From d211a849ea036d2f25617c278c1d58717ffa5283 Mon Sep 17 00:00:00 2001 From: Ville Takio Date: Mon, 2 Nov 2026 15:51:07 +0200 Subject: [PATCH] Unix: unmount all volumes when a new USB or Thunderbolt device is connected On Windows, "Clear encryption keys from memory if a new device is inserted" protects an unlocked machine against devices connected to extract its memory (#1982). Linux and macOS have no equivalent. Add "A new USB or Thunderbolt device is connected" to Preferences > Security > Unmount All Volumes When. The GUI listens to kernel uevents on Linux and to IOKit notifications on macOS. Devices connected when the option is enabled or VeraCrypt starts are ignored; a device is identified by its vendor, product and serial number, or by its port without a serial number. On a new device, all volumes are unmounted even if files are open, and the password cache is wiped. On Linux, a forced unmount detaches the filesystem lazily and removes the device-mapper devices when they are closed, so the keys would stay in memory while a file is open. DestroyVolumeKeys replaces the table of a volume's device-mapper devices with an error target, for all volumes before the cleanup of any. EmergencyDismountVolume can then also abort the FUSE connection, once the volume's loop and device-mapper devices are released, so that the FUSE service closes the volume, which erases its keys, and exits. Open files then fail with I/O errors. The CLI's --emergency-unmount is unchanged. When the option is enabled, the user can also lock it: the option then cannot be disabled, and VeraCrypt cannot be closed, until the session ends. On Linux, only this auto-unmount option is shown, as unmounting may require the administrator password. Tests/test_linux_new_device_unmount.py checks it against the installed GUI. It is skipped without the dummy_hcd module, as on the GitHub runners, unless --connect-command connects a new device. Related to #1982 --- .github/workflows/build-linux.yml | 5 + Tests/test_linux_new_device_unmount.py | 353 +++++++++++++++++ Translations/Language.ar.xml | 6 + Translations/Language.be.xml | 6 + Translations/Language.bg.xml | 6 + Translations/Language.ca.xml | 6 + Translations/Language.co.xml | 6 + Translations/Language.cs.xml | 6 + Translations/Language.da.xml | 6 + Translations/Language.de.xml | 6 + Translations/Language.el.xml | 6 + Translations/Language.es.xml | 6 + Translations/Language.et.xml | 6 + Translations/Language.eu.xml | 6 + Translations/Language.fa.xml | 6 + Translations/Language.fi.xml | 6 + Translations/Language.fr.xml | 6 + Translations/Language.he.xml | 6 + Translations/Language.hu.xml | 6 + Translations/Language.id.xml | 6 + Translations/Language.it.xml | 6 + Translations/Language.ja.xml | 6 + Translations/Language.ka.xml | 6 + Translations/Language.ko.xml | 6 + Translations/Language.lv.xml | 6 + Translations/Language.my.xml | 6 + Translations/Language.nb.xml | 6 + Translations/Language.nl.xml | 6 + Translations/Language.nn.xml | 6 + Translations/Language.pl.xml | 6 + Translations/Language.pt-br.xml | 6 + Translations/Language.ro.xml | 6 + Translations/Language.ru.xml | 6 + Translations/Language.sk.xml | 6 + Translations/Language.sl.xml | 6 + Translations/Language.sv.xml | 6 + Translations/Language.th.xml | 6 + Translations/Language.tr.xml | 6 + Translations/Language.uk.xml | 6 + Translations/Language.uz.xml | 6 + Translations/Language.vi.xml | 6 + Translations/Language.zh-cn.xml | 6 + Translations/Language.zh-hk.xml | 6 + Translations/Language.zh-tw.xml | 6 + src/Common/Language.xml | 6 + src/Core/CoreBase.h | 3 +- src/Core/Unix/CoreService.cpp | 18 +- src/Core/Unix/CoreService.h | 3 +- src/Core/Unix/CoreServiceProxy.h | 9 +- src/Core/Unix/CoreServiceRequest.cpp | 6 + src/Core/Unix/CoreServiceRequest.h | 8 +- src/Core/Unix/CoreUnix.cpp | 29 +- src/Core/Unix/CoreUnix.h | 3 +- src/Core/Unix/Linux/CoreLinux.cpp | 268 +++++++++++-- src/Core/Unix/Linux/CoreLinux.h | 4 +- src/Main/Forms/Forms.cpp | 5 + src/Main/Forms/Forms.h | 2 + src/Main/Forms/MainFrame.cpp | 37 +- src/Main/Forms/MainFrame.h | 7 +- src/Main/Forms/PreferencesDialog.cpp | 51 ++- src/Main/Forms/PreferencesDialog.h | 2 + src/Main/Forms/TrueCrypt.fbp | 65 ++++ src/Main/GraphicUserInterface.cpp | 142 +++++++ src/Main/GraphicUserInterface.h | 14 + src/Main/Main.make | 1 + src/Main/NewDeviceMonitor.cpp | 515 +++++++++++++++++++++++++ src/Main/NewDeviceMonitor.h | 42 ++ src/Main/UserPreferences.cpp | 2 + src/Main/UserPreferences.h | 2 + 69 files changed, 1797 insertions(+), 57 deletions(-) create mode 100644 Tests/test_linux_new_device_unmount.py create mode 100644 src/Main/NewDeviceMonitor.cpp create mode 100644 src/Main/NewDeviceMonitor.h diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml index 6379b82ce8..08fa9cb459 100644 --- a/.github/workflows/build-linux.yml +++ b/.github/workflows/build-linux.yml @@ -28,6 +28,7 @@ on: - 'Tests/test_stdin_password.py' - 'Tests/test_mount_helper.py' - 'Tests/test_linux_mount_point_protection.py' + - 'Tests/test_linux_new_device_unmount.py' - 'Tests/test.*.hc' - 'Tests/test_volume_read.py' - 'Tests/volume_read_test.cpp' @@ -64,6 +65,7 @@ on: - 'Tests/test_stdin_password.py' - 'Tests/test_mount_helper.py' - 'Tests/test_linux_mount_point_protection.py' + - 'Tests/test_linux_new_device_unmount.py' - 'Tests/test.*.hc' - 'Tests/test_volume_read.py' - 'Tests/volume_read_test.cpp' @@ -221,6 +223,9 @@ jobs: sudo python3 Tests/test_stdin_password.py --require-locales sudo python3 Tests/test_mount_helper.py --helper /usr/sbin/mount.veracrypt sudo python3 Tests/test_linux_mount_point_protection.py + sudo apt-get install -y xvfb + sudo apt-get install -y "linux-modules-extra-$(uname -r)" || echo "No extra kernel modules for $(uname -r)" + sudo python3 Tests/test_linux_new_device_unmount.py sudo apt remove -y veracrypt - name: Install and test VeraCrypt Console .deb packages diff --git a/Tests/test_linux_new_device_unmount.py b/Tests/test_linux_new_device_unmount.py new file mode 100644 index 0000000000..20891a12bb --- /dev/null +++ b/Tests/test_linux_new_device_unmount.py @@ -0,0 +1,353 @@ +#!/usr/bin/env python3 +"""Test for issue #1982, against the installed veracrypt GUI. + +Usage (as root, with Xvfb and the dummy_hcd and g_zero kernel modules): + python3 Tests/test_linux_new_device_unmount.py [--veracrypt PATH] + [--connect-command COMMAND] + +With --connect-command, COMMAND connects a new USB device (for example a +virtual machine's host hot-plugging one) instead of g_zero, and the kernel +modules are not needed. + +Mounts a volume with kernel cryptography and a volume without kernel +cryptography, with a file open on each, then starts the GUI with "Unmount +all volumes when a new USB or Thunderbolt device is connected" enabled, and +checks that: + +- a device that was connected when the GUI started does not unmount the + volumes when the kernel reports it again; +- a new USB device unmounts both volumes, and their keys are gone at once: + the open files fail with I/O errors (the FUSE service of the volume without + kernel cryptography has exited), and the device-mapper devices of the + other volume are removed or replaced with an error target. + +The test is skipped if xvfb-run, or the kernel modules without +--connect-command, are not available. +""" + +import argparse +import errno +import os +import re +import shutil +import signal +import subprocess +import sys +import tempfile +import time +from pathlib import Path + +PASSWORD = "regression-test-password-new-device" +# A low PIM keeps the tests fast; it needs passwords of 20 characters or more. +COMMON = ["--pim=1", "--keyfiles=", "--protect-hidden=no"] +NETLINK_KOBJECT_UEVENT = 15 + + +class Checks: + def __init__(self): + self.failures = 0 + + def check(self, desc, cond, detail=""): + print(("ok " if cond else "FAIL ") + desc, flush=True) + if not cond: + self.failures += 1 + if detail: + print(" " + detail.strip().replace("\n", "\n ")) + + +def text(result): + return (result.stdout or b"").decode("utf-8", "replace") + + +def modprobe(*args): + return subprocess.run(["modprobe"] + list(args), stdout=subprocess.PIPE, + stderr=subprocess.STDOUT).returncode == 0 + + +def uevent_socket_inodes(): + """Inodes of the netlink sockets listening to kernel uevents.""" + inodes = set() + with open("/proc/net/netlink") as f: + next(f) + for line in f: + fields = line.split() + # sk Eth Pid Groups Rmem Wmem Dump Locks Drops Inode + if len(fields) >= 10 and int(fields[1]) == NETLINK_KOBJECT_UEVENT \ + and int(fields[3], 16) & 1: + inodes.add(fields[9]) + return inodes + + +def process_tree(root_pid): + """The process and all its descendants.""" + children = {} + for entry in os.listdir("/proc"): + if not entry.isdigit(): + continue + try: + with open("/proc/%s/stat" % entry) as f: + stat = f.read() + except OSError: + continue + ppid = int(stat[stat.rindex(")") + 2:].split()[1]) + children.setdefault(ppid, []).append(int(entry)) + pids, todo = [], [root_pid] + while todo: + pid = todo.pop() + pids.append(pid) + todo.extend(children.get(pid, [])) + return pids + + +def listens_to_uevents(root_pid): + inodes = uevent_socket_inodes() + for pid in process_tree(root_pid): + try: + for fd in os.listdir("/proc/%d/fd" % pid): + link = os.readlink("/proc/%d/fd/%s" % (pid, fd)) + match = re.match(r"socket:\[(\d+)\]", link) + if match and match.group(1) in inodes: + return True + except OSError: + continue + return False + + +def aux_mounts(): + with open("/proc/mounts") as f: + return [line for line in f if ".veracrypt_aux_mnt" in line] + + +def fuse_holders(executable): + """VeraCrypt processes that hold /dev/fuse open.""" + holders = [] + for entry in os.listdir("/proc"): + if not entry.isdigit(): + continue + try: + if os.readlink("/proc/%s/exe" % entry) != executable: + continue + for fd in os.listdir("/proc/%s/fd" % entry): + if os.readlink("/proc/%s/fd/%s" % (entry, fd)) == "/dev/fuse": + holders.append(int(entry)) + break + except OSError: + continue + return holders + + +def wait_for(condition, timeout): + deadline = time.monotonic() + timeout + while time.monotonic() < deadline: + if condition(): + return True + time.sleep(0.5) + return condition() + + +def main(): + parser = argparse.ArgumentParser(description=__doc__.splitlines()[0]) + parser.add_argument("--veracrypt", + default=shutil.which("veracrypt") or "veracrypt") + parser.add_argument("--connect-command", + help="shell command connecting a new USB device") + args = parser.parse_args() + if os.geteuid() != 0: + sys.exit("Run as root: the test mounts volumes and loads kernel modules") + + # The GUI destroys the keys of every mounted volume, not only of this test's + if aux_mounts(): + sys.exit("Other VeraCrypt volumes are mounted: not running this test") + + if not shutil.which("xvfb-run"): + print("SKIP: xvfb-run is not available") + return + if not args.connect_command and not modprobe("dummy_hcd"): + print("SKIP: the dummy_hcd kernel module is not available") + return + + work = Path(tempfile.mkdtemp(prefix="vc-new-device-")) + config = work / "config" / "VeraCrypt" + config.mkdir(parents=True) + env = dict(os.environ, XDG_CONFIG_HOME=str(work / "config")) + (work / "random").write_bytes(os.urandom(4096)) + (config / "Configuration.xml").write_text( + '\n\n' + '\t\n' + '\t\t1\n' + '\t\t0\n' + '\t\n\n') + c = Checks() + gui = None + open_fds = {} + + def run(arguments): + return subprocess.run([args.veracrypt, "--text"] + arguments, + stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, cwd=work, env=env, + timeout=300) + + def mounted(): + """Volume path and slot of each mounted volume; raises if the + volumes cannot be listed.""" + r = run(["--list"]) + if r.returncode != 0: + if "No volumes mounted" in text(r): + return {} + raise RuntimeError("veracrypt --list failed: " + text(r)) + volumes = {} + for line in text(r).splitlines(): + fields = line.split() + if len(fields) >= 4 and fields[0].endswith(":"): + volumes[fields[1]] = fields[0].rstrip(":") + return volumes + + def dismount(volumes): + """Dismounts only these volumes; returns whether none remains.""" + paths = [str(volume) for volume in volumes] + for _ in range(3): + remaining = [path for path in paths if path in mounted()] + if not remaining: + return True + for path in remaining: + run(["--non-interactive", "--force", "-d", path]) + return not any(path in mounted() for path in paths) + + def veracrypt_dm_tables(): + r = subprocess.run(["dmsetup", "table"], stdout=subprocess.PIPE, + stderr=subprocess.STDOUT) + return [line for line in text(r).splitlines() + if line.startswith("veracrypt")] + + kernel, fuse = work / "kernel.hc", work / "fuse.hc" + try: + for volume in (kernel, fuse): + r = run(["--non-interactive", "--create", str(volume), + "--size=10M", "--volume-type=normal", + "--encryption=AES", "--hash=SHA-512", + "--filesystem=fat", "-p", PASSWORD, "--pim=1", + "--keyfiles=", "--random-source=" + str(work / "random")]) + c.check("create %s" % volume.name, r.returncode == 0, text(r)) + if c.failures: + sys.exit("Cannot create the test volumes") + + (work / "kernel").mkdir() + (work / "fuse").mkdir() + tables_before = veracrypt_dm_tables() + r = run(["--non-interactive", "-p", PASSWORD] + COMMON + + [str(kernel), str(work / "kernel")]) + c.check("mount kernel.hc with kernel cryptography", r.returncode == 0, + text(r)) + r = run(["--non-interactive", "-p", PASSWORD] + COMMON + + ["--mount-options=nokernelcrypto", str(fuse), + str(work / "fuse")]) + c.check("mount fuse.hc without kernel cryptography", r.returncode == 0, + text(r)) + tables = [t for t in veracrypt_dm_tables() if t not in tables_before] + c.check("kernel.hc has device-mapper devices", len(tables) > 0, + "\n".join(veracrypt_dm_tables())) + if c.failures: + sys.exit("Cannot mount the test volumes") + dm_names = [t.split(":")[0] for t in tables] + + for name in ("kernel", "fuse"): + fd = os.open(str(work / name / "open.txt"), + os.O_RDWR | os.O_CREAT, 0o600) + open_fds[name] = fd + os.write(fd, b"data") + os.fsync(fd) + + gui_log = open(str(work / "gui.log"), "wb") + gui = subprocess.Popen(["xvfb-run", "-a", args.veracrypt], + cwd=work, env=env, stdout=gui_log, + stderr=subprocess.STDOUT, + start_new_session=True) + listening = wait_for(lambda: listens_to_uevents(gui.pid), 180) + detail = "" + if not listening: + detail = "GUI %s; output:\n%s" % ( + "running" if gui.poll() is None else "exited with %s" % gui.returncode, + (work / "gui.log").read_text(errors="replace")[-3000:]) + c.check("the GUI listens to kernel device events", listening, detail) + if c.failures: + sys.exit("The GUI does not monitor devices") + + # Devices connected when the GUI started, reported again by the kernel + for device in Path("/sys/bus/usb/devices").iterdir(): + if (device / "idVendor").exists(): + try: + (device / "uevent").write_text("add") + except OSError: + pass + time.sleep(5) + volumes = mounted() + c.check("a device connected before the GUI started does not unmount", + str(kernel) in volumes and str(fuse) in volumes, str(volumes)) + + if args.connect_command: + c.check("connect a new device", subprocess.run( + args.connect_command, shell=True).returncode == 0) + else: + # g_zero binds to the dummy UDC: a new device on the dummy host bus + c.check("load g_zero", modprobe("g_zero")) + c.check("#1982: a new USB device unmounts all volumes", + wait_for(lambda: not ({str(kernel), str(fuse)} + & set(mounted())), 60), str(mounted())) + + # The data must be read from the device, not from the page cache + Path("/proc/sys/vm/drop_caches").write_text("3") + for name, fd in open_fds.items(): + try: + os.pread(fd, 4, 0) + read_error = 0 + except OSError as e: + read_error = e.errno + c.check("#1982: the file open on %s.hc fails with an I/O error" + % name, read_error == errno.EIO, "errno %d" % read_error) + + left = [t for t in veracrypt_dm_tables() + if t.split(":")[0] in dm_names] + c.check("#1982: the device-mapper devices are removed or hold no key", + all(" error" in t and " crypt " not in t for t in left), + "\n".join(left)) + + aux = aux_mounts() + c.check("#1982: no auxiliary mount remains", not aux, "".join(aux)) + executable = os.path.realpath(shutil.which(args.veracrypt) or args.veracrypt) + c.check("#1982: no FUSE service remains", + wait_for(lambda: not fuse_holders(executable), 30), + str(fuse_holders(executable))) + finally: + for fd in open_fds.values(): + os.close(fd) + if gui is not None: + for sig in (signal.SIGTERM, signal.SIGKILL): + try: + os.killpg(gui.pid, sig) + gui.wait(timeout=30) + break + except (OSError, subprocess.TimeoutExpired): + continue + if not args.connect_command: + modprobe("-r", "g_zero") + try: + cleaned = dismount([fuse, kernel]) + except Exception as e: + print("Cannot list the mounted volumes: %s" % e) + cleaned = False + if cleaned: + if not args.connect_command: + modprobe("-r", "dummy_hcd") + shutil.rmtree(work, ignore_errors=True) + else: + # Reported after the original error, if any + print("A test volume is still mounted; not removing %s" % work) + c.failures += 1 + + if c.failures: + sys.exit("%d check(s) failed" % c.failures) + print("All checks passed") + + +if __name__ == "__main__": + main() diff --git a/Translations/Language.ar.xml b/Translations/Language.ar.xml index 3e3de1afbc..cd1fb0db90 100644 --- a/Translations/Language.ar.xml +++ b/Translations/Language.ar.xml @@ -1740,6 +1740,12 @@ ‮يشمل هذا الفحص مدير إقلاع ويندوز النشط فقط. قبل الإبطال، تحقق أيضا من توافق خيار الاسترداد بفك التعمية والنسخ الاحتياطية للإنقاذ. قد تؤدي عملية إنشاء قرص إنقاذ ڤيراكربت جديد إلى إعادة استخدام نسخة احتياطية أقدم محفوظة من مدير الإقلاع؛ فمجرد إنشاء القرص لا يثبت توافق تلك النسخة مع الإبطال. ‮النسخة الاحتياطية من مدير إقلاع ويندوز Windows Boot Manager المضمنة في قرص الإنقاذ هذا موقّعة من Microsoft Windows Production PCA 2011. يحتوي البرنامج الثابت لديك بالفعل على Windows UEFI CA 2023.\n\nبعد إبطال PCA 2011 (البت 0x80 من AvailableUpdates، بما في ذلك القيمة المجمّعة 0x280)، قد تؤدي استعادة هذه النسخة الاحتياطية إلى تعذر بدء ويندوز مع تفعيل Secure Boot. يعيد إنشاء قرص إنقاذ جديد استخدام هذه النسخة الاحتياطية المحفوظة، ولا يحدّث توقيعها.\n\nقبل تطبيق الإبطال، جهّز وسائط استرداد ويندوز محدّثة ومتوافقة، وتحقق من خيار الاسترداد بفك التعمية. لا تعتمد على قرص الإنقاذ هذا لاستعادة مدير إقلاع ويندوز متوافق. يظل مفيدا لمهام استرداد ڤيراكربت الأخرى. ‮تعذر على ڤيراكربت فحص النسخة الاحتياطية من مدير إقلاع ويندوز Windows Boot Manager الموجودة في قرص الإنقاذ هذا وفق سياسة Secure Boot في البرنامج الثابت.\n\nإنشاء هذا القرص أو التحقق منه لا يثبت توافق مدير إقلاع ويندوز المحفوظ فيه مع إبطال PCA 2011 (البت 0x80 من AvailableUpdates، بما في ذلك القيمة المجمّعة 0x280). قبل تطبيق الإبطال، تحقق من نسخك الاحتياطية للاسترداد، وجهّز وسائط استرداد ويندوز محدّثة ومتوافقة. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.be.xml b/Translations/Language.be.xml index bf400a6994..7e00cbf870 100644 --- a/Translations/Language.be.xml +++ b/Translations/Language.be.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.bg.xml b/Translations/Language.bg.xml index 9250b75fcf..f0250d4cf1 100644 --- a/Translations/Language.bg.xml +++ b/Translations/Language.bg.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.ca.xml b/Translations/Language.ca.xml index 7dc5a164c1..bfcd961c15 100644 --- a/Translations/Language.ca.xml +++ b/Translations/Language.ca.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.co.xml b/Translations/Language.co.xml index 9846136222..bf5a85625d 100644 --- a/Translations/Language.co.xml +++ b/Translations/Language.co.xml @@ -1763,6 +1763,12 @@ Information about Corsican localization: Stu cuntrollu copre solu u ghjestiunariu di piccera Windows attivu. Prima a revucazione, verificà dinù chì a suluzione alternativa di dicifratura è chì e salvaguardie di succorsu sianu cumpatibile. A creazione d’un discu di succorsu VeraCrypt novu pò rimpiegà una salvaguardia anziana arregistrata di u ghjestiunariu di piccera ; a creazione di u discu solu ùn stabilisce micca a cumpatibilità di quella salvaguardia cù a revucazione. A salvaguardia di u ghjestiunariu di piccera Windows inclusa in stu discu di succorsu hè firmata da Microsoft Windows Production PCA 2011. U vostru microprugramma cuntene dighjà Windows UEFI CA 2023.\n\nDopu a revucazione di PCA 2011 (AvailableUpdates bit 0x80, includendu u valore cumbinatu 0x280), a risturazione di sta salvaguardia pò rende impussibule u lanciu di Windows cù a piccera sicurizata attivata. A creazione d’un discu di succorsu novu rimpiegheghja sta salvaguardia arregistrata ; ùn mudificheghja micca a so segnatura.\n\nPrima d’appiecà a revucazione, appruntà un medià di ricuperazione Windows cumpatibile è messu à livellu è verificà a suluzione alternativa di dicifratura. Ùn vi fidate micca à stu discu di succorsu per risturà un ghjestiunariu di piccera Windows cumpatibile. Ma stà ghjuvevule per d’altre tacche di ricuperazione VeraCrypt. VeraCrypt ùn hà pussutu verificà a salvaguardia di u ghjestiunariu di piccera Windows in stu discu di succorsu secondu à a pulitica di a piccera sicurizata di u microprugramma.\n\nA creazione o a verificazione di stu discu ùn vole micca dì chì u so ghjestiunariu di piccera Windows arregistratu hè cumpatibile cù a revucazione PCA 2011 (AvailableUpdates bit 0x80, includendu u valore cumbinatu 0x280). Prima d’appiecà a revucazione, verificà e vostre salvaguardie di ricuperazione è appruntà un medià di ricuperazione Windows cumpatibile è messu à livellu. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.cs.xml b/Translations/Language.cs.xml index 304bdd69aa..b37ecf0f00 100644 --- a/Translations/Language.cs.xml +++ b/Translations/Language.cs.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.da.xml b/Translations/Language.da.xml index eec9f3a31d..7df61ef17c 100644 --- a/Translations/Language.da.xml +++ b/Translations/Language.da.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.de.xml b/Translations/Language.de.xml index a89101955b..c47eb963b6 100644 --- a/Translations/Language.de.xml +++ b/Translations/Language.de.xml @@ -1743,6 +1743,12 @@ Diese Prüfung erfasst nur den aktiven Windows-Bootmanager. Überprüfen Sie vor dem Widerruf auch, ob die Möglichkeit zur Wiederherstellung durch Entschlüsselung und die Sicherungen auf Rettungsdatenträgern kompatibel sind. Beim Erstellen eines neuen VeraCrypt-Rettungsdatenträgers kann eine ältere gespeicherte Sicherung des Bootmanagers wiederverwendet werden. Das Erstellen des Datenträgers allein bestätigt nicht, dass diese Sicherung mit dem Widerruf kompatibel ist. Die auf diesem Rettungsdatenträger enthaltene Sicherung des Windows-Bootmanagers ist von Microsoft Windows Production PCA 2011 signiert. Ihre Firmware enthält bereits Windows UEFI CA 2023.\n\nNach dem Widerruf von PCA 2011 (Bit 0x80 in AvailableUpdates, einschließlich des kombinierten Werts 0x280) kann die Wiederherstellung dieser Sicherung dazu führen, dass Windows bei aktiviertem Secure Boot nicht mehr startet. Beim Erstellen eines neuen Rettungsdatenträgers wird diese gespeicherte Sicherung wiederverwendet. Ihre Signatur wird dabei nicht aktualisiert.\n\nBereiten Sie vor dem Anwenden des Widerrufs kompatible, aktuelle Windows-Wiederherstellungsmedien vor und überprüfen Sie die Möglichkeit zur Wiederherstellung durch Entschlüsselung. Verlassen Sie sich nicht auf diesen Rettungsdatenträger, um einen kompatiblen Windows-Bootmanager wiederherzustellen. Er bleibt für andere Wiederherstellungsaufgaben von VeraCrypt nützlich. VeraCrypt konnte die Sicherung des Windows-Bootmanagers auf diesem Rettungsdatenträger nicht anhand der Secure-Boot-Richtlinie der Firmware überprüfen.\n\nDas Erstellen oder Überprüfen dieses Datenträgers bestätigt nicht, dass der darauf gespeicherte Windows-Bootmanager mit dem Widerruf von PCA 2011 (Bit 0x80 in AvailableUpdates, einschließlich des kombinierten Werts 0x280) kompatibel ist. Überprüfen Sie vor dem Anwenden des Widerrufs Ihre Sicherungen für die Wiederherstellung und bereiten Sie kompatible, aktuelle Windows-Wiederherstellungsmedien vor. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.el.xml b/Translations/Language.el.xml index 09b7fd0ab4..e738244348 100644 --- a/Translations/Language.el.xml +++ b/Translations/Language.el.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.es.xml b/Translations/Language.es.xml index 9aad9fa76e..3826148ff7 100644 --- a/Translations/Language.es.xml +++ b/Translations/Language.es.xml @@ -1740,6 +1740,12 @@ Esta comprobación sólo cubre el Administrador de arranque de Windows activo. Antes de aplicar la revocación, compruebe también que la alternativa de descifrado y las copias de seguridad de rescate sean compatibles. Al crear un nuevo Disco de Rescate VeraCrypt se puede reutilizar una copia de seguridad antigua del administrador de arranque; crear el disco por sí solo no permite confirmar la compatibilidad de esa copia con la revocación. La copia de seguridad del Administrador de arranque de Windows incluida en este Disco de Rescate está firmada por Microsoft Windows Production PCA 2011. Su firmware ya contiene Windows UEFI CA 2023.\n\nTras la revocación de PCA 2011 (bit 0x80 de AvailableUpdates, incluido el valor combinado 0x280), restaurar esta copia de seguridad puede impedir que Windows arranque con Secure Boot habilitado. Crear un nuevo Disco de Rescate reutiliza esta copia de seguridad almacenada; no actualiza su firma.\n\nAntes de aplicar la revocación, prepare un medio de recuperación de Windows compatible y actualizado y compruebe la alternativa de descifrado. No confíe en este Disco de Rescate para restaurar un Administrador de arranque de Windows compatible. Sigue siendo útil para otras tareas de recuperación de VeraCrypt. VeraCrypt no pudo comprobar la copia de seguridad del Administrador de arranque de Windows de este Disco de Rescate frente a la política de Secure Boot del firmware.\n\nCrear o verificar este disco no permite confirmar que el Administrador de arranque de Windows que contiene sea compatible con la revocación de PCA 2011 (bit 0x80 de AvailableUpdates, incluido el valor combinado 0x280). Antes de aplicar la revocación, verifique sus copias de seguridad de recuperación y prepare un medio de recuperación de Windows compatible y actualizado. