From dd6b96edf860bc47515e0e3dee62920556899a69 Mon Sep 17 00:00:00 2001
From: David Zeuthen <davidz@redhat.com>
Date: Wed, 22 Jun 2011 15:09:15 -0400
Subject: [PATCH] Add .Encrypted interface with Unlock() and Lock() methods

Signed-off-by: David Zeuthen <davidz@redhat.com>
---
 data/org.freedesktop.UDisks2.xml         |  42 +++-
 doc/udisks2-docs.xml                     |   3 +
 doc/udisks2-sections.txt                 |  65 ++++++
 doc/udisks2.types                        |   4 +
 policy/org.freedesktop.udisks2.policy.in |  22 +-
 src/Makefile.am                          |   1 +
 src/udisksdaemon.c                       |  62 +++++
 src/udisksdaemon.h                       |  22 ++
 src/udisksdaemontypes.h                  |   9 +-
 src/udiskslinuxblock.c                   |  35 +++
 src/udiskslinuxencrypted.c               | 383 +++++++++++++++++++++++++++++++
 src/udiskslinuxencrypted.h               |  37 +++
 udisks/udisksenums.h                     |   6 +-
 udisks/udiskserror.c                     |   3 +-
 14 files changed, 680 insertions(+), 14 deletions(-)
 create mode 100644 src/udiskslinuxencrypted.c
 create mode 100644 src/udiskslinuxencrypted.h

diff --git a/data/org.freedesktop.UDisks2.xml b/data/org.freedesktop.UDisks2.xml
index 7b7bf27..80c41ae 100644
--- a/data/org.freedesktop.UDisks2.xml
+++ b/data/org.freedesktop.UDisks2.xml
@@ -303,8 +303,9 @@
 
     <!-- CryptoBackingDevice:
          The #org.freedesktop.UDisks2.BlockDevice object that is
-         backing the device or <literal>/</literal> if unknown or not
-         an encrypted device.
+         backing the device or <literal>/</literal> if unknown or if
+         the block device is not the cleartext device for an encrypted
+         device.
     -->
     <property name="CryptoBackingDevice" type="o" access="read"/>
 
@@ -417,6 +418,43 @@
   <!-- ********************************************************************** -->
 
   <!--
+      org.freedesktop.UDisks2.Encrypted:
+      @short_description: Block device containing encrypted data
+
+      This interface is used for #org.freedesktop.UDisks2.BlockDevice
+      devices that contain encrypted data.
+  -->
+  <interface name="org.freedesktop.UDisks2.Encrypted">
+    <!-- prereq: org.freedesktop.UDisks2.BlockDevice -->
+
+    <!--
+        Unlock:
+        @passphrase: The passphrase to use.
+        @options: Options (currently unused except for <link linkend="udisks-std-options">standard options</link>).
+        @cleartext_device: An object path to the unlocked cleartext #org.freedesktop.UDisks2.BlockDevice.
+
+        Tries to unlock the encrypted device using @passphrase.
+    -->
+    <method name="Unlock">
+      <arg name="passphrase" direction="in" type="ay"/>
+      <arg name="options" direction="in" type="a{sv}"/>
+      <arg name="cleartext_device" direction="out" type="o"/>
+    </method>
+
+    <!--
+        Lock:
+        @options: Options (currently unused except for <link linkend="udisks-std-options">standard options</link>).
+
+        Locks the encrypted device.
+    -->
+    <method name="Lock">
+      <arg name="options" direction="in" type="a{sv}"/>
+    </method>
+  </interface>
+
+  <!-- ********************************************************************** -->
+
+  <!--
       org.freedesktop.UDisks2.Job:
       @short_description: Long-running tasks
 
diff --git a/doc/udisks2-docs.xml b/doc/udisks2-docs.xml
index cc11e7a..dd9d9c1 100644
--- a/doc/udisks2-docs.xml
+++ b/doc/udisks2-docs.xml
@@ -129,6 +129,7 @@
       <xi:include href="../udisks/udisks-generated-doc-org.freedesktop.UDisks2.BlockDevice.xml"/>
       <xi:include href="../udisks/udisks-generated-doc-org.freedesktop.UDisks2.Filesystem.xml"/>
       <xi:include href="../udisks/udisks-generated-doc-org.freedesktop.UDisks2.Swapspace.xml"/>
+      <xi:include href="../udisks/udisks-generated-doc-org.freedesktop.UDisks2.Encrypted.xml"/>
       <xi:include href="../udisks/udisks-generated-doc-org.freedesktop.UDisks2.Job.xml"/>
     </chapter>
   </part>
@@ -147,6 +148,7 @@
       <xi:include href="xml/UDisksBlockDevice.xml"/>
       <xi:include href="xml/UDisksFilesystem.xml"/>
       <xi:include href="xml/UDisksSwapspace.xml"/>
+      <xi:include href="xml/UDisksEncrypted.xml"/>
     </chapter>
   </part>
 
