Comments (11)
josephlr
commented on May 5, 2024
@fancytenseletters, I'm looking though your logs at logout and I don't see the line about dropping caches (logged here). Do you have any more logout logs available?
from fscrypt.
commented on May 5, 2024
Sorry I cut them too early. Here's more complete version:
sddm-helper[3809]: [PAM] Closing session
sddm-helper[3809]: pam_unix(sddm:session): session closed for user user1
pam_fscrypt[3809]: CloseSession(map[debug:true lock_policies:true drop_caches:true])
pam_fscrypt[3809]: Session count for UID=1001 updated to 0
pam_fscrypt[3809]: locking polices protected with login protector
pam_fscrypt[3809]: KeyctlLink(735815295, 111339262) = <nil>
pam_fscrypt[3809]: Setting privileges to "user1"
pam_fscrypt[3809]: Setregid(-1, 1001) = <nil>
pam_fscrypt[3809]: Setgroups([1001 6 7 90 91 92 93 95 96 98]) = <nil>
pam_fscrypt[3809]: Setreuid(-1, 1001) = <nil>
pam_fscrypt[3809]: Reading config from "/etc/fscrypt.conf"
pam_fscrypt[3809]: creating context for "user1"
pam_fscrypt[3809]: found ext4 filesystem "/" (/dev/sda5)
pam_fscrypt[3809]: listing descriptors in "/.fscrypt/protectors"
pam_fscrypt[3809]: found 1 descriptor(s)
pam_fscrypt[3809]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[3809]: Getting protector 6682ae84e70e99b3 from option
pam_fscrypt[3809]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[3809]: listing descriptors in "/.fscrypt/policies"
pam_fscrypt[3809]: found 1 descriptor(s)
pam_fscrypt[3809]: successfully read metadata from "/.fscrypt/policies/949471831dcf55cf"
pam_fscrypt[3809]: got data for 949471831dcf55cf from "/"
pam_fscrypt[3809]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[3809]: listing descriptors in "/home/.fscrypt/policies"
pam_fscrypt[3809]: found 1 descriptor(s)
pam_fscrypt[3809]: successfully read metadata from "/home/.fscrypt/policies/949471831dcf55cf"
pam_fscrypt[3809]: got data for 949471831dcf55cf from "/home"
pam_fscrypt[3809]: stat /run/user/0/.fscrypt: permission denied
pam_fscrypt[3809]: stat /run/user/0/.fscrypt/policies: permission denied
pam_fscrypt[3809]: stat /run/user/0/.fscrypt/protectors: permission denied
pam_fscrypt[3809]: stat /sys/firmware/efi/efivars/.fscrypt: invalid argument
pam_fscrypt[3809]: stat /sys/firmware/efi/efivars/.fscrypt/policies: invalid argument
pam_fscrypt[3809]: stat /sys/firmware/efi/efivars/.fscrypt/protectors: invalid argument
pam_fscrypt[3809]: stat /sys/kernel/debug/.fscrypt: permission denied
pam_fscrypt[3809]: stat /sys/kernel/debug/.fscrypt/policies: permission denied
pam_fscrypt[3809]: stat /sys/kernel/debug/.fscrypt/protectors: permission denied
pam_fscrypt[3809]: KeyctlSearch(735815295, logon, ext4:949471831dcf55cf) = 149252955, <nil>
pam_fscrypt[3809]: KeyctlSearch(735815295, logon, ext4:949471831dcf55cf) = 149252955, <nil>
pam_fscrypt[3809]: KeyctlInvalidate(149252955) = <nil>
pam_fscrypt[3809]: policy 949471831dcf55cf deprovisioned
pam_fscrypt[3809]: KeyctlSearch(735815295, logon, ext4:949471831dcf55cf) = -1, required key not available
pam_fscrypt[3809]: policy 949471831dcf55cf not provisioned
pam_fscrypt[3809]: Setting privileges to "root"
pam_fscrypt[3809]: Setreuid(-1, 0) = <nil>
pam_fscrypt[3809]: Setregid(-1, 0) = <nil>
pam_fscrypt[3809]: Setgroups([0 1 2 3 4 6 10 19]) = <nil>
pam_fscrypt[3809]: dropping inode caches at session close
pam_fscrypt[3809]: dropping page caches
pam_fscrypt[3809]: pam func succeeded
kernel: sddm-helper (3809): drop_caches: 2
sddm-helper[3809]: [PAM] Ended.
sddm[797]: Auth: sddm-helper exited successfully
sddm[797]: Socket server stopping...
sddm[797]: Socket server stopped.
sddm[797]: Display server stopping...
systemd[1]: session-7.scope: Killing process 3981 (kactivitymanage) with signal SIGTERM.
systemd[1]: Stopping Session 7 of user user1.
systemd[1]: Stopped Session 7 of user user1.
systemd-logind[768]: Removed session 7.
systemd[1]: Stopping User Manager for UID 1001...
systemd[3841]: Stopped dbus-org.kde.kwalletd5.service.
systemd[3841]: Stopping dbus-org.gnome.GConf.service...
dbus-launch[3863]: Caught SIGTERM, exiting
obexd[4076]: Terminating
systemd[3841]: Stopping D-Bus User Message Bus...
systemd[3841]: Stopping Sound Service...
systemd[3841]: Stopped target Default.
systemd[3841]: Stopping Bluetooth OBEX service...
systemd[3841]: Stopping dbus-ca.desrt.dconf.service...
