Skip to content

Commit

Permalink
Don't delete encryption password until volume deletion succeeds (#1306)
Browse files Browse the repository at this point in the history
* CreateNixVolume: formatting nits

* CreateNixVolume: don't delete disk encryption password if volume deletion failed

* CreateDeterminateNixVolume: formatting nits

* CreateDeterminateNixVolume: don't delete disk encryption password if volume deletion failed
  • Loading branch information
cole-h authored Nov 21, 2024
1 parent 9790b2c commit e085b5a
Show file tree
Hide file tree
Showing 2 changed files with 63 additions and 28 deletions.
44 changes: 31 additions & 13 deletions src/action/macos/create_determinate_nix_volume.rs
Original file line number Diff line number Diff line change
Expand Up @@ -301,37 +301,55 @@ impl Action for CreateDeterminateNixVolume {
let mut errors = vec![];

if let Err(err) = self.enable_ownership.try_revert().await {
errors.push(err)
};
errors.push(err);
}

if let Err(err) = self.kickstart_launchctl_service.try_revert().await {
errors.push(err)
errors.push(err);
}

if let Err(err) = self.bootstrap_volume.try_revert().await {
errors.push(err)
errors.push(err);
}

if let Err(err) = self.setup_volume_daemon.try_revert().await {
errors.push(err)
}
if let Err(err) = self.encrypt_volume.try_revert().await {
errors.push(err)
errors.push(err);
}

if let Err(err) = self.create_fstab_entry.try_revert().await {
errors.push(err)
errors.push(err);
}

if let Err(err) = self.unmount_volume.try_revert().await {
errors.push(err)
errors.push(err);
}

let mut revert_create_volume_failed = false;
if let Err(err) = self.create_volume.try_revert().await {
errors.push(err)
revert_create_volume_failed = true;
errors.push(err);
}

// Intentionally happens after the create_volume step so we can avoid deleting the
// encryption password if volume deletion failed
if revert_create_volume_failed {
tracing::debug!(
"Not reverting encrypt_volume step (which would delete the disk encryption \
password) because deleting the volume failed"
);
} else {
if let Err(err) = self.encrypt_volume.try_revert().await {
errors.push(err);
}
}

// Purposefully not reversed
if let Err(err) = self.create_or_append_synthetic_conf.try_revert().await {
errors.push(err)
errors.push(err);
}

if let Err(err) = self.create_synthetic_objects.try_revert().await {
errors.push(err)
errors.push(err);
}

if let Err(err) = self.create_directory.try_revert().await {
Expand Down
47 changes: 32 additions & 15 deletions src/action/macos/create_nix_volume.rs
Original file line number Diff line number Diff line change
Expand Up @@ -273,40 +273,57 @@ impl Action for CreateNixVolume {
let mut errors = vec![];

if let Err(err) = self.enable_ownership.try_revert().await {
errors.push(err)
};
errors.push(err);
}

if let Err(err) = self.kickstart_launchctl_service.try_revert().await {
errors.push(err)
errors.push(err);
}

if let Err(err) = self.bootstrap_volume.try_revert().await {
errors.push(err)
errors.push(err);
}

if let Err(err) = self.setup_volume_daemon.try_revert().await {
errors.push(err)
errors.push(err);
}

if let Some(encrypt_volume) = &mut self.encrypt_volume {
if let Err(err) = encrypt_volume.try_revert().await {
errors.push(err)
}
}
if let Err(err) = self.create_fstab_entry.try_revert().await {
errors.push(err)
errors.push(err);
}

if let Err(err) = self.unmount_volume.try_revert().await {
errors.push(err)
errors.push(err);
}

let mut revert_create_volume_failed = false;
if let Err(err) = self.create_volume.try_revert().await {
errors.push(err)
revert_create_volume_failed = true;
errors.push(err);
}

// Intentionally happens after the create_volume step so we can avoid deleting the
// encryption password if volume deletion failed
if let Some(encrypt_volume) = &mut self.encrypt_volume {
if revert_create_volume_failed {
tracing::debug!(
"Not reverting encrypt_volume step (which would delete the disk encryption \
password) because deleting the volume failed"
);
} else {
if let Err(err) = encrypt_volume.try_revert().await {
errors.push(err);
}
}
}

// Purposefully not reversed
if let Err(err) = self.create_or_append_synthetic_conf.try_revert().await {
errors.push(err)
errors.push(err);
}

if let Err(err) = self.create_synthetic_objects.try_revert().await {
errors.push(err)
errors.push(err);
}

if errors.is_empty() {
Expand Down

0 comments on commit e085b5a

Please sign in to comment.