@@ -158,6 +160,7 @@
     <xi:include href="xml/udiskslinuxblock.xml"/>
     <xi:include href="xml/udiskslinuxdrive.xml"/>
     <xi:include href="xml/udiskslinuxfilesystem.xml"/>
+    <xi:include href="xml/udiskslinuxencrypted.xml"/>
     <xi:include href="xml/udisksmount.xml"/>
     <xi:include href="xml/udisksmountmonitor.xml"/>
     <xi:include href="xml/udiskspersistentstore.xml"/>
diff --git a/doc/udisks2-sections.txt b/doc/udisks2-sections.txt
index 6d6fca5..5de30ae 100644
--- a/doc/udisks2-sections.txt
+++ b/doc/udisks2-sections.txt
@@ -61,6 +61,8 @@ udisks_daemon_get_mount_monitor
 udisks_daemon_get_linux_provider
 udisks_daemon_get_persistent_store
 udisks_daemon_get_authority
+UDisksDaemonWaitFunc
+udisks_daemon_wait_for_object_sync
 udisks_daemon_launch_simple_job
 udisks_daemon_launch_spawned_job
 udisks_daemon_launch_spawned_job_sync
@@ -282,6 +284,18 @@ udisks_linux_filesystem_get_type
 </SECTION>
 
 <SECTION>
+<FILE>udiskslinuxencrypted</FILE>
+UDisksLinuxEncrypted
+udisks_linux_encrypted_new
+<SUBSECTION Standard>
+UDISKS_LINUX_ENCRYPTED
+UDISKS_IS_LINUX_ENCRYPTED
+UDISKS_TYPE_LINUX_ENCRYPTED
+<SUBSECTION Private>
+udisks_linux_encrypted_get_type
+</SECTION>
+
+<SECTION>
 <FILE>UDisksObject</FILE>
 <TITLE>UDisksObject</TITLE>
 UDisksObject
@@ -291,11 +305,13 @@ udisks_object_get_drive
 udisks_object_get_filesystem
 udisks_object_get_job
 udisks_object_get_swapspace
+udisks_object_get_encrypted
 udisks_object_peek_block_device
 udisks_object_peek_drive
 udisks_object_peek_filesystem
 udisks_object_peek_job
 udisks_object_peek_swapspace
+udisks_object_peek_encrypted
 UDisksObjectProxy
 UDisksObjectProxyClass
 udisks_object_proxy_new
@@ -307,6 +323,7 @@ udisks_object_skeleton_set_drive
 udisks_object_skeleton_set_filesystem
 udisks_object_skeleton_set_job
 udisks_object_skeleton_set_swapspace
+udisks_object_skeleton_set_encrypted
 <SUBSECTION Standard>
 udisks_object_get_type
 udisks_object_proxy_get_type
@@ -575,6 +592,54 @@ udisks_swapspace_skeleton_get_type
 </SECTION>
 
 <SECTION>
+<FILE>UDisksEncrypted</FILE>
+UDisksEncrypted
+UDisksEncryptedIface
+udisks_encrypted_interface_info
+udisks_encrypted_call_unlock
+udisks_encrypted_call_unlock_finish
+udisks_encrypted_call_unlock_sync
+udisks_encrypted_complete_unlock
+udisks_encrypted_call_lock
+udisks_encrypted_call_lock_finish
+udisks_encrypted_call_lock_sync
+udisks_encrypted_complete_lock
+UDisksEncryptedProxy
+UDisksEncryptedProxyClass
+udisks_encrypted_proxy_new
+udisks_encrypted_proxy_new_finish
+udisks_encrypted_proxy_new_sync
+udisks_encrypted_proxy_new_for_bus
+udisks_encrypted_proxy_new_for_bus_finish
+udisks_encrypted_proxy_new_for_bus_sync
+UDisksEncryptedSkeleton
+UDisksEncryptedSkeletonClass
+udisks_encrypted_skeleton_new
+<SUBSECTION Standard>
+UDISKS_TYPE_ENCRYPTED
+UDISKS_IS_ENCRYPTED
+UDISKS_ENCRYPTED
+UDISKS_ENCRYPTED_GET_IFACE
+UDISKS_TYPE_ENCRYPTED_PROXY
+UDISKS_IS_ENCRYPTED_PROXY
+UDISKS_IS_ENCRYPTED_PROXY_CLASS
+UDISKS_ENCRYPTED_PROXY
+UDISKS_ENCRYPTED_PROXY_CLASS
+UDISKS_ENCRYPTED_PROXY_GET_CLASS
+UDISKS_TYPE_ENCRYPTED_SKELETON
+UDISKS_IS_ENCRYPTED_SKELETON
+UDISKS_IS_ENCRYPTED_SKELETON_CLASS
+UDISKS_ENCRYPTED_SKELETON
+UDISKS_ENCRYPTED_SKELETON_CLASS
+UDISKS_ENCRYPTED_SKELETON_GET_CLASS
+UDisksEncryptedProxyPrivate
+UDisksEncryptedSkeletonPrivate
+udisks_encrypted_get_type
+udisks_encrypted_proxy_get_type
+udisks_encrypted_skeleton_get_type
+</SECTION>
+
+<SECTION>
 <FILE>UDisksBlockDevice</FILE>
 UDisksBlockDevice
 UDisksBlockDeviceIface
diff --git a/doc/udisks2.types b/doc/udisks2.types
index 69b7448..39bc84b 100644
--- a/doc/udisks2.types
+++ b/doc/udisks2.types
@@ -13,6 +13,7 @@ udisks_provider_get_type
 udisks_linux_provider_get_type
 udisks_persistent_store_get_type
 udisks_linux_filesystem_get_type
+udisks_linux_encrypted_get_type
 