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.et.xml b/Translations/Language.et.xml index ca7932fc85..c2cce74c03 100644 --- a/Translations/Language.et.xml +++ b/Translations/Language.et.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.eu.xml b/Translations/Language.eu.xml index 19d735d6cd..f0722d7a31 100644 --- a/Translations/Language.eu.xml +++ b/Translations/Language.eu.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.fa.xml b/Translations/Language.fa.xml index a24d94232e..82d43543c0 100644 --- a/Translations/Language.fa.xml +++ b/Translations/Language.fa.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.fi.xml b/Translations/Language.fi.xml index ae960149cb..5e814ed8e0 100644 --- a/Translations/Language.fi.xml +++ b/Translations/Language.fi.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.fr.xml b/Translations/Language.fr.xml index 7f1ccffe30..ca852f3237 100644 --- a/Translations/Language.fr.xml +++ b/Translations/Language.fr.xml @@ -1740,6 +1740,12 @@ Cette vérification porte uniquement sur le Gestionnaire de démarrage Windows actif. Avant la révocation, vérifiez également la compatibilité de la solution de repli pour le déchiffrement et des sauvegardes de secours. La création d’un nouveau disque de secours VeraCrypt peut réutiliser une ancienne sauvegarde du Gestionnaire de démarrage ; la création du disque à elle seule ne permet pas de confirmer la compatibilité de cette sauvegarde avec la révocation. La sauvegarde du Gestionnaire de démarrage Windows incluse dans ce disque de secours est signée par Microsoft Windows Production PCA 2011. Votre firmware contient déjà Windows UEFI CA 2023.\n\nAprès la révocation de PCA 2011 (bit 0x80 d’AvailableUpdates, y compris la valeur combinée 0x280), la restauration de cette sauvegarde peut empêcher Windows de démarrer lorsque Secure Boot est activé. La création d’un nouveau disque de secours réutilise cette sauvegarde existante ; elle ne met pas à jour sa signature.\n\nAvant d’appliquer la révocation, préparez un support de récupération Windows compatible et à jour et vérifiez la solution de repli pour le déchiffrement. Ne comptez pas sur ce disque de secours pour restaurer un Gestionnaire de démarrage Windows compatible. Il reste utile pour les autres opérations de récupération de VeraCrypt. VeraCrypt n’a pas pu vérifier la sauvegarde du Gestionnaire de démarrage Windows contenue dans ce disque de secours par rapport à la politique Secure Boot du firmware.\n\nLa création ou la vérification de ce disque ne permet pas de confirmer que le Gestionnaire de démarrage Windows qu’il contient est compatible avec la révocation de PCA 2011 (bit 0x80 d’AvailableUpdates, y compris la valeur combinée 0x280). Avant d’appliquer la révocation, vérifiez vos sauvegardes de récupération et préparez un support de récupération Windows compatible et à jour. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.he.xml b/Translations/Language.he.xml index 129d95ad93..25c1a5723b 100644 --- a/Translations/Language.he.xml +++ b/Translations/Language.he.xml @@ -1740,6 +1740,12 @@ בדיקה זו כוללת רק את מנהל האתחול הפעיל של Windows. לפני ביטול האמון, ודא גם שאפשרות השחזור באמצעות פענוח וגיבויי ההצלה תואמים. יצירת דיסק הצלה חדש של VeraCrypt עשויה להשתמש שוב בגיבוי ישן יותר של מנהל האתחול שנשמר; יצירת הדיסק בלבד אינה מוכיחה שגיבוי זה תואם לביטול האמון. הגיבוי של מנהל האתחול של Windows הכלול בדיסק הצלה זה חתום על ידי Microsoft Windows Production PCA 2011. הקושחה שלך כבר מכילה את Windows UEFI CA 2023.\n\nלאחר ביטול האמון ב-PCA 2011 (הסיבית 0x80 של AvailableUpdates, כולל הערך המשולב 0x280), שחזור גיבוי זה עלול למנוע מ-Windows לפעול כאשר Secure Boot מופעל. יצירת דיסק הצלה חדש משתמשת שוב בגיבוי שמור זה; היא אינה מעדכנת את חתימתו.\n\nלפני החלת ביטול האמון, הכן מדיית שחזור עדכנית ותואמת של Windows וודא שאפשרות השחזור באמצעות פענוח תקינה. אל תסתמך על דיסק הצלה זה לשחזור מנהל אתחול תואם של Windows. הוא עדיין שימושי למשימות שחזור אחרות של VeraCrypt. VeraCrypt לא הצליח לבדוק את הגיבוי של מנהל האתחול של Windows בדיסק הצלה זה מול מדיניות Secure Boot של הקושחה.\n\nיצירת דיסק זה או אימותו אינם מוכיחים שמנהל האתחול של Windows השמור בו תואם לביטול האמון ב-PCA 2011 (הסיבית 0x80 של AvailableUpdates, כולל הערך המשולב 0x280). לפני החלת ביטול האמון, בדוק את גיבויי השחזור שלך והכן מדיית שחזור עדכנית ותואמת של Windows. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.hu.xml b/Translations/Language.hu.xml index 71f023df22..e920110302 100644 --- a/Translations/Language.hu.xml +++ b/Translations/Language.hu.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.id.xml b/Translations/Language.id.xml index 484f66970e..33ffc99772 100644 --- a/Translations/Language.id.xml +++ b/Translations/Language.id.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.it.xml b/Translations/Language.it.xml index 7c61032853..70c52852ec 100644 --- a/Translations/Language.it.xml +++ b/Translations/Language.it.xml @@ -1740,6 +1740,12 @@ Questo controllo riguarda solo il boot manager di Windows attivo. Prima della revoca, verificare anche che la soluzione di ripiego per la decrittografia e i backup di ripristino siano compatibili. La creazione di un nuovo disco di ripristino di VeraCrypt può riutilizzare un vecchio backup del boot manager già archiviato; la sola creazione del disco non dimostra la compatibilità di quel backup con la revoca. Il backup del Windows Boot Manager incluso in questo disco di ripristino è firmato da Microsoft Windows Production PCA 2011. Il firmware contiene già Windows UEFI CA 2023.\n\nDopo la revoca di PCA 2011 (bit 0x80 di AvailableUpdates, incluso il valore combinato 0x280), il ripristino di questo backup può impedire l'avvio di Windows con Secure Boot abilitato. La creazione di un nuovo disco di ripristino riutilizza questo backup archiviato; non ne aggiorna la firma.\n\nPrima di applicare la revoca, preparare supporti di ripristino di Windows compatibili e aggiornati e verificare la soluzione di ripiego per la decrittografia. Non fare affidamento su questo disco di ripristino per ripristinare un Windows Boot Manager compatibile. Rimane utile per le altre operazioni di ripristino di VeraCrypt. VeraCrypt non è riuscito a controllare il backup del Windows Boot Manager in questo disco di ripristino rispetto ai criteri di Secure Boot del firmware.\n\nLa creazione o la verifica di questo disco non dimostra che il Windows Boot Manager in esso archiviato sia compatibile con la revoca di PCA 2011 (bit 0x80 di AvailableUpdates, incluso il valore combinato 0x280). Prima di applicare la revoca, verificare i backup di ripristino e preparare supporti di ripristino di Windows compatibili e aggiornati. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.ja.xml b/Translations/Language.ja.xml index 58e2199577..95e2cd3e60 100644 --- a/Translations/Language.ja.xml +++ b/Translations/Language.ja.xml @@ -1740,6 +1740,12 @@ この確認の対象は、現在使用中の Windows ブートマネージャーのみです。失効を適用する前に、復号時の代替手段とレスキュー用バックアップにも互換性があることを確認してください。新しい VeraCrypt レスキューディスクを作成しても、保存されている古いブートマネージャーのバックアップが再利用される場合があります。ディスクを作成しただけでは、そのバックアップに失効との互換性があることは確認できません。 このレスキューディスクに含まれる Windows Boot Manager のバックアップは、Microsoft Windows Production PCA 2011 によって署名されています。ファームウェアには、すでに Windows UEFI CA 2023 が含まれています。\n\nPCA 2011 の失効（AvailableUpdates のビット 0x80、およびこれを含む組み合わせ値 0x280）を適用した後でこのバックアップを復元すると、Secure Boot が有効な状態では Windows を起動できなくなる可能性があります。新しいレスキューディスクを作成しても、保存済みのこのバックアップが再利用され、署名は更新されません。\n\n失効を適用する前に、互換性のある最新の Windows 回復メディアを用意し、復号時の代替手段を確認してください。互換性のある Windows Boot Manager を復元するために、このレスキューディスクを当てにしないでください。このディスクは、VeraCrypt の他の復旧作業には引き続き役立ちます。 VeraCrypt は、このレスキューディスクに含まれる Windows Boot Manager のバックアップを、ファームウェアの Secure Boot ポリシーに照らして確認できませんでした。\n\nこのディスクを作成または検証しただけでは、保存されている Windows Boot Manager に PCA 2011 の失効（AvailableUpdates のビット 0x80、およびこれを含む組み合わせ値 0x280）との互換性があることは確認できません。失効を適用する前に、復旧用バックアップを確認し、互換性のある最新の Windows 回復メディアを用意してください。 + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.ka.xml b/Translations/Language.ka.xml index 25e910e7c3..a46a2fce21 100644 --- a/Translations/Language.ka.xml +++ b/Translations/Language.ka.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.ko.xml b/Translations/Language.ko.xml index 4b8ed6e08d..f2e66f7e71 100644 --- a/Translations/Language.ko.xml +++ b/Translations/Language.ko.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.lv.xml b/Translations/Language.lv.xml index b67107a724..a258e2cee3 100644 --- a/Translations/Language.lv.xml +++ b/Translations/Language.lv.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.my.xml b/Translations/Language.my.xml index ed76af3b2f..ff59d904b7 100644 --- a/Translations/Language.my.xml +++ b/Translations/Language.my.xml @@ -1742,6 +1742,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.nb.xml b/Translations/Language.nb.xml index 5a9ef97596..230a1a7d22 100644 --- a/Translations/Language.nb.xml +++ b/Translations/Language.nb.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.nl.xml b/Translations/Language.nl.xml index ae80329bd9..2398b63ccd 100644 --- a/Translations/Language.nl.xml +++ b/Translations/Language.nl.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.nn.xml b/Translations/Language.nn.xml index c66fbfae33..42b193f4b3 100644 --- a/Translations/Language.nn.xml +++ b/Translations/Language.nn.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.pl.xml b/Translations/Language.pl.xml index 6b639ab383..c13bd9e2dd 100644 --- a/Translations/Language.pl.xml +++ b/Translations/Language.pl.xml @@ -1740,6 +1740,12 @@ To sprawdzenie obejmuje tylko aktywny Menedżer rozruchu systemu Windows. Przed unieważnieniem certyfikatu sprawdź również zgodność awaryjnego programu rozruchowego używanego po odszyfrowaniu systemu oraz kopii zapasowych na nośnikach ratunkowych. Utworzenie nowego dysku ratunkowego VeraCrypt może ponownie wykorzystać starszą kopię zapasową menedżera rozruchu; samo utworzenie dysku nie gwarantuje zgodności kopii zapasowej z odwołaniem. Kopia zapasowa Menedżera rozruchu systemu Windows zawarta na tym dysku ratunkowym jest podpisana przez Microsoft Windows Production PCA 2011. Oprogramowanie układowe zawiera już Windows UEFI CA 2023.\n\nPo odwołaniu PCA 2011 (bit AvailableUpdates 0x80, łącznie z wartością łączną 0x280), przywrócenie tej kopii zapasowej może uniemożliwić uruchomienie systemu Windows z włączonym Secure Boot. Utworzenie nowego dysku ratunkowego powoduje ponowne wykorzystanie tej zapisanej kopii zapasowej; nie aktualizuje ona jej podpisu.\n\nPrzed odwołaniem przygotuj zgodny, zaktualizowany nośnik odzyskiwania systemu Windows i zweryfikuj awaryjny program rozruchowy używany po odszyfrowaniu systemu. Nie należy polegać na tym dysku ratunkowym w celu przywrócenia zgodnego Menedżera rozruchu systemu Windows. Nadal będzie on przydatny do innych zadań odzyskiwania VeraCrypt. VeraCrypt nie był w stanie zweryfikować kopii zapasowej Menedżera rozruchu systemu Windows, znajdującej się na tym dysku ratunkowym, pod kątem zgodności z zasadami Secure Boot w oprogramowaniu układowym.\n\nUtworzenie lub zweryfikowanie tego dysku nie stanowi potwierdzenia, że zapisany na nim Menedżer rozruchu systemu Windows jest zgodny z mechanizmem unieważniania certyfikatów PCA 2011 (bit 0x80 w parametrze AvailableUpdates, w tym wartość łączna 0x280). Przed zastosowaniem unieważnienia należy zweryfikować posiadane kopie zapasowe służące do odzyskiwania systemu oraz przygotować zgodne, zaktualizowane nośniki odzyskiwania systemu Windows. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.pt-br.xml b/Translations/Language.pt-br.xml index ff8d9bdf3b..c5e13d31d4 100644 --- a/Translations/Language.pt-br.xml +++ b/Translations/Language.pt-br.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.ro.xml b/Translations/Language.ro.xml index e5a14af1cb..a7778e0775 100644 --- a/Translations/Language.ro.xml +++ b/Translations/Language.ro.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.ru.xml b/Translations/Language.ru.xml index 03f58e4da5..ca04377d6a 100644 --- a/Translations/Language.ru.xml +++ b/Translations/Language.ru.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.sk.xml b/Translations/Language.sk.xml index 7f1de3adae..fd458708a2 100644 --- a/Translations/Language.sk.xml +++ b/Translations/Language.sk.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.sl.xml b/Translations/Language.sl.xml index 5c938042d3..a4815498c2 100644 --- a/Translations/Language.sl.xml +++ b/Translations/Language.sl.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.sv.xml b/Translations/Language.sv.xml index 50a473dec3..513a7fbec3 100644 --- a/Translations/Language.sv.xml +++ b/Translations/Language.sv.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.th.xml b/Translations/Language.th.xml index cf2d9c0fe8..ca84d79bf4 100644 --- a/Translations/Language.th.xml +++ b/Translations/Language.th.