Lines Matching +full:unlock +full:- +full:keys
1 // SPDX-License-Identifier: GPL-2.0
18 .friendly_name = "AES-256-XTS",
26 .friendly_name = "AES-256-CTS-CBC",
33 .friendly_name = "AES-128-CBC-ESSIV",
41 .friendly_name = "AES-128-CTS-CBC",
65 if (S_ISREG(inode->i_mode)) in select_encryption_mode()
68 if (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) in select_encryption_mode()
72 inode->i_ino, (inode->i_mode & S_IFMT)); in select_encryption_mode()
73 return ERR_PTR(-EINVAL); in select_encryption_mode()
84 tfm = crypto_alloc_skcipher(mode->cipher_str, 0, 0); in fscrypt_allocate_skcipher()
86 if (PTR_ERR(tfm) == -ENOENT) { in fscrypt_allocate_skcipher()
89 mode->friendly_name, mode->cipher_str); in fscrypt_allocate_skcipher()
90 return ERR_PTR(-ENOPKG); in fscrypt_allocate_skcipher()
93 mode->cipher_str, PTR_ERR(tfm)); in fscrypt_allocate_skcipher()
96 if (!xchg(&mode->logged_impl_name, 1)) { in fscrypt_allocate_skcipher()
100 * performance problems by logging the ->cra_driver_name the in fscrypt_allocate_skcipher()
104 mode->friendly_name, crypto_skcipher_driver_name(tfm)); in fscrypt_allocate_skcipher()
106 if (WARN_ON(crypto_skcipher_ivsize(tfm) != mode->ivsize)) { in fscrypt_allocate_skcipher()
107 err = -EINVAL; in fscrypt_allocate_skcipher()
111 err = crypto_skcipher_setkey(tfm, raw_key, mode->keysize); in fscrypt_allocate_skcipher()
123 * Prepare the crypto transform object or blk-crypto key in @prep_key, given the
125 * (fs-layer or blk-crypto) will be used.
135 tfm = fscrypt_allocate_skcipher(ci->ci_mode, raw_key, ci->ci_inode); in fscrypt_prepare_key()
140 * I.e., here we publish ->tfm with a RELEASE barrier so that in fscrypt_prepare_key()
142 * possible for per-mode keys, not for per-file keys. in fscrypt_prepare_key()
144 smp_store_release(&prep_key->tfm, tfm); in fscrypt_prepare_key()
148 /* Destroy a crypto transform object and/or blk-crypto key. */
151 crypto_free_skcipher(prep_key->tfm); in fscrypt_destroy_prepared_key()
156 /* Given a per-file encryption key, set up the file's crypto transform object */
159 ci->ci_owns_key = true; in fscrypt_set_per_file_enc_key()
160 return fscrypt_prepare_key(&ci->ci_enc_key, raw_key, ci); in fscrypt_set_per_file_enc_key()
165 struct fscrypt_prepared_key *keys, in setup_per_mode_enc_key() argument
168 const struct inode *inode = ci->ci_inode; in setup_per_mode_enc_key()
169 const struct super_block *sb = inode->i_sb; in setup_per_mode_enc_key()
170 struct fscrypt_mode *mode = ci->ci_mode; in setup_per_mode_enc_key()
171 const u8 mode_num = mode - fscrypt_modes; in setup_per_mode_enc_key()
174 u8 hkdf_info[sizeof(mode_num) + sizeof(sb->s_uuid)]; in setup_per_mode_enc_key()
179 return -EINVAL; in setup_per_mode_enc_key()
181 prep_key = &keys[mode_num]; in setup_per_mode_enc_key()
183 ci->ci_enc_key = *prep_key; in setup_per_mode_enc_key()
193 BUILD_BUG_ON(sizeof(sb->s_uuid) != 16); in setup_per_mode_enc_key()
197 memcpy(&hkdf_info[hkdf_infolen], &sb->s_uuid, in setup_per_mode_enc_key()
198 sizeof(sb->s_uuid)); in setup_per_mode_enc_key()
199 hkdf_infolen += sizeof(sb->s_uuid); in setup_per_mode_enc_key()
201 err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, in setup_per_mode_enc_key()
203 mode_key, mode->keysize); in setup_per_mode_enc_key()
207 memzero_explicit(mode_key, mode->keysize); in setup_per_mode_enc_key()
211 ci->ci_enc_key = *prep_key; in setup_per_mode_enc_key()
220 * application-specific information string.
