1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Filesystem-level keyring for fscrypt 4 * 5 * Copyright 2019 Google LLC 6 */ 7 8 /* 9 * This file implements management of fscrypt master keys in the 10 * filesystem-level keyring, including the ioctls: 11 * 12 * - FS_IOC_ADD_ENCRYPTION_KEY 13 * - FS_IOC_REMOVE_ENCRYPTION_KEY 14 * - FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS 15 * - FS_IOC_GET_ENCRYPTION_KEY_STATUS 16 * 17 * See the "User API" section of Documentation/filesystems/fscrypt.rst for more 18 * information about these ioctls. 19 */ 20 21 #include <crypto/skcipher.h> 22 #include <linux/export.h> 23 #include <linux/key-type.h> 24 #include <linux/once.h> 25 #include <linux/random.h> 26 #include <linux/seq_file.h> 27 #include <linux/unaligned.h> 28 29 #include "fscrypt_private.h" 30 31 /* The master encryption keys for a filesystem (->s_master_keys) */ 32 struct fscrypt_keyring { 33 /* 34 * Lock that protects ->key_hashtable. It does *not* protect the 35 * fscrypt_master_key structs themselves. 36 */ 37 spinlock_t lock; 38 39 /* Hash table that maps fscrypt_key_specifier to fscrypt_master_key */ 40 struct hlist_head key_hashtable[128]; 41 }; 42 43 static void wipe_master_key_secret(struct fscrypt_master_key_secret *secret) 44 { 45 memzero_explicit(secret, sizeof(*secret)); 46 } 47 48 static void move_master_key_secret(struct fscrypt_master_key_secret *dst, 49 struct fscrypt_master_key_secret *src) 50 { 51 memcpy(dst, src, sizeof(*dst)); 52 memzero_explicit(src, sizeof(*src)); 53 } 54 55 static void fscrypt_free_master_key(struct rcu_head *head) 56 { 57 struct fscrypt_master_key *mk = 58 container_of(head, struct fscrypt_master_key, mk_rcu_head); 59 /* 60 * The master key secret and any embedded subkeys should have already 61 * been wiped when the last active reference to the fscrypt_master_key 62 * struct was dropped; doing it here would be unnecessarily late. 63 * Nevertheless, use kfree_sensitive() in case anything was missed. 64 */ 65 kfree_sensitive(mk); 66 } 67 68 static void clear_mk_users(struct fscrypt_master_key *mk); 69 70 void fscrypt_put_master_key(struct fscrypt_master_key *mk) 71 { 72 if (!refcount_dec_and_test(&mk->mk_struct_refs)) 73 return; 74 /* 75 * No structural references left, so clear ->mk_users, and also free the 76 * fscrypt_master_key struct itself after an RCU grace period ensures 77 * that concurrent keyring lookups can no longer find it. 78 */ 79 WARN_ON_ONCE(refcount_read(&mk->mk_active_refs) != 0); 80 clear_mk_users(mk); 81 call_rcu(&mk->mk_rcu_head, fscrypt_free_master_key); 82 } 83 84 void fscrypt_put_master_key_activeref(struct super_block *sb, 85 struct fscrypt_master_key *mk) 86 { 87 struct fscrypt_mode_key *node, *tmp; 88 89 if (!refcount_dec_and_test(&mk->mk_active_refs)) 90 return; 91 /* 92 * No active references left, so complete the full removal of this 93 * fscrypt_master_key struct by removing it from the keyring and 94 * destroying any non-file-scoped subkeys. 95 */ 96 97 if (WARN_ON_ONCE(!sb->s_master_keys)) 98 return; 99 spin_lock(&sb->s_master_keys->lock); 100 hlist_del_rcu(&mk->mk_node); 101 spin_unlock(&sb->s_master_keys->lock); 102 103 /* 104 * ->mk_active_refs == 0 implies that ->mk_present is false and 105 * ->mk_decrypted_inodes is empty. 106 */ 107 WARN_ON_ONCE(mk->mk_present); 108 WARN_ON_ONCE(!list_empty(&mk->mk_decrypted_inodes)); 109 110 /* 111 * Destroy any non-file-scoped subkeys. Since ->mk_active_refs == 0, 112 * they're no longer referenced by any inodes. Nor can key setup run 113 * and use them again. So they're no longer needed. (This implies no 114 * concurrent readers, so we don't need list_del_rcu() for example.) 