier@chromium.org
Project Member

Comment 13 by bugdroid1@chromium.org, Sep 15 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/b33752fd08c67fc8ffa0b13090c5ce24caa25112

commit b33752fd08c67fc8ffa0b13090c5ce24caa25112
Author: Greg Kerr <kerrnel@chromium.org>
Date: Fri Sep 15 01:01:49 2017

Revert cryptohome sandboxing changes.

This reverts commit 38634c27935ff458b82b77171d7c0fb23918dc82
due to regressions caused by the sandboxing.

Author: Matthew Denton <mpdenton@google.com>
Date: Fri Aug 04 22:39:04 2017

cryptohome: Run cryptohome under minijial

Modified cryptohomed and cryptohome to run under the non-root user
"cryptohome". Modified chaps and cryptohome dbus conf files to
use cryptohome instead of root.

This reverts commit a7d80037cc77b01101417bbed3d183be4f1be4c1.
Author: Matthew Denton <mpdenton@google.com>
Date: Wed Aug 16 03:21:05 2017

cryptohome: Use namespaces for cryptohome and cryptohomed

Modified cryptohome and cryptohomed to use namespaces and
no_new_privs. Also added a comment about deleting the
CAP_DAC_OVERRIDE capability.

BUG= chromium:741786 ,chromium:764540
TEST=test_that platform_CryptoHome*
CQ-DEPEND=CL:665345,CL:666018

Change-Id: I46f116ae0c8d8271b85fb15904906958bb090af6
Reviewed-on: https://chromium-review.googlesource.com/665279
Commit-Ready: Greg Kerr <kerrnel@chromium.org>
Tested-by: Greg Kerr <kerrnel@chromium.org>
Reviewed-by: Matthew Denton <mpdenton@google.com>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/b33752fd08c67fc8ffa0b13090c5ce24caa25112/cryptohome/cryptohomed.cc
[modify] https://crrev.com/b33752fd08c67fc8ffa0b13090c5ce24caa25112/cryptohome/etc/Cryptohome.conf
[modify] https://crrev.com/b33752fd08c67fc8ffa0b13090c5ce24caa25112/cryptohome/cryptohome.cc
[modify] https://crrev.com/b33752fd08c67fc8ffa0b13090c5ce24caa25112/cryptohome/cryptohome.gyp
[modify] https://crrev.com/b33752fd08c67fc8ffa0b13090c5ce24caa25112/cryptohome/platform.cc
[modify] https://crrev.com/b33752fd08c67fc8ffa0b13090c5ce24caa25112/chaps/org.chromium.Chaps.conf.in

Project Member

Comment 14 by bugdroid1@chromium.org, Sep 15 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/211deb059ef5d04c12f43edb8dd0cd5e141d2ff3

commit 211deb059ef5d04c12f43edb8dd0cd5e141d2ff3
Author: Greg Kerr <kerrnel@chromium.org>
Date: Fri Sep 15 01:01:49 2017

Revert cryptohome sandboxing changes.

This reverts the CLs to sandbox cryptohome which cause dregressions.

This reverts commit f7ff65bd0e20ce532d97cc511e1c0ff1749ae91d
Author: Matthew Denton <mpdenton@google.com>
Date: Thu Jul 20 07:36:56 2017

Update cryptohome ebuild to create cryptohome user

Updated the cryptohome ebuild file with a pkg_preinst to create the
new user and group "cryptohome".

This reverts commit 3bb107b6d68d92f23927b99643934be3554a6668
Author: Matthew Denton <mpdenton@google.com>
Date: Fri Aug 04 22:39:04 2017

upstart: Create dircrypto keyring with owner "cryptohome"

This CL creates the dircrypto keyring with owner user and group as
"cryptohome". This is necessary in order to run cryptohome as non-root
user "cryptohome", as cryptohome needs to create keys in the dircrypto
keyring. The keyring was originally owned (and could only be modified
by) root.

BUG= chromium:741786 ,chromium:764540
TEST=pre-cq

Change-Id: I24a9fdd6c6251001fb807bbd5cf3674dbafca3e0
Reviewed-on: https://chromium-review.googlesource.com/665345
Commit-Ready: Greg Kerr <kerrnel@chromium.org>
Tested-by: Greg Kerr <kerrnel@chromium.org>
Reviewed-by: Matthew Denton <mpdenton@google.com>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/211deb059ef5d04c12f43edb8dd0cd5e141d2ff3/sys-apps/upstart/files/upstart-1.2-dircrypto.patch
[modify] https://crrev.com/211deb059ef5d04c12f43edb8dd0cd5e141d2ff3/chromeos-base/cryptohome/cryptohome-9999.ebuild
[rename] https://crrev.com/211deb059ef5d04c12f43edb8dd0cd5e141d2ff3/sys-apps/upstart/upstart-1.2-r21.ebuild

Project Member

Comment 15 by bugdroid1@chromium.org, Sep 15 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/autotest/+/0ec311758db7f10181886053eeab88366d55a2c2

commit 0ec311758db7f10181886053eeab88366d55a2c2
Author: Greg Kerr <kerrnel@chromium.org>
Date: Fri Sep 15 01:01:49 2017

Revert commits for cryptohome baseline test changes.