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.tr.xml b/Translations/Language.tr.xml index a17791a4b0..5bcacec9cb 100644 --- a/Translations/Language.tr.xml +++ b/Translations/Language.tr.xml @@ -1740,6 +1740,12 @@ Bu denetim yalnızca etkin Windows başlatma yöneticisini kapsar. İptali uygulamadan önce, şifre çözme yoluyla kurtarma seçeneğinin ve kurtarma yedeklerinin de uyumlu olduğunu doğrulayın. Yeni bir VeraCrypt kurtarma diski oluşturulurken, saklanmış daha eski bir başlatma yöneticisi yedeği yeniden kullanılabilir; yalnızca diskin oluşturulması, bu yedeğin iptal işlemiyle uyumlu olduğunu kanıtlamaz. Bu kurtarma diskinde bulunan Windows Başlatma Yöneticisi yedeği Microsoft Windows Production PCA 2011 tarafından imzalanmış. Makine yazılımınız zaten Windows UEFI CA 2023 öğesini içeriyor.\n\nPCA 2011 iptalinden sonra (0x280 birleşik değeri de dahil olmak üzere AvailableUpdates değerinin 0x80 biti), bu yedeğin geri yüklenmesi Windows'un Secure Boot etkinken başlatılamamasına neden olabilir. Yeni bir kurtarma diski oluşturulurken saklanmış bu yedek yeniden kullanılır; imzası güncellenmez.\n\nİptali uygulamadan önce, uyumlu ve güncel bir Windows kurtarma ortamı hazırlayın ve şifre çözme yoluyla kurtarma seçeneğini doğrulayın. Uyumlu bir Windows Başlatma Yöneticisini geri yüklemek için bu kurtarma diskine güvenmeyin. Bu disk, diğer VeraCrypt kurtarma işlemleri için kullanılmaya devam edilebilir. VeraCrypt, bu kurtarma diskindeki Windows Başlatma Yöneticisi yedeğini makine yazılımının Secure Boot ilkesine göre denetleyemedi.\n\nBu diskin oluşturulması ya da doğrulanması, içinde saklanan Windows Başlatma Yöneticisinin PCA 2011 iptaliyle (0x280 birleşik değeri de dahil olmak üzere AvailableUpdates değerinin 0x80 biti) uyumlu olduğunu kanıtlamaz. İptali uygulamadan önce kurtarma yedeklerinizi doğrulayın ve uyumlu, güncel bir Windows kurtarma ortamı hazırlayın. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.uk.xml b/Translations/Language.uk.xml index 913836b8c7..bd85a890ee 100644 --- a/Translations/Language.uk.xml +++ b/Translations/Language.uk.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.uz.xml b/Translations/Language.uz.xml index c2548477b1..a1f7a3646a 100644 --- a/Translations/Language.uz.xml +++ b/Translations/Language.uz.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.vi.xml b/Translations/Language.vi.xml index e6a937cccf..681e269c44 100644 --- a/Translations/Language.vi.xml +++ b/Translations/Language.vi.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.zh-cn.xml b/Translations/Language.zh-cn.xml index 77b818294c..b9e05b423e 100644 --- a/Translations/Language.zh-cn.xml +++ b/Translations/Language.zh-cn.xml @@ -1741,6 +1741,12 @@ 此检查仅涵盖当前活动的 Windows 启动管理器。在撤销之前，还请验证解密回退和应急备份是否兼容。创建新的 VeraCrypt 应急盘可能会复用较早存储的启动管理器备份；仅创建该盘并不能证明该备份与撤销操作兼容。 此应急盘中包含的 Windows 启动管理器备份由 Microsoft Windows Production PCA 2011 签名。您的固件已包含 Windows UEFI CA 2023。\n\n在 PCA 2011 撤销（AvailableUpdates 位 0x80，包括组合值 0x280）之后，恢复此备份可能导致 Windows 在启用安全启动时无法启动。创建新的应急盘会复用此已存储的备份；它不会更新其签名。\n\n在应用撤销之前，请准备兼容的、更新后的 Windows 恢复介质，并验证解密回退。请勿依赖此应急盘恢复兼容的 Windows 启动管理器。它对于其他 VeraCrypt 恢复任务仍然有用。 VeraCrypt 无法根据固件安全启动策略检查此应急盘中的 Windows 启动管理器备份。\n\n创建或验证此盘并不能证明其存储的 Windows 启动管理器与 PCA 2011 撤销（AvailableUpdates 位 0x80，包括组合值 0x280）兼容。在应用撤销之前，请验证您的恢复备份，并准备兼容的、更新后的 Windows 恢复介质。 + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.zh-hk.xml b/Translations/Language.zh-hk.xml index 566bce156c..ba7e6e27ef 100644 --- a/Translations/Language.zh-hk.xml +++ b/Translations/Language.zh-hk.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/Translations/Language.zh-tw.xml b/Translations/Language.zh-tw.xml index e739ef654d..ac8432051d 100644 --- a/Translations/Language.zh-tw.xml +++ b/Translations/Language.zh-tw.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/src/Common/Language.xml b/src/Common/Language.xml index a7e7839747..b2875d4690 100644 --- a/src/Common/Language.xml +++ b/src/Common/Language.xml @@ -1740,6 +1740,12 @@ This check covers only the active Windows boot manager. Before revocation, also verify that decryption fallback and rescue backups are compatible. Creating a new VeraCrypt Rescue Disk can reuse an older stored boot-manager backup; creating the disk alone does not establish that backup's compatibility with the revocation. The Windows Boot Manager backup included in this Rescue Disk is signed by Microsoft Windows Production PCA 2011. Your firmware already contains Windows UEFI CA 2023.\n\nAfter PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280), restoring this backup can leave Windows unable to start with Secure Boot enabled. Creating a new Rescue Disk reuses this stored backup; it does not update its signature.\n\nBefore applying the revocation, prepare compatible, updated Windows recovery media and verify the decryption fallback. Do not rely on this Rescue Disk to restore a compatible Windows Boot Manager. It remains useful for other VeraCrypt recovery tasks. VeraCrypt could not check the Windows Boot Manager backup in this Rescue Disk against the firmware Secure Boot policy.\n\nCreating or verifying this disk does not establish that its stored Windows Boot Manager is compatible with PCA 2011 revocation (AvailableUpdates bit 0x80, including combined value 0x280). Before applying the revocation, verify your recovery backups and prepare compatible, updated Windows recovery media. + A new USB or Thunderbolt device is connected + IMPORTANT NOTES:\n - When a USB or Thunderbolt device that was not connected when this option was enabled, or when VeraCrypt started, is connected, VeraCrypt immediately unmounts all volumes, even if files are open on them, and erases their keys from memory. Unsaved data in these files is lost.\n\n - VeraCrypt must be running for this option to work.\n\n - On Linux, if VeraCrypt has not obtained administrator privileges in this session (for example, to mount a volume), it asks for the administrator password before it can unmount the volumes. + Do you also want to prevent this option from being disabled, and VeraCrypt from being closed, until you log out or restart the computer?\n\nNote: this does not protect against someone who can run programs in your session, who can, for example, terminate VeraCrypt. + VeraCrypt cannot be closed now: it unmounts all volumes when a new device is connected until you log out or restart the computer. + A new device was connected ({0}). VeraCrypt unmounted all volumes and erased their keys from memory. + A new device was connected ({0}), but VeraCrypt could not unmount all volumes or erase all their keys from memory. See the system log for details. diff --git a/src/Core/CoreBase.h b/src/Core/CoreBase.h index 89ee198bf9..44d41e1b5f 100644 --- a/src/Core/CoreBase.h +++ b/src/Core/CoreBase.h @@ -41,7 +41,8 @@ namespace VeraCrypt virtual void DismountFilesystem (const DirectoryPath &mountPoint, bool force) const = 0; virtual shared_ptr DismountVolume (shared_ptr mountedVolume, bool ignoreOpenFiles = false, bool syncVolumeInfo = false) = 0; #if defined(TC_LINUX) - virtual shared_ptr EmergencyDismountVolume (shared_ptr mountedVolume) { throw NotApplicable (SRC_POS); } + virtual void DestroyVolumeKeys (shared_ptr mountedVolume) { throw NotApplicable (SRC_POS); } + virtual shared_ptr EmergencyDismountVolume (shared_ptr mountedVolume, bool destroyKeys = false) { throw NotApplicable (SRC_POS); } #endif virtual bool FilesystemSupportsLargeFiles (const FilePath &filePath) const = 0; virtual DirectoryPath GetDeviceMountPoint (const DevicePath &devicePath) const = 0; diff --git a/src/Core/Unix/CoreService.cpp b/src/Core/Unix/CoreService.cpp index 66fbf20959..d168b528ed 100644 --- a/src/Core/Unix/CoreService.cpp +++ b/src/Core/Unix/CoreService.cpp @@ -1274,7 +1274,13 @@ namespace VeraCrypt if (emergencyDismountRequest) { DismountVolumeResponse response; - response.DismountedVolumeInfo = Core->EmergencyDismountVolume (emergencyDismountRequest->MountedVolumeInfo); + if (emergencyDismountRequest->DestroyKeysOnly) + { + Core->DestroyVolumeKeys (emergencyDismountRequest->MountedVolumeInfo); + response.DismountedVolumeInfo = emergencyDismountRequest->MountedVolumeInfo; + } + else + response.DismountedVolumeInfo = Core->EmergencyDismountVolume (emergencyDismountRequest->MountedVolumeInfo, emergencyDismountRequest->DestroyKeys); response.Serialize (outputStream); continue; } @@ -1405,9 +1411,15 @@ namespace VeraCrypt } #ifdef TC_LINUX - shared_ptr CoreService::RequestEmergencyDismountVolume (shared_ptr mountedVolume) + void CoreService::RequestDestroyVolumeKeys (shared_ptr mountedVolume) + { + EmergencyDismountVolumeRequest request (mountedVolume, true, true); + SendRequest (request); + } + + shared_ptr CoreService::RequestEmergencyDismountVolume (shared_ptr mountedVolume, bool destroyKeys) { - EmergencyDismountVolumeRequest request (mountedVolume); + EmergencyDismountVolumeRequest request (mountedVolume, destroyKeys); return SendRequest (request)->DismountedVolumeInfo; } #endif diff --git a/src/Core/Unix/CoreService.h b/src/Core/Unix/CoreService.h index e159e1b7cf..cc28f5ae72 100644 --- a/src/Core/Unix/CoreService.h +++ b/src/Core/Unix/CoreService.h @@ -30,7 +30,8 @@ namespace VeraCrypt static void RequestDismountFilesystem (const DirectoryPath &mountPoint, bool force); static shared_ptr RequestDismountVolume (shared_ptr mountedVolume, bool ignoreOpenFiles = false, bool syncVolumeInfo = false); #ifdef TC_LINUX - static shared_ptr RequestEmergencyDismountVolume (shared_ptr mountedVolume); + static void RequestDestroyVolumeKeys (shared_ptr mountedVolume); + static shared_ptr RequestEmergencyDismountVolume (shared_ptr mountedVolume, bool destroyKeys); #endif static uint32 RequestGetDeviceSectorSize (const DevicePath &devicePath); static uint64 RequestGetDeviceSize (const DevicePath &devicePath); diff --git a/src/Core/Unix/CoreServiceProxy.h b/src/Core/Unix/CoreServiceProxy.h index 37f05c9a13..968011895c 100644 --- a/src/Core/Unix/CoreServiceProxy.h +++ b/src/Core/Unix/CoreServiceProxy.h @@ -56,9 +56,14 @@ namespace VeraCrypt } #ifdef TC_LINUX - virtual shared_ptr EmergencyDismountVolume (shared_ptr mountedVolume) + virtual void DestroyVolumeKeys (shared_ptr mountedVolume) { - shared_ptr dismountedVolumeInfo = CoreService::RequestEmergencyDismountVolume (mountedVolume); + CoreService::RequestDestroyVolumeKeys (mountedVolume); + } + + virtual shared_ptr EmergencyDismountVolume (shared_ptr mountedVolume, bool destroyKeys = false) + { + shared_ptr dismountedVolumeInfo = CoreService::RequestEmergencyDismountVolume (mountedVolume, destroyKeys); VolumeEventArgs eventArgs (dismountedVolumeInfo); T::VolumeDismountedEvent.Raise (eventArgs); diff --git a/src/Core/Unix/CoreServiceRequest.cpp b/src/Core/Unix/CoreServiceRequest.cpp index 5dde6ce351..81ed16206a 100644 --- a/src/Core/Unix/CoreServiceRequest.cpp +++ b/src/Core/Unix/CoreServiceRequest.cpp @@ -132,6 +132,9 @@ namespace VeraCrypt void EmergencyDismountVolumeRequest::DeserializeData (shared_ptr stream) { CoreServiceRequest::DeserializeData (stream); + Serializer sr (stream); + sr.Deserialize ("DestroyKeys", DestroyKeys); + sr.Deserialize ("DestroyKeysOnly", DestroyKeysOnly); MountedVolumeInfo = Serializable::DeserializeNew (stream); } @@ -143,6 +146,9 @@ namespace VeraCrypt void EmergencyDismountVolumeRequest::SerializeData (shared_ptr stream) const { CoreServiceRequest::SerializeData (stream); + Serializer sr (stream); + sr.Serialize ("DestroyKeys", DestroyKeys); + sr.Serialize ("DestroyKeysOnly", DestroyKeysOnly); MountedVolumeInfo->Serialize (stream); } #endif diff --git a/src/Core/Unix/CoreServiceRequest.h b/src/Core/Unix/CoreServiceRequest.h index 4df598b30a..89199a135a 100644 --- a/src/Core/Unix/CoreServiceRequest.h +++ b/src/Core/Unix/CoreServiceRequest.h @@ -77,13 +77,15 @@ namespace VeraCrypt #ifdef TC_LINUX struct EmergencyDismountVolumeRequest : CoreServiceRequest { - EmergencyDismountVolumeRequest () { } - EmergencyDismountVolumeRequest (shared_ptr volumeInfo) - : MountedVolumeInfo (volumeInfo) { } + EmergencyDismountVolumeRequest () : DestroyKeys (false), DestroyKeysOnly (false) { } + EmergencyDismountVolumeRequest (shared_ptr volumeInfo, bool destroyKeys, bool destroyKeysOnly = false) + : DestroyKeys (destroyKeys), DestroyKeysOnly (destroyKeysOnly), MountedVolumeInfo (volumeInfo) { } TC_SERIALIZABLE (EmergencyDismountVolumeRequest); virtual bool RequiresElevation () const; + bool DestroyKeys; + bool DestroyKeysOnly; shared_ptr MountedVolumeInfo; }; #endif diff --git a/src/Core/Unix/CoreUnix.cpp b/src/Core/Unix/CoreUnix.cpp index 6055c4c8e6..020e6fff45 100644 --- a/src/Core/Unix/CoreUnix.cpp +++ b/src/Core/Unix/CoreUnix.cpp @@ -414,10 +414,23 @@ namespace VeraCrypt } #ifdef TC_LINUX - shared_ptr CoreUnix::EmergencyDismountVolume (shared_ptr mountedVolume) + shared_ptr CoreUnix::EmergencyDismountVolume (shared_ptr mountedVolume, bool destroyKeys) { unique_ptr firstException; + // First the keys held by the kernel, so that they are gone even if the volume cannot be released + if (destroyKeys) + { + try + { + DestroyVolumeKeys (mountedVolume); + } + catch (Exception &e) + { + firstException.reset (e.CloneNew()); + } + } + if (!mountedVolume->MountPoint.IsEmpty()) { bool mountPointMounted = true; @@ -464,6 +477,20 @@ namespace VeraCrypt firstException.reset (e.CloneNew()); } + // Then the keys held by the FUSE service: ending it now makes the volume's open files fail + if (destroyKeys) + { + try + { + AbortVolumeService (mountedVolume); + } + catch (Exception &e) + { + if (!firstException.get()) + firstException.reset (e.CloneNew()); + } + } + if (!mountedVolume->AuxMountPoint.IsEmpty()) { bool auxMountPointMounted = true; diff --git a/src/Core/Unix/CoreUnix.h b/src/Core/Unix/CoreUnix.h index 968a7c2d4d..b4f77bf610 100644 --- a/src/Core/Unix/CoreUnix.h +++ b/src/Core/Unix/CoreUnix.h @@ -30,7 +30,7 @@ namespace VeraCrypt virtual void DismountFilesystem (const DirectoryPath &mountPoint, bool force) const; virtual shared_ptr DismountVolume (shared_ptr mountedVolume, bool ignoreOpenFiles = false, bool syncVolumeInfo = false); #ifdef TC_LINUX - virtual shared_ptr EmergencyDismountVolume (shared_ptr mountedVolume); + virtual shared_ptr EmergencyDismountVolume (shared_ptr mountedVolume, bool destroyKeys = false); #endif virtual bool FilesystemSupportsLargeFiles (const FilePath &filePath) const; virtual DirectoryPath GetDeviceMountPoint (const DevicePath &devicePath) const; @@ -63,6 +63,7 @@ namespace VeraCrypt virtual void DetachLoopDevice (const DevicePath &devicePath) const { throw NotApplicable (SRC_POS); } virtual void DismountNativeVolume (shared_ptr mountedVolume) const { throw NotApplicable (SRC_POS); } #ifdef TC_LINUX + virtual void AbortVolumeService (shared_ptr mountedVolume) const { throw NotApplicable (SRC_POS); } virtual void DismountFilesystemLazy (const DirectoryPath &mountPoint) const; virtual void DismountNativeVolumeDeferred (shared_ptr mountedVolume) const { DismountNativeVolume (mountedVolume); } #endif diff --git a/src/Core/Unix/Linux/CoreLinux.cpp b/src/Core/Unix/Linux/CoreLinux.cpp index 9f4651a006..461b91a7ae 100644 --- a/src/Core/Unix/Linux/CoreLinux.cpp +++ b/src/Core/Unix/Linux/CoreLinux.cpp @@ -10,11 +10,13 @@ code distribution packages. */ +#include #include #include #include #include #include +#include #include #include #include @@ -348,6 +350,35 @@ namespace VeraCrypt } // Earlier versions created devices without a UUID: their dependencies must lead to the volume + // Whether the device-mapper device only fails I/O, as after dmsetup wipe_table + bool HasDeviceMapperErrorTable (const string &name) + { + list args; + args.push_back ("table"); + args.push_back (name); + + try + { + istringstream table (Process::Execute ("dmsetup", args)); + string line; + bool found = false; + while (getline (table, line)) + { + // ... + istringstream fields (line); + string start, length, target; + if (!(fields >> start >> length >> target) || target != "error") + return false; + found = true; + } + return found; + } + catch (ExecutedProcessFailed&) + { + return false; + } + } + void VerifyLegacyDeviceMapperDevice (const VolumeInfo &volume, const string &name, const string &kernelName) { const string volumePath = volume.Path; @@ -451,7 +482,9 @@ namespace VeraCrypt if (!legacyDevice.KernelName.empty()) { - VerifyLegacyDeviceMapperDevice (volume, name, legacyDevice.KernelName); + // A wiped device has no backing device to verify any more, and nothing to protect + if (!HasDeviceMapperErrorTable (legacyDevice.Name)) + VerifyLegacyDeviceMapperDevice (volume, name, legacyDevice.KernelName); device = legacyDevice; return DeviceOwnership::Owned; } @@ -511,12 +544,9 @@ namespace VeraCrypt return fd; } - void RemoveDeviceMapperDevice (const VolumeInfo &volume, const string &name, bool includeLegacy, bool deferred) + // Arguments selecting a device-mapper device of the volume for dmsetup + list GetDeviceMapperDeviceArgs (const VolumeInfo &volume, const string &name, const DeviceMapperDevice &device) { - DeviceMapperDevice device; - if (GetDeviceMapperOwnership (volume, name, includeLegacy, device) != DeviceOwnership::Owned) - return; - list deviceArgs; if (device.Legacy) { @@ -527,6 +557,108 @@ namespace VeraCrypt deviceArgs.push_back ("-u"); deviceArgs.push_back (GetDeviceMapperUuid (volume.SerialInstanceNumber, name)); } + return deviceArgs; + } + + // Names of the device-mapper devices of a volume mounted with kernel cryptography (none otherwise): the top + // device first, then the volume's cascade layers _0 ... _, any of which a partial dismount + // may have removed. A device without a UUID named after a layer that the volume does not have, as left by a + // failed cascade mount of an earlier version, cannot be verified and must not fail the dismount. + list GetDeviceMapperNames (const VolumeInfo &volume) + { + list names; + const string virtualDevice = volume.VirtualDevice; + const string mapperDirectory = "/dev/mapper/"; + + if (virtualDevice.find (mapperDirectory + "veracrypt") != 0) + return names; + + const string name = virtualDevice.substr (mapperDirectory.size()); + names.push_back (name); + + size_t cipherCount = 0; + size_t maxCipherCount = 1; + foreach (shared_ptr ea, EncryptionAlgorithm::GetAvailableAlgorithms()) + { + if (ea->GetName() == volume.EncryptionAlgorithmName) + cipherCount = ea->GetCiphers().size(); + + if (ea->GetCiphers().size() > maxCipherCount) + maxCipherCount = ea->GetCiphers().size(); + } + + // An unknown algorithm leaves all possible layers to check + if (cipherCount == 0) + cipherCount = maxCipherCount; + + for (size_t i = 0; i + 1 < cipherCount; i++) + names.push_back (name + "_" + StringConverter::ToSingle ((uint32) i)); + + return names; + } + + // Device number of the FUSE filesystem mounted at the mount point, read from the mount table, as a request + // to the filesystem itself could block. Returns false if no FUSE filesystem is mounted there. + bool GetFuseConnectionNumber (const string &mountPoint, unsigned int &connection) + { + ifstream mountInfo ("/proc/self/mountinfo"); + string line; + bool found = false; + + while (getline (mountInfo, line)) + { + // : [] - ... + istringstream fields (line); + string id, parent, deviceNumber, root, path, field; + if (!(fields >> id >> parent >> deviceNumber >> root >> path)) + continue; + + string type; + while (fields >> field) + { + if (field == "-") + { + fields >> type; + break; + } + } + + // Octal escapes of the mount point (for example \040 for a space) + string unescaped; + for (size_t i = 0; i < path.size(); i++) + { + if (path[i] == '\\' && i + 3 < path.size() + && isdigit ((unsigned char) path[i + 1]) && isdigit ((unsigned char) path[i + 2]) && isdigit ((unsigned char) path[i + 3])) + { + unescaped += (char) (((path[i + 1] - '0') << 6) | ((path[i + 2] - '0') << 3) | (path[i + 3] - '0')); + i += 3; + } + else + unescaped += path[i]; + } + + unsigned int major, minor; + if (unescaped != mountPoint || (type != "fuse" && type.find ("fuse.") != 0) + || sscanf (deviceNumber.c_str(), "%u:%u", &major, &minor) != 2 || major != 0) + { + continue; + } + + // The last mount at the mount point is the visible one + connection = minor; + found = true; + } + + return found; + } + + void RemoveDeviceMapperDevice (const VolumeInfo &volume, const string &name, bool includeLegacy, bool deferred) + { + DeviceMapperDevice device; + if (GetDeviceMapperOwnership (volume, name, includeLegacy, device) != DeviceOwnership::Owned) + return; + + list deviceArgs = GetDeviceMapperDeviceArgs (volume, name, device); list removeArgs; removeArgs.push_back ("remove"); @@ -708,9 +840,98 @@ namespace VeraCrypt return CoreUnix::DismountVolume (ResolveMountedVolume (mountedVolume), ignoreOpenFiles, syncVolumeInfo); } - shared_ptr CoreLinux::EmergencyDismountVolume (shared_ptr mountedVolume) + shared_ptr CoreLinux::EmergencyDismountVolume (shared_ptr mountedVolume, bool destroyKeys) + { + return CoreUnix::EmergencyDismountVolume (ResolveMountedVolume (mountedVolume), destroyKeys); + } + + // Frees the keys of a volume held by the kernel now, even if it is in use: its open files then fail with I/O errors + void CoreLinux::DestroyVolumeKeys (shared_ptr mountedVolume) { - return CoreUnix::EmergencyDismountVolume (ResolveMountedVolume (mountedVolume)); + const shared_ptr resolvedVolume = ResolveMountedVolume (mountedVolume); + const VolumeInfo &volume = *resolvedVolume; + unique_ptr firstException; + + // Replacing the table of a device-mapper device with an error target frees its key in the kernel at once + foreach (const string &name, GetDeviceMapperNames (volume)) + { + DeviceMapperDevice device; + if (GetDeviceMapperOwnership (volume, name, true, device) != DeviceOwnership::Owned) + continue; + + // Unlike remove, wipe_table selects the device only by name. Its UUID was just verified, and only + // an administrator can rename it. + // Without flushing or freezing the filesystem, which a stalled backing device would block + list args; + args.push_back ("wipe_table"); + args.push_back ("--noflush"); + args.push_back ("--nolockfs"); + args.push_back (device.Name); + + try + { + Process::Execute ("dmsetup", args, 10000); + } + catch (Exception &e) + { + if (!firstException.get()) + firstException.reset (e.CloneNew()); + } + } + + if (firstException.get()) + firstException->Throw(); + } + + // The FUSE service holds the keys of a volume too. Called once the volume's loop and device-mapper devices + // are released, as their release needs the service. + void CoreLinux::AbortVolumeService (shared_ptr mountedVolume) const + { + const VolumeInfo &volume = *mountedVolume; + + // The FUSE service holds the keys too. Aborting its connection ends its loop: it closes the volume, which + // erases the keys, and exits. Without kernel cryptography, it is the only holder of the keys. + if (volume.AuxMountPoint.IsEmpty()) + return; + + unsigned int connection; + if (!GetFuseConnectionNumber (volume.AuxMountPoint, connection)) + { + // The service would keep the keys while the volume is in use + if (!GetMountedFilesystems (DevicePath(), volume.AuxMountPoint).empty()) + throw ParameterIncorrect (SRC_POS); + return; + } + + const string connectionsPath = "/sys/fs/fuse/connections"; + const string abortPath = connectionsPath + "/" + StringConverter::ToSingle ((uint32) connection) + "/abort"; + int fd = open (abortPath.c_str(), O_WRONLY | O_CLOEXEC); + if (fd == -1 && errno == ENOENT) + { + // The FUSE control filesystem is mounted there by systemd, not by every system + list args; + args.push_back ("-t"); + args.push_back ("fusectl"); + args.push_back ("fusectl"); + args.push_back (connectionsPath); + try + { + Process::Execute ("mount", args); + } + catch (...) { } + + fd = open (abortPath.c_str(), O_WRONLY | O_CLOEXEC); + } + bool aborted = fd != -1 && write (fd, "1", 1) == 1; + int error = errno; + if (fd != -1) + close (fd); + + if (!aborted) + { + errno = error; + throw SystemException (SRC_POS, abortPath); + } } void CoreLinux::DismountNativeVolume (shared_ptr mountedVolume) const @@ -734,37 +955,10 @@ namespace VeraCrypt return; } - const string virtualDevice = volume.VirtualDevice; - const string mapperDirectory = "/dev/mapper/"; - - if (virtualDevice.find (mapperDirectory + "veracrypt") != 0) + list names = GetDeviceMapperNames (volume); + if (names.empty()) throw NotApplicable (SRC_POS); - // Top device first, then the volume's cascade layers _0 ... _, any of which a partial dismount - // may have removed. A device without a UUID named after a layer that the volume does not have, as left by a - // failed cascade mount of an earlier version, cannot be verified and must not fail the dismount. - const string name = virtualDevice.substr (mapperDirectory.size()); - list names; - names.push_back (name); - - size_t cipherCount = 0; - size_t maxCipherCount = 1; - foreach (shared_ptr ea, EncryptionAlgorithm::GetAvailableAlgorithms()) - { - if (ea->GetName() == volume.EncryptionAlgorithmName) - cipherCount = ea->GetCiphers().size(); - - if (ea->GetCiphers().size() > maxCipherCount) - maxCipherCount = ea->GetCiphers().size(); - } - - // An unknown algorithm leaves all possible layers to check - if (cipherCount == 0) - cipherCount = maxCipherCount; - - for (size_t i = 0; i + 1 < cipherCount; i++) - names.push_back (name + "_" + StringConverter::ToSingle ((uint32) i)); - // Device-hosted volumes have no loop device. Earlier versions recorded the host device instead. const bool fileHosted = !volume.LoopDevice.IsEmpty() && wstring (volume.LoopDevice) != wstring (volume.Path); diff --git a/src/Core/Unix/Linux/CoreLinux.h b/src/Core/Unix/Linux/CoreLinux.h index 43da5133f0..6fe11df52e 100644 --- a/src/Core/Unix/Linux/CoreLinux.h +++ b/src/Core/Unix/Linux/CoreLinux.h @@ -26,11 +26,13 @@ namespace VeraCrypt virtual void CheckFilesystem (shared_ptr mountedVolume, bool repair = false) const; virtual shared_ptr DismountVolume (shared_ptr mountedVolume, bool ignoreOpenFiles = false, bool syncVolumeInfo = false); - virtual shared_ptr EmergencyDismountVolume (shared_ptr mountedVolume); + virtual void DestroyVolumeKeys (shared_ptr mountedVolume); + virtual shared_ptr EmergencyDismountVolume (shared_ptr mountedVolume, bool destroyKeys = false); virtual HostDeviceList GetHostDevices (bool pathListOnly = false) const; protected: virtual DevicePath AttachFileToLoopDevice (const FilePath &filePath, bool readOnly) const; + virtual void AbortVolumeService (shared_ptr mountedVolume) const; virtual void DetachLoopDevice (const DevicePath &devicePath) const; virtual void