115 */ 116 list_for_each_entry_safe(node, tmp, &mk->mk_mode_keys, link) { 117 fscrypt_destroy_prepared_key(sb, &node->key); 118 list_del(&node->link); 119 kfree(node); 120 } 121 memzero_explicit(&mk->mk_ino_hash_key, 122 sizeof(mk->mk_ino_hash_key)); 123 mk->mk_ino_hash_key_initialized = false; 124 125 /* Drop the structural ref associated with the active refs. */ 126 fscrypt_put_master_key(mk); 127 } 128 129 /* 130 * This transitions the key state from present to incompletely removed, and then 131 * potentially to absent (depending on whether inodes remain). 132 */ 133 static void fscrypt_initiate_key_removal(struct super_block *sb, 134 struct fscrypt_master_key *mk) 135 { 136 WRITE_ONCE(mk->mk_present, false); 137 wipe_master_key_secret(&mk->mk_secret); 138 fscrypt_put_master_key_activeref(sb, mk); 139 } 140 141 static inline bool valid_key_spec(const struct fscrypt_key_specifier *spec) 142 { 143 if (spec->__reserved) 144 return false; 145 return master_key_spec_len(spec) != 0; 146 } 147 148 static int fscrypt_user_key_instantiate(struct key *key, 149 struct key_preparsed_payload *prep) 150 { 151 /* 152 * We just charge FSCRYPT_MAX_RAW_KEY_SIZE bytes to the user's key quota 153 * for each key, regardless of the exact key size. The amount of memory 154 * actually used is greater than the size of the raw key anyway. 155 */ 156 return key_payload_reserve(key, FSCRYPT_MAX_RAW_KEY_SIZE); 157 } 158 159 static void fscrypt_user_key_describe(const struct key *key, struct seq_file *m) 160 { 161 seq_puts(m, key->description); 162 } 163 164 /* 165 * Type of fscrypt_master_key_user::quota_key. This contains no secret; it 166 * exists solely to charge a user's key quota. 167 * 168 * Note that the name of this key type really should be something like 169 * ".fscrypt-user" instead of simply ".fscrypt". But the shorter name is chosen 170 * mainly for simplicity of presentation in /proc/keys when read by a non-root 171 * user. And it is expected to be rare that a key is actually added by multiple 172 * users, since users should keep their encryption keys confidential. 173 */ 174 static struct key_type key_type_fscrypt_user = { 175 .name = ".fscrypt", 176 .instantiate = fscrypt_user_key_instantiate, 177 .describe = fscrypt_user_key_describe, 178 }; 179 180 #define FSCRYPT_MK_USER_DESCRIPTION_SIZE \ 181 (2 * FSCRYPT_KEY_IDENTIFIER_SIZE + CONST_STRLEN(".uid.") + 10 + 1) 182 183 /* Create ->s_master_keys if needed. Synchronized by fscrypt_add_key_mutex. */ 184 static int allocate_filesystem_keyring(struct super_block *sb) 185 { 186 struct fscrypt_keyring *keyring; 187 188 if (sb->s_master_keys) 189 return 0; 190 191 keyring = kzalloc_obj(*keyring); 192 if (!keyring) 193 return -ENOMEM; 194 spin_lock_init(&keyring->lock); 195 /* 196 * Pairs with the smp_load_acquire() in fscrypt_find_master_key(). 197 * I.e., here we publish ->s_master_keys with a RELEASE barrier so that 198 * concurrent tasks can ACQUIRE it. 199 */ 200 smp_store_release(&sb->s_master_keys, keyring); 201 return 0; 202 } 203 204 /* 205 * Release all encryption keys that have been added to the filesystem, along 206 * with the keyring that contains them. 207 * 208 * This is called at unmount time, after all potentially-encrypted inodes have 209 * been evicted. The filesystem's underlying block device(s) are still 210 * available at this time; this is important because after user file accesses 211 * have been allowed, this function may need to evict keys from the keyslots of 212 * an inline crypto engine, which requires the block device(s). 