Lines Matching +full:cts +full:- +full:override
1 // SPDX-License-Identifier: GPL-2.0
19 .friendly_name = "AES-256-XTS",
27 .friendly_name = "AES-256-CTS-CBC",
28 .cipher_str = "cts(cbc(aes))",
34 .friendly_name = "AES-128-CBC-ESSIV",
42 .friendly_name = "AES-128-CTS-CBC",
43 .cipher_str = "cts(cbc(aes))",
66 if (S_ISREG(inode->i_mode)) in select_encryption_mode()
69 if (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) in select_encryption_mode()
73 inode->i_ino, (inode->i_mode & S_IFMT)); in select_encryption_mode()
74 return ERR_PTR(-EINVAL); in select_encryption_mode()
85 tfm = crypto_alloc_skcipher(mode->cipher_str, 0, 0); in fscrypt_allocate_skcipher()
87 if (PTR_ERR(tfm) == -ENOENT) { in fscrypt_allocate_skcipher()
90 mode->friendly_name, mode->cipher_str); in fscrypt_allocate_skcipher()
91 return ERR_PTR(-ENOPKG); in fscrypt_allocate_skcipher()
94 mode->cipher_str, PTR_ERR(tfm)); in fscrypt_allocate_skcipher()
97 if (!xchg(&mode->logged_impl_name, 1)) { in fscrypt_allocate_skcipher()
101 * performance problems by logging the ->cra_driver_name the in fscrypt_allocate_skcipher()
105 mode->friendly_name, crypto_skcipher_driver_name(tfm)); in fscrypt_allocate_skcipher()
107 if (WARN_ON(crypto_skcipher_ivsize(tfm) != mode->ivsize)) { in fscrypt_allocate_skcipher()
108 err = -EINVAL; in fscrypt_allocate_skcipher()
112 err = crypto_skcipher_setkey(tfm, raw_key, mode->keysize); in fscrypt_allocate_skcipher()
124 * Prepare the crypto transform object or blk-crypto key in @prep_key, given the
126 * (fs-layer or blk-crypto) will be used.
136 tfm = fscrypt_allocate_skcipher(ci->ci_mode, raw_key, ci->ci_inode); in fscrypt_prepare_key()
141 * I.e., here we publish ->tfm with a RELEASE barrier so that in fscrypt_prepare_key()
143 * possible for per-mode keys, not for per-file keys. in fscrypt_prepare_key()
145 smp_store_release(&prep_key->tfm, tfm); in fscrypt_prepare_key()
149 /* Destroy a crypto transform object and/or blk-crypto key. */
152 crypto_free_skcipher(prep_key->tfm); in fscrypt_destroy_prepared_key()
156 /* Given a per-file encryption key, set up the file's crypto transform object */
159 ci->ci_owns_key = true; in fscrypt_set_per_file_enc_key()
160 return fscrypt_prepare_key(&ci->ci_enc_key, raw_key, ci); in fscrypt_set_per_file_enc_key()
168 const struct inode *inode = ci->ci_inode; in setup_per_mode_enc_key()
169 const struct super_block *sb = inode->i_sb; in setup_per_mode_enc_key()
170 struct fscrypt_mode *mode = ci->ci_mode; in setup_per_mode_enc_key()
171 const u8 mode_num = mode - fscrypt_modes; in setup_per_mode_enc_key()
174 u8 hkdf_info[sizeof(mode_num) + sizeof(sb->s_uuid)]; in setup_per_mode_enc_key()
179 return -EINVAL; in setup_per_mode_enc_key()
183 ci->ci_enc_key = *prep_key; in setup_per_mode_enc_key()
193 BUILD_BUG_ON(sizeof(sb->s_uuid) != 16); in setup_per_mode_enc_key()
197 memcpy(&hkdf_info[hkdf_infolen], &sb->s_uuid, in setup_per_mode_enc_key()
198 sizeof(sb->s_uuid)); in setup_per_mode_enc_key()
199 hkdf_infolen += sizeof(sb->s_uuid); in setup_per_mode_enc_key()
201 err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, in setup_per_mode_enc_key()
203 mode_key, mode->keysize); in setup_per_mode_enc_key()
207 memzero_explicit(mode_key, mode->keysize); in setup_per_mode_enc_key()
211 ci->ci_enc_key = *prep_key; in setup_per_mode_enc_key()
220 * application-specific information string.
