Lines Matching +full:unlock +full:- +full:keys
1 // SPDX-License-Identifier: GPL-2.0
18 .friendly_name = "AES-256-XTS",
26 .friendly_name = "AES-256-CTS-CBC",
33 .friendly_name = "AES-128-CBC-ESSIV",
41 .friendly_name = "AES-128-CTS-CBC",
48 .friendly_name = "SM4-XTS",
56 .friendly_name = "SM4-CTS-CBC",
71 .friendly_name = "AES-256-HCTR2",
87 if (S_ISREG(inode->i_mode)) in select_encryption_mode()
90 if (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) in select_encryption_mode()
94 inode->i_ino, (inode->i_mode & S_IFMT)); in select_encryption_mode()
95 return ERR_PTR(-EINVAL); in select_encryption_mode()
106 tfm = crypto_alloc_skcipher(mode->cipher_str, 0, 0); in fscrypt_allocate_skcipher()
108 if (PTR_ERR(tfm) == -ENOENT) { in fscrypt_allocate_skcipher()
111 mode->friendly_name, mode->cipher_str); in fscrypt_allocate_skcipher()
112 return ERR_PTR(-ENOPKG); in fscrypt_allocate_skcipher()
115 mode->cipher_str, PTR_ERR(tfm)); in fscrypt_allocate_skcipher()
118 if (!xchg(&mode->logged_cryptoapi_impl, 1)) { in fscrypt_allocate_skcipher()
122 * performance problems by logging the ->cra_driver_name the in fscrypt_allocate_skcipher()
126 mode->friendly_name, crypto_skcipher_driver_name(tfm)); in fscrypt_allocate_skcipher()
128 if (WARN_ON_ONCE(crypto_skcipher_ivsize(tfm) != mode->ivsize)) { in fscrypt_allocate_skcipher()
129 err = -EINVAL; in fscrypt_allocate_skcipher()
133 err = crypto_skcipher_setkey(tfm, raw_key, mode->keysize); in fscrypt_allocate_skcipher()
145 * Prepare the crypto transform object or blk-crypto key in @prep_key, given the
146 * raw key, encryption mode (@ci->ci_mode), flag indicating which encryption
147 * implementation (fs-layer or blk-crypto) will be used (@ci->ci_inlinecrypt),
148 * and IV generation method (@ci->ci_policy.flags).
158 tfm = fscrypt_allocate_skcipher(ci->ci_mode, raw_key, ci->ci_inode); in fscrypt_prepare_key()
163 * I.e., here we publish ->tfm with a RELEASE barrier so that in fscrypt_prepare_key()
165 * possible for per-mode keys, not for per-file keys. in fscrypt_prepare_key()
167 smp_store_release(&prep_key->tfm, tfm); in fscrypt_prepare_key()
171 /* Destroy a crypto transform object and/or blk-crypto key. */
175 crypto_free_skcipher(prep_key->tfm); in fscrypt_destroy_prepared_key()
180 /* Given a per-file encryption key, set up the file's crypto transform object */
183 ci->ci_owns_key = true; in fscrypt_set_per_file_enc_key()
184 return fscrypt_prepare_key(&ci->ci_enc_key, raw_key, ci); in fscrypt_set_per_file_enc_key()
189 struct fscrypt_prepared_key *keys, in setup_per_mode_enc_key() argument
192 const struct inode *inode = ci->ci_inode; in setup_per_mode_enc_key()
193 const struct super_block *sb = inode->i_sb; in setup_per_mode_enc_key()
194 struct fscrypt_mode *mode = ci->ci_mode; in setup_per_mode_enc_key()
195 const u8 mode_num = mode - fscrypt_modes; in setup_per_mode_enc_key()
198 u8 hkdf_info[sizeof(mode_num) + sizeof(sb->s_uuid)]; in setup_per_mode_enc_key()
203 return -EINVAL; in setup_per_mode_enc_key()
205 prep_key = &keys[mode_num]; in setup_per_mode_enc_key()
207 ci->ci_enc_key = *prep_key; in setup_per_mode_enc_key()
217 BUILD_BUG_ON(sizeof(sb->s_uuid) != 16); in setup_per_mode_enc_key()
221 memcpy(&hkdf_info[hkdf_infolen], &sb->s_uuid, in setup_per_mode_enc_key()
222 sizeof(sb->s_uuid)); in setup_per_mode_enc_key()
223 hkdf_infolen += sizeof(sb->s_uuid); in setup_per_mode_enc_key()
225 err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, in setup_per_mode_enc_key()
227 mode_key, mode->keysize); in setup_per_mode_enc_key()
231 memzero_explicit(mode_key, mode->keysize); in setup_per_mode_enc_key()
235 ci->ci_enc_key = *prep_key; in setup_per_mode_enc_key()
244 * application-specific information string.