 udisks_drive_get_type
 udisks_drive_proxy_get_type
@@ -26,6 +27,9 @@ udisks_filesystem_skeleton_get_type
 udisks_swapspace_get_type
 udisks_swapspace_proxy_get_type
 udisks_swapspace_skeleton_get_type
+udisks_encrypted_get_type
+udisks_encrypted_proxy_get_type
+udisks_encrypted_skeleton_get_type
 udisks_job_get_type
 udisks_job_proxy_get_type
 udisks_job_skeleton_get_type
diff --git a/policy/org.freedesktop.udisks2.policy.in b/policy/org.freedesktop.udisks2.policy.in
index 06dc743..92d563f 100644
--- a/policy/org.freedesktop.udisks2.policy.in
+++ b/policy/org.freedesktop.udisks2.policy.in
@@ -19,9 +19,19 @@
     </defaults>
   </action>
 
-  <action id="org.freedesktop.udisks2.modify">
-    <_description>Modify a device</_description>
-    <_message>Authentication is required to modify a device</_message>
+  <action id="org.freedesktop.udisks2.encrypted-unlock">
+    <_description>Unlock an encrypted device</_description>
+    <_message>Authentication is required to unlock the encrypted device</_message>
+    <defaults>
+      <allow_any>auth_admin</allow_any>
+      <allow_inactive>auth_admin</allow_inactive>
+      <allow_active>yes</allow_active>
+    </defaults>
+  </action>
+
+  <action id="org.freedesktop.udisks2.encrypted-lock-others">
+    <_description>Lock an encrypted device unlocked by another user</_description>
+    <_message>Authentication is required to lock the unlocked encrypted device</_message>
     <defaults>
       <allow_any>auth_admin</allow_any>
       <allow_inactive>auth_admin</allow_inactive>
@@ -29,9 +39,9 @@
     </defaults>
   </action>
 
-  <action id="org.freedesktop.udisks2.iscsi">
-    <_description>Configure iSCSI devices</_description>
-    <_message>Authentication is required to configure iSCSI devices</_message>
+  <action id="org.freedesktop.udisks2.modify">
+    <_description>Modify a device</_description>
+    <_message>Authentication is required to modify a device</_message>
     <defaults>
       <allow_any>auth_admin</allow_any>
       <allow_inactive>auth_admin</allow_inactive>
diff --git a/src/Makefile.am b/src/Makefile.am
index 8418e2d..72b5761 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -49,6 +49,7 @@ libudisks_daemon_la_SOURCES =						\
 	udiskslinuxprovider.h		udiskslinuxprovider.c		\
 	udiskslinuxblock.h		udiskslinuxblock.c		\
 	udiskslinuxfilesystem.h		udiskslinuxfilesystem.c		\
+	udiskslinuxencrypted.h		udiskslinuxencrypted.c		\
 	udiskslinuxdrive.h		udiskslinuxdrive.c		\
 	udisksbasejob.h			udisksbasejob.c			\
 	udisksspawnedjob.h		udisksspawnedjob.c		\
diff --git a/src/udisksdaemon.c b/src/udisksdaemon.c
index eb750e5..3e85862 100644
--- a/src/udisksdaemon.c
+++ b/src/udisksdaemon.c
@@ -671,3 +671,65 @@ udisks_daemon_launch_spawned_job_sync (UDisksDaemon    *daemon,
 }
 