213 */ 214 void fscrypt_destroy_keyring(struct super_block *sb) 215 { 216 struct fscrypt_keyring *keyring = sb->s_master_keys; 217 size_t i; 218 219 if (!keyring) 220 return; 221 222 for (i = 0; i < ARRAY_SIZE(keyring->key_hashtable); i++) { 223 struct hlist_head *bucket = &keyring->key_hashtable[i]; 224 struct fscrypt_master_key *mk; 225 struct hlist_node *tmp; 226 227 hlist_for_each_entry_safe(mk, tmp, bucket, mk_node) { 228 /* 229 * Since all potentially-encrypted inodes were already 230 * evicted, every key remaining in the keyring should 231 * have an empty inode list, and should only still be in 232 * the keyring due to the single active ref associated 233 * with ->mk_present. There should be no structural 234 * refs beyond the one associated with the active ref. 235 */ 236 WARN_ON_ONCE(refcount_read(&mk->mk_active_refs) != 1); 237 WARN_ON_ONCE(refcount_read(&mk->mk_struct_refs) != 1); 238 WARN_ON_ONCE(!mk->mk_present); 239 fscrypt_initiate_key_removal(sb, mk); 240 } 241 } 242 kfree_sensitive(keyring); 243 sb->s_master_keys = NULL; 244 } 245 246 static struct hlist_head * 247 fscrypt_mk_hash_bucket(struct fscrypt_keyring *keyring, 248 const struct fscrypt_key_specifier *mk_spec) 249 { 250 /* 251 * Since key specifiers should be "random" values, it is sufficient to 252 * use a trivial hash function that just takes the first several bits of 253 * the key specifier. 254 */ 255 unsigned long i = get_unaligned((unsigned long *)&mk_spec->u); 256 257 return &keyring->key_hashtable[i % ARRAY_SIZE(keyring->key_hashtable)]; 258 } 259 260 /* 261 * Find the specified master key struct in ->s_master_keys and take a structural 262 * ref to it. The structural ref guarantees that the key struct continues to 263 * exist, but it does *not* guarantee that ->s_master_keys continues to contain 264 * the key struct. The structural ref needs to be dropped by 265 * fscrypt_put_master_key(). Returns NULL if the key struct is not found. 266 */ 267 struct fscrypt_master_key * 268 fscrypt_find_master_key(struct super_block *sb, 269 const struct fscrypt_key_specifier *mk_spec) 270 { 271 struct fscrypt_keyring *keyring; 272 struct hlist_head *bucket; 273 struct fscrypt_master_key *mk; 274 275 /* 276 * Pairs with the smp_store_release() in allocate_filesystem_keyring(). 277 * I.e., another task can publish ->s_master_keys concurrently, 278 * executing a RELEASE barrier. We need to use smp_load_acquire() here 279 * to safely ACQUIRE the memory the other task published. 280 */ 281 keyring = smp_load_acquire(&sb->s_master_keys); 282 if (keyring == NULL) 283 return NULL; /* No keyring yet, so no keys yet. */ 284 285 bucket = fscrypt_mk_hash_bucket(keyring, mk_spec); 286 rcu_read_lock(); 287 switch (mk_spec->type) { 288 case FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR: 289 hlist_for_each_entry_rcu(mk, bucket, mk_node) { 290 if (mk->mk_spec.type == 291 FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR && 292 memcmp(mk->mk_spec.u.descriptor, 293 mk_spec->u.descriptor, 294 FSCRYPT_KEY_DESCRIPTOR_SIZE) == 0 && 295 refcount_inc_not_zero(&mk->mk_struct_refs)) 296 goto out; 297 } 298 break; 299 case FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER: 300 hlist_for_each_entry_rcu(mk, bucket, mk_node) { 301 if (mk->mk_spec.type == 302 FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER && 303 memcmp(mk->mk_spec.u.identifier, 304 mk_spec->u.identifier, 305 FSCRYPT_KEY_IDENTIFIER_SIZE) == 0 && 306 refcount_inc_not_zero(&mk->mk_struct_refs)) 307 goto out; 308 } 309 break; 310 } 311 mk = NULL; 312 out: 313 rcu_read_unlock(); 314 return mk; 315 } 316 317 /* Find the current user's claim in ->mk_users. ->mk_sem must be held. */ 318 static struct fscrypt_master_key_user * 319 find_master_key_user(struct fscrypt_master_key *mk) 320 { 321 struct fscrypt_master_key_user *mk_user; 322 kuid_t uid = current_fsuid(); 323 324 list_for_each_entry(mk_user, &mk->mk_users, link) { 325 if (uid_eq(mk_user->uid, uid)) 326 return mk_user; 327 } 328 return NULL; 329 } 330 331 /* 332 * Give the current user a claim in ->mk_users. This charges the user's quota 333 * and marks the master key as added by the current user, so that it cannot be 334 * removed by another user with the key. Either ->mk_sem must be held for 335 * write, or the master key must be still undergoing initialization. 