Enable mounting encrypted volumes #18

acecilia · 2018-01-11T17:19:19Z

Fixes #17

acecilia · 2018-01-12T01:39:18Z

Another alternative I consider (in case it is possible) is mount the encrypted disk using the same method that diskUtility uses. After some investigation seems that the popup where you enter the password, is being presented by the process SecurityAgent using the plugin DiskUnlock.bundle (found under /System/Library/CoreServices/SecurityAgentPlugins/DiskUnlock.bundle).

Apple has documentation about this here. I will be looking into it when I have some time.

My guess is that it may be possible to call SecurityAgent->DiskUnlock.bundle from Semulov, and pass it the disk identifier, so it prompts the user for the password or gets the key from the keychain + unlocks and mounts the disk.

richardmalone · 2018-01-13T21:03:42Z

acecilia,

That is awesome! Thank you so much, that works for me. BTW, I had to link the Security.framework to get this to build.

Great work.

acecilia · 2018-01-14T02:18:06Z

@richardmalone fixed linking of security.framework

acecilia · 2018-01-14T02:23:40Z

Continuing with the idea of using the DiskUnlock.bundle to unlock the disk.

Using the following code:

AuthorizationRef authRef;
AuthorizationItem authItem;
AuthorizationRights authRights;
AuthorizationFlags authFlags;

OSStatus authStatus;

// Create empty authorization
printf("awaiting: AuthorizationCreate\n");
authStatus = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment, kAuthorizationFlagDefaults, &authRef);
printf("AuthorizationCreate // authStatus == %d\n", authStatus);

// Create a new authorization proces
authItem.name = "system.disk.unlock";
authItem.valueLength = 0;
authItem.value = NULL;
authItem.flags = 0;

authRights.count = 1;
authRights.items = &authItem;

authFlags = kAuthorizationFlagDefaults | kAuthorizationFlagInteractionAllowed; 

// Get new credentials
printf("awaiting: AuthorizationCopyRights\n");
authStatus = AuthorizationCopyRights(authRef, &authRights, kAuthorizationEmptyEnvironment, authFlags, NULL);
printf("AuthorizationCopyRights // authStatus == %d\n", authStatus);

printf("DONE");

I managed to invoke the window prompt form the DiskUnlock.bundle:

But the authorization finally fails:

My guess is that it fails because it requires the UUID of the disk to mount, but I am not sure how that information should be passed to the DiskUnlock.bundle plugin. I could not find any documentation about this plugin and which data it needs, plus the general documentation about authentication plugins is very limited. Any help is appreciated.

kainjow

Looks good, thanks!

kainjow · 2018-01-14T02:22:35Z

SLDiskManager.m

+    disk.encrypted = [volumeType rangeOfString:@"encrypt"].location == NSNotFound;
+    CFUUIDRef uuidRef = (__bridge CFUUIDRef)[description objectForKey:(NSString *)kDADiskDescriptionVolumeUUIDKey];
+    if (uuidRef) {
+        disk.volumeUUID = (__bridge NSString *)CFUUIDCreateString(NULL, uuidRef);


I think this should be __bridge_transfer__.

kainjow · 2018-01-14T02:24:17Z

SLDiskManager.m

+                [task launch];
+            } else {
+                NSAlert *alert = [[NSAlert alloc] init];
+                [alert setMessageText: [NSString stringWithFormat:@"Error: %@ \n\nRemember that in order to be able to mount an encrypted volume, previously you have to: \na) Mount it using Disk Utility\nb) Save the password in the keychain", SecCopyErrorMessageString(status, NULL)]];


Use NSLocalizedString() here.

Also SecCopyErrorMessageString() result is leaked, needs __bridge_transfer__ here.

kainjow · 2018-01-14T02:25:05Z

SLDiskManager.m

+                [alert setMessageText: [NSString stringWithFormat:@"Error: %@ \n\nRemember that in order to be able to mount an encrypted volume, previously you have to: \na) Mount it using Disk Utility\nb) Save the password in the keychain", SecCopyErrorMessageString(status, NULL)]];
+                [alert runModal];
+
+                NSLog(@"Failed to fetch the volume encryption password from the keychain: %@", SecCopyErrorMessageString(status, NULL));


Same as above with the leak. IMO create a var that's bridge_retained and just use that?

kainjow · 2018-01-14T02:25:41Z

SLDiskManager.m

+            if (pwData) SecKeychainItemFreeContent(NULL, pwData);  // Free memory
+        } else {
+            DADiskRef diskref = DADiskCreateFromBSDName(kCFAllocatorDefault, _session, [disk.diskID UTF8String]);
+            DADiskMount(diskref, NULL, kDADiskMountOptionDefault, NULL, NULL);


Only do this and the CFRelease if diskref is not NULL, otherwise could potentially crash. I just realized the original code was doing this but incorrectly checked disk instead of diskref.

acecilia · 2018-01-14T02:57:30Z

@kainjow done. Thanks for the feedback.
Still working on this, do not merge it yet :) I would like to implement it using DiskUnlock.bundle, or if that is not possible, prompt the user for the password in case it is not in the keychain.

