policy.c (66da65005aa819e0b8d3a08f5ec1491b7690cb67) | policy.c (6b2a51ff03bf0c54cbc699ee85a9a49eb203ebfc) |
---|---|
1// SPDX-License-Identifier: GPL-2.0 2/* 3 * Encryption policy functions for per-file encryption support. 4 * 5 * Copyright (C) 2015, Google, Inc. 6 * Copyright (C) 2015, Motorola Mobility. 7 * 8 * Originally written by Michael Halcrow, 2015. 9 * Modified by Jaegeuk Kim, 2015. 10 * Modified by Eric Biggers, 2019 for v2 policy support. 11 */ 12 13#include <linux/fs_context.h> 14#include <linux/random.h> 15#include <linux/seq_file.h> 16#include <linux/string.h> 17#include <linux/mount.h> 18#include "fscrypt_private.h" 19 20/** 21 * fscrypt_policies_equal() - check whether two encryption policies are the same 22 * @policy1: the first policy 23 * @policy2: the second policy 24 * 25 * Return: %true if equal, else %false 26 */ 27bool fscrypt_policies_equal(const union fscrypt_policy *policy1, 28 const union fscrypt_policy *policy2) 29{ 30 if (policy1->version != policy2->version) 31 return false; 32 33 return !memcmp(policy1, policy2, fscrypt_policy_size(policy1)); 34} 35 36int fscrypt_policy_to_key_spec(const union fscrypt_policy *policy, 37 struct fscrypt_key_specifier *key_spec) 38{ 39 switch (policy->version) { 40 case FSCRYPT_POLICY_V1: 41 key_spec->type = FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR; 42 memcpy(key_spec->u.descriptor, policy->v1.master_key_descriptor, 43 FSCRYPT_KEY_DESCRIPTOR_SIZE); 44 return 0; 45 case FSCRYPT_POLICY_V2: 46 key_spec->type = FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER; 47 memcpy(key_spec->u.identifier, policy->v2.master_key_identifier, 48 FSCRYPT_KEY_IDENTIFIER_SIZE); 49 return 0; 50 default: 51 WARN_ON(1); 52 return -EINVAL; 53 } 54} 55 56static const union fscrypt_policy * 57fscrypt_get_dummy_policy(struct super_block *sb) 58{ 59 if (!sb->s_cop->get_dummy_policy) 60 return NULL; 61 return sb->s_cop->get_dummy_policy(sb); 62} 63 | 1// SPDX-License-Identifier: GPL-2.0 2/* 3 * Encryption policy functions for per-file encryption support. 4 * 5 * Copyright (C) 2015, Google, Inc. 6 * Copyright (C) 2015, Motorola Mobility. 7 * 8 * Originally written by Michael Halcrow, 2015. 9 * Modified by Jaegeuk Kim, 2015. 10 * Modified by Eric Biggers, 2019 for v2 policy support. 11 */ 12 13#include <linux/fs_context.h> 14#include <linux/random.h> 15#include <linux/seq_file.h> 16#include <linux/string.h> 17#include <linux/mount.h> 18#include "fscrypt_private.h" 19 20/** 21 * fscrypt_policies_equal() - check whether two encryption policies are the same 22 * @policy1: the first policy 23 * @policy2: the second policy 24 * 25 * Return: %true if equal, else %false 26 */ 27bool fscrypt_policies_equal(const union fscrypt_policy *policy1, 28 const union fscrypt_policy *policy2) 29{ 30 if (policy1->version != policy2->version) 31 return false; 32 33 return !memcmp(policy1, policy2, fscrypt_policy_size(policy1)); 34} 35 36int fscrypt_policy_to_key_spec(const union fscrypt_policy *policy, 37 struct fscrypt_key_specifier *key_spec) 38{ 39 switch (policy->version) { 40 case FSCRYPT_POLICY_V1: 41 key_spec->type = FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR; 42 memcpy(key_spec->u.descriptor, policy->v1.master_key_descriptor, 43 FSCRYPT_KEY_DESCRIPTOR_SIZE); 44 return 0; 45 case FSCRYPT_POLICY_V2: 46 key_spec->type = FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER; 47 memcpy(key_spec->u.identifier, policy->v2.master_key_identifier, 48 FSCRYPT_KEY_IDENTIFIER_SIZE); 49 return 0; 50 default: 51 WARN_ON(1); 52 return -EINVAL; 53 } 54} 55 56static const union fscrypt_policy * 57fscrypt_get_dummy_policy(struct super_block *sb) 58{ 59 if (!sb->s_cop->get_dummy_policy) 60 return NULL; 61 return sb->s_cop->get_dummy_policy(sb); 62} 63 |
64static bool fscrypt_valid_enc_modes(u32 contents_mode, u32 filenames_mode) | 64static bool fscrypt_valid_enc_modes_v1(u32 contents_mode, u32 filenames_mode) |
65{ 66 if (contents_mode == FSCRYPT_MODE_AES_256_XTS && 67 filenames_mode == FSCRYPT_MODE_AES_256_CTS) 68 return true; 69 70 if (contents_mode == FSCRYPT_MODE_AES_128_CBC && 71 filenames_mode == FSCRYPT_MODE_AES_128_CTS) 72 return true; 73 74 if (contents_mode == FSCRYPT_MODE_ADIANTUM && 75 filenames_mode == FSCRYPT_MODE_ADIANTUM) 76 return true; 77 78 return false; 79} 80 | 65{ 66 if (contents_mode == FSCRYPT_MODE_AES_256_XTS && 67 filenames_mode == FSCRYPT_MODE_AES_256_CTS) 68 return true; 69 70 if (contents_mode == FSCRYPT_MODE_AES_128_CBC && 71 filenames_mode == FSCRYPT_MODE_AES_128_CTS) 72 return true; 73 74 if (contents_mode == FSCRYPT_MODE_ADIANTUM && 75 filenames_mode == FSCRYPT_MODE_ADIANTUM) 76 return true; 77 78 return false; 79} 80 |
81static bool fscrypt_valid_enc_modes_v2(u32 contents_mode, u32 filenames_mode) 82{ 83 if (contents_mode == FSCRYPT_MODE_AES_256_XTS && 84 filenames_mode == FSCRYPT_MODE_AES_256_HCTR2) 85 return true; 86 return fscrypt_valid_enc_modes_v1(contents_mode, filenames_mode); 87} 88 |
|
81static bool supported_direct_key_modes(const struct inode *inode, 82 u32 contents_mode, u32 filenames_mode) 83{ 84 const struct fscrypt_mode *mode; 85 86 if (contents_mode != filenames_mode) { 87 fscrypt_warn(inode, 88 "Direct key flag not allowed with different contents and filenames modes"); 89 return false; 90 } 91 mode = &fscrypt_modes[contents_mode]; 92 93 if (mode->ivsize < offsetofend(union fscrypt_iv, nonce)) { 94 fscrypt_warn(inode, "Direct key flag not allowed with %s", 95 mode->friendly_name); 96 return false; 97 } 98 return true; 99} 100 101static bool supported_iv_ino_lblk_policy(const struct fscrypt_policy_v2 *policy, 102 const struct inode *inode, 103 const char *type, 104 int max_ino_bits, int max_lblk_bits) 105{ 106 struct super_block *sb = inode->i_sb; 107 int ino_bits = 64, lblk_bits = 64; 108 109 /* 110 * IV_INO_LBLK_* exist only because of hardware limitations, and 111 * currently the only known use case for them involves AES-256-XTS. 112 * That's also all we test currently. For these reasons, for now only 113 * allow AES-256-XTS here. This can be relaxed later if a use case for 114 * IV_INO_LBLK_* with other encryption modes arises. 115 */ 116 if (policy->contents_encryption_mode != FSCRYPT_MODE_AES_256_XTS) { 117 fscrypt_warn(inode, 118 "Can't use %s policy with contents mode other than AES-256-XTS", 119 type); 120 return false; 121 } 122 123 /* 124 * It's unsafe to include inode numbers in the IVs if the filesystem can 125 * potentially renumber inodes, e.g. via filesystem shrinking. 