This reverts commit 0be215d51744c5a682ab6d5b70f24f4505f0e2f3
Author: Matthew Denton <mpdenton@google.com>
Date: Thu Jul 20 07:36:56 2017

Add cryptohome to the baseline accounts test.

This adds cryptohome to the baseline accounts test to note its new
group.

This reverts commit 2f972f0c098113976403925fadd77b43c754b76f
Author: Matthew Denton <mpdenton@google.com>
Date: Fri Aug 04 22:39:05 2017

Update security tests for non-root cryptohomed

This updates the security_SandboxedServices,
security_ProfilePermissions,
and security_StatefulPermissions tests to reflect the fact that
cryptohomed
runs and mounts directories under the "cryptohome" user instead of
"root".

BUG= chromium:741786 ,chromium:764540
TEST=pre-cq
CQ-DEPEND=CL:665279,CL:665345

Change-Id: I6cde77c984bbee7fbc4ab99f3c527d5bbf176215
Reviewed-on: https://chromium-review.googlesource.com/666018
Commit-Ready: Greg Kerr <kerrnel@chromium.org>
Tested-by: Greg Kerr <kerrnel@chromium.org>
Reviewed-by: Matthew Denton <mpdenton@google.com>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/0ec311758db7f10181886053eeab88366d55a2c2/client/site_tests/security_AccountsBaseline/baseline.group
[modify] https://crrev.com/0ec311758db7f10181886053eeab88366d55a2c2/client/site_tests/security_ProfilePermissions/security_ProfilePermissions.py
[modify] https://crrev.com/0ec311758db7f10181886053eeab88366d55a2c2/client/site_tests/security_StatefulPermissions/security_StatefulPermissions.py
[modify] https://crrev.com/0ec311758db7f10181886053eeab88366d55a2c2/client/site_tests/security_SandboxedServices/baseline
[modify] https://crrev.com/0ec311758db7f10181886053eeab88366d55a2c2/client/site_tests/security_AccountsBaseline/baseline.passwd

Project Member

Comment 16 by sheriffbot@chromium.org, Sep 19 2017

Labels: Hotlist-Recharge-BouncingOwner
Owner: ----
Status: Untriaged (was: Assigned)
The assigned owner "mpdenton@google.com" is not able to receive e-mails, please re-triage.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
"+1 Me too!
Owner: kerrnel@chromium.org
Status: Fixed (was: Untriaged)
Abandoning for now.
Project Member

Comment 19 by bugdroid1@chromium.org, Sep 19 2017

Labels: merge-merged-release-R62-9901.B
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/autotest/+/e58989ad984d8a136c4551ad675c0e231552dc7b

commit e58989ad984d8a136c4551ad675c0e231552dc7b
Author: Greg Kerr <kerrnel@chromium.org>
Date: Tue Sep 19 21:40:44 2017

Revert commits for cryptohome baseline test changes.

This reverts commit 0be215d51744c5a682ab6d5b70f24f4505f0e2f3
Author: Matthew Denton <mpdenton@google.com>
Date: Thu Jul 20 07:36:56 2017

Add cryptohome to the baseline accounts test.

This adds cryptohome to the baseline accounts test to note its new
group.

This reverts commit 2f972f0c098113976403925fadd77b43c754b76f
Author: Matthew Denton <mpdenton@google.com>
Date: Fri Aug 04 22:39:05 2017

Update security tests for non-root cryptohomed

This updates the security_SandboxedServices,
security_ProfilePermissions,
and security_StatefulPermissions tests to reflect the fact that
cryptohomed
runs and mounts directories under the "cryptohome" user instead of
"root".

BUG= chromium:741786 ,chromium:764540
TEST=pre-cq
CQ-DEPEND=CL:671199,CL:671880

Change-Id: Ie8be99517fcb0d9052c872c86ca8111c33f05c1d
Reviewed-on: https://chromium-review.googlesource.com/671925
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Tested-by: Greg Kerr <kerrnel@chromium.org>
Commit-Queue: Greg Kerr <kerrnel@chromium.org>

[modify] https://crrev.com/e58989ad984d8a136c4551ad675c0e231552dc7b/client/site_tests/security_AccountsBaseline/baseline.group
[modify] https://crrev.com/e58989ad984d8a136c4551ad675c0e231552dc7b/client/site_tests/security_ProfilePermissions/security_ProfilePermissions.py
[modify] https://crrev.com/e58989ad984d8a136c4551ad675c0e231552dc7b/client/site_tests/security_StatefulPermissions/security_StatefulPermissions.py
[modify] https://crrev.com/e58989ad984d8a136c4551ad675c0e231552dc7b/client/site_tests/security_SandboxedServices/baseline
[modify] https://crrev.com/e58989ad984d8a136c4551ad675c0e231552dc7b/client/site_tests/security_AccountsBaseline/baseline.passwd

Project Member

Comment 20 by bugdroid1@chromium.org, Sep 19 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/71df93ac1063f370c69bf5e055d208ec9b886bfd

commit 71df93ac1063f370c69bf5e055d208ec9b886bfd
Author: Greg Kerr <kerrnel@chromium.org>
Date: Tue Sep 19 21:40:55 2017

Revert cryptohome sandboxing changes.