systemd[3841]: Stopped dbus-org.gnome.GConf.service.
systemd[3841]: Stopped dbus-ca.desrt.dconf.service.
systemd[3841]: Stopped D-Bus User Message Bus.
systemd[3841]: Stopped Bluetooth OBEX service.
systemd[3841]: Stopped Sound Service.
systemd[3841]: Stopped target Basic System.
systemd[3841]: Stopped target Sockets.
systemd[3841]: Closed GnuPG cryptographic agent (ssh-agent emulation).
systemd[3841]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
systemd[3841]: Closed GnuPG cryptographic agent and passphrase cache (access for web browsers).
systemd[3841]: Closed GnuPG network certificate management daemon.
systemd[3841]: Closed GnuPG cryptographic agent and passphrase cache.
systemd[3841]: Closed D-Bus User Message Bus Socket.
systemd[3841]: Stopped target Timers.
systemd[3841]: Stopped target Paths.
systemd[3841]: Closed Sound System.
systemd[3841]: Reached target Shutdown.
systemd[3841]: Starting Exit the Session...
systemd[3841]: Received SIGRTMIN+24 from PID 4426 (kill).
systemd[3847]: pam_unix(systemd-user:session): session closed for user user1
systemd[1]: Stopped User Manager for UID 1001.
systemd[1]: Removed slice User Slice of user1.
sddm[797]: Display server stopped.
sddm[797]: Running display stop script "/usr/share/sddm/scripts/Xstop"
sddm[797]: Removing display ":0" ...
from fscrypt.
josephlr
commented on May 5, 2024
Ok this is weird. The lines:
pam_fscrypt[3809]: KeyctlSearch(735815295, logon, ext4:949471831dcf55cf) = 149252955, <nil>
pam_fscrypt[3809]: KeyctlInvalidate(149252955) = <nil>
pam_fscrypt[3809]: dropping inode caches at session close
pam_fscrypt[3809]: dropping page caches
show that the key is getting revoked and then caches are being dropped. That should result in the plaintext no longer being visible. This might be a kernel caching issue. Let me check with some people about it.
Also, @fancytenseletters it looks like part of the logs for the login for user1 were also cut off. Do you have the rest of them?
from fscrypt.
josephlr
commented on May 5, 2024
After talking to @ebiggers (who knows this stuff the best), there are two potential issues here:
- The existing call to DropInodeCache does not call the sync() system call, so dirty inodes will will be skipped when dropping reclaimable dentries and inodes.
- Open file descriptors (like an open encrypted directory) do not see the effects of the cache drop. This is a limitation imposed by the kernel, so nothing fscrypt does can change this behavior.
I'm working on a patch to fix (1) and some related logging information. However, you are most likely hitting (2). "Fixing" this will involve updating the documentation to emphasize three key points about Linux filesystem encryption (i.e. the behavior of the kernel):
- Filesystem encryption does not replace standard Unix access controls. If
User 1unlocks a globally readable directory,User 2will be able to see it. - If
User 2has a currently open file or directory that is encrypted and unlocked,User 1runningfscrypt purgewill not have any effect on the contents of that open file. The plaintext will still be visible. - The concerns of (1) and (2) can both be addressed by setting Unix file permissions appropriately.
This documentation change should also address the concerns of #61.
from fscrypt.
commented on May 5, 2024
Thank you for the reply. Two questions:
- As it doesn't happen with console login (everything is encrypted at logout) isn't it a timing issue? Maybe SDDM is blocking something during logout process.
- Why only filenames stay visible while file contents are encrypted?
Filesystem encryption does not replace standard Unix access controls. If User 1 unlocks a globally readable directory, User 2 will be able to see it.
I don't understand this. What's the role of user keyrings then?
In my understanding Unix access controls grants permission for user2 to browse encrypted files but if user2 doesn't have relevant key in his keyring he should be able to see only it's encrypted form regardless if user1 unlocks them or not. I remember that you had to link user's keyring to root's to grant system daemons access to encrypted files.
If it's true that unlocking directory make it accessible to everyone who has unix permissions then there are little advantages of using fscrypt in multi user environment. Also when locking encrypted directory again is non trivial it's little better than full disk encryption if any. Perhaps some FUSE file based encryption systems offers more in this regard.
I'm sorry for complaining but those news make me sad. 😞
from fscrypt.
ebiggers
commented on May 5, 2024
As it doesn't happen with console login (everything is encrypted at logout) isn't it a timing issue? Maybe SDDM is blocking something during logout process.
First, just to clarify, this has nothing to do with whether the data (including both file contents and file names) written to disk is encrypted or not. This is solely a matter of how the operating system kernel presents files to userspace after the encryption key has been "revoked". It is indeed reasonable to expect the files should "appear encrypted" after key revocation, and I'm actually working on designing a better API which may improve the usability of this. However, note just because the files "appear encrypted" doesn't mean that the key was properly revoked. To properly revoke a key, all instances of the key and all plaintext must be sanitized from memory --- since it must be assumed than the attacker can compromise everything in memory. This is actually very difficult and is rarely (if ever) gotten correct with any encryption solution. Thus, focusing only on how the files are presented is somewhat missing the point.
Why only filenames stay visible while file contents are encrypted?
Again, the data being written to disk is still encrypted either way. But as for why the filenames are still being presented in plaintext form, there might be a process that still has one of the files in the directory tree open --- that will pin all parent directories. Or, alternatively the directory inode may be dirty; if the latter, the problem should be fixed by doing sync() before echo 2 > /proc/sys/vm/drop_caches.