126 */ 127 if (!sb->s_cop->has_stable_inodes || 128 !sb->s_cop->has_stable_inodes(sb)) { 129 fscrypt_warn(inode, 130 "Can't use %s policy on filesystem '%s' because it doesn't have stable inode numbers", 131 type, sb->s_id); 132 return false; 133 } 134 if (sb->s_cop->get_ino_and_lblk_bits) 135 sb->s_cop->get_ino_and_lblk_bits(sb, &ino_bits, &lblk_bits); 136 if (ino_bits > max_ino_bits) { 137 fscrypt_warn(inode, 138 "Can't use %s policy on filesystem '%s' because its inode numbers are too long", 139 type, sb->s_id); 140 return false; 141 } 142 if (lblk_bits > max_lblk_bits) { 143 fscrypt_warn(inode, 144 "Can't use %s policy on filesystem '%s' because its block numbers are too long", 145 type, sb->s_id); 146 return false; 147 } 148 return true; 149} 150 151static bool fscrypt_supported_v1_policy(const struct fscrypt_policy_v1 *policy, 152 const struct inode *inode) 153{ | 89static bool supported_direct_key_modes(const struct inode *inode, 90 u32 contents_mode, u32 filenames_mode) 91{ 92 const struct fscrypt_mode *mode; 93 94 if (contents_mode != filenames_mode) { 95 fscrypt_warn(inode, 96 "Direct key flag not allowed with different contents and filenames modes"); 97 return false; 98 } 99 mode = &fscrypt_modes[contents_mode]; 100 101 if (mode->ivsize < offsetofend(union fscrypt_iv, nonce)) { 102 fscrypt_warn(inode, "Direct key flag not allowed with %s", 103 mode->friendly_name); 104 return false; 105 } 106 return true; 107} 108 109static bool supported_iv_ino_lblk_policy(const struct fscrypt_policy_v2 *policy, 110 const struct inode *inode, 111 const char *type, 112 int max_ino_bits, int max_lblk_bits) 113{ 114 struct super_block *sb = inode->i_sb; 115 int ino_bits = 64, lblk_bits = 64; 116 117 /* 118 * IV_INO_LBLK_* exist only because of hardware limitations, and 119 * currently the only known use case for them involves AES-256-XTS. 120 * That's also all we test currently. For these reasons, for now only 121 * allow AES-256-XTS here. This can be relaxed later if a use case for 122 * IV_INO_LBLK_* with other encryption modes arises. 123 */ 124 if (policy->contents_encryption_mode != FSCRYPT_MODE_AES_256_XTS) { 125 fscrypt_warn(inode, 126 "Can't use %s policy with contents mode other than AES-256-XTS", 127 type); 128 return false; 129 } 130 131 /* 132 * It's unsafe to include inode numbers in the IVs if the filesystem can 133 * potentially renumber inodes, e.g. via filesystem shrinking. 134 */ 135 if (!sb->s_cop->has_stable_inodes || 136 !sb->s_cop->has_stable_inodes(sb)) { 137 fscrypt_warn(inode, 138 "Can't use %s policy on filesystem '%s' because it doesn't have stable inode numbers", 139 type, sb->s_id); 140 return false; 141 } 142 if (sb->s_cop->get_ino_and_lblk_bits) 143 sb->s_cop->get_ino_and_lblk_bits(sb, &ino_bits, &lblk_bits); 144 if (ino_bits > max_ino_bits) { 145 fscrypt_warn(inode, 146 "Can't use %s policy on filesystem '%s' because its inode numbers are too long", 147 type, sb->s_id); 148 return false; 149 } 150 if (lblk_bits > max_lblk_bits) { 151 fscrypt_warn(inode, 152 "Can't use %s policy on filesystem '%s' because its block numbers are too long", 153 type, sb->s_id); 154 return false; 155 } 156 return true; 157} 158 159static bool fscrypt_supported_v1_policy(const struct fscrypt_policy_v1 *policy, 160 const struct inode *inode) 161{ |
154 if (!fscrypt_valid_enc_modes(policy->contents_encryption_mode, | 162 if (!fscrypt_valid_enc_modes_v1(policy->contents_encryption_mode, |
155 policy->filenames_encryption_mode)) { 156 fscrypt_warn(inode, 157 "Unsupported encryption modes (contents %d, filenames %d)", 158 policy->contents_encryption_mode, 159 policy->filenames_encryption_mode); 160 return false; 161 } 162 163 if (policy->flags & ~(FSCRYPT_POLICY_FLAGS_PAD_MASK | 164 FSCRYPT_POLICY_FLAG_DIRECT_KEY)) { 165 fscrypt_warn(inode, "Unsupported encryption flags (0x%02x)", 166 policy->flags); 167 return false; 168 } 169 170 if ((policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) && 171 !supported_direct_key_modes(inode, policy->contents_encryption_mode, 172 policy->filenames_encryption_mode)) 173 return false; 174 175 if (IS_CASEFOLDED(inode)) { 176 /* With v1, there's no way to derive dirhash keys. */ 177 fscrypt_warn(inode, 178 "v1 policies can't be used on casefolded directories"); 179 return false; 180 } 181 182 return true; 183} 184 185static bool fscrypt_supported_v2_policy(const struct fscrypt_policy_v2 *policy, 186 const struct inode *inode) 187{ 188 int count = 0; 189 | 163 policy->filenames_encryption_mode)) { 164 fscrypt_warn(inode, 165 "Unsupported encryption modes (contents %d, filenames %d)", 166 policy->contents_encryption_mode, 167 policy->filenames_encryption_mode); 168 return false; 169 } 170 171 if (policy->flags & ~(FSCRYPT_POLICY_FLAGS_PAD_MASK | 172 FSCRYPT_POLICY_FLAG_DIRECT_KEY)) { 173 fscrypt_warn(inode, "Unsupported encryption flags (0x%02x)", 174 policy->flags); 175 return false; 176 } 177 178 if ((policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) && 179 !supported_direct_key_modes(inode, policy->contents_encryption_mode, 180 policy->filenames_encryption_mode)) 181 return false; 182 183 if (IS_CASEFOLDED(inode)) { 184 /* With v1, there's no way to derive dirhash keys. */ 185 fscrypt_warn(inode, 186 "v1 policies can't be used on casefolded directories"); 187 return false; 188 } 189 190 return true; 191} 192 193static bool fscrypt_supported_v2_policy(const struct fscrypt_policy_v2 *policy, 194 const struct inode *inode) 195{ 196 int count = 0; 197 |
190 if (!fscrypt_valid_enc_modes(policy->contents_encryption_mode, | 198 if (!fscrypt_valid_enc_modes_v2(policy->contents_encryption_mode, |
191 policy->filenames_encryption_mode)) { 192 fscrypt_warn(inode, 193 "Unsupported encryption modes (contents %d, filenames %d)", 194 policy->contents_encryption_mode, 195 policy->filenames_encryption_mode); 196 return false; 197 } 198 199 if (policy->flags & ~(FSCRYPT_POLICY_FLAGS_PAD_MASK | 200 FSCRYPT_POLICY_FLAG_DIRECT_KEY | 201 FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 | 202 FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32)) { 203 fscrypt_warn(inode, "Unsupported encryption flags (0x%02x)", 204 policy->flags); 205 return false; 206 } 207 208 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY); 209 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64); 210 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32); 211 if (count > 1) { 212 fscrypt_warn(inode, "Mutually exclusive encryption flags (0x%02x)", 213 policy->flags); 214 return false; 215 } 216 217 if ((policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) && 218 !supported_direct_key_modes(inode, policy->contents_encryption_mode, 219 policy->filenames_encryption_mode)) 220 return false; 221 222 if ((policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64) && 223 !supported_iv_ino_lblk_policy(policy, inode, "IV_INO_LBLK_64", 224 32, 32)) 225 return false; 226 227 /* 228 * IV_INO_LBLK_32 hashes the inode number, so in principle it can 229 * support any ino_bits. However, currently the inode number is gotten 230 * from inode::i_ino which is 'unsigned long'. So for now the 231 * implementation limit is 32 bits. 232 */ 233 if ((policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) && 234 !supported_iv_ino_lblk_policy(policy, inode, "IV_INO_LBLK_32", 235 32, 32)) 236 return false; 237 238 if (memchr_inv(policy->__reserved, 0, sizeof(policy->__reserved))) { 239 fscrypt_warn(inode, "Reserved bits set in encryption policy"); 240 return false; 241 } 242 243 return true; 244} 245 246/** 247 * fscrypt_supported_policy() - check whether an encryption policy is supported 248 * @policy_u: the encryption policy 249 * @inode: the inode on which the policy will be used 250 * 251 * Given an encryption policy, check whether all its encryption modes and other 252 * settings are supported by this kernel on the given inode. (But we don't 253 * currently don't check for crypto API support here, so attempting to use an 254 * algorithm not configured into the crypto API will still fail later.) 