223 * as a pair of 64-bit words. Therefore, on big endian CPUs we have to do an
232 err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, context, info, infolen, in fscrypt_derive_siphash_key()
238 BUILD_BUG_ON(ARRAY_SIZE(key->key) != 2); in fscrypt_derive_siphash_key()
239 le64_to_cpus(&key->key[0]); in fscrypt_derive_siphash_key()
240 le64_to_cpus(&key->key[1]); in fscrypt_derive_siphash_key()
250 ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE, in fscrypt_derive_dirhash_key()
251 &ci->ci_dirhash_key); in fscrypt_derive_dirhash_key()
254 ci->ci_dirhash_key_initialized = true; in fscrypt_derive_dirhash_key()
261 WARN_ON(ci->ci_inode->i_ino == 0); in fscrypt_hash_inode_number()
262 WARN_ON(!mk->mk_ino_hash_key_initialized); in fscrypt_hash_inode_number()
264 ci->ci_hashed_ino = (u32)siphash_1u64(ci->ci_inode->i_ino, in fscrypt_hash_inode_number()
265 &mk->mk_ino_hash_key); in fscrypt_hash_inode_number()
273 err = setup_per_mode_enc_key(ci, mk, mk->mk_iv_ino_lblk_32_keys, in fscrypt_setup_iv_ino_lblk_32_key()
279 if (!smp_load_acquire(&mk->mk_ino_hash_key_initialized)) { in fscrypt_setup_iv_ino_lblk_32_key()
283 if (mk->mk_ino_hash_key_initialized) in fscrypt_setup_iv_ino_lblk_32_key()
284 goto unlock; in fscrypt_setup_iv_ino_lblk_32_key()
288 NULL, 0, &mk->mk_ino_hash_key); in fscrypt_setup_iv_ino_lblk_32_key()
290 goto unlock; in fscrypt_setup_iv_ino_lblk_32_key()
292 smp_store_release(&mk->mk_ino_hash_key_initialized, true); in fscrypt_setup_iv_ino_lblk_32_key()
293 unlock: in fscrypt_setup_iv_ino_lblk_32_key()
303 if (ci->ci_inode->i_ino) in fscrypt_setup_iv_ino_lblk_32_key()
314 if (ci->ci_policy.v2.flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) { in fscrypt_setup_v2_file_key()
316 * DIRECT_KEY: instead of deriving per-file encryption keys, the in fscrypt_setup_v2_file_key()
317 * per-file nonce will be included in all the IVs. But unlike in fscrypt_setup_v2_file_key()
319 * with the master key directly but rather derive a per-mode in fscrypt_setup_v2_file_key()
323 err = setup_per_mode_enc_key(ci, mk, mk->mk_direct_keys, in fscrypt_setup_v2_file_key()
325 } else if (ci->ci_policy.v2.flags & in fscrypt_setup_v2_file_key()
328 * IV_INO_LBLK_64: encryption keys are derived from (master_key, in fscrypt_setup_v2_file_key()
333 err = setup_per_mode_enc_key(ci, mk, mk->mk_iv_ino_lblk_64_keys, in fscrypt_setup_v2_file_key()
336 } else if (ci->ci_policy.v2.flags & in fscrypt_setup_v2_file_key()
342 err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, in fscrypt_setup_v2_file_key()
344 ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE, in fscrypt_setup_v2_file_key()
345 derived_key, ci->ci_mode->keysize); in fscrypt_setup_v2_file_key()
350 memzero_explicit(derived_key, ci->ci_mode->keysize); in fscrypt_setup_v2_file_key()
375 * (but in practice we only need to consider @ci->ci_mode, since any other
377 * required key size over @ci->ci_mode). This allows AES-256-XTS keys to be
378 * derived from a 256-bit master key, which is cryptographically sufficient,
379 * rather than requiring a 512-bit master key which is unnecessarily long. (We
380 * still allow 512-bit master keys if the user chooses to use them, though.)
