1 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ 2 /* 3 * fscrypt user API 4 * 5 * These ioctls can be used on filesystems that support fscrypt. See the 6 * "User API" section of Documentation/filesystems/fscrypt.rst. 7 */ 8 #ifndef _UAPI_LINUX_FSCRYPT_H 9 #define _UAPI_LINUX_FSCRYPT_H 10 11 #include <linux/ioctl.h> 12 #include <linux/types.h> 13 14 /* Encryption policy flags */ 15 #define FSCRYPT_POLICY_FLAGS_PAD_4 0x00 16 #define FSCRYPT_POLICY_FLAGS_PAD_8 0x01 17 #define FSCRYPT_POLICY_FLAGS_PAD_16 0x02 18 #define FSCRYPT_POLICY_FLAGS_PAD_32 0x03 19 #define FSCRYPT_POLICY_FLAGS_PAD_MASK 0x03 20 #define FSCRYPT_POLICY_FLAG_DIRECT_KEY 0x04 21 #define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 0x08 22 #define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32 0x10 23 24 /* Encryption algorithms */ 25 #define FSCRYPT_MODE_AES_256_XTS 1 26 #define FSCRYPT_MODE_AES_256_CTS 4 27 #define FSCRYPT_MODE_AES_128_CBC 5 28 #define FSCRYPT_MODE_AES_128_CTS 6 29 #define FSCRYPT_MODE_SM4_XTS 7 30 #define FSCRYPT_MODE_SM4_CTS 8 31 #define FSCRYPT_MODE_ADIANTUM 9 32 #define FSCRYPT_MODE_AES_256_HCTR2 10 33 34 /* 35 * Legacy policy version; ad-hoc KDF and no key verification. 36 * For new encrypted directories, use fscrypt_policy_v2 instead. 37 * 38 * Careful: the .version field for this is actually 0, not 1. 39 */ 40 #define FSCRYPT_POLICY_V1 0 41 #define FSCRYPT_KEY_DESCRIPTOR_SIZE 8 42 struct fscrypt_policy_v1 { 43 __u8 version; 44 __u8 contents_encryption_mode; 45 __u8 filenames_encryption_mode; 46 __u8 flags; 47 __u8 master_key_descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE]; 48 }; 49 50 /* 51 * Process-subscribed "logon" key description prefix and payload format. 52 * Deprecated; prefer FS_IOC_ADD_ENCRYPTION_KEY instead. 53 */ 54 #define FSCRYPT_KEY_DESC_PREFIX "fscrypt:" 55 #define FSCRYPT_KEY_DESC_PREFIX_SIZE 8 56 #define FSCRYPT_MAX_KEY_SIZE 64 57 struct fscrypt_key { 58 __u32 mode; 59 __u8 raw[FSCRYPT_MAX_KEY_SIZE]; 60 __u32 size; 61 }; 62 63 /* 64 * New policy version with HKDF and key verification (recommended). 65 */ 66 #define FSCRYPT_POLICY_V2 2 67 #define FSCRYPT_KEY_IDENTIFIER_SIZE 16 68 struct fscrypt_policy_v2 { 69 __u8 version; 70 __u8 contents_encryption_mode; 71 __u8 filenames_encryption_mode; 72 __u8 flags; 73 __u8 log2_data_unit_size; 74 __u8 __reserved[3]; 75 __u8 master_key_identifier[FSCRYPT_KEY_IDENTIFIER_SIZE]; 76 }; 77 78 /* Struct passed to FS_IOC_GET_ENCRYPTION_POLICY_EX */ 79 struct fscrypt_get_policy_ex_arg { 80 __u64 policy_size; /* input/output */ 81 union { 82 __u8 version; 83 struct fscrypt_policy_v1 v1; 84 struct fscrypt_policy_v2 v2; 85 } policy; /* output */ 86 }; 87 88 /* 89 * v1 policy keys are specified by an arbitrary 8-byte key "descriptor", 90 * matching fscrypt_policy_v1::master_key_descriptor. 91 */ 92 #define FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR 1 93 94 /* 95 * v2 policy keys are specified by a 16-byte key "identifier" which the kernel 96 * calculates as a cryptographic hash of the key itself, 97 * matching fscrypt_policy_v2::master_key_identifier. 98 */ 99 #define FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER 2 100 101 /* 102 * Specifies a key, either for v1 or v2 policies. This doesn't contain the 103 * actual key itself; this is just the "name" of the key. 104 */ 105 struct fscrypt_key_specifier { 106 __u32 type; /* one of FSCRYPT_KEY_SPEC_TYPE_* */ 107 __u32 __reserved; 108 union { 109 __u8 __reserved[32]; /* reserve some extra space */ 110 __u8 descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE]; 111 __u8 identifier[FSCRYPT_KEY_IDENTIFIER_SIZE]; 112 } u; 113 }; 114 115 /* 116 * Payload of