255 * 256 * Return: %true if supported, else %false 257 */ 258bool fscrypt_supported_policy(const union fscrypt_policy *policy_u, 259 const struct inode *inode) 260{ 261 switch (policy_u->version) { 262 case FSCRYPT_POLICY_V1: 263 return fscrypt_supported_v1_policy(&policy_u->v1, inode); 264 case FSCRYPT_POLICY_V2: 265 return fscrypt_supported_v2_policy(&policy_u->v2, inode); 266 } 267 return false; 268} 269 270/** 271 * fscrypt_new_context() - create a new fscrypt_context 272 * @ctx_u: output context 273 * @policy_u: input policy 274 * @nonce: nonce to use 275 * 276 * Create an fscrypt_context for an inode that is being assigned the given 277 * encryption policy. @nonce must be a new random nonce. 278 * 279 * Return: the size of the new context in bytes. 280 */ 281static int fscrypt_new_context(union fscrypt_context *ctx_u, 282 const union fscrypt_policy *policy_u, 283 const u8 nonce[FSCRYPT_FILE_NONCE_SIZE]) 284{ 285 memset(ctx_u, 0, sizeof(*ctx_u)); 286 287 switch (policy_u->version) { 288 case FSCRYPT_POLICY_V1: { 289 const struct fscrypt_policy_v1 *policy = &policy_u->v1; 290 struct fscrypt_context_v1 *ctx = &ctx_u->v1; 291 292 ctx->version = FSCRYPT_CONTEXT_V1; 293 ctx->contents_encryption_mode = 294 policy->contents_encryption_mode; 295 ctx->filenames_encryption_mode = 296 policy->filenames_encryption_mode; 297 ctx->flags = policy->flags; 298 memcpy(ctx->master_key_descriptor, 299 policy->master_key_descriptor, 300 sizeof(ctx->master_key_descriptor)); 301 memcpy(ctx->nonce, nonce, FSCRYPT_FILE_NONCE_SIZE); 302 return sizeof(*ctx); 303 } 304 case FSCRYPT_POLICY_V2: { 305 const struct fscrypt_policy_v2 *policy = &policy_u->v2; 306 struct fscrypt_context_v2 *ctx = &ctx_u->v2; 307 308 ctx->version = FSCRYPT_CONTEXT_V2; 309 ctx->contents_encryption_mode = 310 policy->contents_encryption_mode; 311 ctx->filenames_encryption_mode = 312 policy->filenames_encryption_mode; 313 ctx->flags = policy->flags; 314 memcpy(ctx->master_key_identifier, 315 policy->master_key_identifier, 316 sizeof(ctx->master_key_identifier)); 317 memcpy(ctx->nonce, nonce, FSCRYPT_FILE_NONCE_SIZE); 318 return sizeof(*ctx); 319 } 320 } 321 BUG(); 322} 323 324/** 325 * fscrypt_policy_from_context() - convert an fscrypt_context to 326 * an fscrypt_policy 327 * @policy_u: output policy 328 * @ctx_u: input context 329 * @ctx_size: size of input context in bytes 330 * 331 * Given an fscrypt_context, build the corresponding fscrypt_policy. 332 * 333 * Return: 0 on success, or -EINVAL if the fscrypt_context has an unrecognized 334 * version number or size. 335 * 336 * This does *not* validate the settings within the policy itself, e.g. the 337 * modes, flags, and reserved bits. Use fscrypt_supported_policy() for that. 338 */ 339int fscrypt_policy_from_context(union fscrypt_policy *policy_u, 340 const union fscrypt_context *ctx_u, 341 int ctx_size) 342{ 343 memset(policy_u, 0, sizeof(*policy_u)); 344 345 if (!fscrypt_context_is_valid(ctx_u, ctx_size)) 346 return -EINVAL; 347 348 switch (ctx_u->version) { 349 case FSCRYPT_CONTEXT_V1: { 350 const struct fscrypt_context_v1 *ctx = &ctx_u->v1; 351 struct fscrypt_policy_v1 *policy = &policy_u->v1; 352 353 policy->version = FSCRYPT_POLICY_V1; 354 policy->contents_encryption_mode = 355 ctx->contents_encryption_mode; 356 policy->filenames_encryption_mode = 357 ctx->filenames_encryption_mode; 358 policy->flags = ctx->flags; 359 memcpy(policy->master_key_descriptor, 360 ctx->master_key_descriptor, 361 sizeof(policy->master_key_descriptor)); 362 return 0; 363 } 364 case FSCRYPT_CONTEXT_V2: { 365 const struct fscrypt_context_v2 *ctx = &ctx_u->v2; 366 struct fscrypt_policy_v2 *policy = &policy_u->v2; 367 368 policy->version = FSCRYPT_POLICY_V2; 369 policy->contents_encryption_mode = 370 ctx->contents_encryption_mode; 371 policy->filenames_encryption_mode = 372 ctx->filenames_encryption_mode; 373 policy->flags = ctx->flags; 374 memcpy(policy->__reserved, ctx->__reserved, 375 sizeof(policy->__reserved)); 376 memcpy(policy->master_key_identifier, 377 ctx->master_key_identifier, 378 sizeof(policy->master_key_identifier)); 379 return 0; 380 } 381 } 382 /* unreachable */ 383 return -EINVAL; 384} 385 386/* Retrieve an inode's encryption policy */ 387static int fscrypt_get_policy(struct inode *inode, union fscrypt_policy *policy) 388{ 389 const struct fscrypt_info *ci; 390 union fscrypt_context ctx; 391 int ret; 392 393 ci = fscrypt_get_info(inode); 394 if (ci) { 395 /* key available, use the cached policy */ 396 *policy = ci->ci_policy; 397 return 0; 398 } 399 400 if (!IS_ENCRYPTED(inode)) 401 return -ENODATA; 402 403 ret = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx)); 404 if (ret < 0) 405 return (ret == -ERANGE) ? -EINVAL : ret; 406 407 return fscrypt_policy_from_context(policy, &ctx, ret); 408} 409 410static int set_encryption_policy(struct inode *inode, 411 const union fscrypt_policy *policy) 412{ 413 u8 nonce[FSCRYPT_FILE_NONCE_SIZE]; 414 union fscrypt_context ctx; 415 int ctxsize; 416 int err; 417 418 if (!fscrypt_supported_policy(policy, inode)) 419 return -EINVAL; 420 421 switch (policy->version) { 422 case FSCRYPT_POLICY_V1: 423 /* 424 * The original encryption policy version provided no way of 425 * verifying that the correct master key was supplied, which was 426 * insecure in scenarios where multiple users have access to the 427 * same encrypted files (even just read-only access). The new 428 * encryption policy version fixes this and also implies use of 429 * an improved key derivation function and allows non-root users 430 * to securely remove keys. So as long as compatibility with 431 * old kernels isn't required, it is recommended to use the new 432 * policy version for all new encrypted directories. 433 */ 434 pr_warn_once("%s (pid %d) is setting deprecated v1 encryption policy; recommend upgrading to v2.\n", 435 current->comm, current->pid); 436 break; 437 case FSCRYPT_POLICY_V2: 438 err = fscrypt_verify_key_added(inode->i_sb, 439 policy->v2.master_key_identifier); 440 if (err) 441 return err; 442 if (policy->v2.flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) 443 pr_warn_once("%s (pid %d) is setting an IV_INO_LBLK_32 encryption policy. This should only be used if there are certain hardware limitations.