 /* ---------------------------------------------------------------------------------------------------- */
+
+/**
+ * udisks_daemon_wait_for_object_sync:
+ * @daemon: A #UDisksDaemon.
+ * @wait_func: Function to check for desired object.
+ * @user_data: User data to pass to @wait_func.
+ * @user_data_free_func: (allow-none): Function to free @user_data or %NULL.
+ * @timeout_seconds: Maximum time to wait for the object (in seconds) or 0 to never wait.
+ * @error: (allow-none): Return location for error or %NULL.
+ *
+ * Blocks the calling thread until an object picked by @wait_func is
+ * available or until @timeout_seconds has passed (in which case the
+ * function fails with %UDISKS_ERROR_TIMED_OUT).
+ *
+ * Note that @wait_func will be called on all objects - possibly more than once.
+ *
+ * Returns: (transfer full): The object picked by @wait_func or %NULL if @error is set.
+ */
+UDisksObject *
+udisks_daemon_wait_for_object_sync (UDisksDaemon         *daemon,
+                                    UDisksDaemonWaitFunc  wait_func,
+                                    gpointer              user_data,
+                                    GDestroyNotify        user_data_free_func,
+                                    guint                 timeout_seconds,
+                                    GError              **error)
+{
+  GDBusObjectManagerServer *manager;
+  UDisksObject *ret;
+  GList *objects;
+  GList *l;
+
+  /* TODO: support GCancellable */
+
+  g_return_val_if_fail (UDISKS_IS_DAEMON (daemon), NULL);
+  g_return_val_if_fail (wait_func != NULL, NULL);
+
+  ret = NULL;
+
+  g_object_ref (daemon);
+  manager = udisks_daemon_get_object_manager (daemon);
+  objects = g_dbus_object_manager_get_objects (G_DBUS_OBJECT_MANAGER (manager));
+  for (l = objects; l != NULL; l = l->next)
+    {
+      UDisksObject *object = UDISKS_OBJECT (l->data);
+      if (wait_func (daemon, object, user_data))
+        {
+          ret = g_object_ref (object);
+          break;
+        }
+    }
+  g_list_foreach (objects, (GFunc) g_object_unref, NULL);
+  g_list_free (objects);
+
+  /* TODO: actually sit and wait for up to @timeout_seconds if the object isn't there already */
+
+  if (user_data_free_func != NULL)
+    user_data_free_func (user_data);
+
+  g_object_unref (daemon);
+
+  return ret;
+}
diff --git a/src/udisksdaemon.h b/src/udisksdaemon.h
index 57a7123..14904e5 100644
--- a/src/udisksdaemon.h
+++ b/src/udisksdaemon.h
@@ -37,6 +37,28 @@ UDisksMountMonitor       *udisks_daemon_get_mount_monitor     (UDisksDaemon    *
 UDisksLinuxProvider      *udisks_daemon_get_linux_provider    (UDisksDaemon    *daemon);
 UDisksPersistentStore    *udisks_daemon_get_persistent_store  (UDisksDaemon    *daemon);
 PolkitAuthority          *udisks_daemon_get_authority         (UDisksDaemon    *daemon);
+
+/**
+ * UDisksDaemonWaitFunc:
+ * @daemon: A #UDisksDaemon.
+ * @object: A #UDisksObject to check.
+ * @user_data: The #gpointer passed to udisks_daemon_wait_for_object_sync().
+ *
+ * Type for callback function used with udisks_daemon_wait_for_object_sync().
+ *
+ * Returns: %TRUE if the object is the one to wait for.
+ */
+typedef gboolean (*UDisksDaemonWaitFunc) (UDisksDaemon *daemon,
+                                          UDisksObject *object,
+                                          gpointer      user_data);
+
+UDisksObject             *udisks_daemon_wait_for_object_sync  (UDisksDaemon         *daemon,
+                                                               UDisksDaemonWaitFunc  wait_func,
+                                                               gpointer              user_data,
+                                                               GDestroyNotify        user_data_free_func,
+                                                               guint                 timeout_seconds,
+                                                               GError              **error);
+
 UDisksBaseJob            *udisks_daemon_launch_simple_job     (UDisksDaemon    *daemon,
                                                                GCancellable    *cancellable);
 UDisksBaseJob            *udisks_daemon_launch_spawned_job    (UDisksDaemon    *daemon,
diff --git a/src/udisksdaemontypes.h b/src/udisksdaemontypes.h
index 6a9519c..d6ac0a4 100644
--- a/src/udisksdaemontypes.h
+++ b/src/udisksdaemontypes.h
@@ -18,8 +18,8 @@
  *
  */
 
-#ifndef __TYPES_H__
-#define __TYPES_H__
+#ifndef __UDISKS_DAEMON_TYPES_H__
+#define __UDISKS_DAEMON_TYPES_H__
 
 #include <gio/gio.h>
 #include <polkit/polkit.h>
@@ -64,6 +64,9 @@ typedef struct _UDisksProvider UDisksProvider;
 struct _UDisksLinuxFilesystem;
 typedef struct _UDisksLinuxFilesystem UDisksLinuxFilesystem;
 
+struct _UDisksLinuxEncrypted;
+typedef struct _UDisksLinuxEncrypted UDisksLinuxEncrypted;
+
 /**
  * UDisksThreadedJobFunc:
  * @job: A #UDisksThreadedJob.
@@ -121,4 +124,4 @@ typedef enum
   UDISKS_LOG_LEVEL_ERROR
 } UDisksLogLevel;
 
-#endif
+#endif /* __UDISKS_DAEMON_TYPES_H__ */
diff --git a/src/udiskslinuxblock.c b/src/udiskslinuxblock.c
index 9511a7a..cb25184 100644
--- a/src/udiskslinuxblock.c
+++ b/src/udiskslinuxblock.c
@@ -37,6 +37,7 @@
 #include "udisksmountmonitor.h"
 #include "udiskslinuxdrive.h"
 #include "udiskslinuxfilesystem.h"
+#include "udiskslinuxencrypted.h"
 #include "udiskspersistentstore.h"
 #include "udiskslinuxprovider.h"
 
@@ -69,6 +70,7 @@ struct _UDisksLinuxBlock
   UDisksBlockDevice *iface_block_device;
   UDisksFilesystem *iface_filesystem;
   UDisksSwapspace *iface_swapspace;
+  UDisksEncrypted *iface_encrypted;
 };
 
 struct _UDisksLinuxBlockClass
@@ -109,6 +111,8 @@ udisks_linux_block_finalize (GObject *object)
     g_object_unref (block->iface_filesystem);
   if (block->iface_swapspace != NULL)
     g_object_unref (block->iface_swapspace);
+  if (block->iface_encrypted != NULL)
+    g_object_unref (block->iface_encrypted);
 
   if (G_OBJECT_CLASS (udisks_linux_block_parent_class)->finalize != NULL)
     G_OBJECT_CLASS (udisks_linux_block_parent_class)->finalize (object);
@@ -958,6 +962,35 @@ swapspace_update (UDisksLinuxBlock  *block,
 