Filesystem encryption does not replace standard Unix access controls. If User 1 unlocks a globally readable directory, User 2 will be able to see it.
I don't understand this. What's the role of user keyrings then?In my understanding Unix access controls grants permission for user2 to browse encrypted files but if user2 doesn't have relevant key in his keyring he should be able to see only it's encrypted form regardless if user1 unlocks them or not. I remember that you had to link user's keyring to root's to grant system daemons access to encrypted files.
The decision to search for the encryption keys in the keyrings "possessed" by the process accessing the filesystem was probably a mistake. Along with other changes I've been looking into moving to a global (or a per-filesystem) keyring instead, since a global keyring better reflects the actual semantics (including the semantics of the Linux VFS --- there can only be one "view" of a directory at a time) as well as the threats which encryption actually protects against. It is important to understand that the purpose of encryption is to protect the confidentiality of data written to disk. It is not an access control mechanism. Sure, we could theoretically make the kernel enforce access control based on "who has the key" or not, but in reality after anyone has added the key to the running system, the data is actually not being protected by encryption, it is only being protected by the correctness of the kernel. Thus to protect against other users on the online system you really might as well just use file permissions. After all, if a malicious user is able to circumvent file permissions by exploiting a kernel security vulnerability, they could just easily circumvent any "encryption"-related access control checks. No need to break your AES-256 key :-)
If it's true that unlocking directory make it accessible to everyone who has unix permissions then there are little advantages of using fscrypt in multi user environment.
Each user can have their data encrypted on-disk with a different key, and it's allowed to have unencrypted files on the same filesystem. Neither of those is not possible with block-device level encryption.
Also when locking encrypted directory again is non trivial it's little better than full disk encryption if any.
Perhaps some FUSE file based encryption systems offers more in this regard.
It's true that other solutions such as dm-crypt and eCryptfs do currently have a clearer way to determine whether files should "appear encrypted" or not. However, they generally don't do any better at actually managing key material securely and securely revoking the encryption key(s).
from fscrypt.
josephlr
commented on May 5, 2024
To add on to what @ebiggers mentioned,
I don't understand this. What's the role of user keyrings then?
In an idea world, we would not use the user keyring, there would just be a single global keyring that all users could add keys to (this doesn't risk a leak of key material as all encryption keys are of type logon, meaning the data cannot ever be returned to userspace).
However, due to a limitation to the keyrings API, any keyring that users can add keys to, users can delete keys from. Under the global keyring, users could launch a denial of service attack on other users by constantly deleting their keys.
This is the reason we use the user keyrings, not for confidentially, but for availability.
from fscrypt.
josephlr
commented on May 5, 2024
@fancytenseletters, could you try running the same commands with #67? That will at least tell us if it is a syncing issue or an issue with SDDM holding the home directory open. I'm going to try to setup SDDM on Arch so I can test it myself.
from fscrypt.
commented on May 5, 2024
# fscrypt --version
Version:
0.2.1-11-g6953697
user1 logs in:
sddm[803]: Message received from greeter: Login
sddm[803]: Reading from "/usr/share/xsessions/plasma.desktop"
sddm[803]: Reading from "/usr/share/xsessions/plasma.desktop"
sddm[803]: Session "/usr/share/xsessions/plasma.desktop" selected, command: "/usr/bin/startkde"
sddm-helper[1195]: [PAM] Starting...
sddm-helper[1195]: [PAM] Authenticating...
sddm-helper[1195]: [PAM] Preparing to converse...
sddm-helper[1195]: [PAM] Conversation with 1 messages
pam_fscrypt[1195]: Authenticate()
pam_fscrypt[1195]: Setreuid(1001, 0) = <nil>
pam_fscrypt[1195]: keyringID(_uid.1001) = 749743258, <nil>
sddm-helper[1195]: [PAM] returning.