Cherry-picked from b33752fd08c67fc8ffa0b13090c5ce24caa25112.

This reverts commit 38634c27935ff458b82b77171d7c0fb23918dc82
due to regressions caused by the sandboxing.

Author: Matthew Denton <mpdenton@google.com>
Date: Fri Aug 04 22:39:04 2017

cryptohome: Run cryptohome under minijial

Modified cryptohomed and cryptohome to run under the non-root user
"cryptohome". Modified chaps and cryptohome dbus conf files to
use cryptohome instead of root.

This reverts commit a7d80037cc77b01101417bbed3d183be4f1be4c1.
Author: Matthew Denton <mpdenton@google.com>
Date: Wed Aug 16 03:21:05 2017

cryptohome: Use namespaces for cryptohome and cryptohomed

Modified cryptohome and cryptohomed to use namespaces and
no_new_privs. Also added a comment about deleting the
CAP_DAC_OVERRIDE capability.

BUG= chromium:741786 ,chromium:764540
TEST=test_that platform_CryptoHome*
CQ-DEPEND=CL:671880,CL:671925

Change-Id: Ie77cde9785861e998b89d6db199f4fcbc4d25081
Reviewed-on: https://chromium-review.googlesource.com/671199
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Tested-by: Greg Kerr <kerrnel@chromium.org>
Commit-Queue: Greg Kerr <kerrnel@chromium.org>

[modify] https://crrev.com/71df93ac1063f370c69bf5e055d208ec9b886bfd/cryptohome/cryptohomed.cc
[modify] https://crrev.com/71df93ac1063f370c69bf5e055d208ec9b886bfd/cryptohome/etc/Cryptohome.conf
[modify] https://crrev.com/71df93ac1063f370c69bf5e055d208ec9b886bfd/cryptohome/cryptohome.cc
[modify] https://crrev.com/71df93ac1063f370c69bf5e055d208ec9b886bfd/cryptohome/cryptohome.gyp
[modify] https://crrev.com/71df93ac1063f370c69bf5e055d208ec9b886bfd/cryptohome/platform.cc
[modify] https://crrev.com/71df93ac1063f370c69bf5e055d208ec9b886bfd/chaps/org.chromium.Chaps.conf.in

Project Member

Comment 21 by bugdroid1@chromium.org, Sep 19 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/overlays/chromiumos-overlay/+/6185b142308388662dfeedcbdc8b51aaa6962dbb

commit 6185b142308388662dfeedcbdc8b51aaa6962dbb
Author: Greg Kerr <kerrnel@chromium.org>
Date: Tue Sep 19 21:41:04 2017

Revert cryptohome sandboxing changes.

This is cherry-picked from 211deb059ef5d04c12f43edb8dd0cd5e141d2ff3

This reverts the CLs to sandbox cryptohome which caused regressions.

This reverts commit f7ff65bd0e20ce532d97cc511e1c0ff1749ae91d
Author: Matthew Denton <mpdenton@google.com>
Date: Thu Jul 20 07:36:56 2017

Update cryptohome ebuild to create cryptohome user

Updated the cryptohome ebuild file with a pkg_preinst to create the
new user and group "cryptohome".

This reverts commit 3bb107b6d68d92f23927b99643934be3554a6668
Author: Matthew Denton <mpdenton@google.com>
Date: Fri Aug 04 22:39:04 2017

upstart: Create dircrypto keyring with owner "cryptohome"

This CL creates the dircrypto keyring with owner user and group as
"cryptohome". This is necessary in order to run cryptohome as non-root
user "cryptohome", as cryptohome needs to create keys in the dircrypto
keyring. The keyring was originally owned (and could only be modified
by) root.

BUG= chromium:741786 ,chromium:764540
TEST=pre-cq
CQ-DEPEND=CL:671199,CL:671925

Change-Id: I8cbb926e3ec62e7e079f7f32697a51d578a86a4d
Reviewed-on: https://chromium-review.googlesource.com/671880
Tested-by: Greg Kerr <kerrnel@chromium.org>
Commit-Queue: Greg Kerr <kerrnel@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>

[modify] https://crrev.com/6185b142308388662dfeedcbdc8b51aaa6962dbb/sys-apps/upstart/files/upstart-1.2-dircrypto.patch
[modify] https://crrev.com/6185b142308388662dfeedcbdc8b51aaa6962dbb/chromeos-base/cryptohome/cryptohome-9999.ebuild
[rename] https://crrev.com/6185b142308388662dfeedcbdc8b51aaa6962dbb/sys-apps/upstart/upstart-1.2-r21.ebuild

Comment 22 by dchan@chromium.org, Jan 22 2018

Status: Archived (was: Fixed)

Comment 23 by dchan@chromium.org, Jan 23 2018

Status: Fixed (was: Archived)

Sign in to add a comment