247 * as a pair of 64-bit words. Therefore, on big endian CPUs we have to do an
256 err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, context, info, infolen, in fscrypt_derive_siphash_key()
262 BUILD_BUG_ON(ARRAY_SIZE(key->key) != 2); in fscrypt_derive_siphash_key()
263 le64_to_cpus(&key->key[0]); in fscrypt_derive_siphash_key()
264 le64_to_cpus(&key->key[1]); in fscrypt_derive_siphash_key()
274 ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE, in fscrypt_derive_dirhash_key()
275 &ci->ci_dirhash_key); in fscrypt_derive_dirhash_key()
278 ci->ci_dirhash_key_initialized = true; in fscrypt_derive_dirhash_key()
285 WARN_ON_ONCE(ci->ci_inode->i_ino == 0); in fscrypt_hash_inode_number()
286 WARN_ON_ONCE(!mk->mk_ino_hash_key_initialized); in fscrypt_hash_inode_number()
288 ci->ci_hashed_ino = (u32)siphash_1u64(ci->ci_inode->i_ino, in fscrypt_hash_inode_number()
289 &mk->mk_ino_hash_key); in fscrypt_hash_inode_number()
297 err = setup_per_mode_enc_key(ci, mk, mk->mk_iv_ino_lblk_32_keys, in fscrypt_setup_iv_ino_lblk_32_key()
303 if (!smp_load_acquire(&mk->mk_ino_hash_key_initialized)) { in fscrypt_setup_iv_ino_lblk_32_key()
307 if (mk->mk_ino_hash_key_initialized) in fscrypt_setup_iv_ino_lblk_32_key()
308 goto unlock; in fscrypt_setup_iv_ino_lblk_32_key()
312 NULL, 0, &mk->mk_ino_hash_key); in fscrypt_setup_iv_ino_lblk_32_key()
314 goto unlock; in fscrypt_setup_iv_ino_lblk_32_key()
316 smp_store_release(&mk->mk_ino_hash_key_initialized, true); in fscrypt_setup_iv_ino_lblk_32_key()
317 unlock: in fscrypt_setup_iv_ino_lblk_32_key()
327 if (ci->ci_inode->i_ino) in fscrypt_setup_iv_ino_lblk_32_key()
338 if (ci->ci_policy.v2.flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) { in fscrypt_setup_v2_file_key()
340 * DIRECT_KEY: instead of deriving per-file encryption keys, the in fscrypt_setup_v2_file_key()
341 * per-file nonce will be included in all the IVs. But unlike in fscrypt_setup_v2_file_key()
343 * with the master key directly but rather derive a per-mode in fscrypt_setup_v2_file_key()
347 err = setup_per_mode_enc_key(ci, mk, mk->mk_direct_keys, in fscrypt_setup_v2_file_key()
349 } else if (ci->ci_policy.v2.flags & in fscrypt_setup_v2_file_key()
352 * IV_INO_LBLK_64: encryption keys are derived from (master_key, in fscrypt_setup_v2_file_key()
357 err = setup_per_mode_enc_key(ci, mk, mk->mk_iv_ino_lblk_64_keys, in fscrypt_setup_v2_file_key()
360 } else if (ci->ci_policy.v2.flags & in fscrypt_setup_v2_file_key()
366 err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, in fscrypt_setup_v2_file_key()
368 ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE, in fscrypt_setup_v2_file_key()
369 derived_key, ci->ci_mode->keysize); in fscrypt_setup_v2_file_key()
374 memzero_explicit(derived_key, ci->ci_mode->keysize); in fscrypt_setup_v2_file_key()
399 * (but in practice we only need to consider @ci->ci_mode, since any other
401 * required key size over @ci->ci_mode). This allows AES-256-XTS keys to be
402 * derived from a 256-bit master key, which is cryptographically sufficient,
403 * rather than requiring a 512-bit master key which is unnecessarily long. (We
404 * still allow 512-bit master keys if the user chooses to use them, though.)