 /* ---------------------------------------------------------------------------------------------------- */
 
+static gboolean
+encrypted_check (UDisksLinuxBlock *block)
+{
+  gboolean ret;
+
+  ret = FALSE;
+  if (g_strcmp0 (udisks_block_device_get_id_usage (block->iface_block_device), "crypto") == 0 &&
+      g_strcmp0 (udisks_block_device_get_id_type (block->iface_block_device), "crypto_LUKS") == 0)
+    ret = TRUE;
+
+  return ret;
+}
+
+static void
+encrypted_connect (UDisksLinuxBlock *block)
+{
+  /* do nothing */
+}
+
+static void
+encrypted_update (UDisksLinuxBlock  *block,
+                  const gchar       *uevent_action,
+                  GDBusInterface    *_iface)
+{
+  /* do nothing */
+}
+
+/* ---------------------------------------------------------------------------------------------------- */
+
 /**
  * udisks_linux_block_uevent:
  * @block: A #UDisksLinuxBlock.
@@ -987,6 +1020,8 @@ udisks_linux_block_uevent (UDisksLinuxBlock *block,
                 UDISKS_TYPE_LINUX_FILESYSTEM, &block->iface_filesystem);
   update_iface (block, action, swapspace_check, swapspace_connect, swapspace_update,
                 UDISKS_TYPE_SWAPSPACE_SKELETON, &block->iface_swapspace);
+  update_iface (block, action, encrypted_check, encrypted_connect, encrypted_update,
+                UDISKS_TYPE_LINUX_ENCRYPTED, &block->iface_encrypted);
 }
 