387 if (ci->ci_policy.version == FSCRYPT_POLICY_V1) in fscrypt_valid_master_key_size()
388 min_keysize = ci->ci_mode->keysize; in fscrypt_valid_master_key_size()
390 min_keysize = ci->ci_mode->security_strength; in fscrypt_valid_master_key_size()
392 if (mk->mk_secret.size < min_keysize) { in fscrypt_valid_master_key_size()
395 master_key_spec_type(&mk->mk_spec), in fscrypt_valid_master_key_size()
396 master_key_spec_len(&mk->mk_spec), in fscrypt_valid_master_key_size()
397 (u8 *)&mk->mk_spec.u, in fscrypt_valid_master_key_size()
398 mk->mk_secret.size, min_keysize); in fscrypt_valid_master_key_size()
407 * If the master key is found in the filesystem-level keyring, then it is
408 * returned in *mk_ret with its semaphore read-locked. This is needed to ensure
409 * that only one task links the fscrypt_info into ->mk_decrypted_inodes (as
425 switch (ci->ci_policy.version) { in setup_file_encryption_key()
429 ci->ci_policy.v1.master_key_descriptor, in setup_file_encryption_key()
435 ci->ci_policy.v2.master_key_identifier, in setup_file_encryption_key()
440 return -EINVAL; in setup_file_encryption_key()
443 mk = fscrypt_find_master_key(ci->ci_inode->i_sb, &mk_spec); in setup_file_encryption_key()
445 if (ci->ci_policy.version != FSCRYPT_POLICY_V1) in setup_file_encryption_key()
446 return -ENOKEY; in setup_file_encryption_key()
451 * to before the search of ->s_master_keys, since users in setup_file_encryption_key()
452 * shouldn't be able to override filesystem-level keys. in setup_file_encryption_key()
456 down_read(&mk->mk_sem); in setup_file_encryption_key()
459 if (!is_master_key_secret_present(&mk->mk_secret)) { in setup_file_encryption_key()
460 err = -ENOKEY; in setup_file_encryption_key()
465 err = -ENOKEY; in setup_file_encryption_key()
469 switch (ci->ci_policy.version) { in setup_file_encryption_key()
471 err = fscrypt_setup_v1_file_key(ci, mk->mk_secret.raw); in setup_file_encryption_key()
478 err = -EINVAL; in setup_file_encryption_key()
488 up_read(&mk->mk_sem); in setup_file_encryption_key()
500 if (ci->ci_direct_key) in put_crypt_info()
501 fscrypt_put_direct_key(ci->ci_direct_key); in put_crypt_info()
502 else if (ci->ci_owns_key) in put_crypt_info()
503 fscrypt_destroy_prepared_key(&ci->ci_enc_key); in put_crypt_info()
505 mk = ci->ci_master_key; in put_crypt_info()
513 spin_lock(&mk->mk_decrypted_inodes_lock); in put_crypt_info()
514 list_del(&ci->ci_master_key_link); in put_crypt_info()
515 spin_unlock(&mk->mk_decrypted_inodes_lock); in put_crypt_info()
533 res = fscrypt_initialize(inode->i_sb->s_cop->flags); in fscrypt_setup_encryption_info()
539 return -ENOMEM; in fscrypt_setup_encryption_info()
541 crypt_info->ci_inode = inode; in fscrypt_setup_encryption_info()
542 crypt_info->ci_policy = *policy; in fscrypt_setup_encryption_info()
543 memcpy(crypt_info->ci_nonce, nonce, FSCRYPT_FILE_NONCE_SIZE); in fscrypt_setup_encryption_info()
545 mode = select_encryption_mode(&crypt_info->ci_policy, inode); in fscrypt_setup_encryption_info()
550 WARN_ON(mode->ivsize > FSCRYPT_MAX_IV_SIZE); in fscrypt_setup_encryption_info()
551 crypt_info->ci_mode = mode; in fscrypt_setup_encryption_info()
558 * For existing inodes, multiple tasks may race to set ->i_crypt_info. in fscrypt_setup_encryption_info()
560 * fscrypt_get_info(). I.e., here we publish ->i_crypt_info with a in fscrypt_setup_encryption_info()
563 if (cmpxchg_release(&inode->i_crypt_info, NULL, crypt_info) == NULL) { in fscrypt_setup_encryption_info()
565 * We won the race and set ->i_crypt_info to our crypt_info. in fscrypt_setup_encryption_info()
569 crypt_info->ci_master_key = mk; in fscrypt_setup_encryption_info()
570 refcount_inc(&mk->mk_active_refs); in fscrypt_setup_encryption_info()
571 spin_lock(&mk->mk_decrypted_inodes_lock); in fscrypt_setup_encryption_info()
572 list_add(&crypt_info->ci_master_key_link, in fscrypt_setup_encryption_info()
573 &mk->mk_decrypted_inodes); in fscrypt_setup_encryption_info()
574 spin_unlock(&mk->mk_decrypted_inodes_lock); in fscrypt_setup_encryption_info()
581 up_read(&mk->mk_sem); in fscrypt_setup_encryption_info()
589 * fscrypt_get_encryption_info() - set up an inode's encryption key
592 * Set up ->i_crypt_info, if it hasn't already been done.