411 if (ci->ci_policy.version == FSCRYPT_POLICY_V1) in fscrypt_valid_master_key_size()
412 min_keysize = ci->ci_mode->keysize; in fscrypt_valid_master_key_size()
414 min_keysize = ci->ci_mode->security_strength; in fscrypt_valid_master_key_size()
416 if (mk->mk_secret.size < min_keysize) { in fscrypt_valid_master_key_size()
419 master_key_spec_type(&mk->mk_spec), in fscrypt_valid_master_key_size()
420 master_key_spec_len(&mk->mk_spec), in fscrypt_valid_master_key_size()
421 (u8 *)&mk->mk_spec.u, in fscrypt_valid_master_key_size()
422 mk->mk_secret.size, min_keysize); in fscrypt_valid_master_key_size()
431 * If the master key is found in the filesystem-level keyring, then it is
432 * returned in *mk_ret with its semaphore read-locked. This is needed to ensure
433 * that only one task links the fscrypt_info into ->mk_decrypted_inodes (as
441 struct super_block *sb = ci->ci_inode->i_sb; in setup_file_encryption_key()
450 err = fscrypt_policy_to_key_spec(&ci->ci_policy, &mk_spec); in setup_file_encryption_key()
460 * Add the test_dummy_encryption key on-demand. In principle, in setup_file_encryption_key()
466 fscrypt_policies_equal(dummy_policy, &ci->ci_policy)) { in setup_file_encryption_key()
474 if (ci->ci_policy.version != FSCRYPT_POLICY_V1) in setup_file_encryption_key()
475 return -ENOKEY; in setup_file_encryption_key()
480 * to before the search of ->s_master_keys, since users in setup_file_encryption_key()
481 * shouldn't be able to override filesystem-level keys. in setup_file_encryption_key()
485 down_read(&mk->mk_sem); in setup_file_encryption_key()
488 if (!is_master_key_secret_present(&mk->mk_secret)) { in setup_file_encryption_key()
489 err = -ENOKEY; in setup_file_encryption_key()
494 err = -ENOKEY; in setup_file_encryption_key()
498 switch (ci->ci_policy.version) { in setup_file_encryption_key()
500 err = fscrypt_setup_v1_file_key(ci, mk->mk_secret.raw); in setup_file_encryption_key()
507 err = -EINVAL; in setup_file_encryption_key()
517 up_read(&mk->mk_sem); in setup_file_encryption_key()
529 if (ci->ci_direct_key) in put_crypt_info()
530 fscrypt_put_direct_key(ci->ci_direct_key); in put_crypt_info()
531 else if (ci->ci_owns_key) in put_crypt_info()
532 fscrypt_destroy_prepared_key(ci->ci_inode->i_sb, in put_crypt_info()
533 &ci->ci_enc_key); in put_crypt_info()
535 mk = ci->ci_master_key; in put_crypt_info()
543 spin_lock(&mk->mk_decrypted_inodes_lock); in put_crypt_info()
544 list_del(&ci->ci_master_key_link); in put_crypt_info()
545 spin_unlock(&mk->mk_decrypted_inodes_lock); in put_crypt_info()
546 fscrypt_put_master_key_activeref(ci->ci_inode->i_sb, mk); in put_crypt_info()
563 res = fscrypt_initialize(inode->i_sb); in fscrypt_setup_encryption_info()
569 return -ENOMEM; in fscrypt_setup_encryption_info()
571 crypt_info->ci_inode = inode; in fscrypt_setup_encryption_info()
572 crypt_info->ci_policy = *policy; in fscrypt_setup_encryption_info()
573 memcpy(crypt_info->ci_nonce, nonce, FSCRYPT_FILE_NONCE_SIZE); in fscrypt_setup_encryption_info()
575 mode = select_encryption_mode(&crypt_info->ci_policy, inode); in fscrypt_setup_encryption_info()
580 WARN_ON_ONCE(mode->ivsize > FSCRYPT_MAX_IV_SIZE); in fscrypt_setup_encryption_info()
581 crypt_info->ci_mode = mode; in fscrypt_setup_encryption_info()
588 * For existing inodes, multiple tasks may race to set ->i_crypt_info. in fscrypt_setup_encryption_info()
590 * fscrypt_get_info(). I.e., here we publish ->i_crypt_info with a in fscrypt_setup_encryption_info()
593 if (cmpxchg_release(&inode->i_crypt_info, NULL, crypt_info) == NULL) { in fscrypt_setup_encryption_info()
595 * We won the race and set ->i_crypt_info to our crypt_info. in fscrypt_setup_encryption_info()
599 crypt_info->ci_master_key = mk; in fscrypt_setup_encryption_info()
600 refcount_inc(&mk->mk_active_refs); in fscrypt_setup_encryption_info()
601 spin_lock(&mk->mk_decrypted_inodes_lock); in fscrypt_setup_encryption_info()
602 list_add(&crypt_info->ci_master_key_link, in fscrypt_setup_encryption_info()
603 &mk->mk_decrypted_inodes); in fscrypt_setup_encryption_info()
604 spin_unlock(&mk->mk_decrypted_inodes_lock); in fscrypt_setup_encryption_info()
611 up_read(&mk->mk_sem); in fscrypt_setup_encryption_info()
619 * fscrypt_get_encryption_info() - set up an inode's encryption key
627 * Set up ->i_crypt_info, if it hasn't already been done.