pam_fscrypt[1195]: Setreuid(0, 1001) = <nil>
sddm[803]: Authenticated successfully
pam_fscrypt[1195]: KeyctlLink(749743258, -2) = <nil>
pam_fscrypt[1195]: Setreuid(0, 0) = <nil>
pam_fscrypt[1195]: keyringID(_uid.0) = 311378727, <nil>
pam_fscrypt[1195]: KeyctlLink(311378727, -2) = <nil>
pam_fscrypt[1195]: KeyctlLink(749743258, 311378727) = <nil>
pam_fscrypt[1195]: Setting privileges to "user1"
pam_fscrypt[1195]: Setregid(-1, 1001) = <nil>
pam_fscrypt[1195]: Setgroups([1001 6 7 90 91 92 93 95 96 98]) = <nil>
pam_fscrypt[1195]: Setreuid(-1, 1001) = <nil>
pam_fscrypt[1195]: Reading config from "/etc/fscrypt.conf"
pam_fscrypt[1195]: creating context for "user1"
pam_fscrypt[1195]: found ext4 filesystem "/" (/dev/sda)
pam_fscrypt[1195]: listing descriptors in "/.fscrypt/protectors"
pam_fscrypt[1195]: found 1 descriptor(s)
pam_fscrypt[1195]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[1195]: Getting protector 6682ae84e70e99b3 from option
pam_fscrypt[1195]: copying AUTHTOK for use in the session open
pam_fscrypt[1195]: Setting privileges to "root"
pam_fscrypt[1195]: Setreuid(-1, 0) = <nil>
pam_fscrypt[1195]: Setregid(-1, 0) = <nil>
pam_fscrypt[1195]: Setgroups([0 1 2 3 4 6 10 19]) = <nil>
pam_fscrypt[1195]: pam func succeeded
sddm-helper[1195]: pam_unix(sddm:session): session opened for user user1 by (uid=0)
pam_fscrypt[1195]: OpenSession()
pam_fscrypt[1195]: Session count for UID=1001 updated to 1
pam_fscrypt[1195]: KeyctlLink(749743258, 311378727) = <nil>
pam_fscrypt[1195]: Setting privileges to "user1"
pam_fscrypt[1195]: Setregid(-1, 1001) = <nil>
pam_fscrypt[1195]: Setgroups([1001 6 7 90 91 92 93 95 96 98]) = <nil>
pam_fscrypt[1195]: Setreuid(-1, 1001) = <nil>
pam_fscrypt[1195]: Reading config from "/etc/fscrypt.conf"
pam_fscrypt[1195]: creating context for "user1"
pam_fscrypt[1195]: found ext4 filesystem "/" (/dev/sda)
pam_fscrypt[1195]: listing descriptors in "/.fscrypt/protectors"
pam_fscrypt[1195]: found 1 descriptor(s)
pam_fscrypt[1195]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[1195]: Getting protector 6682ae84e70e99b3 from option
pam_fscrypt[1195]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[1195]: listing descriptors in "/.fscrypt/policies"
pam_fscrypt[1195]: found 1 descriptor(s)
pam_fscrypt[1195]: successfully read metadata from "/.fscrypt/policies/949471831dcf55cf"
pam_fscrypt[1195]: got data for 949471831dcf55cf from "/"
pam_fscrypt[1195]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[1195]: listing descriptors in "/home/.fscrypt/policies"
pam_fscrypt[1195]: found 1 descriptor(s)
pam_fscrypt[1195]: successfully read metadata from "/home/.fscrypt/policies/949471831dcf55cf"
pam_fscrypt[1195]: got data for 949471831dcf55cf from "/home"
systemd[1]: proc-sys-fs-binfmt_misc.automount: Got automount request for /proc/sys/fs/binfmt_misc, triggered by 1195 (sddm-helper)
systemd[1]: Mounting Arbitrary Executable File Formats File System...
systemd[1]: Mounted Arbitrary Executable File Formats File System.
pam_fscrypt[1195]: stat /run/user/0/.fscrypt: permission denied
pam_fscrypt[1195]: stat /run/user/0/.fscrypt/policies: permission denied
pam_fscrypt[1195]: stat /run/user/0/.fscrypt/protectors: permission denied
pam_fscrypt[1195]: stat /run/user/995/.fscrypt: permission denied
pam_fscrypt[1195]: stat /run/user/995/.fscrypt/policies: permission denied
pam_fscrypt[1195]: stat /run/user/995/.fscrypt/protectors: permission denied
pam_fscrypt[1195]: stat /sys/firmware/efi/efivars/.fscrypt: invalid argument
pam_fscrypt[1195]: stat /sys/firmware/efi/efivars/.fscrypt/policies: invalid argument
pam_fscrypt[1195]: stat /sys/firmware/efi/efivars/.fscrypt/protectors: invalid argument
pam_fscrypt[1195]: stat /sys/kernel/debug/.fscrypt: permission denied
pam_fscrypt[1195]: stat /sys/kernel/debug/.fscrypt/policies: permission denied
pam_fscrypt[1195]: stat /sys/kernel/debug/.fscrypt/protectors: permission denied
pam_fscrypt[1195]: unlocking 2 policies protected with AUTHTOK
pam_fscrypt[1195]: running passphrase hash for protector 6682ae84e70e99b3
sddm-helper[975]: [PAM] Closing session
sddm-helper[975]: pam_unix(sddm-greeter:session): session closed for user sddm
sddm-helper[975]: [PAM] Ended.
systemd[1]: session-c1.scope: Killing process 975 (sddm-helper) with signal SIGTERM.
systemd[1]: Stopping Session c1 of user sddm.
sddm[803]: Auth: sddm-helper exited successfully
sddm[803]: Greeter stopped.
systemd[1]: Stopped Session c1 of user sddm.
systemd-logind[779]: Removed session c1.
systemd[1]: Stopping User Manager for UID 995...
systemd[981]: Stopping D-Bus User Message Bus...
dbus-launch[998]: Caught SIGTERM, exiting
systemd[981]: Stopped target Default.
systemd[981]: Stopped D-Bus User Message Bus.
systemd[981]: Stopped target Basic System.
systemd[981]: Stopped target Timers.
systemd[981]: Stopped target Sockets.
systemd[981]: Closed GnuPG network certificate management daemon.
systemd[981]: Closed GnuPG cryptographic agent and passphrase cache (access for web browsers).
systemd[981]: Closed Sound System.
systemd[981]: Closed GnuPG cryptographic agent and passphrase cache.
systemd[981]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
systemd[981]: Closed GnuPG cryptographic agent (ssh-agent emulation).
systemd[981]: Stopped target Paths.
systemd[981]: Closed D-Bus User Message Bus Socket.
systemd[981]: Reached target Shutdown.
systemd[981]: Starting Exit the Session...
systemd[981]: Received SIGRTMIN+24 from PID 1209 (kill).
systemd[987]: pam_unix(systemd-user:session): session closed for user sddm
systemd[1]: Stopped User Manager for UID 995.