\n", 444 current->comm, current->pid); 445 break; 446 default: 447 WARN_ON(1); 448 return -EINVAL; 449 } 450 451 get_random_bytes(nonce, FSCRYPT_FILE_NONCE_SIZE); 452 ctxsize = fscrypt_new_context(&ctx, policy, nonce); 453 454 return inode->i_sb->s_cop->set_context(inode, &ctx, ctxsize, NULL); 455} 456 457int fscrypt_ioctl_set_policy(struct file *filp, const void __user *arg) 458{ 459 union fscrypt_policy policy; 460 union fscrypt_policy existing_policy; 461 struct inode *inode = file_inode(filp); 462 u8 version; 463 int size; 464 int ret; 465 466 if (get_user(policy.version, (const u8 __user *)arg)) 467 return -EFAULT; 468 469 size = fscrypt_policy_size(&policy); 470 if (size <= 0) 471 return -EINVAL; 472 473 /* 474 * We should just copy the remaining 'size - 1' bytes here, but a 475 * bizarre bug in gcc 7 and earlier (fixed by gcc r255731) causes gcc to 476 * think that size can be 0 here (despite the check above!) *and* that 477 * it's a compile-time constant. Thus it would think copy_from_user() 478 * is passed compile-time constant ULONG_MAX, causing the compile-time 479 * buffer overflow check to fail, breaking the build. This only occurred 480 * when building an i386 kernel with -Os and branch profiling enabled. 481 * 482 * Work around it by just copying the first byte again... 483 */ 484 version = policy.version; 485 if (copy_from_user(&policy, arg, size)) 486 return -EFAULT; 487 policy.version = version; 488 489 if (!inode_owner_or_capable(&init_user_ns, inode)) 490 return -EACCES; 491 492 ret = mnt_want_write_file(filp); 493 if (ret) 494 return ret; 495 496 inode_lock(inode); 497 498 ret = fscrypt_get_policy(inode, &existing_policy); 499 if (ret == -ENODATA) { 500 if (!S_ISDIR(inode->i_mode)) 501 ret = -ENOTDIR; 502 else if (IS_DEADDIR(inode)) 503 ret = -ENOENT; 504 else if (!inode->i_sb->s_cop->empty_dir(inode)) 505 ret = -ENOTEMPTY; 506 else 507 ret = set_encryption_policy(inode, &policy); 508 } else if (ret == -EINVAL || 509 (ret == 0 && !fscrypt_policies_equal(&policy, 510 &existing_policy))) { 511 /* The file already uses a different encryption policy. */ 512 ret = -EEXIST; 513 } 514 515 inode_unlock(inode); 516 517 mnt_drop_write_file(filp); 518 return ret; 519} 520EXPORT_SYMBOL(fscrypt_ioctl_set_policy); 521 522/* Original ioctl version; can only get the original policy version */ 523int fscrypt_ioctl_get_policy(struct file *filp, void __user *arg) 524{ 525 union fscrypt_policy policy; 526 int err; 527 528 err = fscrypt_get_policy(file_inode(filp), &policy); 529 if (err) 530 return err; 531 532 if (policy.version != FSCRYPT_POLICY_V1) 533 return -EINVAL; 534 535 if (copy_to_user(arg, &policy, sizeof(policy.v1))) 536 return -EFAULT; 537 return 0; 538} 539EXPORT_SYMBOL(fscrypt_ioctl_get_policy); 540 541/* Extended ioctl version; can get policies of any version */ 542int fscrypt_ioctl_get_policy_ex(struct file *filp, void __user *uarg) 543{ 544 struct fscrypt_get_policy_ex_arg arg; 545 union fscrypt_policy *policy = (union fscrypt_policy *)&arg.policy; 546 size_t policy_size; 547 int err; 548 549 /* arg is policy_size, then policy */ 550 BUILD_BUG_ON(offsetof(typeof(arg), policy_size) != 0); 551 BUILD_BUG_ON(offsetofend(typeof(arg), policy_size) != 552 offsetof(typeof(arg), policy)); 553 BUILD_BUG_ON(sizeof(arg.policy) != sizeof(*policy)); 554 555 err = fscrypt_get_policy(file_inode(filp), policy); 556 if (err) 557 return err; 558 policy_size = fscrypt_policy_size(policy); 559 560 if (copy_from_user(&arg, uarg, sizeof(arg.policy_size))) 561 return -EFAULT; 562 563 if (policy_size > arg.policy_size) 564 return -EOVERFLOW; 565 arg.policy_size = policy_size; 566 567 if (copy_to_user(uarg, &arg, sizeof(arg.policy_size) + policy_size)) 568 return -EFAULT; 569 return 0; 570} 571EXPORT_SYMBOL_GPL(fscrypt_ioctl_get_policy_ex); 572 573/* FS_IOC_GET_ENCRYPTION_NONCE: retrieve file's encryption nonce for testing */ 574int fscrypt_ioctl_get_nonce(struct file *filp, void __user *arg) 575{ 576 struct inode *inode = file_inode(filp); 577 union fscrypt_context ctx; 578 int ret; 579 580 ret = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx)); 581 if (ret < 0) 582 return ret; 583 if (!fscrypt_context_is_valid(&ctx, ret)) 584 return -EINVAL; 585 if (copy_to_user(arg, fscrypt_context_nonce(&ctx), 586 FSCRYPT_FILE_NONCE_SIZE)) 587 return -EFAULT; 588 return 0; 589} 590EXPORT_SYMBOL_GPL(fscrypt_ioctl_get_nonce); 591 592/** 593 * fscrypt_has_permitted_context() - is a file's encryption policy permitted 594 * within its directory? 595 * 596 * @parent: inode for parent directory 597 * @child: inode for file being looked up, opened, or linked into @parent 598 * 599 * Filesystems must call this before permitting access to an inode in a 600 * situation where the parent directory is encrypted (either before allowing 601 * ->lookup() to succeed, or for a regular file before allowing it to be opened) 602 * and before any operation that involves linking an inode into an encrypted 603 * directory, including link, rename, and cross rename. It enforces the 604 * constraint that within a given encrypted directory tree, all files use the 605 * same encryption policy. The pre-access check is needed to detect potentially 606 * malicious offline violations of this constraint, while the link and rename 607 * checks are needed to prevent online violations of this constraint. 608 * 609 * Return: 1 if permitted, 0 if forbidden. 610 */ 611int fscrypt_has_permitted_context(struct inode *parent, struct inode *child) 612{ 613 union fscrypt_policy parent_policy, child_policy; 614 int err, err1, err2; 615 616 /* No restrictions on file types which are never encrypted */ 617 if (!S_ISREG(child->i_mode) && !S_ISDIR(child->i_mode) && 618 !S_ISLNK(child->i_mode)) 619 return 1; 620 621 /* No restrictions if the parent directory is unencrypted */ 622 if (!IS_ENCRYPTED(parent)) 623 return 1; 624 625 /* Encrypted directories must not contain unencrypted files */ 626 if (!IS_ENCRYPTED(child)) 627 return 0; 628 629 /* 630 * Both parent and child are encrypted, so verify they use the same 631 * encryption policy. Compare the fscrypt_info structs if the keys are 632 * available, otherwise retrieve and compare the fscrypt_contexts. 633 * 634 * Note that the fscrypt_context retrieval will be required frequently 635 * when accessing an encrypted directory tree without the key. 636 * Performance-wise this is not a big deal because we already don't 637 * really optimize for file access without the key (to the extent that 638 * such access is even possible), given that any attempted access 639 * already causes a fscrypt_context retrieval and keyring search. 640 * 641 * In any case, if an unexpected error occurs, fall back to "forbidden". 642 */ 643 644 err = fscrypt_get_encryption_info(parent, true); 645 if (err) 646 return 0; 647 err = fscrypt_get_encryption_info(child, true); 648 if (err) 649 return 0; 650 651 err1 = fscrypt_get_policy(parent, &parent_policy); 652 err2 = fscrypt_get_policy(child, &child_policy); 653 654 /* 655 * Allow the case where the parent and child both have an unrecognized 656 * encryption policy, so that files with an unrecognized encryption 657 * policy can be deleted. 