Linux keyring key of type "fscrypt-provisioning", referenced by 117 * fscrypt_add_key_arg::key_id as an alternative to fscrypt_add_key_arg::raw. 118 */ 119 struct fscrypt_provisioning_key_payload { 120 __u32 type; 121 __u32 flags; 122 __u8 raw[]; 123 }; 124 125 /* Struct passed to FS_IOC_ADD_ENCRYPTION_KEY */ 126 struct fscrypt_add_key_arg { 127 struct fscrypt_key_specifier key_spec; 128 __u32 raw_size; 129 __u32 key_id; 130 #define FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED 0x00000001 131 __u32 flags; 132 __u32 __reserved[7]; 133 __u8 raw[]; 134 }; 135 136 /* Struct passed to FS_IOC_REMOVE_ENCRYPTION_KEY */ 137 struct fscrypt_remove_key_arg { 138 struct fscrypt_key_specifier key_spec; 139 #define FSCRYPT_KEY_REMOVAL_STATUS_FLAG_FILES_BUSY 0x00000001 140 #define FSCRYPT_KEY_REMOVAL_STATUS_FLAG_OTHER_USERS 0x00000002 141 __u32 removal_status_flags; /* output */ 142 __u32 __reserved[5]; 143 }; 144 145 /* Struct passed to FS_IOC_GET_ENCRYPTION_KEY_STATUS */ 146 struct fscrypt_get_key_status_arg { 147 /* input */ 148 struct fscrypt_key_specifier key_spec; 149 __u32 __reserved[6]; 150 151 /* output */ 152 #define FSCRYPT_KEY_STATUS_ABSENT 1 153 #define FSCRYPT_KEY_STATUS_PRESENT 2 154 #define FSCRYPT_KEY_STATUS_INCOMPLETELY_REMOVED 3 155 __u32 status; 156 #define FSCRYPT_KEY_STATUS_FLAG_ADDED_BY_SELF 0x00000001 157 __u32 status_flags; 158 __u32 user_count; 159 __u32 __out_reserved[13]; 160 }; 161 162 #define FS_IOC_SET_ENCRYPTION_POLICY _IOR('f', 19, struct fscrypt_policy_v1) 163 #define FS_IOC_GET_ENCRYPTION_PWSALT _IOW('f', 20, __u8[16]) 164 #define FS_IOC_GET_ENCRYPTION_POLICY _IOW('f', 21, struct fscrypt_policy_v1) 165 #define FS_IOC_GET_ENCRYPTION_POLICY_EX _IOWR('f', 22, __u8[9]) /* size + version */ 166 #define FS_IOC_ADD_ENCRYPTION_KEY _IOWR('f', 23, struct fscrypt_add_key_arg) 167 #define FS_IOC_REMOVE_ENCRYPTION_KEY _IOWR('f', 24, struct fscrypt_remove_key_arg) 168 #define FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS _IOWR('f', 25, struct fscrypt_remove_key_arg) 169 #define FS_IOC_GET_ENCRYPTION_KEY_STATUS _IOWR('f', 26, struct fscrypt_get_key_status_arg) 170 #define FS_IOC_GET_ENCRYPTION_NONCE _IOR('f', 27, __u8[16]) 171 172 /**********************************************************************/ 173 174 /* old names; don't add anything new here! */ 175 #ifndef __KERNEL__ 176 #define fscrypt_policy fscrypt_policy_v1 177 #define FS_KEY_DESCRIPTOR_SIZE FSCRYPT_KEY_DESCRIPTOR_SIZE 178 #define FS_POLICY_FLAGS_PAD_4 FSCRYPT_POLICY_FLAGS_PAD_4 179 #define FS_POLICY_FLAGS_PAD_8 FSCRYPT_POLICY_FLAGS_PAD_8 180 #define FS_POLICY_FLAGS_PAD_16 FSCRYPT_POLICY_FLAGS_PAD_16 181 #define FS_POLICY_FLAGS_PAD_32 FSCRYPT_POLICY_FLAGS_PAD_32 182 #define FS_POLICY_FLAGS_PAD_MASK FSCRYPT_POLICY_FLAGS_PAD_MASK 183 #define FS_POLICY_FLAG_DIRECT_KEY FSCRYPT_POLICY_FLAG_DIRECT_KEY 184 #define FS_POLICY_FLAGS_VALID 0x07 /* contains old flags only */ 185 #define FS_ENCRYPTION_MODE_INVALID 0 /* never used */ 186 #define FS_ENCRYPTION_MODE_AES_256_XTS FSCRYPT_MODE_AES_256_XTS 187 #define FS_ENCRYPTION_MODE_AES_256_GCM 2 /* never used */ 188 #define FS_ENCRYPTION_MODE_AES_256_CBC 3 /* never used */ 189 #define FS_ENCRYPTION_MODE_AES_256_CTS FSCRYPT_MODE_AES_256_CTS 190 #define FS_ENCRYPTION_MODE_AES_128_CBC FSCRYPT_MODE_AES_128_CBC 191 #define FS_ENCRYPTION_MODE_AES_128_CTS FSCRYPT_MODE_AES_128_CTS 192 #define FS_ENCRYPTION_MODE_ADIANTUM FSCRYPT_MODE_ADIANTUM 193 #define FS_KEY_DESC_PREFIX FSCRYPT_KEY_DESC_PREFIX 194 #define FS_KEY_DESC_PREFIX_SIZE FSCRYPT_KEY_DESC_PREFIX_SIZE 195 #define FS_MAX_KEY_SIZE FSCRYPT_MAX_KEY_SIZE 196 #endif /* !__KERNEL__ */ 197 198 #endif /* _UAPI_LINUX_FSCRYPT_H */ 199