…not found in the keychain Added the hability to check if the mounting was successful, in case the introduced password is wrong

acecilia · 2018-01-16T19:29:20Z

@kainjow You can merge it, I am not going to have much time to work on the DiskUnlock.bundle approach this days.

kainjow · 2018-01-21T00:51:33Z

SLDiskManager.m

-            [alert runModal];
+            NSLog(@"Error when fetching the encryption password from the keychain: %@ Prompting the user for it.", (__bridge_transfer NSString *)SecCopyErrorMessageString(status, NULL));
+
+            NSAlert *alert = [NSAlert alertWithMessageText: [NSString stringWithFormat: NSLocalizedString(@"Introduce the encryption password to unlock the volume once:", nil), (__bridge_transfer NSString *)SecCopyErrorMessageString(status, NULL)] defaultButton: NSLocalizedString(@"Ok", nil) alternateButton: NSLocalizedString(@"Cancel", nil) otherButton: nil informativeTextWithFormat: @"If you want to mount an encrypted volume automatically without manually introducing the password: \na) Mount it using Disk Utility\nb) Save the password in the keychain"];


Use NSLocalizedString for informativeTextWithFormat param.

kainjow · 2018-01-21T00:52:23Z

SLDiskManager.m

+
+    // In case return code is not zero, there was an error
+    if ([task terminationStatus]) {
+        NSAlert *alert = [NSAlert alertWithMessageText: @"There was an error unlocking the disk" defaultButton: @"Ok" alternateButton: nil otherButton: nil informativeTextWithFormat: @"Check that you introduced the correct password"];


NSLocalizedString here for UI text as well.

kainjow · 2018-01-21T00:56:05Z

SLDiskManager.m

+
+    // In case return code is not zero, there was an error
+    if ([task terminationStatus]) {
+        NSAlert *alert = [NSAlert alertWithMessageText:@"There was an error unlocking the disk" defaultButton:@"Ok" alternateButton:nil otherButton:nil informativeTextWithFormat:@"Check that you introduced the correct password"];


Don't use "Ok", that's non-standard. Try nil. If that doesn't work, use standard NSAlert alloc init routine and set message text and info and then don't set the button text, which defaults to "OK" for English. Basically, provide less so to use defaults when possible. Also, I'd rather have more lines that are shorter then a big long line that's harder to read/edit.

Nil worked :)

richardmalone · 2018-01-22T13:00:28Z

Thanks to you both for all your efforts getting this feature included into Semulov. Really useful piece of software - even better now. I owe you both a beer!

kainjow · 2018-02-25T22:33:46Z

SLDiskManager.m

@@ -152,6 +152,13 @@ - (void)updateDisk:(SLDisk *)disk fromDescription:(NSDictionary *)description
            disk.deviceName = [disk.diskImage lastPathComponent];
        }
    }
+    disk.volumeKind = [description objectForKey:(NSString *)kDADiskDescriptionVolumeKindKey];
+    NSString* volumeType = [description objectForKey:(NSString *)kDADiskDescriptionVolumeTypeKey];
+    disk.encrypted = [volumeType rangeOfString:@"encrypt"].location == NSNotFound;


@acecilia shouldn't this be the opposite? Currently it's set to encrypted if "encrypted" Is not found..

Seems like a bug, yes. Your fix in master looks good though, tested on my machine and now all encrypted disks are identified correctly

acecilia added 2 commits January 11, 2018 18:15

Added support for mounting encrypted disks

db22888

Clean

33ce5f7

acecilia changed the title ~~Enable mounting encrypted volumes (Fix https://github.com/kainjow/Semulov/issues/17)~~ Enable mounting encrypted volumes Jan 11, 2018

acecilia mentioned this pull request Jan 11, 2018

Can't mount encrypted drives #17

Closed

Linked forgotten security.framework

63446f0

kainjow requested changes Jan 14, 2018

View reviewed changes

Fix according to comments

e2d2cb1

Added the hability to prompt the user for the password in case it is …

4093303

…not found in the keychain Added the hability to check if the mounting was successful, in case the introduced password is wrong

acecilia added 2 commits January 18, 2018 15:38

Set focus on the textfield when entering the disk password

d5b8778

Clean

bacf799

kainjow requested changes Jan 21, 2018

View reviewed changes

Fix with comments

e3cea7d

kainjow approved these changes Jan 22, 2018

View reviewed changes

kainjow merged commit a0b1bf7 into kainjow:master Jan 22, 2018

kainjow reviewed Feb 25, 2018

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable mounting encrypted volumes #18

Enable mounting encrypted volumes #18

acecilia commented Jan 11, 2018 •

edited

Loading

acecilia commented Jan 12, 2018 •

edited

Loading

richardmalone commented Jan 13, 2018

acecilia commented Jan 14, 2018

acecilia commented Jan 14, 2018

kainjow left a comment •

edited

Loading

kainjow Jan 14, 2018

kainjow Jan 14, 2018

kainjow Jan 14, 2018 •

edited

Loading

kainjow Jan 14, 2018

acecilia commented Jan 14, 2018

acecilia commented Jan 16, 2018

kainjow Jan 21, 2018

kainjow Jan 21, 2018

kainjow Jan 21, 2018

acecilia Jan 21, 2018

richardmalone commented Jan 22, 2018

kainjow Feb 25, 2018

acecilia Feb 25, 2018

Enable mounting encrypted volumes #18

Enable mounting encrypted volumes #18

Conversation

acecilia commented Jan 11, 2018 • edited Loading

acecilia commented Jan 12, 2018 • edited Loading

richardmalone commented Jan 13, 2018

acecilia commented Jan 14, 2018

acecilia commented Jan 14, 2018

kainjow left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kainjow Jan 14, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

acecilia commented Jan 14, 2018

acecilia commented Jan 16, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

richardmalone commented Jan 22, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

acecilia commented Jan 11, 2018 •

edited

Loading

acecilia commented Jan 12, 2018 •

edited

Loading

kainjow left a comment •

edited

Loading

kainjow Jan 14, 2018 •

edited

Loading