658 */ 659 if (err1 == -EINVAL && err2 == -EINVAL) 660 return 1; 661 662 if (err1 || err2) 663 return 0; 664 665 return fscrypt_policies_equal(&parent_policy, &child_policy); 666} 667EXPORT_SYMBOL(fscrypt_has_permitted_context); 668 669/* 670 * Return the encryption policy that new files in the directory will inherit, or 671 * NULL if none, or an ERR_PTR() on error. If the directory is encrypted, also 672 * ensure that its key is set up, so that the new filename can be encrypted. 673 */ 674const union fscrypt_policy *fscrypt_policy_to_inherit(struct inode *dir) 675{ 676 int err; 677 678 if (IS_ENCRYPTED(dir)) { 679 err = fscrypt_require_key(dir); 680 if (err) 681 return ERR_PTR(err); 682 return &dir->i_crypt_info->ci_policy; 683 } 684 685 return fscrypt_get_dummy_policy(dir->i_sb); 686} 687 688/** 689 * fscrypt_set_context() - Set the fscrypt context of a new inode 690 * @inode: a new inode 691 * @fs_data: private data given by FS and passed to ->set_context() 692 * 693 * This should be called after fscrypt_prepare_new_inode(), generally during a 694 * filesystem transaction. Everything here must be %GFP_NOFS-safe. 695 * 696 * Return: 0 on success, -errno on failure 697 */ 698int fscrypt_set_context(struct inode *inode, void *fs_data) 699{ 700 struct fscrypt_info *ci = inode->i_crypt_info; 701 union fscrypt_context ctx; 702 int ctxsize; 703 704 /* fscrypt_prepare_new_inode() should have set up the key already. */ 705 if (WARN_ON_ONCE(!ci)) 706 return -ENOKEY; 707 708 BUILD_BUG_ON(sizeof(ctx) != FSCRYPT_SET_CONTEXT_MAX_SIZE); 709 ctxsize = fscrypt_new_context(&ctx, &ci->ci_policy, ci->ci_nonce); 710 711 /* 712 * This may be the first time the inode number is available, so do any 713 * delayed key setup that requires the inode number. 714 */ 715 if (ci->ci_policy.version == FSCRYPT_POLICY_V2 && 716 (ci->ci_policy.v2.flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32)) { 717 const struct fscrypt_master_key *mk = 718 ci->ci_master_key->payload.data[0]; 719 720 fscrypt_hash_inode_number(ci, mk); 721 } 722 723 return inode->i_sb->s_cop->set_context(inode, &ctx, ctxsize, fs_data); 724} 725EXPORT_SYMBOL_GPL(fscrypt_set_context); 726 727/** 728 * fscrypt_parse_test_dummy_encryption() - parse the test_dummy_encryption mount option 729 * @param: the mount option 730 * @dummy_policy: (input/output) the place to write the dummy policy that will 731 * result from parsing the option. Zero-initialize this. If a policy is 732 * already set here (due to test_dummy_encryption being given multiple 733 * times), then this function will verify that the policies are the same. 734 * 735 * Return: 0 on success; -EINVAL if the argument is invalid; -EEXIST if the 736 * argument conflicts with one already specified; or -ENOMEM. 737 */ 738int fscrypt_parse_test_dummy_encryption(const struct fs_parameter *param, 739 struct fscrypt_dummy_policy *dummy_policy) 740{ 741 const char *arg = "v2"; 742 union fscrypt_policy *policy; 743 int err; 744 745 if (param->type == fs_value_is_string && *param->string) 746 arg = param->string; 747 748 policy = kzalloc(sizeof(*policy), GFP_KERNEL); 749 if (!policy) 750 return -ENOMEM; 751 752 if (!strcmp(arg, "v1")) { 753 policy->version = FSCRYPT_POLICY_V1; 754 policy->v1.contents_encryption_mode = FSCRYPT_MODE_AES_256_XTS; 755 policy->v1.filenames_encryption_mode = FSCRYPT_MODE_AES_256_CTS; 756 memset(policy->v1.master_key_descriptor, 0x42, 757 FSCRYPT_KEY_DESCRIPTOR_SIZE); 758 } else if (!strcmp(arg, "v2")) { 759 policy->version = FSCRYPT_POLICY_V2; 760 policy->v2.contents_encryption_mode = FSCRYPT_MODE_AES_256_XTS; 761 policy->v2.filenames_encryption_mode = FSCRYPT_MODE_AES_256_CTS; 762 err = fscrypt_get_test_dummy_key_identifier( 763 policy->v2.master_key_identifier); 764 if (err) 765 goto out; 766 } else { 767 err = -EINVAL; 768 goto out; 769 } 770 771 if (dummy_policy->policy) { 772 if (fscrypt_policies_equal(policy, dummy_policy->policy)) 773 err = 0; 774 else 775 err = -EEXIST; 776 goto out; 777 } 778 dummy_policy->policy = policy; 779 policy = NULL; 780 err = 0; 781out: 782 kfree(policy); 783 return err; 784} 785EXPORT_SYMBOL_GPL(fscrypt_parse_test_dummy_encryption); 786 787/** 788 * fscrypt_dummy_policies_equal() - check whether two dummy policies are equal 789 * @p1: the first test dummy policy (may be unset) 790 * @p2: the second test dummy policy (may be unset) 791 * 792 * Return: %true if the dummy policies are both set and equal, or both unset. 793 */ 794bool fscrypt_dummy_policies_equal(const struct fscrypt_dummy_policy *p1, 795 const struct fscrypt_dummy_policy *p2) 796{ 797 if (!p1->policy && !p2->policy) 798 return true; 799 if (!p1->policy || !p2->policy) 800 return false; 801 return fscrypt_policies_equal(p1->policy, p2->policy); 802} 803EXPORT_SYMBOL_GPL(fscrypt_dummy_policies_equal); 804 805/* Deprecated, do not use */ 806int fscrypt_set_test_dummy_encryption(struct super_block *sb, const char *arg, 807 struct fscrypt_dummy_policy *dummy_policy) 808{ 809 struct fs_parameter param = { 810 .type = fs_value_is_string, 811 .string = arg ? (char *)arg : "", 812 }; 813 return fscrypt_parse_test_dummy_encryption(¶m, dummy_policy) ?: 814 fscrypt_add_test_dummy_key(sb, dummy_policy); 815} 816EXPORT_SYMBOL_GPL(fscrypt_set_test_dummy_encryption); 817 818/** 819 * fscrypt_show_test_dummy_encryption() - show '-o test_dummy_encryption' 820 * @seq: the seq_file to print the option to 821 * @sep: the separator character to use 822 * @sb: the filesystem whose options are being shown 823 * 824 * Show the test_dummy_encryption mount option, if it was specified. 825 * This is mainly used for /proc/mounts. 826 */ 827void fscrypt_show_test_dummy_encryption(struct seq_file *seq, char sep, 828 struct super_block *sb) 829{ 830 const union fscrypt_policy *policy = fscrypt_get_dummy_policy(sb); 831 int vers; 832 833 if (!policy) 834 return; 835 836 vers = policy->version; 837 if (vers == FSCRYPT_POLICY_V1) /* Handle numbering quirk */ 838 vers = 1; 839 840 seq_printf(seq, "%ctest_dummy_encryption=v%d", sep, vers); 841} 842EXPORT_SYMBOL_GPL(fscrypt_show_test_dummy_encryption); | 199 policy->filenames_encryption_mode)) { 200 fscrypt_warn(inode, 201 "Unsupported encryption modes (contents %d, filenames %d)", 202 policy->contents_encryption_mode, 203 policy->filenames_encryption_mode); 204 return false; 205 } 206 207 if (policy->flags & ~(FSCRYPT_POLICY_FLAGS_PAD_MASK | 208 FSCRYPT_POLICY_FLAG_DIRECT_KEY | 209 FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 | 210 FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32)) { 211 fscrypt_warn(inode, "Unsupported encryption flags (0x%02x)", 212 policy->flags); 213 return false; 214 } 215 216 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY); 217 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64); 218 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32); 219 if (count > 1) { 220 fscrypt_warn(inode, "Mutually exclusive encryption flags (0x%02x)", 221 policy->flags); 222 return false; 223 } 224 225 if ((policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) && 