From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from localhost (localhost [127.0.0.1]) by arlo.cworth.org (Postfix) with ESMTP id 2FEE06DE0C66 for ; Thu, 30 Nov 2017 00:59:59 -0800 (PST) X-Virus-Scanned: Debian amavisd-new at cworth.org X-Spam-Flag: NO X-Spam-Score: -0.015 X-Spam-Level: X-Spam-Status: No, score=-0.015 tagged_above=-999 required=5 tests=[AWL=-0.015] autolearn=disabled Received: from arlo.cworth.org ([127.0.0.1]) by localhost (arlo.cworth.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Znh0gZHsDcgp for ; Thu, 30 Nov 2017 00:59:58 -0800 (PST) Received: from che.mayfirst.org (che.mayfirst.org [162.247.75.118]) by arlo.cworth.org (Postfix) with ESMTPS id 60AB86DE00C4 for ; Thu, 30 Nov 2017 00:59:57 -0800 (PST) Received: from fifthhorseman.net (ool-6c3a0662.static.optonline.net [108.58.6.98]) by che.mayfirst.org (Postfix) with ESMTPSA id 957E2F99A for ; Thu, 30 Nov 2017 03:59:56 -0500 (EST) Received: by fifthhorseman.net (Postfix, from userid 1000) id 32ECC213B8; Thu, 30 Nov 2017 03:59:53 -0500 (EST) From: Daniel Kahn Gillmor To: Notmuch Mail Subject: [PATCH v2 17/21] cli/reindex: destroy stashed session keys when --decrypt=false Date: Thu, 30 Nov 2017 03:59:42 -0500 Message-Id: <20171130085946.11332-18-dkg@fifthhorseman.net> X-Mailer: git-send-email 2.15.0 In-Reply-To: <20171130085946.11332-1-dkg@fifthhorseman.net> References: <20171130085946.11332-1-dkg@fifthhorseman.net> X-BeenThere: notmuch@notmuchmail.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: "Use and development of the notmuch mail system." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Nov 2017 08:59:59 -0000 There are some situations where the user wants to get rid of the cleartext index of a message. For example, if they're indexing encrypted messages normally, but suddenly they run across a message that they really don't want any trace of in their index. In that case, the natural thing to do is: notmuch reindex --decrypt=false id:whatever@example.biz But of course, clearing the cleartext index without clearing the stashed session key is just silly. So we do the expected thing and also destroy any stashed session keys while we're destroying the index of the cleartext. Note that stashed session keys are stored in the xapian database, but xapian does not currently allow safe deletion (see https://trac.xapian.org/ticket/742). As a workaround, after removing session keys and cleartext material from the database, the user probably should do something like "notmuch compact" to try to purge whatever recoverable data is left in the xapian freelist. This problem really needs to be addressed within xapian, though, if we want it fixed right. --- doc/man1/notmuch-reindex.rst | 3 +++ lib/message.cc | 5 +++++ test/T357-index-decryption.sh | 17 +++++++++++++++++ 3 files changed, 25 insertions(+) diff --git a/doc/man1/notmuch-reindex.rst b/doc/man1/notmuch-reindex.rst index d87e9d85..e8174f39 100644 --- a/doc/man1/notmuch-reindex.rst +++ b/doc/man1/notmuch-reindex.rst @@ -30,6 +30,9 @@ Supported options for **reindex** include the user's secret keys. If decryption is successful, index the cleartext itself. + If ``false``, notmuch reindex will also delete any stashed + session keys for all messages matching the search terms. + Be aware that the index is likely sufficient to reconstruct the cleartext of the message itself, so please ensure that the notmuch message index is adequately protected. DO NOT USE diff --git a/lib/message.cc b/lib/message.cc index 12743460..d5db89b6 100644 --- a/lib/message.cc +++ b/lib/message.cc @@ -2002,6 +2002,11 @@ notmuch_message_reindex (notmuch_message_t *message, ret = notmuch_message_remove_all_properties_with_prefix (message, "index."); if (ret) goto DONE; /* XXX TODO: distinguish from other error returns above? */ + if (indexopts && notmuch_indexopts_get_decrypt_policy (indexopts) == NOTMUCH_DECRYPT_FALSE) { + ret = notmuch_message_remove_all_properties (message, "session-key"); + if (ret) + goto DONE; + } /* re-add the filenames with the associated indexopts */ for (; notmuch_filenames_valid (orig_filenames); diff --git a/test/T357-index-decryption.sh b/test/T357-index-decryption.sh index b2717a7a..64317c64 100755 --- a/test/T357-index-decryption.sh +++ b/test/T357-index-decryption.sh @@ -218,6 +218,23 @@ test_expect_equal \ "$output" \ "$expected" +test_begin_subtest "purging stashed session keys should lose access to the cleartext" +notmuch reindex --decrypt=false id:simple-encrypted@crypto.notmuchmail.org +output=$(notmuch search sekrit) +expected='' +test_expect_equal \ + "$output" \ + "$expected" + +test_begin_subtest "and cleartext should be unrecoverable now that there are no stashed session keys" +notmuch dump +notmuch reindex --decrypt=true id:simple-encrypted@crypto.notmuchmail.org +output=$(notmuch search sekrit) +expected='' +test_expect_equal \ + "$output" \ + "$expected" + # TODO: test removal of a message from the message store between # indexing and reindexing. -- 2.15.0