systemd[1]: Removed slice User Slice of sddm.
pam_fscrypt[1195]: valid wrapping key for protector 6682ae84e70e99b3
pam_fscrypt[1195]: KeyctlSearch(749743258, logon, ext4:949471831dcf55cf) = -1, required key not available
pam_fscrypt[1195]: keyringID(session) = 275631317, <nil>
pam_fscrypt[1195]: KeyctlSearch(275631317, keyring, _uid.1001) = 749743258, <nil>
pam_fscrypt[1195]: KeyctlAddKey(logon, ext4:949471831dcf55cf, <data>, 749743258) = 1022238537, <nil>
pam_fscrypt[1195]: policy 949471831dcf55cf provisioned
pam_fscrypt[1195]: KeyctlSearch(749743258, logon, ext4:949471831dcf55cf) = 1022238537, <nil>
pam_fscrypt[1195]: policy 949471831dcf55cf already provisioned
pam_fscrypt[1195]: Setting privileges to "root"
pam_fscrypt[1195]: Setreuid(-1, 0) = <nil>
pam_fscrypt[1195]: Setregid(-1, 0) = <nil>
pam_fscrypt[1195]: Setgroups([0 1 2 3 4 6 10 19]) = <nil>
pam_fscrypt[1195]: pam func succeeded
systemd[1]: Created slice User Slice of user1.
systemd[1]: Starting User Manager for UID 1001...
systemd-logind[779]: New session 4 of user user1.
systemd[1]: Started Session 4 of user user1.
systemd[1227]: pam_unix(systemd-user:session): session opened for user user1 by (uid=0)
systemd[1227]: Reached target Paths.
systemd[1227]: Reached target Timers.
systemd[1227]: Listening on GnuPG network certificate management daemon.
systemd[1227]: Listening on GnuPG cryptographic agent (ssh-agent emulation).
systemd[1227]: Listening on Sound System.
systemd[1227]: Listening on GnuPG cryptographic agent and passphrase cache (access for web browsers).
systemd[1227]: Starting D-Bus User Message Bus Socket.
systemd[1227]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
systemd[1227]: Listening on GnuPG cryptographic agent and passphrase cache.
systemd[1227]: Listening on D-Bus User Message Bus Socket.
systemd[1227]: Reached target Sockets.
systemd[1227]: Reached target Basic System.
systemd[1227]: Reached target Default.
systemd[1227]: Startup finished in 18ms.
systemd[1]: Started User Manager for UID 1001.
sddm-helper[1195]: Starting: "/usr/share/sddm/scripts/Xsession \"/usr/bin/startkde\""
sddm-helper[1254]: Adding cookie to "/home/user1/.Xauthority"
sddm[803]: Session started
systemd[1227]: Started D-Bus User Message Bus.
dbus-launch[1267]: Listening on inherited socket
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/com.google.code.AccountsSSO.SingleSignOn.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.kwalletd5.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.kpasswdserver.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.jackaudio.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/ca.desrt.dconf.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.kglobalaccel.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/com.nokia.singlesignonui.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.freedesktop.ColorHelper.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.fedoraproject.Config.Printing.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.a11y.Bus.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.bluez.obex.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.plasma.Notifications.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.ffado.Control.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.dolphin.FileManager1.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.kscreen.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.kded5.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.kssld5.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.gnome.GConf.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/com.canonical.indicators.webcredentials.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.gtk.GLib.PACRunner.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.kioexecd.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.kcookiejar5.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.Spectacle.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/kf5_org.kde.kuiserver.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.freedesktop.systemd1.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.fontinst.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.krunner.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.gnome.keyring.PrivatePrompter.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.kwalletd.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/com.nokia.SingleSignOn.Backup.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.freedesktop.Akonadi.Control.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.gnome.keyring.SystemPrompter.service'
dbus-launch[1267]: Loading service '/usr/share/dbus-1/services/org.kde.kiod5.service'
kaccess[1316]: kf5.kcoreaddons.kaboutdata: Could not initialize the equivalent properties of Q*Application: no instance (yet) existing.
dbus-launch[1267]: Activation request for 'org.kde.kglobalaccel'
systemd[1227]: Started dbus-org.kde.kglobalaccel.service.
dbus-launch[1267]: Activation request for 'ca.desrt.dconf'
systemd[1227]: Started dbus-ca.desrt.dconf.service.