 /* ---------------------------------------------------------------------------------------------------- */
diff --git a/src/udiskslinuxencrypted.c b/src/udiskslinuxencrypted.c
new file mode 100644
index 0000000..fac10f1
--- /dev/null
+++ b/src/udiskslinuxencrypted.c
@@ -0,0 +1,383 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2007-2010 David Zeuthen <zeuthen@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#include "config.h"
+#include <glib/gi18n-lib.h>
+
+#include <sys/types.h>
+#include <pwd.h>
+#include <grp.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include <glib/gstdio.h>
+
+#include "udiskslogging.h"
+#include "udiskslinuxencrypted.h"
+#include "udiskslinuxblock.h"
+#include "udisksdaemon.h"
+#include "udiskspersistentstore.h"
+#include "udisksdaemonutil.h"
+
+/**
+ * SECTION:udiskslinuxencrypted
+ * @title: UDisksLinuxEncrypted
+ * @short_description: Locking and unlocking encrypted devices Linux
+ *
+ * This type provides an implementation of the #UDisksEncrypted
+ * interface on Linux.
+ */
+
+typedef struct _UDisksLinuxEncryptedClass   UDisksLinuxEncryptedClass;
+
+/**
+ * UDisksLinuxEncrypted:
+ *
+ * The #UDisksLinuxEncrypted structure contains only private data and should
+ * only be accessed using the provided API.
+ */
+struct _UDisksLinuxEncrypted
+{
+  UDisksEncryptedSkeleton parent_instance;
+};
+
+struct _UDisksLinuxEncryptedClass
+{
+  UDisksEncryptedSkeletonClass parent_class;
+};
+
+static void encrypted_iface_init (UDisksEncryptedIface *iface);
+
+G_DEFINE_TYPE_WITH_CODE (UDisksLinuxEncrypted, udisks_linux_encrypted, UDISKS_TYPE_ENCRYPTED_SKELETON,
+                         G_IMPLEMENT_INTERFACE (UDISKS_TYPE_ENCRYPTED, encrypted_iface_init));
+
+/* ---------------------------------------------------------------------------------------------------- */
+
+static void
+udisks_linux_encrypted_init (UDisksLinuxEncrypted *encrypted)
+{
+  g_dbus_interface_skeleton_set_flags (G_DBUS_INTERFACE_SKELETON (encrypted),
+                                       G_DBUS_INTERFACE_SKELETON_FLAGS_HANDLE_METHOD_INVOCATIONS_IN_THREAD);
+}
+
+static void
+udisks_linux_encrypted_class_init (UDisksLinuxEncryptedClass *klass)
+{
+}
+
+/**
+ * udisks_linux_encrypted_new:
+ *
+ * Creates a new #UDisksLinuxEncrypted instance.
+ *
+ * Returns: A new #UDisksLinuxEncrypted. Free with g_object_unref().
+ */
+UDisksEncrypted *
+udisks_linux_encrypted_new (void)
+{
+  return UDISKS_ENCRYPTED (g_object_new (UDISKS_TYPE_LINUX_ENCRYPTED,
+                                         NULL));
+}
+
+/* ---------------------------------------------------------------------------------------------------- */
+
+static gboolean
+wait_for_cleartext_object (UDisksDaemon *daemon,
+                           UDisksObject *object,
+                           gpointer      user_data)
+{
+  const gchar *crypto_object_path = user_data;
+  UDisksBlockDevice *block;
+  gboolean ret;
+
+  ret = FALSE;
+  block = udisks_object_peek_block_device (object);
+  if (block == NULL)
+    goto out;
+
+  if (g_strcmp0 (udisks_block_device_get_crypto_backing_device (block), crypto_object_path) == 0)
+    ret = TRUE;
+
+ out:
+  return ret;
+}
+
+/* ---------------------------------------------------------------------------------------------------- */
+
+/* runs in thread dedicated to handling @invocation */
+static gboolean
+handle_unlock (UDisksEncrypted        *encrypted,
+               GDBusMethodInvocation  *invocation,
+               const gchar            *passphrase,
+               GVariant               *options)
+{
+  UDisksObject *object;
+  UDisksBlockDevice *block;
+  UDisksDaemon *daemon;
+  gchar *error_message;
+  gchar *name;
+  gchar *escaped_name;
+  UDisksObject *cleartext_object;
+  UDisksBlockDevice *cleartext_block;
+  GError *error;
+
+  object = NULL;
+  daemon = NULL;
+  error_message = NULL;
+  name = NULL;
+  escaped_name = NULL;
+  cleartext_object = NULL;
+
+  object = UDISKS_OBJECT (g_dbus_interface_get_object (G_DBUS_INTERFACE (encrypted)));
+  block = udisks_object_peek_block_device (object);
+  daemon = udisks_linux_block_get_daemon (UDISKS_LINUX_BLOCK (object));
+
+  /* TODO: check if the device is mentioned in /etc/crypttab (see crypttab(5)) - if so use that
+   *
+   *       Of course cryptsetup(8) don't support that, see https://bugzilla.redhat.com/show_bug.cgi?id=692258
+   */
+
+  /* Fail if the device is not a LUKS device */
+  if (!(g_strcmp0 (udisks_block_device_get_id_usage (block), "crypto") == 0 &&
+        g_strcmp0 (udisks_block_device_get_id_type (block), "crypto_LUKS") == 0))
+    {
+      g_dbus_method_invocation_return_error (invocation,
+                                             UDISKS_ERROR,
+                                             UDISKS_ERROR_FAILED,
+                                             "Device %s does not appear to be a LUKS device",
+                                             udisks_block_device_get_device (block));
+      goto out;
+    }
+
+  /* Fail if device is already unlocked */
+  cleartext_object = udisks_daemon_wait_for_object_sync (daemon,
+                                                         wait_for_cleartext_object,
+                                                         g_strdup (g_dbus_object_get_object_path (G_DBUS_OBJECT (object))),
+                                                         g_free,
+                                                         0, /* timeout_seconds */
+                                                         NULL); /* error */
+  if (cleartext_object != NULL)
+    {
+      UDisksBlockDevice *unlocked_block;
+      unlocked_block = udisks_object_peek_block_device (cleartext_object);
+      g_dbus_method_invocation_return_error (invocation,
+                                             UDISKS_ERROR,
+                                             UDISKS_ERROR_FAILED,
+                                             "Device %s is already unlocked as %s",
+                                             udisks_block_device_get_device (block),
+                                             udisks_block_device_get_device (unlocked_block));
+      goto out;
+    }
+
+
+  /* Now, check that the user is actually authorized to unlock the device.
+   *
+   * TODO: want nicer authentication message + special treatment for system-internal
+   */
+  if (!udisks_daemon_util_check_authorization_sync (daemon,
+                                                    object,
+                                                    "org.freedesktop.udisks2.encrypted-unlock",
+                                                    options,
+                                                    N_("Authentication is required to unlock $(udisks2.device)"),
+                                                    invocation))
+    goto out;
+
+  /* calculate the name to use */
+  name = g_strdup_printf ("LUKS-udisks2-%s", udisks_block_device_get_id_uuid (block));
+  escaped_name = g_strescape (name, NULL);
+
+  /* TODO: support a 'readonly' option */
+  if (!udisks_daemon_launch_spawned_job_sync (daemon,
+                                              NULL,  /* GCancellable */
+                                              &error_message,
+                                              passphrase,  /* input_string */
+                                              "cryptsetup luksOpen \"%s\" \"%s\"",
+                                              udisks_block_device_get_device (block),
+                                              escaped_name))
+    {
+      g_dbus_method_invocation_return_error (invocation,
+                                             UDISKS_ERROR,
+                                             UDISKS_ERROR_FAILED,
+                                             "Error unlocking %s: %s",
+                                             udisks_block_device_get_device (block),
+                                             error_message);
+      goto out;
+    }
+
+  /* Determine the resulting cleartext object */
+  error = NULL;
+  cleartext_object = udisks_daemon_wait_for_object_sync (daemon,
+                                                         wait_for_cleartext_object,
+                                                         g_strdup (g_dbus_object_get_object_path (G_DBUS_OBJECT (object))),
+                                                         g_free,
+                                                         10, /* timeout_seconds */
+                                                         &error);
+  if (cleartext_object == NULL)