DismountNativeVolume (shared_ptr mountedVolume) const; virtual void DismountNativeVolumeDeferred (shared_ptr mountedVolume) const; diff --git a/src/Main/Forms/Forms.cpp b/src/Main/Forms/Forms.cpp index c64dbbfbc4..63eebce41d 100644 --- a/src/Main/Forms/Forms.cpp +++ b/src/Main/Forms/Forms.cpp @@ -1835,6 +1835,9 @@ PreferencesDialogBase::PreferencesDialogBase( wxWindow* parent, wxWindowID id, c DismountOnPowerSavingCheckBox = new wxCheckBox( sbSizer13->GetStaticBox(), wxID_ANY, _("LINUX_ENTERING_POVERSAWING"), wxDefaultPosition, wxDefaultSize, 0 ); sbSizer13->Add( DismountOnPowerSavingCheckBox, 0, wxALL, 5 ); + DismountOnNewDeviceCheckBox = new wxCheckBox( sbSizer13->GetStaticBox(), wxID_ANY, _("LINUX_UNMOUNT_NEW_DEVICE"), wxDefaultPosition, wxDefaultSize, 0 ); + sbSizer13->Add( DismountOnNewDeviceCheckBox, 0, wxALL, 5 ); + AutoDismountSizer->Add( sbSizer13, 0, wxEXPAND|wxALL, 5 ); @@ -2349,6 +2352,7 @@ PreferencesDialogBase::PreferencesDialogBase( wxWindow* parent, wxWindowID id, c PreferencesNotebook->Connect( wxEVT_COMMAND_NOTEBOOK_PAGE_CHANGED, wxNotebookEventHandler( PreferencesDialogBase::OnPageChanged ), NULL, this ); DismountOnScreenSaverCheckBox->Connect( wxEVT_COMMAND_CHECKBOX_CLICKED, wxCommandEventHandler( PreferencesDialogBase::OnDismountOnScreenSaverCheckBoxClick ), NULL, this ); DismountOnPowerSavingCheckBox->Connect( wxEVT_COMMAND_CHECKBOX_CLICKED, wxCommandEventHandler( PreferencesDialogBase::OnDismountOnPowerSavingCheckBoxClick ), NULL, this ); + DismountOnNewDeviceCheckBox->Connect( wxEVT_COMMAND_CHECKBOX_CLICKED, wxCommandEventHandler( PreferencesDialogBase::OnDismountOnNewDeviceCheckBoxClick ), NULL, this ); ForceAutoDismountCheckBox->Connect( wxEVT_COMMAND_CHECKBOX_CLICKED, wxCommandEventHandler( PreferencesDialogBase::OnForceAutoDismountCheckBoxClick ), NULL, this ); PreserveTimestampsCheckBox->Connect( wxEVT_COMMAND_CHECKBOX_CLICKED, wxCommandEventHandler( PreferencesDialogBase::OnPreserveTimestampsCheckBoxClick ), NULL, this ); BackgroundTaskEnabledCheckBox->Connect( wxEVT_COMMAND_CHECKBOX_CLICKED, wxCommandEventHandler( PreferencesDialogBase::OnBackgroundTaskEnabledCheckBoxClick ), NULL, this ); @@ -2370,6 +2374,7 @@ PreferencesDialogBase::~PreferencesDialogBase() PreferencesNotebook->Disconnect( wxEVT_COMMAND_NOTEBOOK_PAGE_CHANGED, wxNotebookEventHandler( PreferencesDialogBase::OnPageChanged ), NULL, this ); DismountOnScreenSaverCheckBox->Disconnect( wxEVT_COMMAND_CHECKBOX_CLICKED, wxCommandEventHandler( PreferencesDialogBase::OnDismountOnScreenSaverCheckBoxClick ), NULL, this ); DismountOnPowerSavingCheckBox->Disconnect( wxEVT_COMMAND_CHECKBOX_CLICKED, wxCommandEventHandler( PreferencesDialogBase::OnDismountOnPowerSavingCheckBoxClick ), NULL, this ); + DismountOnNewDeviceCheckBox->Disconnect( wxEVT_COMMAND_CHECKBOX_CLICKED, wxCommandEventHandler( PreferencesDialogBase::OnDismountOnNewDeviceCheckBoxClick ), NULL, this ); ForceAutoDismountCheckBox->Disconnect( wxEVT_COMMAND_CHECKBOX_CLICKED, wxCommandEventHandler( PreferencesDialogBase::OnForceAutoDismountCheckBoxClick ), NULL, this ); PreserveTimestampsCheckBox->Disconnect( wxEVT_COMMAND_CHECKBOX_CLICKED, wxCommandEventHandler( PreferencesDialogBase::OnPreserveTimestampsCheckBoxClick ), NULL, this ); BackgroundTaskEnabledCheckBox->Disconnect( wxEVT_COMMAND_CHECKBOX_CLICKED, wxCommandEventHandler( PreferencesDialogBase::OnBackgroundTaskEnabledCheckBoxClick ), NULL, this ); diff --git a/src/Main/Forms/Forms.h b/src/Main/Forms/Forms.h index 42f9b8f83b..11d65247bc 100644 --- a/src/Main/Forms/Forms.h +++ b/src/Main/Forms/Forms.h @@ -567,6 +567,7 @@ namespace VeraCrypt wxCheckBox* DismountOnLogOffCheckBox; wxCheckBox* DismountOnScreenSaverCheckBox; wxCheckBox* DismountOnPowerSavingCheckBox; + wxCheckBox* DismountOnNewDeviceCheckBox; wxCheckBox* DismountOnInactivityCheckBox; wxSpinCtrl* DismountOnInactivitySpinCtrl; wxCheckBox* ForceAutoDismountCheckBox; @@ -629,6 +630,7 @@ namespace VeraCrypt virtual void OnPageChanged( wxNotebookEvent& event ) { event.Skip(); } virtual void OnDismountOnScreenSaverCheckBoxClick( wxCommandEvent& event ) { event.Skip(); } virtual void OnDismountOnPowerSavingCheckBoxClick( wxCommandEvent& event ) { event.Skip(); } + virtual void OnDismountOnNewDeviceCheckBoxClick( wxCommandEvent& event ) { event.Skip(); } virtual void OnForceAutoDismountCheckBoxClick( wxCommandEvent& event ) { event.Skip(); } virtual void OnPreserveTimestampsCheckBoxClick( wxCommandEvent& event ) { event.Skip(); } virtual void OnBackgroundTaskEnabledCheckBoxClick( wxCommandEvent& event ) { event.Skip(); } diff --git a/src/Main/Forms/MainFrame.cpp b/src/Main/Forms/MainFrame.cpp index 0797955c23..39e9073ace 100644 --- a/src/Main/Forms/MainFrame.cpp +++ b/src/Main/Forms/MainFrame.cpp @@ -96,6 +96,7 @@ namespace VeraCrypt }; #endif DEFINE_EVENT_TYPE(wxEVT_COMMAND_UPDATE_VOLUME_LIST) + DEFINE_EVENT_TYPE(wxEVT_COMMAND_NEW_DEVICE) DEFINE_EVENT_TYPE(wxEVT_COMMAND_PREF_UPDATED) DEFINE_EVENT_TYPE(wxEVT_COMMAND_OPEN_VOLUME_REQUEST) DEFINE_EVENT_TYPE(wxEVT_COMMAND_VOLUME_DISCOVERY_COMPLETED) @@ -153,6 +154,9 @@ namespace VeraCrypt InitMessageFilter(); InitWindowPrivacy(); + // The preferences are loaded before their update event is connected + Gui->UpdateNewDeviceMonitor(); + if (!GetPreferences().SecurityTokenModule.IsEmpty() && !SecurityToken::IsInitialized()) { try @@ -167,6 +171,7 @@ namespace VeraCrypt Connect( wxID_EXIT, wxEVT_COMMAND_MENU_SELECTED, wxCommandEventHandler( MainFrame::OnQuit ) ); Connect( wxID_ANY, wxEVT_COMMAND_UPDATE_VOLUME_LIST, wxThreadEventHandler( MainFrame::OnUpdateVolumeList ) ); + Connect( wxID_ANY, wxEVT_COMMAND_NEW_DEVICE, wxThreadEventHandler( MainFrame::OnNewDevice ) ); Connect( wxID_ANY, wxEVT_COMMAND_VOLUME_DISCOVERY_COMPLETED, wxCommandEventHandler( MainFrame::OnVolumeDiscoveryCompleted ) ); Connect( wxID_ANY, wxEVT_COMMAND_PREF_UPDATED, wxCommandEventHandler( MainFrame::OnPreferencesUpdated ) ); Connect( wxID_ANY, wxEVT_COMMAND_OPEN_VOLUME_REQUEST, wxCommandEventHandler( MainFrame::OnOpenVolumeSystemRequest ) ); @@ -197,7 +202,9 @@ namespace VeraCrypt #endif Disconnect( wxID_EXIT, wxEVT_COMMAND_MENU_SELECTED, wxCommandEventHandler( MainFrame::OnQuit ) ); + Gui->StopNewDeviceMonitor(); Disconnect( wxID_ANY, wxEVT_COMMAND_UPDATE_VOLUME_LIST, wxThreadEventHandler( MainFrame::OnUpdateVolumeList ) ); + Disconnect( wxID_ANY, wxEVT_COMMAND_NEW_DEVICE, wxThreadEventHandler( MainFrame::OnNewDevice ) ); Disconnect( wxID_ANY, wxEVT_COMMAND_VOLUME_DISCOVERY_COMPLETED, wxCommandEventHandler( MainFrame::OnVolumeDiscoveryCompleted ) ); Disconnect( wxID_ANY, wxEVT_COMMAND_PREF_UPDATED, wxCommandEventHandler( MainFrame::OnPreferencesUpdated ) ); Disconnect( wxID_ANY, wxEVT_COMMAND_OPEN_VOLUME_REQUEST, wxCommandEventHandler( MainFrame::OnOpenVolumeSystemRequest ) ); @@ -258,6 +265,16 @@ namespace VeraCrypt return Gui->IsTheOnlyTopLevelWindow (this); } + // While unmounting all volumes when a new device is connected is locked, only the end of the session closes VeraCrypt + bool MainFrame::CanExitWhenLocked () const + { + if (!Gui->IsDismountOnNewDeviceLocked()) + return true; + + Gui->ShowWarning (LangString["LINUX_UNMOUNT_NEW_DEVICE_LOCKED"]); + return false; + } + void MainFrame::ChangePassword (ChangePasswordDialog::Mode::Enum mode) { if (!CheckVolumePathNotEmpty ()) @@ -694,7 +711,7 @@ namespace VeraCrypt void OnExitMenuItemSelected (wxCommandEvent& event) { Busy = true; - if (Core->GetMountedVolumes().empty() || Gui->AskYesNo (LangString ["CONFIRM_EXIT"], false, true)) + if (Frame->CanExitWhenLocked() && (Core->GetMountedVolumes().empty() || Gui->AskYesNo (LangString ["CONFIRM_EXIT"], false, true))) Frame->Close (true); Busy = false; } @@ -951,6 +968,8 @@ namespace VeraCrypt } else { + if (event.CanVeto() && !CanExitWhenLocked()) + return; #ifdef __WXGTK__ Show(); #endif @@ -1394,11 +1413,13 @@ namespace VeraCrypt NoHistoryCheckBox->SetValue (!prefs.SaveHistory); ShowTaskBarIcon (prefs.BackgroundTaskEnabled); - if (Gui->IsInBackgroundMode() && !prefs.BackgroundTaskEnabled) + if (Gui->IsInBackgroundMode() && !prefs.BackgroundTaskEnabled && !Gui->IsDismountOnNewDeviceLocked()) Close (true); InitWindowPrivacy(); SavePreferences(); + + Gui->UpdateNewDeviceMonitor(); } void MainFrame::OnRestoreVolumeHeaderMenuItemSelected (wxCommandEvent& event) @@ -1467,6 +1488,13 @@ namespace VeraCrypt void MainFrame::OnTimer () { + // First, and not prevented by a failure below + try + { + Gui->ProcessPendingNewDevice(); + } + catch (exception &e) { SystemLog::WriteException (e); } + try { UpdateVolumeList(); @@ -1555,7 +1583,8 @@ namespace VeraCrypt } } - if (Gui->IsInBackgroundMode()) + // While unmounting all volumes when a new device is connected is locked, VeraCrypt keeps running + if (Gui->IsInBackgroundMode() && !Gui->IsDismountOnNewDeviceLocked()) { if (!GetPreferences().BackgroundTaskEnabled) { @@ -1712,7 +1741,7 @@ namespace VeraCrypt } static void IndicatorOnExitMenuItemSelected (GtkWidget *widget, MainFrame *self) { self->SetBusy(true); - if (Core->GetMountedVolumes().empty() || Gui->AskYesNo (LangString ["CONFIRM_EXIT"], false, true)) + if (self->CanExitWhenLocked() && (Core->GetMountedVolumes().empty() || Gui->AskYesNo (LangString ["CONFIRM_EXIT"], false, true))) self->Close (true); self->SetBusy(false); } diff --git a/src/Main/Forms/MainFrame.h b/src/Main/Forms/MainFrame.h index e179fb90c9..e6c6e7f034 100644 --- a/src/Main/Forms/MainFrame.h +++ b/src/Main/Forms/MainFrame.h @@ -34,6 +34,7 @@ namespace VeraCrypt #endif DECLARE_LOCAL_EVENT_TYPE(wxEVT_COMMAND_UPDATE_VOLUME_LIST, -1); + DECLARE_LOCAL_EVENT_TYPE(wxEVT_COMMAND_NEW_DEVICE, -1); DECLARE_LOCAL_EVENT_TYPE(wxEVT_COMMAND_PREF_UPDATED, -1); DECLARE_LOCAL_EVENT_TYPE(wxEVT_COMMAND_OPEN_VOLUME_REQUEST, -1); DECLARE_LOCAL_EVENT_TYPE(wxEVT_COMMAND_VOLUME_DISCOVERY_COMPLETED, -1); @@ -50,6 +51,9 @@ namespace VeraCrypt MainFrame (wxWindow* parent); virtual ~MainFrame (); + // Shows why VeraCrypt cannot be closed while it is locked running + bool CanExitWhenLocked () const; + void OnDeviceChange (const DirectoryPath &mountPoint = DirectoryPath()); #ifdef TC_UNIX static FilePath GetShowRequestFifoPath () { return Application::GetConfigFilePath (L".show-request-queue", true); } @@ -108,7 +112,7 @@ namespace VeraCrypt void MountAllDevices (); void MountVolume (); void OnAboutMenuItemSelected (wxCommandEvent& event); - void OnQuit(wxCommandEvent& event) { Close(true); } + void OnQuit(wxCommandEvent& event) { if (CanExitWhenLocked()) Close(true); } void OnActivate (wxActivateEvent& event); void OnAddAllMountedToFavoritesMenuItemSelected (wxCommandEvent& event); void OnAddToFavoritesMenuItemSelected (wxCommandEvent& event); @@ -168,6 +172,7 @@ namespace VeraCrypt void OnOpenVolumeSystemRequestEvent (EventArgs &args); void OnOrganizeFavoritesMenuItemSelected (wxCommandEvent& event); void OnPreferencesMenuItemSelected (wxCommandEvent& event); + void OnNewDevice (wxThreadEvent& event) { Gui->OnNewDeviceConnected (wstring (event.GetString())); } void OnPreferencesUpdated (wxCommandEvent& event); void OnPreferencesUpdatedEvent (EventArgs &args) { wxQueueEvent (this, new wxCommandEvent( wxEVT_COMMAND_PREF_UPDATED,0)); } void OnRemoveKeyfilesMenuItemSelected (wxCommandEvent& event) { ChangePassword (ChangePasswordDialog::Mode::RemoveAllKeyfiles); } diff --git a/src/Main/Forms/PreferencesDialog.cpp b/src/Main/Forms/PreferencesDialog.cpp index 879394cac7..9f909721ad 100644 --- a/src/Main/Forms/PreferencesDialog.cpp +++ b/src/Main/Forms/PreferencesDialog.cpp @@ -75,6 +75,7 @@ namespace VeraCrypt PreferencesDialog::PreferencesDialog (wxWindow* parent) : PreferencesDialogBase (parent), LastVirtualKeyPressed (0), + LockDismountOnNewDevice (false), Preferences (Gui->GetPreferences()), RestoreValidatorBell (false) { @@ -85,6 +86,7 @@ namespace VeraCrypt #endif // Security TC_CHECK_BOX_VALIDATOR (DismountOnLogOff); + TC_CHECK_BOX_VALIDATOR (DismountOnNewDevice); TC_CHECK_BOX_VALIDATOR (DismountOnPowerSaving); TC_CHECK_BOX_VALIDATOR (DismountOnScreenSaver); TC_CHECK_BOX_VALIDATOR (DismountOnInactivity); @@ -284,11 +286,30 @@ namespace VeraCrypt #if defined (TC_WINDOWS) || defined (TC_MACOSX) FilesystemSizer->Show (false); #else - // Auto-dismount is not supported on Linux as dismount may require the user to enter admin password - AutoDismountSizer->Show (false); + // Auto-dismount is not supported on Linux as dismount may require the user to enter admin password, + // except when a new device is connected: a volume is then unmounted at the latest once the password is entered + DismountOnLogOffCheckBox->Show (false); + DismountOnScreenSaverCheckBox->Show (false); + DismountOnPowerSavingCheckBox->Show (false); + AutoDismountSizer->Show (DismountOnInactivityCheckBox->GetContainingSizer(), false); + ForceAutoDismountCheckBox->Show (false); WipeCacheOnAutoDismountCheckBox->Show (false); + if (!NewDeviceMonitor::IsSupported()) + AutoDismountSizer->Show (false); #endif + if (!NewDeviceMonitor::IsSupported()) + { + DismountOnNewDeviceCheckBox->Show (false); + } + else if (Gui->IsDismountOnNewDeviceLocked()) + { + // Locked until VeraCrypt is terminated. Disabling the background