223 * as a pair of 64-bit words. Therefore, on big endian CPUs we have to do an
232 err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, context, info, infolen, in fscrypt_derive_siphash_key()
238 BUILD_BUG_ON(ARRAY_SIZE(key->key) != 2); in fscrypt_derive_siphash_key()
239 le64_to_cpus(&key->key[0]); in fscrypt_derive_siphash_key()
240 le64_to_cpus(&key->key[1]); in fscrypt_derive_siphash_key()
250 ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE, in fscrypt_derive_dirhash_key()
251 &ci->ci_dirhash_key); in fscrypt_derive_dirhash_key()
254 ci->ci_dirhash_key_initialized = true; in fscrypt_derive_dirhash_key()
261 WARN_ON(ci->ci_inode->i_ino == 0); in fscrypt_hash_inode_number()
262 WARN_ON(!mk->mk_ino_hash_key_initialized); in fscrypt_hash_inode_number()
264 ci->ci_hashed_ino = (u32)siphash_1u64(ci->ci_inode->i_ino, in fscrypt_hash_inode_number()
265 &mk->mk_ino_hash_key); in fscrypt_hash_inode_number()
273 err = setup_per_mode_enc_key(ci, mk, mk->mk_iv_ino_lblk_32_keys, in fscrypt_setup_iv_ino_lblk_32_key()
279 if (!smp_load_acquire(&mk->mk_ino_hash_key_initialized)) { in fscrypt_setup_iv_ino_lblk_32_key()
283 if (mk->mk_ino_hash_key_initialized) in fscrypt_setup_iv_ino_lblk_32_key()
288 NULL, 0, &mk->mk_ino_hash_key); in fscrypt_setup_iv_ino_lblk_32_key()
292 smp_store_release(&mk->mk_ino_hash_key_initialized, true); in fscrypt_setup_iv_ino_lblk_32_key()
303 if (ci->ci_inode->i_ino) in fscrypt_setup_iv_ino_lblk_32_key()
314 if (ci->ci_policy.v2.flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) { in fscrypt_setup_v2_file_key()
316 * DIRECT_KEY: instead of deriving per-file encryption keys, the in fscrypt_setup_v2_file_key()
317 * per-file nonce will be included in all the IVs. But unlike in fscrypt_setup_v2_file_key()
319 * with the master key directly but rather derive a per-mode in fscrypt_setup_v2_file_key()
323 err = setup_per_mode_enc_key(ci, mk, mk->mk_direct_keys, in fscrypt_setup_v2_file_key()
325 } else if (ci->ci_policy.v2.flags & in fscrypt_setup_v2_file_key()
333 err = setup_per_mode_enc_key(ci, mk, mk->mk_iv_ino_lblk_64_keys, in fscrypt_setup_v2_file_key()
336 } else if (ci->ci_policy.v2.flags & in fscrypt_setup_v2_file_key()
342 err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, in fscrypt_setup_v2_file_key()
344 ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE, in fscrypt_setup_v2_file_key()
345 derived_key, ci->ci_mode->keysize); in fscrypt_setup_v2_file_key()
350 memzero_explicit(derived_key, ci->ci_mode->keysize); in fscrypt_setup_v2_file_key()
375 * (but in practice we only need to consider @ci->ci_mode, since any other
377 * required key size over @ci->ci_mode). This allows AES-256-XTS keys to be
378 * derived from a 256-bit master key, which is cryptographically sufficient,
379 * rather than requiring a 512-bit master key which is unnecessarily long. (We
380 * still allow 512-bit master keys if the user chooses to use them, though.)