226 !supported_direct_key_modes(inode, policy->contents_encryption_mode, 227 policy->filenames_encryption_mode)) 228 return false; 229 230 if ((policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64) && 231 !supported_iv_ino_lblk_policy(policy, inode, "IV_INO_LBLK_64", 232 32, 32)) 233 return false; 234 235 /* 236 * IV_INO_LBLK_32 hashes the inode number, so in principle it can 237 * support any ino_bits. However, currently the inode number is gotten 238 * from inode::i_ino which is 'unsigned long'. So for now the 239 * implementation limit is 32 bits. 240 */ 241 if ((policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) && 242 !supported_iv_ino_lblk_policy(policy, inode, "IV_INO_LBLK_32", 243 32, 32)) 244 return false; 245 246 if (memchr_inv(policy->__reserved, 0, sizeof(policy->__reserved))) { 247 fscrypt_warn(inode, "Reserved bits set in encryption policy"); 248 return false; 249 } 250 251 return true; 252} 253 254/** 255 * fscrypt_supported_policy() - check whether an encryption policy is supported 256 * @policy_u: the encryption policy 257 * @inode: the inode on which the policy will be used 258 * 259 * Given an encryption policy, check whether all its encryption modes and other 260 * settings are supported by this kernel on the given inode. (But we don't 261 * currently don't check for crypto API support here, so attempting to use an 262 * algorithm not configured into the crypto API will still fail later.) 263 * 264 * Return: %true if supported, else %false 265 */ 266bool fscrypt_supported_policy(const union fscrypt_policy *policy_u, 267 const struct inode *inode) 268{ 269 switch (policy_u->version) { 270 case FSCRYPT_POLICY_V1: 271 return fscrypt_supported_v1_policy(&policy_u->v1, inode); 272 case FSCRYPT_POLICY_V2: 273 return fscrypt_supported_v2_policy(&policy_u->v2, inode); 274 } 275 return false; 276} 277 278/** 279 * fscrypt_new_context() - create a new fscrypt_context 280 * @ctx_u: output context 281 * @policy_u: input policy 282 * @nonce: nonce to use 283 * 284 * Create an fscrypt_context for an inode that is being assigned the given 285 * encryption policy. @nonce must be a new random nonce. 286 * 287 * Return: the size of the new context in bytes. 288 */ 289static int fscrypt_new_context(union fscrypt_context *ctx_u, 290 const union fscrypt_policy *policy_u, 291 const u8 nonce[FSCRYPT_FILE_NONCE_SIZE]) 292{ 293 memset(ctx_u, 0, sizeof(*ctx_u)); 294 295 switch (policy_u->version) { 296 case FSCRYPT_POLICY_V1: { 297 const struct fscrypt_policy_v1 *policy = &policy_u->v1; 298 struct fscrypt_context_v1 *ctx = &ctx_u->v1; 299 300 ctx->version = FSCRYPT_CONTEXT_V1; 301 ctx->contents_encryption_mode = 302 policy->contents_encryption_mode; 303 ctx->filenames_encryption_mode = 304 policy->filenames_encryption_mode; 305 ctx->flags = policy->flags; 306 memcpy(ctx->master_key_descriptor, 307 policy->master_key_descriptor, 308 sizeof(ctx->master_key_descriptor)); 309 memcpy(ctx->nonce, nonce, FSCRYPT_FILE_NONCE_SIZE); 310 return sizeof(*ctx); 311 } 312 case FSCRYPT_POLICY_V2: { 313 const struct fscrypt_policy_v2 *policy = &policy_u->v2; 314 struct fscrypt_context_v2 *ctx = &ctx_u->v2; 315 316 ctx->version = FSCRYPT_CONTEXT_V2; 317 ctx->contents_encryption_mode = 318 policy->contents_encryption_mode; 319 ctx->filenames_encryption_mode = 320 policy->filenames_encryption_mode; 321 ctx->flags = policy->flags; 322 memcpy(ctx->master_key_identifier, 323 policy->master_key_identifier, 324 sizeof(ctx->master_key_identifier)); 325 memcpy(ctx->nonce, nonce, FSCRYPT_FILE_NONCE_SIZE); 326 return sizeof(*ctx); 327 } 328 } 329 BUG(); 330} 331 332/** 333 * fscrypt_policy_from_context() - convert an fscrypt_context to 334 * an fscrypt_policy 335 * @policy_u: output policy 336 * @ctx_u: input context 337 * @ctx_size: size of input context in bytes 338 * 339 * Given an fscrypt_context, build the corresponding fscrypt_policy. 340 * 341 * Return: 0 on success, or -EINVAL if the fscrypt_context has an unrecognized 342 * version number or size. 343 * 344 * This does *not* validate the settings within the policy itself, e.g. the 345 * modes, flags, and reserved bits. Use fscrypt_supported_policy() for that. 346 */ 347int fscrypt_policy_from_context(union fscrypt_policy *policy_u, 348 const union fscrypt_context *ctx_u, 349 int ctx_size) 350{ 351 memset(policy_u, 0, sizeof(*policy_u)); 352 353 if (!fscrypt_context_is_valid(ctx_u, ctx_size)) 354 return -EINVAL; 355 356 switch (ctx_u->version) { 357 case FSCRYPT_CONTEXT_V1: { 358 const struct fscrypt_context_v1 *ctx = &ctx_u->v1; 359 struct fscrypt_policy_v1 *policy = &policy_u->v1; 360 361 policy->version = FSCRYPT_POLICY_V1; 362 policy->contents_encryption_mode = 363 ctx->contents_encryption_mode; 364 policy->filenames_encryption_mode = 365 ctx->filenames_encryption_mode; 366 policy->flags = ctx->flags; 367 memcpy(policy->master_key_descriptor, 368 ctx->master_key_descriptor, 369 sizeof(policy->master_key_descriptor)); 370 return 0; 371 } 372 case FSCRYPT_CONTEXT_V2: { 373 const struct fscrypt_context_v2 *ctx = &ctx_u->v2; 374 struct fscrypt_policy_v2 *policy = &policy_u->v2; 375 376 policy->version = FSCRYPT_POLICY_V2; 377 policy->contents_encryption_mode = 378 ctx->contents_encryption_mode; 379 policy->filenames_encryption_mode = 380 ctx->filenames_encryption_mode; 381 policy->flags = ctx->flags; 382 memcpy(policy->__reserved, ctx->__reserved, 383 sizeof(policy->__reserved)); 384 memcpy(policy->master_key_identifier, 385 ctx->master_key_identifier, 386 sizeof(policy->master_key_identifier)); 387 return 0; 388 } 389 } 390 /* unreachable */ 391 return -EINVAL; 392} 393 394/* Retrieve an inode's encryption policy */ 395static int fscrypt_get_policy(struct inode *inode, union fscrypt_policy *policy) 396{ 397 const struct fscrypt_info *ci; 398 union fscrypt_context ctx; 399 int ret; 400 401 ci = fscrypt_get_info(inode); 402 if (ci) { 403 /* key available, use the cached policy */ 404 *policy = ci->ci_policy; 405 return 0; 406 } 407 408 if (!IS_ENCRYPTED(inode)) 409 return -ENODATA; 410 411 ret = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx)); 412 if (ret < 0) 413 return (ret == -ERANGE) ? -EINVAL : ret; 414 415 return fscrypt_policy_from_context(policy, &ctx, ret); 416} 417 418static int set_encryption_policy(struct inode *inode, 419 const union fscrypt_policy *policy) 420{ 421 u8 nonce[FSCRYPT_FILE_NONCE_SIZE]; 422 union fscrypt_context ctx; 423 int ctxsize; 424 int err; 425 426 if (!fscrypt_supported_policy(policy, inode)) 427 return -EINVAL; 428 429 switch (policy->version) { 430 case FSCRYPT_POLICY_V1: 431 /* 432 * The original encryption policy version provided no way of 433 * verifying that the correct master key was supplied, which was 434 * insecure in scenarios where multiple users have access to the 435 * same encrypted files (even just read-only access). The new 436 * encryption policy version fixes this and also implies use of 437 * an improved key derivation function and allows non-root users 438 * to securely remove keys. So as long as compatibility with 439 * old kernels isn't required, it is recommended to use the new 440 * policy version for all new encrypted directories. 