594 * Note: unless ->i_crypt_info is already set, this isn't %GFP_NOFS-safe. So
597 * Return: 0 if ->i_crypt_info was set or was already set, *or* if the
599 * distinguish these cases.) Also can return another -errno code.
610 res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx)); in fscrypt_get_encryption_info()
624 return -EINVAL; in fscrypt_get_encryption_info()
629 S_ISDIR(inode->i_mode)); in fscrypt_get_encryption_info()
630 if (res == -ENOKEY) in fscrypt_get_encryption_info()
637 * fscrypt_prepare_new_inode() - prepare to create a new inode in a directory
638 * @dir: a possibly-encrypted directory
639 * @inode: the new inode. ->i_mode must be set already.
640 * ->i_ino doesn't need to be set yet.
643 * If the directory is encrypted, set up its ->i_crypt_info in preparation for
645 * encrypted, set up its ->i_crypt_info and set *encrypt_ret=true.
647 * This isn't %GFP_NOFS-safe, and therefore it should be called before starting
648 * any filesystem transaction to create the inode. For this reason, ->i_ino
654 * Return: 0 on success, -ENOKEY if the encryption key is missing, or another
655 * -errno code
669 if (WARN_ON_ONCE(inode->i_mode == 0)) in fscrypt_prepare_new_inode()
670 return -EINVAL; in fscrypt_prepare_new_inode()
676 if (!S_ISREG(inode->i_mode) && in fscrypt_prepare_new_inode()
677 !S_ISDIR(inode->i_mode) && in fscrypt_prepare_new_inode()
678 !S_ISLNK(inode->i_mode)) in fscrypt_prepare_new_inode()
686 S_ISDIR(inode->i_mode)); in fscrypt_prepare_new_inode()
691 * fscrypt_put_encryption_info() - free most of an inode's fscrypt data
699 put_crypt_info(inode->i_crypt_info); in fscrypt_put_encryption_info()
700 inode->i_crypt_info = NULL; in fscrypt_put_encryption_info()
705 * fscrypt_free_inode() - free an inode's fscrypt data requiring RCU delay
713 if (IS_ENCRYPTED(inode) && S_ISLNK(inode->i_mode)) { in fscrypt_free_inode()
714 kfree(inode->i_link); in fscrypt_free_inode()
715 inode->i_link = NULL; in fscrypt_free_inode()
721 * fscrypt_drop_inode() - check whether the inode's master key has been removed
724 * Filesystems supporting fscrypt must call this from their ->drop_inode()
737 * was provided via the legacy mechanism of the process-subscribed in fscrypt_drop_inode()
740 if (!ci || !ci->ci_master_key) in fscrypt_drop_inode()
744 * With proper, non-racy use of FS_IOC_REMOVE_ENCRYPTION_KEY, all inodes in fscrypt_drop_inode()
749 if (inode->i_state & I_DIRTY_ALL) in fscrypt_drop_inode()
760 return !is_master_key_secret_present(&ci->ci_master_key->mk_secret); in fscrypt_drop_inode()