user1 logout:
kdeinit5[1305]: QThread: Destroyed while thread is still running
sddm-helper[1195]: [PAM] Closing session
sddm-helper[1195]: pam_unix(sddm:session): session closed for user user1
pam_fscrypt[1195]: CloseSession(map[debug:true lock_policies:true drop_caches:true])
pam_fscrypt[1195]: Session count for UID=1001 updated to 0
pam_fscrypt[1195]: locking polices protected with login protector
pam_fscrypt[1195]: KeyctlLink(38418302, 1063174483) = <nil>
pam_fscrypt[1195]: Setting privileges to "user1"
pam_fscrypt[1195]: Setregid(-1, 1001) = <nil>
pam_fscrypt[1195]: Setgroups([1001 6 7 90 91 92 93 95 96 98]) = <nil>
pam_fscrypt[1195]: Setreuid(-1, 1001) = <nil>
pam_fscrypt[1195]: Reading config from "/etc/fscrypt.conf"
pam_fscrypt[1195]: creating context for "user1"
pam_fscrypt[1195]: found ext4 filesystem "/" (/dev/sda)
pam_fscrypt[1195]: listing descriptors in "/.fscrypt/protectors"
pam_fscrypt[1195]: found 1 descriptor(s)
pam_fscrypt[1195]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[1195]: Getting protector 6682ae84e70e99b3 from option
pam_fscrypt[1195]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[1195]: listing descriptors in "/.fscrypt/policies"
pam_fscrypt[1195]: found 1 descriptor(s)
pam_fscrypt[1195]: successfully read metadata from "/.fscrypt/policies/949471831dcf55cf"
pam_fscrypt[1195]: got data for 949471831dcf55cf from "/"
pam_fscrypt[1195]: successfully read metadata from "/.fscrypt/protectors/6682ae84e70e99b3"
pam_fscrypt[1195]: listing descriptors in "/home/.fscrypt/policies"
pam_fscrypt[1195]: found 1 descriptor(s)
pam_fscrypt[1195]: successfully read metadata from "/home/.fscrypt/policies/949471831dcf55cf"
pam_fscrypt[1195]: got data for 949471831dcf55cf from "/home"
pam_fscrypt[1195]: stat /run/user/0/.fscrypt: permission denied
pam_fscrypt[1195]: stat /run/user/0/.fscrypt/policies: permission denied
pam_fscrypt[1195]: stat /run/user/0/.fscrypt/protectors: permission denied
pam_fscrypt[1195]: stat /sys/firmware/efi/efivars/.fscrypt: invalid argument
pam_fscrypt[1195]: stat /sys/firmware/efi/efivars/.fscrypt/policies: invalid argument
pam_fscrypt[1195]: stat /sys/firmware/efi/efivars/.fscrypt/protectors: invalid argument
pam_fscrypt[1195]: stat /sys/kernel/debug/.fscrypt: permission denied
pam_fscrypt[1195]: stat /sys/kernel/debug/.fscrypt/policies: permission denied
pam_fscrypt[1195]: stat /sys/kernel/debug/.fscrypt/protectors: permission denied
pam_fscrypt[1195]: KeyctlSearch(38418302, logon, ext4:949471831dcf55cf) = 291924544, <nil>
pam_fscrypt[1195]: KeyctlSearch(38418302, logon, ext4:949471831dcf55cf) = 291924544, <nil>
pam_fscrypt[1195]: KeyctlInvalidate(291924544) = <nil>
pam_fscrypt[1195]: policy 949471831dcf55cf deprovisioned
pam_fscrypt[1195]: KeyctlSearch(38418302, logon, ext4:949471831dcf55cf) = -1, required key not available
pam_fscrypt[1195]: policy 949471831dcf55cf not provisioned
pam_fscrypt[1195]: Setting privileges to "root"
pam_fscrypt[1195]: Setreuid(-1, 0) = <nil>
pam_fscrypt[1195]: Setregid(-1, 0) = <nil>
pam_fscrypt[1195]: Setgroups([0 1 2 3 4 6 10 19]) = <nil>
pam_fscrypt[1195]: dropping appropriate filesystem caches at session close
pam_fscrypt[1195]: syncing changes to filesystem
pam_fscrypt[1195]: freeing reclaimable inodes and dentries
pam_fscrypt[1195]: pam func succeeded
kernel: sddm-helper (1195): drop_caches: 2
kernel: echo (1706): drop_caches: 2
sddm-helper[1195]: [PAM] Ended.
sddm[758]: Auth: sddm-helper exited successfully
sddm[758]: Socket server stopping...
sddm[758]: Socket server stopped.
sddm[758]: Display server stopping...
systemd[1]: session-4.scope: Killing process 1403 (kactivitymanage) with signal SIGTERM.
systemd[1]: Stopping Session 4 of user user1.
systemd[1]: Stopped Session 4 of user user1.
systemd-logind[744]: Removed session 4.
systemd[1]: Stopping User Manager for UID 1001...
systemd[1231]: Stopping dbus-ca.desrt.dconf.service...
systemd[1231]: Stopping dbus-org.gnome.GConf.service...
systemd[1231]: Stopping Sound Service...
systemd[1231]: Stopping D-Bus User Message Bus...
systemd[1231]: Stopped target Default.
systemd[1231]: Stopping Bluetooth OBEX service...
systemd[1231]: Stopped dbus-ca.desrt.dconf.service.
systemd[1231]: obex.service: Main process exited, code=exited, status=1/FAILURE
systemd[1231]: Stopped Bluetooth OBEX service.
systemd[1231]: obex.service: Unit entered failed state.
systemd[1231]: obex.service: Failed with result 'exit-code'.
systemd[1231]: Stopped D-Bus User Message Bus.
systemd[1231]: Stopped dbus-org.gnome.GConf.service.
systemd[1231]: Stopped Sound Service.
systemd[1231]: Stopped target Basic System.
systemd[1231]: Stopped target Paths.
systemd[1231]: Stopped target Timers.
systemd[1231]: Stopped target Sockets.
systemd[1231]: Closed GnuPG network certificate management daemon.
systemd[1231]: Closed D-Bus User Message Bus Socket.
systemd[1231]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
systemd[1231]: Closed GnuPG cryptographic agent (ssh-agent emulation).
systemd[1231]: Closed GnuPG cryptographic agent and passphrase cache.
systemd[1231]: Closed GnuPG cryptographic agent and passphrase cache (access for web browsers).
systemd[1231]: Closed Sound System.