441 */ 442 pr_warn_once("%s (pid %d) is setting deprecated v1 encryption policy; recommend upgrading to v2.\n", 443 current->comm, current->pid); 444 break; 445 case FSCRYPT_POLICY_V2: 446 err = fscrypt_verify_key_added(inode->i_sb, 447 policy->v2.master_key_identifier); 448 if (err) 449 return err; 450 if (policy->v2.flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) 451 pr_warn_once("%s (pid %d) is setting an IV_INO_LBLK_32 encryption policy. This should only be used if there are certain hardware limitations.\n", 452 current->comm, current->pid); 453 break; 454 default: 455 WARN_ON(1); 456 return -EINVAL; 457 } 458 459 get_random_bytes(nonce, FSCRYPT_FILE_NONCE_SIZE); 460 ctxsize = fscrypt_new_context(&ctx, policy, nonce); 461 462 return inode->i_sb->s_cop->set_context(inode, &ctx, ctxsize, NULL); 463} 464 465int fscrypt_ioctl_set_policy(struct file *filp, const void __user *arg) 466{ 467 union fscrypt_policy policy; 468 union fscrypt_policy existing_policy; 469 struct inode *inode = file_inode(filp); 470 u8 version; 471 int size; 472 int ret; 473 474 if (get_user(policy.version, (const u8 __user *)arg)) 475 return -EFAULT; 476 477 size = fscrypt_policy_size(&policy); 478 if (size <= 0) 479 return -EINVAL; 480 481 /* 482 * We should just copy the remaining 'size - 1' bytes here, but a 483 * bizarre bug in gcc 7 and earlier (fixed by gcc r255731) causes gcc to 484 * think that size can be 0 here (despite the check above!) *and* that 485 * it's a compile-time constant. Thus it would think copy_from_user() 486 * is passed compile-time constant ULONG_MAX, causing the compile-time 487 * buffer overflow check to fail, breaking the build. This only occurred 488 * when building an i386 kernel with -Os and branch profiling enabled. 489 * 490 * Work around it by just copying the first byte again... 491 */ 492 version = policy.version; 493 if (copy_from_user(&policy, arg, size)) 494 return -EFAULT; 495 policy.version = version; 496 497 if (!inode_owner_or_capable(&init_user_ns, inode)) 498 return -EACCES; 499 500 ret = mnt_want_write_file(filp); 501 if (ret) 502 return ret; 503 504 inode_lock(inode); 505 506 ret = fscrypt_get_policy(inode, &existing_policy); 507 if (ret == -ENODATA) { 508 if (!S_ISDIR(inode->i_mode)) 509 ret = -ENOTDIR; 510 else if (IS_DEADDIR(inode)) 511 ret = -ENOENT; 512 else if (!inode->i_sb->s_cop->empty_dir(inode)) 513 ret = -ENOTEMPTY; 514 else 515 ret = set_encryption_policy(inode, &policy); 516 } else if (ret == -EINVAL || 517 (ret == 0 && !fscrypt_policies_equal(&policy, 518 &existing_policy))) { 519 /* The file already uses a different encryption policy. */ 520 ret = -EEXIST; 521 } 522 523 inode_unlock(inode); 524 525 mnt_drop_write_file(filp); 526 return ret; 527} 528EXPORT_SYMBOL(fscrypt_ioctl_set_policy); 529 530/* Original ioctl version; can only get the original policy version */ 531int fscrypt_ioctl_get_policy(struct file *filp, void __user *arg) 532{ 533 union fscrypt_policy policy; 534 int err; 535 536 err = fscrypt_get_policy(file_inode(filp), &policy); 537 if (err) 538 return err; 539 540 if (policy.version != FSCRYPT_POLICY_V1) 541 return -EINVAL; 542 543 if (copy_to_user(arg, &policy, sizeof(policy.v1))) 544 return -EFAULT; 545 return 0; 546} 547EXPORT_SYMBOL(fscrypt_ioctl_get_policy); 548 549/* Extended ioctl version; can get policies of any version */ 550int fscrypt_ioctl_get_policy_ex(struct file *filp, void __user *uarg) 551{ 552 struct fscrypt_get_policy_ex_arg arg; 553 union fscrypt_policy *policy = (union fscrypt_policy *)&arg.policy; 554 size_t policy_size; 555 int err; 556 557 /* arg is policy_size, then policy */ 558 BUILD_BUG_ON(offsetof(typeof(arg), policy_size) != 0); 559 BUILD_BUG_ON(offsetofend(typeof(arg), policy_size) != 560 offsetof(typeof(arg), policy)); 561 BUILD_BUG_ON(sizeof(arg.policy) != sizeof(*policy)); 562 563 err = fscrypt_get_policy(file_inode(filp), policy); 564 if (err) 565 return err; 566 policy_size = fscrypt_policy_size(policy); 567 568 if (copy_from_user(&arg, uarg, sizeof(arg.policy_size))) 569 return -EFAULT; 570 571 if (policy_size > arg.policy_size) 572 return -EOVERFLOW; 573 arg.policy_size = policy_size; 574 575 if (copy_to_user(uarg, &arg, sizeof(arg.policy_size) + policy_size)) 576 return -EFAULT; 577 return 0; 578} 579EXPORT_SYMBOL_GPL(fscrypt_ioctl_get_policy_ex); 580 581/* FS_IOC_GET_ENCRYPTION_NONCE: retrieve file's encryption nonce for testing */ 582int fscrypt_ioctl_get_nonce(struct file *filp, void __user *arg) 583{ 584 struct inode *inode = file_inode(filp); 585 union fscrypt_context ctx; 586 int ret; 587 588 ret = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx)); 589 if (ret < 0) 590 return ret; 591 if (!fscrypt_context_is_valid(&ctx, ret)) 592 return -EINVAL; 593 if (copy_to_user(arg, fscrypt_context_nonce(&ctx), 594 FSCRYPT_FILE_NONCE_SIZE)) 595 return -EFAULT; 596 return 0; 597} 598EXPORT_SYMBOL_GPL(fscrypt_ioctl_get_nonce); 599 600/** 601 * fscrypt_has_permitted_context() - is a file's encryption policy permitted 602 * within its directory? 603 * 604 * @parent: inode for parent directory 605 * @child: inode for file being looked up, opened, or linked into @parent 606 * 607 * Filesystems must call this before permitting access to an inode in a 608 * situation where the parent directory is encrypted (either before allowing 609 * ->lookup() to succeed, or for a regular file before allowing it to be opened) 610 * and before any operation that involves linking an inode into an encrypted 611 * directory, including link, rename, and cross rename. It enforces the 612 * constraint that within a given encrypted directory tree, all files use the 613 * same encryption policy. The pre-access check is needed to detect potentially 614 * malicious offline violations of this constraint, while the link and rename 615 * checks are needed to prevent online violations of this constraint. 616 * 617 * Return: 1 if permitted, 0 if forbidden. 618 */ 619int fscrypt_has_permitted_context(struct inode *parent, struct inode *child) 620{ 621 union fscrypt_policy parent_policy, child_policy; 622 int err, err1, err2; 623 624 /* No restrictions on file types which are never encrypted */ 625 if (!S_ISREG(child->i_mode) && !S_ISDIR(child->i_mode) && 626 !S_ISLNK(child->i_mode)) 627 return 1; 628 629 /* No restrictions if the parent directory is unencrypted */ 630 if (!IS_ENCRYPTED(parent)) 631 return 1; 632 633 /* Encrypted directories must not contain unencrypted files */ 634 if (!IS_ENCRYPTED(child)) 635 return 0; 636 637 /* 638 * Both parent and child are encrypted, so verify they use the same 639 * encryption policy. Compare the fscrypt_info structs if the keys are 640 * available, otherwise retrieve and compare the fscrypt_contexts. 