task would close VeraCrypt. + DismountOnNewDeviceCheckBox->SetValue (true); + DismountOnNewDeviceCheckBox->Enable (false); + BackgroundTaskEnabledCheckBox->Enable (false); + } + #ifndef TC_WINDOWS LogOnSizer->Show (false); MountRemovableCheckBox->Show (false); @@ -501,6 +522,16 @@ namespace VeraCrypt event.Skip(); } + void PreferencesDialog::OnDismountOnNewDeviceCheckBoxClick (wxCommandEvent& event) + { + LockDismountOnNewDevice = false; + if (event.IsChecked()) + { + Gui->ShowWarning (LangString["LINUX_UNMOUNT_NEW_DEVICE_WARNING"]); + LockDismountOnNewDevice = Gui->AskYesNo (LangString["LINUX_UNMOUNT_NEW_DEVICE_LOCK_PROMPT"], false, true); + } + } + void PreferencesDialog::OnDismountOnPowerSavingCheckBoxClick (wxCommandEvent& event) { if (event.IsChecked() && !ForceAutoDismountCheckBox->IsChecked()) @@ -584,8 +615,24 @@ namespace VeraCrypt Gui->ShowInfo (LangString["LINUX_RESTART_FOR_LANGUAGE_CHANGE"]); } + bool lockDismountOnNewDevice = LockDismountOnNewDevice && Preferences.DismountOnNewDevice; + if (Gui->IsDismountOnNewDeviceLocked()) + Preferences.DismountOnNewDevice = true; + + // Closing the main window of a locked VeraCrypt must keep it reachable + if (Gui->IsDismountOnNewDeviceLocked() || lockDismountOnNewDevice) + Preferences.BackgroundTaskEnabled = true; + Gui->SetPreferences (Preferences); + if (lockDismountOnNewDevice) + { + // Reports the error if it cannot be started: VeraCrypt then stays closable + Gui->UpdateNewDeviceMonitor(); + if (Gui->IsNewDeviceMonitorRunning()) + Gui->LockDismountOnNewDevice(); + } + try { if (securityTokenModuleChanged) diff --git a/src/Main/Forms/PreferencesDialog.h b/src/Main/Forms/PreferencesDialog.h index 17a88d871a..8f6cd7d93d 100644 --- a/src/Main/Forms/PreferencesDialog.h +++ b/src/Main/Forms/PreferencesDialog.h @@ -32,6 +32,7 @@ namespace VeraCrypt void OnBackgroundTaskEnabledCheckBoxClick (wxCommandEvent& event); void OnCancelButtonClick (wxCommandEvent& event) { EndModal (wxID_CANCEL); } void OnClose (wxCloseEvent& event); + void OnDismountOnNewDeviceCheckBoxClick (wxCommandEvent& event); void OnDismountOnPowerSavingCheckBoxClick (wxCommandEvent& event); void OnDismountOnScreenSaverCheckBoxClick (wxCommandEvent& event); void OnForceAutoDismountCheckBoxClick (wxCommandEvent& event); @@ -62,6 +63,7 @@ namespace VeraCrypt wxCheckBox *DisableScreenProtectionCheckBox; #endif int LastVirtualKeyPressed; + bool LockDismountOnNewDevice; unique_ptr mTimer; UserPreferences Preferences; bool RestoreValidatorBell; diff --git a/src/Main/Forms/TrueCrypt.fbp b/src/Main/Forms/TrueCrypt.fbp index a100bf1f74..ac0c1f326a 100644 --- a/src/Main/Forms/TrueCrypt.fbp +++ b/src/Main/Forms/TrueCrypt.fbp @@ -11166,6 +11166,71 @@ OnDismountOnPowerSavingCheckBoxClick + + 5 + wxALL + 0 + + 1 + 1 + 1 + 1 + + + + + + + + 1 + 0 + 0 + 1 + + 1 + 0 + Dock + 0 + Left + 1 + + 1 + + 0 + 0 + wxID_ANY + LINUX_UNMOUNT_NEW_DEVICE + + 0 + + + 0 + + 1 + DismountOnNewDeviceCheckBox + 1 + + + protected + 1 + + Resizable + 1 + + + + 0 + + + wxFILTER_NONE + wxDefaultValidator + + + + + OnDismountOnNewDeviceCheckBoxClick + + diff --git a/src/Main/GraphicUserInterface.cpp b/src/Main/GraphicUserInterface.cpp index 6db149a7c0..80960f34bd 100644 --- a/src/Main/GraphicUserInterface.cpp +++ b/src/Main/GraphicUserInterface.cpp @@ -167,6 +167,8 @@ namespace VeraCrypt GraphicUserInterface::GraphicUserInterface () : ActiveFrame (nullptr), BackgroundMode (false), + DismountOnNewDeviceLocked (false), + HandlingNewDevice (false), mMainFrame (nullptr), mWaitDialog (nullptr) #ifdef TC_MACOSX @@ -1497,6 +1499,146 @@ namespace VeraCrypt } #endif + void GraphicUserInterface::UpdateNewDeviceMonitor () + { + if (!NewDeviceMonitor::IsSupported() || (!DismountOnNewDeviceLocked && !GetPreferences().DismountOnNewDevice)) + { + mNewDeviceMonitor.Stop(); + mPendingNewDevice.clear(); + return; + } + + if (mNewDeviceMonitor.IsRunning()) + return; + + try + { + mNewDeviceMonitor.Start (OnNewDeviceDetected); + } + catch (exception &e) + { + ShowError (e); + } + } + + // Called by the device monitor, possibly on another thread + void GraphicUserInterface::OnNewDeviceDetected (const wstring &device) + { + wxWindow *mainFrame = Gui ? Gui->GetMainFrame() : nullptr; + if (mainFrame) + { + wxThreadEvent *event = new wxThreadEvent (wxEVT_COMMAND_NEW_DEVICE); + event->SetString (device); + wxQueueEvent (mainFrame, event); + } + } + + void GraphicUserInterface::ProcessPendingNewDevice () + { + if (!mPendingNewDevice.empty() && !GetWaitDialog()) + { + wstring device = mPendingNewDevice; + mPendingNewDevice.clear(); + OnNewDeviceConnected (device); + } + } + + void GraphicUserInterface::OnNewDeviceConnected (const wstring &device) + { + if (!DismountOnNewDeviceLocked && !GetPreferences().DismountOnNewDevice) + return; + + // Another core operation must not start from the nested event loop of a wait dialog, nor while the volumes are + // being unmounted (for example, while the administrator password is requested): the main frame's timer + // processes the device afterwards + if (GetWaitDialog() || HandlingNewDevice) + { + mPendingNewDevice = device; + return; + } + + VolumeInfoList volumes; + bool failed = false; + { + HandlingNewDevice = true; + finally_do_arg (bool *, &HandlingNewDevice, { *finally_arg = false; }); + + SystemLog::WriteError (string ("New device connected: ") + StringConverter::ToSingle (device, true) + ": unmounting all volumes"); + + // Needs no administrator privileges, unlike unmounting below, which can wait for the password + try + { + Core->WipePasswordCache(); + } + catch (exception &e) + { + SystemLog::WriteException (e); + failed = true; + } + + try + { +#ifdef TC_MACOSX + // Includes the volumes known from before if some cannot be read now + volumes = GetVolumesForAutoDismount(); +#else + volumes = Core->GetMountedVolumes(); +#endif + } + catch (exception &e) + { + SystemLog::WriteException (e); + failed = true; + } + + // A volume mounted inside another one first. Open files do not keep a volume mounted: their unsaved data is lost. + volumes.sort (VolumeInfo::FirstVolumeMountedAfterSecond); +#ifdef TC_LINUX + // The keys held by the kernel of all volumes before the cleanup of any, which takes longer + foreach (shared_ptr volume, volumes) + { + try + { + Core->DestroyVolumeKeys (volume); + } + catch (exception &e) + { + SystemLog::WriteException (e); + failed = true; + } + } +#endif + foreach (shared_ptr volume, volumes) + { + try + { +#ifdef TC_LINUX + // A forced unmount would leave the keys in memory until the files open on the volume are closed + Core->EmergencyDismountVolume (volume, true); +#elif defined (TC_MACOSX) + DismountVolumeThread (volume, true, false); +#else + Core->DismountVolume (volume, true); +#endif + } + catch (exception &e) + { + SystemLog::WriteException (e); + failed = true; + } + } + + // A monitor that stopped after a failure reported it as a new device: start it again + UpdateNewDeviceMonitor(); + } + + // Another device connected while this is shown must not have to wait for it + if (failed) + ShowErrorTopMost (StringFormatter (LangString["LINUX_NEW_DEVICE_UNMOUNT_FAILED"], device)); + else if (!volumes.empty()) + ShowWarningTopMost (StringFormatter (LangString["LINUX_NEW_DEVICE_UNMOUNTED"], device)); + } + void GraphicUserInterface::OnSignal (int signal) { #ifdef TC_UNIX diff --git a/src/Main/GraphicUserInterface.h b/src/Main/GraphicUserInterface.h index 5c7302cb2b..c61ec4026c 100644 --- a/src/Main/GraphicUserInterface.h +++ b/src/Main/GraphicUserInterface.h @@ -18,6 +18,7 @@ #include "Main.h" #include "UserInterface.h" #include "Forms/WaitDialog.h" +#include "NewDeviceMonitor.h" #ifdef TC_MACOSX #include #endif @@ -65,6 +66,7 @@ namespace VeraCrypt virtual void InitSecurityTokenLibrary () const; virtual void InsertToListCtrl (wxListCtrl *listCtrl, long itemIndex, const vector &itemFields, int imageIndex = -1, void *itemDataPtr = nullptr) const; virtual bool IsInBackgroundMode () const { return BackgroundMode; } + bool IsDismountOnNewDeviceLocked () const { return DismountOnNewDeviceLocked; } virtual bool IsTheOnlyTopLevelWindow (const wxWindow *window) const; virtual void ListTokenKeyfiles () const; virtual void ListSecurityTokenKeyfiles () const; @@ -73,6 +75,8 @@ namespace VeraCrypt virtual shared_ptr MountVolume (MountOptions &options, bool tryCachedPasswords = true) const; virtual void MoveListCtrlItem (wxListCtrl *listCtrl, long itemIndex, long newItemIndex) const; virtual void OnAutoDismountAllEvent (); + // Keeps unmounting all volumes when a new device is connected, and VeraCrypt running, until it is terminated + void LockDismountOnNewDevice () { DismountOnNewDeviceLocked = true; } virtual bool OnInit (); virtual void OnLogOff (); virtual void OpenDocument (wxWindow *parent, const wxFileName &document); @@ -99,6 +103,11 @@ namespace VeraCrypt virtual bool UpdateListCtrlItem (wxListCtrl *listCtrl, long itemIndex, const vector &itemFields) const; virtual void UserEnrichRandomPool (wxWindow *parent, shared_ptr hash = shared_ptr ()) const; virtual void Yield () const; + bool IsNewDeviceMonitorRunning () const { return mNewDeviceMonitor.IsRunning(); } + void OnNewDeviceConnected (const wstring &device); + void ProcessPendingNewDevice (); + void StopNewDeviceMonitor () { mNewDeviceMonitor.Stop(); } + void UpdateNewDeviceMonitor (); virtual shared_ptr MountVolumeThread (MountOptions &options) const; #ifdef TC_MACOSX virtual shared_ptr DismountVolumeThread (shared_ptr volume, bool ignoreOpenFiles, bool interactive = true) const; @@ -135,6 +144,7 @@ namespace VeraCrypt #ifdef wxHAS_POWER_EVENTS virtual void OnPowerSuspending (wxPowerEvent& event); #endif + static void OnNewDeviceDetected (const wstring &device); static void OnSignal (int signal); virtual void OnVolumesAutoDismounted (); #ifdef TC_MACOSX @@ -146,6 +156,8 @@ namespace VeraCrypt wxFrame *ActiveFrame; bool BackgroundMode; + bool DismountOnNewDeviceLocked; + bool HandlingNewDevice; #ifdef TC_WINDOWS unique_ptr DDEServer; #endif @@ -157,6 +169,8 @@ namespace VeraCrypt unique_ptr SingleInstanceChecker; mutable WaitDialog* mWaitDialog; + NewDeviceMonitor mNewDeviceMonitor; + wstring mPendingNewDevice; #ifdef TC_MACOSX mutable list mUnconfirmedCleanupWarnings; mutable bool mShowingCleanupWarning; diff --git a/src/Main/Main.make b/src/Main/Main.make index 20d114d8fe..c3fec3ac95 100755 --- a/src/Main/Main.make +++ b/src/Main/Main.make @@ -26,6 +26,7 @@ OBJS += Resources.o ifndef TC_NO_GUI OBJS += FatalErrorHandler.o OBJS += GraphicUserInterface.o +OBJS += NewDeviceMonitor.o ifeq "$(PLATFORM)" "MacOSX" OBJS += MacOSXSecureTextFieldHotkeys.o OBJS += MacOSXWindowTitle.o diff --git a/src/Main/NewDeviceMonitor.cpp b/src/Main/NewDeviceMonitor.cpp new file mode 100644 index 0000000000..dcf027b72a --- /dev/null +++ b/src/Main/NewDeviceMonitor.cpp @@ -0,0 +1,515 @@ +/* + Copyright (c) 2013-2026 AM Crypto. All rights reserved. + + Governed by the Apache License 2.0 the full text of which is + contained in the file License.txt included in VeraCrypt binary and source + code distribution packages. +*/ + +#include "System.h" +#include +#include +#include "Platform/Platform.h" +#include "Platform/SystemException.h" +#include "Platform/StringConverter.h" +#include "NewDeviceMonitor.h" + +#ifdef TC_LINUX +#include +#include +#include +#include +// GCC 4.4 (CentOS 6) provides the atomic types under the old header name. +#if defined(__GNUC__) && !defined(__clang__) && __GNUC__ == 4 && __GNUC_MINOR__ < 5 +#include +#else +#include +#endif +#include +#include +#include +#include +#include +#endif + +#ifdef TC_MACOSX +#include +#include +#endif + +namespace VeraCrypt +{ +#if defined (TC_LINUX) || defined (TC_MACOSX) + namespace + { + // A device's name must not prevent reporting it: a serial number may not decode in the current locale + wstring GetDeviceLabel (const string &device) + { + try + { + return StringConverter::ToWide (device); + } + catch (...) { } + + wstring label; + for (size_t i = 0; i < device.size(); i++) + label += (device[i] > 0 && device[i] < 0x7f) ? (wchar_t) device[i] : L'?'; + return label; + } + + void ReportNewDevice (NewDeviceMonitor::Handler handler, const string &device) + { + try + { + handler (GetDeviceLabel (device)); + } + catch (...) { } + } + } +#endif + +#ifdef TC_LINUX + namespace + { + string ReadSysfsAttribute (const string &directory, const char *name) + { + ifstream file ((directory + "/" + name).c_str()); + string value; + getline (file, value); + return value; + } + + string GetLastPathComponent (const string &path) + { + size_t pos = path.find_last_of ('/'); + return pos == string::npos ? path : path.substr (pos + 1); + } + + // The vendor, product and serial number of a USB device, or its port if it has no serial number. + // Returns an empty string if the attributes cannot be read. + string GetUsbDeviceId (const string &directory) + { + string vendor = ReadSysfsAttribute (directory, "idVendor"); + string product = ReadSysfsAttribute (directory, "idProduct"); + if (vendor.empty() || product.empty()) + return string(); + + string id = "usb:" + vendor + ":" + product + ":"; + string serial = ReadSysfsAttribute (directory, "serial"); + if (!serial.empty()) + id += serial; + else + id += "@" + GetLastPathComponent (directory); + + return id; + } + + string GetThunderboltDeviceId (const string &directory) + { + string uniqueId = ReadSysfsAttribute (directory, "unique_id"); + return uniqueId.empty() ? string() : "thunderbolt:" + uniqueId; + } + + void AddConnectedDevices (const string &busDirectory, string (*getId) (const string &), std::set &devices) + { + DIR *dir = opendir (busDirectory.c_str()); + if (!dir) + return; + + struct dirent *entry; + while ((entry = readdir (dir)) != nullptr) + { + if (entry->d_name[0] == '.') + continue; + + // Interfaces and other objects without the attributes are not devices + string id = getId (busDirectory + "/" + entry->d_name); + if (!id.empty()) + devices.insert (id); + } + + closedir (dir); + } + } + + struct NewDeviceMonitor::Impl + { + Impl () : Socket (-1), Stopped (false) + { + StopPipe[0] = StopPipe[1] = -1; + } + + bool IsAlive () const { return !Stopped; } + + static TC_THREAD_PROC RunWorker (void *impl) + { + static_cast (impl)->Run(); + return 0; + } + + ~Impl () + { + if (Socket != -1) + close (Socket); + if (StopPipe[0] != -1) + close (StopPipe[0]); + if (StopPipe[1] != -1) + close (StopPipe[1]); + } + + void Run () + { + vector buffer (64 * 1024); + + while (true) + { + struct pollfd fds[2]; + fds[0].fd = Socket; + fds[0].events = POLLIN; + fds[0].revents = 0; + fds[1].fd = StopPipe[0]; + fds[1].events = POLLIN; + fds[1].revents = 0; + + if (poll (fds, 2, -1) == -1) + { + if (errno == EINTR) + continue; + Fail(); + return; + } + + if (fds[1].revents) + { + Stopped = true; + return; + } + + struct sockaddr_nl sender; + socklen_t senderSize = sizeof (sender); + ssize_t size = recvfrom (Socket, &buffer[0], buffer.size() - 1, 0, (struct sockaddr *) &sender, &senderSize); + if (size < 0) + { + if (errno == EINTR || errno == EAGAIN) + continue; + + // Events were lost: compare the devices connected now with those connected at start + if (errno == ENOBUFS) + { + std::set connected; + AddConnectedDevices ("/sys/bus/usb/devices", GetUsbDeviceId, connected); + AddConnectedDevices ("/sys/bus/thunderbolt/devices", GetThunderboltDeviceId, connected); + foreach (const string &id, connected) + { + if (Known.find (id) == Known.end()) + ReportNewDevice (OnNewDevice, id); + } + continue; + } + + Fail(); + return; + } + + // Only the kernel reports devices on this group + if (senderSize != sizeof (sender) || sender.nl_pid != 0) + continue; + + buffer[size] = 0; + + // "@" followed by NUL-terminated KEY=VALUE pairs + map event; + for (size_t pos = strlen (&buffer[0]) + 1; pos < (size_t) size; pos += strlen (&buffer[pos]) + 1) + { + const char *pair = &buffer[pos]; + const char *equal = strchr (pair, '='); + if (equal) + event[string (pair, equal - pair)] = equal + 1; + } + + if (event["ACTION"] != "add" || event["DEVPATH"].empty()) + continue; + + const string directory = "/sys" + event["DEVPATH"]; + string id; + + if (event["SUBSYSTEM"] == "usb" && event["DEVTYPE"] == "usb_device") + { + id = GetUsbDeviceId (directory); + if (id.empty()) + id = "usb:" + event["DEVPATH"]; + } + else if (event["SUBSYSTEM"] == "thunderbolt" && event["DEVTYPE"] == "thunderbolt_device") + { + id = GetThunderboltDeviceId (directory); + if (id.empty()) + id = "thunderbolt:" + event["DEVPATH"]; + } + else + continue; + + if (Known.find (id) == Known.end()) + ReportNewDevice (OnNewDevice, id); + } + } + + // Not monitoring from here on, which the handler can already see: it starts the monitor again + void Fail () + { + Stopped = true; + ReportNewDevice (OnNewDevice, "(device monitoring failed)"); + } + + int Socket; + int StopPipe[2]; + std::atomic Stopped; + Thread Worker; + std::set Known; + Handler OnNewDevice; + }; + + bool NewDeviceMonitor::IsSupported () + { + return true; + } + + void NewDeviceMonitor::Start (Handler handler) + { + if (IsRunning()) + return; + + // A worker that stopped after a failure + Stop(); + + unique_ptr impl (new Impl); + impl->OnNewDevice = handler; + + // Listen before taking the list of connected devices, so that no device can be connected in between unseen + impl->Socket = socket (AF_NETLINK, SOCK_DGRAM | SOCK_CLOEXEC, NETLINK_KOBJECT_UEVENT); + throw_sys_if (impl->Socket == -1); + + int bufferSize = 1024 * 1024; + setsockopt (impl->Socket, SOL_SOCKET, SO_RCVBUF, &bufferSize, sizeof (bufferSize)); + + struct sockaddr_nl address; + memset (&address, 0, sizeof (address)); + address.nl_family = AF_NETLINK; + address.nl_groups = 1; // Kernel events + throw_sys_if (bind (impl->Socket, (struct sockaddr *) &address, sizeof (address)) == -1); + + throw_sys_if (pipe2 (impl->StopPipe, O_CLOEXEC) == -1); + + AddConnectedDevices ("/sys/bus/usb/devices", GetUsbDeviceId, impl->Known); + AddConnectedDevices ("/sys/bus/thunderbolt/devices", GetThunderboltDeviceId, impl->Known); + + impl->Worker.Start (Impl::RunWorker, impl.get()); + mImpl.reset (impl.release()); + } + + void NewDeviceMonitor::Stop () + { + if (!mImpl.get()) + return; + + while (write (mImpl->StopPipe[1], "", 1) == -1 && errno == EINTR) + continue; + + mImpl->Worker.Join(); + mImpl.reset(); + } + +#elif defined (TC_MACOSX) + + namespace + { + bool GetNumberProperty (io_service_t service, CFStringRef name, uint64 &value) + { + CFTypeRef property = IORegistryEntryCreateCFProperty (service, name, kCFAllocatorDefault, 0); + if (!property) + return false; + + bool result = false; + long long number; + if (CFGetTypeID (property) == CFNumberGetTypeID() && CFNumberGetValue ((CFNumberRef) property, kCFNumberLongLongType, &number)) + { + value = (uint64) number; + result = true; + } + + CFRelease (property); + return result; + } + + string GetStringProperty (io_service_t service, CFStringRef name) + { + CFTypeRef property = IORegistryEntryCreateCFProperty (service, name, kCFAllocatorDefault, 0); + if (!property) + return string(); + + string result; + char value[512]; + if (CFGetTypeID (property) == CFStringGetTypeID() && CFStringGetCString ((CFStringRef) property, value, sizeof (value), kCFStringEncodingUTF8)) + result = value; + + CFRelease (property); + return result; + } + + // The vendor, product and serial number of a USB device, or its location if it has no serial number. + // A Thunderbolt device by its UID. Otherwise, the registry entry, which changes when the device is connected again. + string GetDeviceId (io_service_t service) + { + uint64 vendor, product, location, uid; + if (GetNumberProperty (service, CFSTR ("idVendor"), vendor) && GetNumberProperty (service, CFSTR ("idProduct"), product)) + { + string id = "usb:" + StringConverter::ToSingle (vendor) + ":" + StringConverter::ToSingle (product) + ":"; + + string serial = GetStringProperty (service, CFSTR ("USB Serial Number")); + if (serial.empty()) + serial = GetStringProperty (service, CFSTR ("kUSBSerialNumberString")); + + if (!serial.empty()) + id += serial; + else if (GetNumberProperty (service, CFSTR ("locationID"), location)) + id += "@" + StringConverter::ToSingle (location); + + return id; + } + + if (GetNumberProperty (service, CFSTR ("UID"), uid)) + return "thunderbolt:" + StringConverter::ToSingle (uid); + + uint64 entryId = 0; + IORegistryEntryGetRegistryEntryID (service, &entryId); + return "registry:" + StringConverter::ToSingle (entryId); + } + } + + struct NewDeviceMonitor::Impl + { + Impl () : Port (nullptr), Reporting (false) { } + + bool IsAlive () const { return true; } + + ~Impl () + { + foreach (io_iterator_t iterator, Iterators) + IOObjectRelease (iterator); + + if (Port) + { + CFRunLoopRemoveSource (CFRunLoopGetMain(), IONotificationPortGetRunLoopSource (Port), kCFRunLoopCommonModes); + IONotificationPortDestroy (Port); + } + } + + // Called on the main thread by the run loop. The notification is armed again only once the iterator is emptied. + static void OnMatched (void *context, io_iterator_t iterator) + { + static_cast (context)->Drain (iterator); + } + + void Drain (io_iterator_t iterator) + { + io_service_t service; + while ((service = IOIteratorNext (iterator)) != 0) + { + string id = GetDeviceId (service); + IOObjectRelease (service); + + if (!Reporting) + Known.insert (id); + else if (Known.find (id) == Known.end()) + ReportNewDevice (OnNewDevice, id); + } + } + + IONotificationPortRef Port; + list Iterators; + std::set Known; + Handler OnNewDevice; + bool Reporting; + }; + + bool NewDeviceMonitor::IsSupported () + { + return true; + } + + void NewDeviceMonitor::Start (Handler handler) + { + if (IsRunning()) + return; + + unique_ptr impl (new Impl); + impl->OnNewDevice = handler; + + impl->Port = IONotificationPortCreate (MACH_PORT_NULL); + if (!impl->Port) + throw SystemException (SRC_POS, "IONotificationPortCreate"); + + CFRunLoopAddSource (CFRunLoopGetMain(), IONotificationPortGetRunLoopSource (impl->Port), kCFRunLoopCommonModes); + + // The first notifications list the devices connected now. Thunderbolt devices can access memory directly. + const char *classes[] = { "IOUSBHostDevice", "IOUSBDevice", "IOThunderboltSwitch" }; + for (size_t i = 0; i < array_capacity (classes); i++) + { + const char *className = classes[i]; + io_iterator_t iterator = 0; + // IOServiceMatching's dictionary is consumed by the call + kern_return_t result = IOServiceAddMatchingNotification (impl->Port, kIOFirstMatchNotification, + IOServiceMatching (className), Impl::OnMatched, impl.get(), &iterator); + + if (result != KERN_SUCCESS) + throw SystemException (SRC_POS, string ("IOServiceAddMatchingNotification: ") + className); + + impl->Iterators.push_back (iterator); + impl->Drain (iterator); + } + + impl->Reporting = true; + mImpl.reset (impl.release()); + } + + void NewDeviceMonitor::Stop () + { + mImpl.reset(); + } + +#else + + struct NewDeviceMonitor::Impl + { + bool IsAlive () const { return false; } + }; + + bool NewDeviceMonitor::IsSupported () + { + return false; + } + + void NewDeviceMonitor::Start (Handler handler) + { + throw NotApplicable (SRC_POS); + } + + void NewDeviceMonitor::Stop () + { + } + +#endif + + NewDeviceMonitor::NewDeviceMonitor () + { + } + + NewDeviceMonitor::~NewDeviceMonitor () + { + Stop(); + } + + bool NewDeviceMonitor::IsRunning () const + { + return mImpl.get() != nullptr && mImpl->IsAlive(); + } +} diff --git a/src/Main/NewDeviceMonitor.h b/src/Main/NewDeviceMonitor.h new file mode 100644 index 0000000000..13ed12d2c1 --- /dev/null +++ b/src/Main/NewDeviceMonitor.h @@ -0,0 +1,42 @@ +/* + Copyright (c) 2013-2026 AM Crypto. All rights reserved. + + Governed by the Apache License 2.0 the full text of which is + contained in the file License.txt included in VeraCrypt binary and source + code distribution packages. +*/ + +#ifndef TC_HEADER_Main_NewDeviceMonitor +#define TC_HEADER_Main_NewDeviceMonitor + +#include "System.h" + +namespace VeraCrypt +{ + // Reports USB and Thunderbolt devices that are connected while it runs and were not connected when it started. + // A device that is disconnected and connected again is not reported, unless it has no serial number and is + // connected to another port. + class NewDeviceMonitor + { + public: + typedef void (*Handler) (const wstring &device); + + NewDeviceMonitor (); + ~NewDeviceMonitor (); + + static bool IsSupported (); + bool IsRunning () const; + // The handler can be called on another thread. Throws if the monitor cannot be started. + void Start (Handler handler); + void Stop (); + + private: + struct Impl; + unique_ptr mImpl; + + NewDeviceMonitor (const NewDeviceMonitor &); + NewDeviceMonitor &operator= (const NewDeviceMonitor &); + }; +} + +#endif // TC_HEADER_Main_NewDeviceMonitor diff --git a/src/Main/UserPreferences.cpp b/src/Main/UserPreferences.cpp index a626efc3ad..4aa37d8ed4 100644 --- a/src/Main/UserPreferences.cpp +++ b/src/Main/UserPreferences.cpp @@ -89,6 +89,7 @@ namespace VeraCrypt #endif TC_CONFIG_SET (DismountOnInactivity); TC_CONFIG_SET (DismountOnLogOff); + TC_CONFIG_SET (DismountOnNewDevice); TC_CONFIG_SET (DismountOnPowerSaving); TC_CONFIG_SET (DismountOnScreenSaver); TC_CONFIG_SET (DisplayMessageAfterHotkeyDismount); @@ -220,6 +221,7 @@ namespace VeraCrypt #endif TC_CONFIG_ADD (DismountOnInactivity); TC_CONFIG_ADD (DismountOnLogOff); + TC_CONFIG_ADD (DismountOnNewDevice); TC_CONFIG_ADD (DismountOnPowerSaving); TC_CONFIG_ADD (DismountOnScreenSaver); TC_CONFIG_ADD (DisplayMessageAfterHotkeyDismount); diff --git a/src/Main/UserPreferences.h b/src/Main/UserPreferences.h index 07ab4176f9..e2c0bb5c6c 100644 --- a/src/Main/UserPreferences.h +++ b/src/Main/UserPreferences.h @@ -36,6 +36,7 @@ namespace VeraCrypt DisableScreenProtection (false), DismountOnInactivity (false), DismountOnLogOff (true), + DismountOnNewDevice (false), DismountOnPowerSaving (false), DismountOnScreenSaver (false), DisplayMessageAfterHotkeyDismount (false), @@ -80,6 +81,7 @@ namespace VeraCrypt bool DisableScreenProtection; bool DismountOnInactivity; bool DismountOnLogOff; + bool DismountOnNewDevice; bool DismountOnPowerSaving; bool DismountOnScreenSaver; bool DisplayMessageAfterHotkeyDismount;