systemd[1231]: Reached target Shutdown.
systemd[1231]: Starting Exit the Session...
systemd[1231]: Received SIGRTMIN+24 from PID 1718 (kill).
systemd[1251]: pam_unix(systemd-user:session): session closed for user user1
systemd[1]: Stopped User Manager for UID 1001.
systemd[1]: Removed slice User Slice of user1.
sddm[758]: Display server stopped.
sddm[758]: Running display stop script "/usr/share/sddm/scripts/Xstop"
sddm[758]: Removing display ":0" ...
sddm[758]: Adding new display on vt 1 ...
sddm[758]: Display server starting...
sddm[758]: Running: /usr/bin/X -nolisten tcp -nolisten local -auth /var/run/sddm/{296ef275-cd8c-4465-9503-dea755ad6c25} -background none -noreset -displayfd 19 vt1
sddm[758]: Setting default cursor
sddm[758]: Running display setup script "/usr/share/sddm/scripts/Xsetup"
sddm[758]: Display server started.
sddm[758]: Socket server starting...
sddm[758]: Socket server started.
sddm[758]: Greeter starting...
sddm[758]: Adding cookie to "/var/run/sddm/{296ef275-cd8c-4465-9503-dea755ad6c25}"
sddm-helper[1729]: [PAM] Starting...
sddm-helper[1729]: [PAM] Authenticating...
sddm-helper[1729]: pam_unix(sddm-greeter:session): session opened for user sddm by (uid=0)
sddm-helper[1729]: [PAM] returning.
systemd[1]: Created slice User Slice of sddm.
systemd[1]: Starting User Manager for UID 995...
systemd-logind[744]: New session c2 of user sddm.
systemd[1]: Started Session c2 of user sddm.
systemd[1736]: pam_unix(systemd-user:session): session opened for user sddm by (uid=0)
systemd[1736]: Listening on GnuPG cryptographic agent and passphrase cache (access for web browsers).
systemd[1736]: Listening on Sound System.
systemd[1736]: Reached target Timers.
systemd[1736]: Reached target Paths.
systemd[1736]: Listening on GnuPG cryptographic agent (ssh-agent emulation).
systemd[1736]: Listening on GnuPG cryptographic agent and passphrase cache (restricted).
systemd[1736]: Starting D-Bus User Message Bus Socket.
systemd[1736]: Listening on GnuPG network certificate management daemon.
systemd[1736]: Listening on GnuPG cryptographic agent and passphrase cache.
systemd[1736]: Listening on D-Bus User Message Bus Socket.
systemd[1736]: Reached target Sockets.
systemd[1736]: Reached target Basic System.
systemd[1736]: Reached target Default.
systemd[1736]: Startup finished in 30ms.
systemd[1]: Started User Manager for UID 995.
sddm[758]: Greeter session started successfully
sddm-greeter[1748]: High-DPI autoscaling not Enabled
sddm[758]: Message received from greeter: Connect
systemd[1736]: Started D-Bus User Message Bus.
dbus-launch[1752]: Listening on inherited socket
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/com.google.code.AccountsSSO.SingleSignOn.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.kwalletd5.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.kpasswdserver.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.jackaudio.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/ca.desrt.dconf.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.kglobalaccel.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/com.nokia.singlesignonui.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.freedesktop.ColorHelper.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.fedoraproject.Config.Printing.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.a11y.Bus.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.bluez.obex.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.plasma.Notifications.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.ffado.Control.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.dolphin.FileManager1.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.kscreen.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.kded5.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.kssld5.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.gnome.GConf.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/com.canonical.indicators.webcredentials.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.gtk.GLib.PACRunner.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.kioexecd.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.kcookiejar5.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.Spectacle.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/kf5_org.kde.kuiserver.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.freedesktop.systemd1.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.fontinst.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.krunner.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.gnome.keyring.PrivatePrompter.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.kwalletd.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/com.nokia.SingleSignOn.Backup.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.freedesktop.Akonadi.Control.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.gnome.keyring.SystemPrompter.service'
dbus-launch[1752]: Loading service '/usr/share/dbus-1/services/org.kde.kiod5.service'
Encrypted directory view after user1 logout:
total 48
drwxr-xr-x 8 user1 user1 4096 Oct 3 12:35 .
drwxr-xr-x 6 root root 4096 Oct 3 11:49 ..
-rwxr-xr-x 1 user1 user1 44 Oct 1 22:59 .bash_history
drwxr-xr-x 5 user1 user1 4096 Oct 3 12:17 .cache
drwxr-xr-x 12 user1 user1 4096 Oct 3 12:36 .config
drwxr-xr-x 2 user1 user1 4096 Oct 1 21:55 Desktop
-rwxr-xr-x 1 user1 user1 16 Oct 1 21:55 .esd_auth
-rwxr-xr-x 1 user1 user1 336 Oct 1 21:55 .gtkrc-2.0
drwxr-xr-x 3 user1 user1 4096 Oct 1 21:55 .kde4
drwxr-xr-x 3 user1 user1 4096 Oct 1 21:55 .local
drwxr-xr-x 2 user1 user1 4096 Oct 1 21:55 Temp
-rw------- 1 user1 user1 51 Oct 3 12:35 .Xauthority
Manually purging keys:
# fscrypt purge / --verbose --force --user=user1
Setreuid(1001, 0) = <nil>
keyringID(_uid.1001) = 38418302, <nil>
Setreuid(0, 1001) = <nil>
KeyctlLink(38418302, -2) = <nil>
Setreuid(0, 0) = <nil>
keyringID(_uid.0) = 1063174483, <nil>
KeyctlLink(1063174483, -2) = <nil>
KeyctlLink(38418302, 1063174483) = <nil>
Reading config from "/etc/fscrypt.conf"
creating context for "user1"
found ext4 filesystem "/" (/dev/sda)
listing descriptors in "/.fscrypt/policies"
found 1 descriptor(s)
KeyctlLink(38418302, 1063174483) = <nil>
KeyctlSearch(38418302, logon, ext4:949471831dcf55cf) = -1, required key not available
Policies purged for "/".
syncing changes to filesystem
freeing reclaimable inodes and dentries
Encrypted data removed filesystem cache.