641 * 642 * Note that the fscrypt_context retrieval will be required frequently 643 * when accessing an encrypted directory tree without the key. 644 * Performance-wise this is not a big deal because we already don't 645 * really optimize for file access without the key (to the extent that 646 * such access is even possible), given that any attempted access 647 * already causes a fscrypt_context retrieval and keyring search. 648 * 649 * In any case, if an unexpected error occurs, fall back to "forbidden". 650 */ 651 652 err = fscrypt_get_encryption_info(parent, true); 653 if (err) 654 return 0; 655 err = fscrypt_get_encryption_info(child, true); 656 if (err) 657 return 0; 658 659 err1 = fscrypt_get_policy(parent, &parent_policy); 660 err2 = fscrypt_get_policy(child, &child_policy); 661 662 /* 663 * Allow the case where the parent and child both have an unrecognized 664 * encryption policy, so that files with an unrecognized encryption 665 * policy can be deleted. 666 */ 667 if (err1 == -EINVAL && err2 == -EINVAL) 668 return 1; 669 670 if (err1 || err2) 671 return 0; 672 673 return fscrypt_policies_equal(&parent_policy, &child_policy); 674} 675EXPORT_SYMBOL(fscrypt_has_permitted_context); 676 677/* 678 * Return the encryption policy that new files in the directory will inherit, or 679 * NULL if none, or an ERR_PTR() on error. If the directory is encrypted, also 680 * ensure that its key is set up, so that the new filename can be encrypted. 681 */ 682const union fscrypt_policy *fscrypt_policy_to_inherit(struct inode *dir) 683{ 684 int err; 685 686 if (IS_ENCRYPTED(dir)) { 687 err = fscrypt_require_key(dir); 688 if (err) 689 return ERR_PTR(err); 690 return &dir->i_crypt_info->ci_policy; 691 } 692 693 return fscrypt_get_dummy_policy(dir->i_sb); 694} 695 696/** 697 * fscrypt_set_context() - Set the fscrypt context of a new inode 698 * @inode: a new inode 699 * @fs_data: private data given by FS and passed to ->set_context() 700 * 701 * This should be called after fscrypt_prepare_new_inode(), generally during a 702 * filesystem transaction. Everything here must be %GFP_NOFS-safe. 703 * 704 * Return: 0 on success, -errno on failure 705 */ 706int fscrypt_set_context(struct inode *inode, void *fs_data) 707{ 708 struct fscrypt_info *ci = inode->i_crypt_info; 709 union fscrypt_context ctx; 710 int ctxsize; 711 712 /* fscrypt_prepare_new_inode() should have set up the key already. */ 713 if (WARN_ON_ONCE(!ci)) 714 return -ENOKEY; 715 716 BUILD_BUG_ON(sizeof(ctx) != FSCRYPT_SET_CONTEXT_MAX_SIZE); 717 ctxsize = fscrypt_new_context(&ctx, &ci->ci_policy, ci->ci_nonce); 718 719 /* 720 * This may be the first time the inode number is available, so do any 721 * delayed key setup that requires the inode number. 722 */ 723 if (ci->ci_policy.version == FSCRYPT_POLICY_V2 && 724 (ci->ci_policy.v2.flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32)) { 725 const struct fscrypt_master_key *mk = 726 ci->ci_master_key->payload.data[0]; 727 728 fscrypt_hash_inode_number(ci, mk); 729 } 730 731 return inode->i_sb->s_cop->set_context(inode, &ctx, ctxsize, fs_data); 732} 733EXPORT_SYMBOL_GPL(fscrypt_set_context); 734 735/** 736 * fscrypt_parse_test_dummy_encryption() - parse the test_dummy_encryption mount option 737 * @param: the mount option 738 * @dummy_policy: (input/output) the place to write the dummy policy that will 739 * result from parsing the option. Zero-initialize this. If a policy is 740 * already set here (due to test_dummy_encryption being given multiple 741 * times), then this function will verify that the policies are the same. 742 * 743 * Return: 0 on success; -EINVAL if the argument is invalid; -EEXIST if the 744 * argument conflicts with one already specified; or -ENOMEM. 745 */ 746int fscrypt_parse_test_dummy_encryption(const struct fs_parameter *param, 747 struct fscrypt_dummy_policy *dummy_policy) 748{ 749 const char *arg = "v2"; 750 union fscrypt_policy *policy; 751 int err; 752 753 if (param->type == fs_value_is_string && *param->string) 754 arg = param->string; 755 756 policy = kzalloc(sizeof(*policy), GFP_KERNEL); 757 if (!policy) 758 return -ENOMEM; 759 760 if (!strcmp(arg, "v1")) { 761 policy->version = FSCRYPT_POLICY_V1; 762 policy->v1.contents_encryption_mode = FSCRYPT_MODE_AES_256_XTS; 763 policy->v1.filenames_encryption_mode = FSCRYPT_MODE_AES_256_CTS; 764 memset(policy->v1.master_key_descriptor, 0x42, 765 FSCRYPT_KEY_DESCRIPTOR_SIZE); 766 } else if (!strcmp(arg, "v2")) { 767 policy->version = FSCRYPT_POLICY_V2; 768 policy->v2.contents_encryption_mode = FSCRYPT_MODE_AES_256_XTS; 769 policy->v2.filenames_encryption_mode = FSCRYPT_MODE_AES_256_CTS; 770 err = fscrypt_get_test_dummy_key_identifier( 771 policy->v2.master_key_identifier); 772 if (err) 773 goto out; 774 } else { 775 err = -EINVAL; 776 goto out; 777 } 778 779 if (dummy_policy->policy) { 780 if (fscrypt_policies_equal(policy, dummy_policy->policy)) 781 err = 0; 782 else 783 err = -EEXIST; 784 goto out; 785 } 786 dummy_policy->policy = policy; 787 policy = NULL; 788 err = 0; 789out: 790 kfree(policy); 791 return err; 792} 793EXPORT_SYMBOL_GPL(fscrypt_parse_test_dummy_encryption); 794 795/** 796 * fscrypt_dummy_policies_equal() - check whether two dummy policies are equal 797 * @p1: the first test dummy policy (may be unset) 798 * @p2: the second test dummy policy (may be unset) 799 * 800 * Return: %true if the dummy policies are both set and equal, or both unset. 801 */ 802bool fscrypt_dummy_policies_equal(const struct fscrypt_dummy_policy *p1, 803 const struct fscrypt_dummy_policy *p2) 804{ 805 if (!p1->policy && !p2->policy) 806 return true; 807 if (!p1->policy || !p2->policy) 808 return false; 809 return fscrypt_policies_equal(p1->policy, p2->policy); 810} 811EXPORT_SYMBOL_GPL(fscrypt_dummy_policies_equal); 812 813/* Deprecated, do not use */ 814int fscrypt_set_test_dummy_encryption(struct super_block *sb, const char *arg, 815 struct fscrypt_dummy_policy *dummy_policy) 816{ 817 struct fs_parameter param = { 818 .type = fs_value_is_string, 819 .string = arg ? (char *)arg : "", 820 }; 821 return fscrypt_parse_test_dummy_encryption(¶m, dummy_policy) ?: 822 fscrypt_add_test_dummy_key(sb, dummy_policy); 823} 824EXPORT_SYMBOL_GPL(fscrypt_set_test_dummy_encryption); 825 826/** 827 * fscrypt_show_test_dummy_encryption() - show '-o test_dummy_encryption' 828 * @seq: the seq_file to print the option to 829 * @sep: the separator character to use 830 * @sb: the filesystem whose options are being shown 831 * 832 * Show the test_dummy_encryption mount option, if it was specified. 833 * This is mainly used for /proc/mounts. 834 */ 835void fscrypt_show_test_dummy_encryption(struct seq_file *seq, char sep, 836 struct super_block *sb) 837{ 838 const union fscrypt_policy *policy = fscrypt_get_dummy_policy(sb); 839 int vers; 840 841 if (!policy) 842 return; 843 844 vers = policy->version; 845 if (vers == FSCRYPT_POLICY_V1) /* Handle numbering quirk */ 846 vers = 1; 847 848 seq_printf(seq, "%ctest_dummy_encryption=v%d", sep, vers); 849} 850EXPORT_SYMBOL_GPL(fscrypt_show_test_dummy_encryption); |