387 if (ci->ci_policy.version == FSCRYPT_POLICY_V1) in fscrypt_valid_master_key_size()
388 min_keysize = ci->ci_mode->keysize; in fscrypt_valid_master_key_size()
390 min_keysize = ci->ci_mode->security_strength; in fscrypt_valid_master_key_size()
392 if (mk->mk_secret.size < min_keysize) { in fscrypt_valid_master_key_size()
395 master_key_spec_type(&mk->mk_spec), in fscrypt_valid_master_key_size()
396 master_key_spec_len(&mk->mk_spec), in fscrypt_valid_master_key_size()
397 (u8 *)&mk->mk_spec.u, in fscrypt_valid_master_key_size()
398 mk->mk_secret.size, min_keysize); in fscrypt_valid_master_key_size()
407 * If the master key is found in the filesystem-level keyring, then the
409 * ->mk_secret_sem read-locked. This is needed to ensure that only one task
410 * links the fscrypt_info into ->mk_decrypted_inodes (as multiple tasks may race
427 switch (ci->ci_policy.version) { in setup_file_encryption_key()
431 ci->ci_policy.v1.master_key_descriptor, in setup_file_encryption_key()
437 ci->ci_policy.v2.master_key_identifier, in setup_file_encryption_key()
442 return -EINVAL; in setup_file_encryption_key()
445 key = fscrypt_find_master_key(ci->ci_inode->i_sb, &mk_spec); in setup_file_encryption_key()
447 if (key != ERR_PTR(-ENOKEY) || in setup_file_encryption_key()
448 ci->ci_policy.version != FSCRYPT_POLICY_V1) in setup_file_encryption_key()
454 * to before the search of ->s_master_keys, since users in setup_file_encryption_key()
455 * shouldn't be able to override filesystem-level keys. in setup_file_encryption_key()
460 mk = key->payload.data[0]; in setup_file_encryption_key()
461 down_read(&mk->mk_secret_sem); in setup_file_encryption_key()
464 if (!is_master_key_secret_present(&mk->mk_secret)) { in setup_file_encryption_key()
465 err = -ENOKEY; in setup_file_encryption_key()
470 err = -ENOKEY; in setup_file_encryption_key()
474 switch (ci->ci_policy.version) { in setup_file_encryption_key()
476 err = fscrypt_setup_v1_file_key(ci, mk->mk_secret.raw); in setup_file_encryption_key()
483 err = -EINVAL; in setup_file_encryption_key()
493 up_read(&mk->mk_secret_sem); in setup_file_encryption_key()
505 if (ci->ci_direct_key) in put_crypt_info()
506 fscrypt_put_direct_key(ci->ci_direct_key); in put_crypt_info()
507 else if (ci->ci_owns_key) in put_crypt_info()
508 fscrypt_destroy_prepared_key(&ci->ci_enc_key); in put_crypt_info()
510 key = ci->ci_master_key; in put_crypt_info()
512 struct fscrypt_master_key *mk = key->payload.data[0]; in put_crypt_info()
520 * gets removed from ->s_master_keys. in put_crypt_info()
522 spin_lock(&mk->mk_decrypted_inodes_lock); in put_crypt_info()
523 list_del(&ci->ci_master_key_link); in put_crypt_info()
524 spin_unlock(&mk->mk_decrypted_inodes_lock); in put_crypt_info()
525 if (refcount_dec_and_test(&mk->mk_refcount)) in put_crypt_info()
544 res = fscrypt_initialize(inode->i_sb->s_cop->flags); in fscrypt_setup_encryption_info()
550 return -ENOMEM; in fscrypt_setup_encryption_info()
552 crypt_info->ci_inode = inode; in fscrypt_setup_encryption_info()
553 crypt_info->ci_policy = *policy; in fscrypt_setup_encryption_info()
554 memcpy(crypt_info->ci_nonce, nonce, FSCRYPT_FILE_NONCE_SIZE); in fscrypt_setup_encryption_info()
556 mode = select_encryption_mode(&crypt_info->ci_policy, inode); in fscrypt_setup_encryption_info()
561 WARN_ON(mode->ivsize > FSCRYPT_MAX_IV_SIZE); in fscrypt_setup_encryption_info()
562 crypt_info->ci_mode = mode; in fscrypt_setup_encryption_info()
570 * For existing inodes, multiple tasks may race to set ->i_crypt_info. in fscrypt_setup_encryption_info()
572 * fscrypt_get_info(). I.e., here we publish ->i_crypt_info with a in fscrypt_setup_encryption_info()
575 if (cmpxchg_release(&inode->i_crypt_info, NULL, crypt_info) == NULL) { in fscrypt_setup_encryption_info()
577 * We won the race and set ->i_crypt_info to our crypt_info. in fscrypt_setup_encryption_info()
582 master_key->payload.data[0]; in fscrypt_setup_encryption_info()
584 refcount_inc(&mk->mk_refcount); in fscrypt_setup_encryption_info()
585 crypt_info->ci_master_key = key_get(master_key); in fscrypt_setup_encryption_info()
586 spin_lock(&mk->mk_decrypted_inodes_lock); in fscrypt_setup_encryption_info()
587 list_add(&crypt_info->ci_master_key_link, in fscrypt_setup_encryption_info()
588 &mk->mk_decrypted_inodes); in fscrypt_setup_encryption_info()
589 spin_unlock(&mk->mk_decrypted_inodes_lock); in fscrypt_setup_encryption_info()
596 struct fscrypt_master_key *mk = master_key->payload.data[0]; in fscrypt_setup_encryption_info()
598 up_read(&mk->mk_secret_sem); in fscrypt_setup_encryption_info()
606 * fscrypt_get_encryption_info() - set up an inode's encryption key
609 * Set up ->i_crypt_info, if it hasn't already been done.