+    {
+      g_prefix_error (&error,
+                      "Error waiting for cleartext object after unlocking %s",
+                      udisks_block_device_get_device (block));
+      g_dbus_method_invocation_take_error (invocation, error);
+      goto out;
+    }
+  cleartext_block = udisks_object_peek_block_device (cleartext_object);
+
+  udisks_notice ("Unlocked LUKS device %s as %s",
+                 udisks_block_device_get_device (block),
+                 udisks_block_device_get_device (cleartext_block));
+
+  udisks_encrypted_complete_unlock (encrypted,
+                                    invocation,
+                                    g_dbus_object_get_object_path (G_DBUS_OBJECT (cleartext_object)));
+
+ out:
+  g_free (escaped_name);
+  g_free (name);
+  g_free (error_message);
+  if (cleartext_object != NULL)
+    g_object_unref (cleartext_object);
+
+  return TRUE; /* returning TRUE means that we handled the method invocation */
+}
+
+/* ---------------------------------------------------------------------------------------------------- */
+
+/* runs in thread dedicated to handling @invocation */
+static gboolean
+handle_lock (UDisksEncrypted        *encrypted,
+             GDBusMethodInvocation  *invocation,
+             GVariant               *options)
+{
+  UDisksObject *object;
+  UDisksBlockDevice *block;
+  UDisksDaemon *daemon;
+  gchar *error_message;
+  gchar *name;
+  gchar *escaped_name;
+  UDisksObject *cleartext_object;
+  UDisksBlockDevice *cleartext_block;
+  GUdevDevice *device;
+
+  object = NULL;
+  daemon = NULL;
+  error_message = NULL;
+  name = NULL;
+  escaped_name = NULL;
+  cleartext_object = NULL;
+  device = NULL;
+
+  object = UDISKS_OBJECT (g_dbus_interface_get_object (G_DBUS_INTERFACE (encrypted)));
+  block = udisks_object_peek_block_device (object);
+  daemon = udisks_linux_block_get_daemon (UDISKS_LINUX_BLOCK (object));
+
+  /* TODO: check if the device is mentioned in /etc/crypttab (see crypttab(5)) - if so use that
+   *
+   *       Of course cryptsetup(8) don't support that, see https://bugzilla.redhat.com/show_bug.cgi?id=692258
+   */
+
+  /* Fail if the device is not a LUKS device */
+  if (!(g_strcmp0 (udisks_block_device_get_id_usage (block), "crypto") == 0 &&
+        g_strcmp0 (udisks_block_device_get_id_type (block), "crypto_LUKS") == 0))
+    {
+      g_dbus_method_invocation_return_error (invocation,
+                                             UDISKS_ERROR,
+                                             UDISKS_ERROR_FAILED,
+                                             "Device %s does not appear to be a LUKS device",
+                                             udisks_block_device_get_device (block));
+      goto out;
+    }
+
+  /* Fail if device is not unlocked */
+  cleartext_object = udisks_daemon_wait_for_object_sync (daemon,
+                                                         wait_for_cleartext_object,
+                                                         g_strdup (g_dbus_object_get_object_path (G_DBUS_OBJECT (object))),
+                                                         g_free,
+                                                         0, /* timeout_seconds */
+                                                         NULL); /* error */
+  if (cleartext_object == NULL)
+    {
+      g_dbus_method_invocation_return_error (invocation,
+                                             UDISKS_ERROR,
+                                             UDISKS_ERROR_FAILED,
+                                             "Device %s is not unlocked",
+                                             udisks_block_device_get_device (block));
+      goto out;
+    }
+  cleartext_block = udisks_object_peek_block_device (cleartext_object);
+
+  /* Now, check that the user is actually authorized to lock the device.
+   *
+   * TODO: want nicer authentication message + special treatment if the
+   * uid that locked the device (e.g. w/o -others).
+   */
+  if (!udisks_daemon_util_check_authorization_sync (daemon,
+                                                    object,
+                                                    "org.freedesktop.udisks2.encrypted-lock-others",
+                                                    options,
+                                                    N_("Authentication is required to lock $(udisks2.device)"),
+                                                    invocation))
+    goto out;
+
+  device = udisks_linux_block_get_device (UDISKS_LINUX_BLOCK (cleartext_object));
+  escaped_name = g_strescape (g_udev_device_get_sysfs_attr (device, "dm/name"), NULL);
+
+  if (!udisks_daemon_launch_spawned_job_sync (daemon,
+                                              NULL,  /* GCancellable */
+                                              &error_message,
+                                              NULL,  /* input_string */
+                                              "cryptsetup luksClose \"%s\"",
+                                              escaped_name))
+    {
+      g_dbus_method_invocation_return_error (invocation,
+                                             UDISKS_ERROR,
+                                             UDISKS_ERROR_FAILED,
+                                             "Error locking %s (%s): %s",
+                                             udisks_block_device_get_device (cleartext_block),
+                                             udisks_block_device_get_device (block),
+                                             error_message);
+      goto out;
+    }
+
+  udisks_notice ("Locked LUKS device %s (was unlocked as %s)",
+                 udisks_block_device_get_device (block),
+                 udisks_block_device_get_device (cleartext_block));
+
+  udisks_encrypted_complete_lock (encrypted, invocation);
+
+ out:
+  if (device != NULL)
+    g_object_unref (device);
+  g_free (escaped_name);
+  g_free (name);
+  g_free (error_message);
+  if (cleartext_object != NULL)
+    g_object_unref (cleartext_object);
+
+  return TRUE; /* returning TRUE means that we handled the method invocation */
+}
+
+/* ---------------------------------------------------------------------------------------------------- */
+
+static void
+encrypted_iface_init (UDisksEncryptedIface *iface)
+{
+  iface->handle_unlock = handle_unlock;
+  iface->handle_lock   = handle_lock;
+}
diff --git a/src/udiskslinuxencrypted.h b/src/udiskslinuxencrypted.h
new file mode 100644
index 0000000..042d496
--- /dev/null
+++ b/src/udiskslinuxencrypted.h
@@ -0,0 +1,37 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2007-2010 David Zeuthen <zeuthen@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ */
+
+#ifndef __UDISKS_LINUX_ENCRYPTED_H__
+#define __UDISKS_LINUX_ENCRYPTED_H__
+
+#include "udisksdaemontypes.h"
+
+G_BEGIN_DECLS
+
+#define UDISKS_TYPE_LINUX_ENCRYPTED         (udisks_linux_encrypted_get_type ())
+#define UDISKS_LINUX_ENCRYPTED(o)           (G_TYPE_CHECK_INSTANCE_CAST ((o), UDISKS_TYPE_LINUX_ENCRYPTED, UDisksLinuxEncrypted))
+#define UDISKS_IS_LINUX_ENCRYPTED(o)        (G_TYPE_CHECK_INSTANCE_TYPE ((o), UDISKS_TYPE_LINUX_ENCRYPTED))
+
+GType            udisks_linux_encrypted_get_type (void) G_GNUC_CONST;
+UDisksEncrypted *udisks_linux_encrypted_new      (void);
+
+G_END_DECLS
+
+#endif /* __UDISKS_LINUX_ENCRYPTED_H__ */
diff --git a/udisks/udisksenums.h b/udisks/udisksenums.h
index b8ff0be..4d02129 100644
--- a/udisks/udisksenums.h
+++ b/udisks/udisksenums.h
@@ -43,6 +43,7 @@ G_BEGIN_DECLS
  * @UDISKS_ERROR_MOUNTED_BY_OTHER_USER: The device is mounted by another user.
  * @UDISKS_ERROR_ALREADY_UNMOUNTING: The device is already unmounting.
  * @UDISKS_ERROR_NOT_SUPPORTED: The operation is not supported due to missing driver/tool support.
+ * @UDISKS_ERROR_TIMED_OUT: The operation timed out.
  *
  * Error codes for the #UDISKS_ERROR error domain and the
  * corresponding D-Bus error names.
@@ -60,10 +61,11 @@ typedef enum
   UDISKS_ERROR_OPTION_NOT_PERMITTED,       /* org.freedesktop.UDisks.Error.OptionNotPermitted */
   UDISKS_ERROR_MOUNTED_BY_OTHER_USER,      /* org.freedesktop.UDisks.Error.MountedByOtherUser */
   UDISKS_ERROR_ALREADY_UNMOUNTING,         /* org.freedesktop.UDisks.Error.AlreadyUnmounting */
-  UDISKS_ERROR_NOT_SUPPORTED               /* org.freedesktop.UDisks.Error.NotSupported */
+  UDISKS_ERROR_NOT_SUPPORTED,              /* org.freedesktop.UDisks.Error.NotSupported */
+  UDISKS_ERROR_TIMED_OUT                   /* org.freedesktop.UDisks.Error.Timedout */
 } UDisksError;
 