629 * Note: unless ->i_crypt_info is already set, this isn't %GFP_NOFS-safe. So
632 * Return: 0 if ->i_crypt_info was set or was already set, *or* if the
634 * distinguish these cases.) Also can return another -errno code.
645 res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx)); in fscrypt_get_encryption_info()
647 if (res == -ERANGE && allow_unsupported) in fscrypt_get_encryption_info()
665 return -EINVAL; in fscrypt_get_encryption_info()
671 S_ISDIR(inode->i_mode)); in fscrypt_get_encryption_info()
673 if (res == -ENOPKG && allow_unsupported) /* Algorithm unavailable? */ in fscrypt_get_encryption_info()
675 if (res == -ENOKEY) in fscrypt_get_encryption_info()
681 * fscrypt_prepare_new_inode() - prepare to create a new inode in a directory
682 * @dir: a possibly-encrypted directory
683 * @inode: the new inode. ->i_mode must be set already.
684 * ->i_ino doesn't need to be set yet.
687 * If the directory is encrypted, set up its ->i_crypt_info in preparation for
689 * encrypted, set up its ->i_crypt_info and set *encrypt_ret=true.
691 * This isn't %GFP_NOFS-safe, and therefore it should be called before starting
692 * any filesystem transaction to create the inode. For this reason, ->i_ino
698 * Return: 0 on success, -ENOKEY if the encryption key is missing, or another
699 * -errno code
713 if (WARN_ON_ONCE(inode->i_mode == 0)) in fscrypt_prepare_new_inode()
714 return -EINVAL; in fscrypt_prepare_new_inode()
720 if (!S_ISREG(inode->i_mode) && in fscrypt_prepare_new_inode()
721 !S_ISDIR(inode->i_mode) && in fscrypt_prepare_new_inode()
722 !S_ISLNK(inode->i_mode)) in fscrypt_prepare_new_inode()
730 S_ISDIR(inode->i_mode)); in fscrypt_prepare_new_inode()
735 * fscrypt_put_encryption_info() - free most of an inode's fscrypt data
743 put_crypt_info(inode->i_crypt_info); in fscrypt_put_encryption_info()
744 inode->i_crypt_info = NULL; in fscrypt_put_encryption_info()
749 * fscrypt_free_inode() - free an inode's fscrypt data requiring RCU delay
757 if (IS_ENCRYPTED(inode) && S_ISLNK(inode->i_mode)) { in fscrypt_free_inode()
758 kfree(inode->i_link); in fscrypt_free_inode()
759 inode->i_link = NULL; in fscrypt_free_inode()
765 * fscrypt_drop_inode() - check whether the inode's master key has been removed
768 * Filesystems supporting fscrypt must call this from their ->drop_inode()
781 * was provided via the legacy mechanism of the process-subscribed in fscrypt_drop_inode()
784 if (!ci || !ci->ci_master_key) in fscrypt_drop_inode()
788 * With proper, non-racy use of FS_IOC_REMOVE_ENCRYPTION_KEY, all inodes in fscrypt_drop_inode()
793 if (inode->i_state & I_DIRTY_ALL) in fscrypt_drop_inode()
804 return !is_master_key_secret_present(&ci->ci_master_key->mk_secret); in fscrypt_drop_inode()