611 * Note: unless ->i_crypt_info is already set, this isn't %GFP_NOFS-safe. So
614 * Return: 0 if ->i_crypt_info was set or was already set, *or* if the
616 * distinguish these cases.) Also can return another -errno code.
627 res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx)); in fscrypt_get_encryption_info()
641 return -EINVAL; in fscrypt_get_encryption_info()
646 S_ISDIR(inode->i_mode)); in fscrypt_get_encryption_info()
647 if (res == -ENOKEY) in fscrypt_get_encryption_info()
654 * fscrypt_prepare_new_inode() - prepare to create a new inode in a directory
655 * @dir: a possibly-encrypted directory
656 * @inode: the new inode. ->i_mode must be set already.
657 * ->i_ino doesn't need to be set yet.
660 * If the directory is encrypted, set up its ->i_crypt_info in preparation for
662 * encrypted, set up its ->i_crypt_info and set *encrypt_ret=true.
664 * This isn't %GFP_NOFS-safe, and therefore it should be called before starting
665 * any filesystem transaction to create the inode. For this reason, ->i_ino
671 * Return: 0 on success, -ENOKEY if the encryption key is missing, or another
672 * -errno code
686 if (WARN_ON_ONCE(inode->i_mode == 0)) in fscrypt_prepare_new_inode()
687 return -EINVAL; in fscrypt_prepare_new_inode()
693 if (!S_ISREG(inode->i_mode) && in fscrypt_prepare_new_inode()
694 !S_ISDIR(inode->i_mode) && in fscrypt_prepare_new_inode()
695 !S_ISLNK(inode->i_mode)) in fscrypt_prepare_new_inode()
703 S_ISDIR(inode->i_mode)); in fscrypt_prepare_new_inode()
708 * fscrypt_put_encryption_info() - free most of an inode's fscrypt data
716 put_crypt_info(inode->i_crypt_info); in fscrypt_put_encryption_info()
717 inode->i_crypt_info = NULL; in fscrypt_put_encryption_info()
722 * fscrypt_free_inode() - free an inode's fscrypt data requiring RCU delay
730 if (IS_ENCRYPTED(inode) && S_ISLNK(inode->i_mode)) { in fscrypt_free_inode()
731 kfree(inode->i_link); in fscrypt_free_inode()
732 inode->i_link = NULL; in fscrypt_free_inode()
738 * fscrypt_drop_inode() - check whether the inode's master key has been removed
741 * Filesystems supporting fscrypt must call this from their ->drop_inode()
755 * was provided via the legacy mechanism of the process-subscribed in fscrypt_drop_inode()
758 if (!ci || !ci->ci_master_key) in fscrypt_drop_inode()
760 mk = ci->ci_master_key->payload.data[0]; in fscrypt_drop_inode()
763 * With proper, non-racy use of FS_IOC_REMOVE_ENCRYPTION_KEY, all inodes in fscrypt_drop_inode()
768 if (inode->i_state & I_DIRTY_ALL) in fscrypt_drop_inode()
772 * Note: since we aren't holding ->mk_secret_sem, the result here can in fscrypt_drop_inode()
779 return !is_master_key_secret_present(&mk->mk_secret); in fscrypt_drop_inode()