Source code
Revision control
Copy as Markdown
Other Tools
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
#ifndef mozilla_security_lockstore_ProfileKek_h
#define mozilla_security_lockstore_ProfileKek_h
#include "mozilla/FunctionRef.h"
#include "mozilla/Maybe.h"
#include "nsLiteralString.h"
namespace mozilla::security::lockstore {
// Constants for the profile KEK. lockstore derives a kek_ref from
// (type, identifier), so the same pair always names the same record; keep
// these in step with ProfileKekPassword.sys.mjs, which names the same two
// records from JS.
constexpr auto kProfileKekId = "profile"_ns;
constexpr auto kProfilePasswordKek = "lockstore::kek::password:profile"_ns;
constexpr auto kProfileLocalKek = "lockstore::kek::local:profile"_ns;
enum class PrimaryPasswordSync {
// Reopen a password KEK this session has not unlocked yet.
Unlock,
// Bring a primary password lockstore knows nothing about under its wing.
Adopt,
};
/**
* Decide what startup has to do to keep the profile KEK in step with the
* primary password, given the observed state. Nothing means the two already
* agree. Only consulted while security.lockstore.unlock.enabled is set.
*
* aKekExists whether a password profile KEK is on disk
* aKekUnlocked whether the KEK is unlocked, which at this point in
* startup means someone else opened it and owns it
* aTokenHasPassword queried only when the outcome turns on it, since
* instantiating the internal key token is not free
*/
Maybe<PrimaryPasswordSync> ChoosePrimaryPasswordSync(
bool aKekExists, bool aKekUnlocked, FunctionRef<bool()> aTokenHasPassword);
/**
* Whether giving up on aSync leaves the session usable. Adoption is the one
* sync with nothing at stake: no password KEK exists yet, so every DEK is
* still under the LocalKey. Giving up on an unlock leaves DEKs under a KEK this
* session cannot unlock, which breaks every consumer of an encrypted database.
*/
bool SyncIsSkippable(PrimaryPasswordSync aSync);
/**
* While security.lockstore.unlock.enabled is set, bring the profile KEK in step
* with the primary password, prompting for it when needed. Whatever the pref,
* move the profile DEKs back to a LocalKey if it is turned off later in the
* session. Called from nsXREDirProvider::DoStartup just before
* profile-do-change, ahead of the first encrypted database open.
* Returns false when startup cannot continue. Main-thread only.
*/
bool SyncProfileKekAtStartup();
} // namespace mozilla::security::lockstore
#endif // mozilla_security_lockstore_ProfileKek_h