-#define UDISKS_ERROR_NUM_ENTRIES  (UDISKS_ERROR_NOT_SUPPORTED + 1)
+#define UDISKS_ERROR_NUM_ENTRIES  (UDISKS_ERROR_TIMED_OUT + 1)
 
 G_END_DECLS
 
diff --git a/udisks/udiskserror.c b/udisks/udiskserror.c
index 8f1cfe9..70cbb12 100644
--- a/udisks/udiskserror.c
+++ b/udisks/udiskserror.c
@@ -44,7 +44,8 @@ static const GDBusErrorEntry dbus_error_entries[] =
   {UDISKS_ERROR_OPTION_NOT_PERMITTED,         "org.freedesktop.UDisks.Error.OptionNotPermitted"},
   {UDISKS_ERROR_MOUNTED_BY_OTHER_USER,        "org.freedesktop.UDisks.Error.MountedByOtherUser"},
   {UDISKS_ERROR_ALREADY_UNMOUNTING,           "org.freedesktop.UDisks.Error.AlreadyUnmounting"},
-  {UDISKS_ERROR_NOT_SUPPORTED,                "org.freedesktop.UDisks.Error.NotSupported"}
+  {UDISKS_ERROR_NOT_SUPPORTED,                "org.freedesktop.UDisks.Error.NotSupported"},
+  {UDISKS_ERROR_TIMED_OUT,                    "org.freedesktop.UDisks.Error.Timedout"}
 };
 
 GQuark
-- 
2.7.4