Encrypted directory view after manual purge:
total 48
drwxr-xr-x 8 user1 user1 4096 Oct 3 12:35 .
drwxr-xr-x 6 root root 4096 Oct 3 11:49 ..
drwxr-xr-x 3 user1 user1 4096 Oct 1 21:55 4KuOWyB8JVvtSjQ5wWBs+3UWsPIAtebNN03,X6EhRRD
-rw------- 1 user1 user1 51 Oct 3 12:35 7Gkj14k6MhIjhqp,YpbkzY0ZmW5CZ8NWfjtIUvuXVYN
drwxr-xr-x 5 user1 user1 4096 Oct 3 12:17 cYjQyFUTZ0aueNUy49A2gC6rqu+hr9YqG+J0YxZuogN
drwxr-xr-x 3 user1 user1 4096 Oct 1 21:55 dUJK0ZvNyVKTTyY2aT4uwV70oxGuP4UpaaNTHH6f,PI
-rwxr-xr-x 1 user1 user1 16 Oct 1 21:55 gaVOjkDXQ,epFAzE0U9oaiJ1RZegg,E46fybSNZxyZJ
drwxr-xr-x 12 user1 user1 4096 Oct 3 12:36 GhiHtwJJ6Udq2iruRTdskoM3gOuZO0qwD8Y7db9ViYK
-rwxr-xr-x 1 user1 user1 44 Oct 1 22:59 kqzCh1XWtdVwkE,KK35Atmzw5sgMJX7LstIonhmQBjF
-rwxr-xr-x 1 user1 user1 336 Oct 1 21:55 mA2atU6muhkdiJ8+x11CDrSijNnTx6GymhU5fZQSIRM
drwxr-xr-x 2 user1 user1 4096 Oct 1 21:55 t3rX5lOToba9YDfnn,05o5AOxqs,8C+lilp7ayKpy5M
drwxr-xr-x 2 user1 user1 4096 Oct 1 21:55 xavy48JtAUzUGMEFTKfrwd,ckOdtF0I09FkVArPrg1N
from fscrypt.
commented on May 5, 2024
I tried invoking fscrypt purge / --verbose --force --user=user1 through pam_exec but it didn't work either.
from fscrypt.
ebiggers
commented on May 5, 2024
To revisit this:
The best that fscrypt can do to return an encrypted directory tree to its ciphertext view is what it currently does: remove the key, sync, and drop caches. If that doesn't fully work, then there must be a process that still has one of the files or directories open. For example, if /home/foo is the encrypted directory being locked but a process still has the file /home/foo/bar/baz open, then /home/foo/bar/baz will remain accessible. Furthermore, filenames in /home/foo/bar and /home/foo will remain presented in plaintext (since all parent directories are pinned into cache by an open file too). There's nothing that fscrypt can do about this if the file remains open.
When we switch fscrypt to use the filesystem-level keyrings (#148), the kernel will start printing a warning message when a file is still in-use when an encryption key is removed. That will allow tracking down the cause of these types of bugs. However note that such bugs are really in other parts of the system, not in fscrypt --- though maybe we could try to work around them by retrying the key removal for a few seconds and hoping the file was only in-use temporarily.
from fscrypt.
Related Issues (20)
- Support for individual files to assigned instead of directory level HOT 3
- "fscrypt metadata add-protector-to-policy" doesn't work in key files HOT 1
- Poor scriptability due to --name not being easily checkable HOT 2
- failureExitCode should return higher number than 1 if user tries to lock an already locked file
- Deleting files from folder encrypted with fscrypt HOT 4
- Partial Decrypt HOT 3
- fscrypt tests fail on non x86_64 arches (aarch64, ppc64le, s390x) HOT 7
- How to resolve "Some processes can't access unlocked encrypted files"? HOT 2
- Should we make the fscrypt metadata harder to delete? HOT 2
- multiple login nodes (multiple lustre client), how should I correctly apply the fscrypt tool to encrypt files under shared storage? HOT 1
- Unlocking of encrypted directory inside of disk partition image does not work while fscrypt confirms "ready for use" HOT 4
- Generate `fscrypt.conf` with Adiantum as the encryption mode HOT 2
- How to unlock encrypted regular files located in an unencrypted directory? HOT 8
- Obscure error message due to process address space limit HOT 5
- A question: how does diectory know what policy protects it? HOT 12
- Is it good Idea to copy and reuse policy on other device? Is it good idea to copy and reuse a protector? HOT 2
- fscrypt on CephFS does not recognize locked directories upon remount HOT 7
- fscrypt on CephFS: no buffer space available HOT 1
- Can't lock folders encrypted with fscrypt HOT 8
- Inability to change fscrypt's default directory HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from fscrypt.