336 */ 337 static int add_master_key_user(struct fscrypt_master_key *mk) 338 { 339 kuid_t uid = current_fsuid(); 340 char description[FSCRYPT_MK_USER_DESCRIPTION_SIZE]; 341 struct key *quota_key; 342 struct fscrypt_master_key_user *mk_user; 343 int err; 344 345 snprintf(description, sizeof(description), "%*phN.uid.%u", 346 FSCRYPT_KEY_IDENTIFIER_SIZE, mk->mk_spec.u.identifier, 347 __kuid_val(uid)); 348 quota_key = key_alloc(&key_type_fscrypt_user, description, uid, 349 current_gid(), current_cred(), 350 KEY_POS_SEARCH | KEY_USR_VIEW, 0, NULL); 351 if (IS_ERR(quota_key)) 352 return PTR_ERR(quota_key); 353 354 err = key_instantiate_and_link(quota_key, NULL, 0, NULL, NULL); 355 if (err) { 356 key_put(quota_key); 357 return err; 358 } 359 360 mk_user = kzalloc_obj(*mk_user); 361 if (!mk_user) { 362 key_put(quota_key); 363 return -ENOMEM; 364 } 365 mk_user->uid = uid; 366 mk_user->quota_key = quota_key; 367 list_add(&mk_user->link, &mk->mk_users); 368 return 0; 369 } 370 371 static void unlink_and_free_mk_user(struct fscrypt_master_key_user *mk_user) 372 { 373 list_del(&mk_user->link); 374 key_put(mk_user->quota_key); 375 kfree(mk_user); 376 } 377 378 /* 379 * Remove the current user's claim from ->mk_users. 380 * ->mk_sem must be held for write. 381 * 382 * Returns 0 if removed or -ENOKEY if not found. 383 */ 384 static int remove_master_key_user(struct fscrypt_master_key *mk) 385 { 386 struct fscrypt_master_key_user *mk_user; 387 388 mk_user = find_master_key_user(mk); 389 if (!mk_user) 390 return -ENOKEY; 391 unlink_and_free_mk_user(mk_user); 392 return 0; 393 } 394 395 /* 396 * Clear ->mk_users. Either ->mk_sem must be held for write, or 'mk' must have 397 * no structural references left. 398 */ 399 static void clear_mk_users(struct fscrypt_master_key *mk) 400 { 401 struct fscrypt_master_key_user *mk_user, *tmp; 402 403 list_for_each_entry_safe(mk_user, tmp, &mk->mk_users, link) 404 unlink_and_free_mk_user(mk_user); 405 } 406 407 /* 408 * Allocate a new fscrypt_master_key, transfer the given secret over to it, and 409 * insert it into sb->s_master_keys. 410 */ 411 static int add_new_master_key(struct super_block *sb, 412 struct fscrypt_master_key_secret *secret, 413 const struct fscrypt_key_specifier *mk_spec) 414 { 415 struct fscrypt_keyring *keyring = sb->s_master_keys; 416 struct fscrypt_master_key *mk; 417 int err; 418 419 mk = kzalloc_obj(*mk); 420 if (!mk) 421 return -ENOMEM; 422 423 init_rwsem(&mk->mk_sem); 424 refcount_set(&mk->mk_struct_refs, 1); 425 mk->mk_spec = *mk_spec; 426 427 INIT_LIST_HEAD(&mk->mk_users); 428 429 INIT_LIST_HEAD(&mk->mk_decrypted_inodes); 430 spin_lock_init(&mk->mk_decrypted_inodes_lock); 431 432 INIT_LIST_HEAD(&mk->mk_mode_keys); 433 434 if (mk_spec->type == FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER) { 435 err = add_master_key_user(mk); 436 if (err) 437 goto out_put; 438 } 439 440 move_master_key_secret(&mk->mk_secret, secret); 441 mk->mk_present = true; 442 refcount_set(&mk->mk_active_refs, 1); /* ->mk_present is true */ 443 444 spin_lock(&keyring->lock); 445 hlist_add_head_rcu(&mk->mk_node, 446 fscrypt_mk_hash_bucket(keyring, mk_spec)); 447 spin_unlock(&keyring->lock); 448 return 0; 449 450 out_put: 451 fscrypt_put_master_key(mk); 452 return err; 453 } 454 455 #define KEY_DEAD 1 456 457 static int add_existing_master_key(struct fscrypt_master_key *mk, 458 struct fscrypt_master_key_secret *secret) 459 { 460 int err; 461 462 /* 463 * For v2 policy keys (FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER): If the current 464 * user is already in ->mk_users, then there's nothing to do. 465 * Otherwise, add the user to ->mk_users. 466 */ 467 if (mk->mk_spec.type == FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER) { 468 if (find_master_key_user(mk) != NULL) 469 return 0; 470 err = add_master_key_user(mk); 471 if (err) 472 return err; 473 } 474 475 /* If the key is incompletely removed, make it present again. */ 476 if (!mk->mk_present) { 477 if (!refcount_inc_not_zero(&mk->mk_active_refs)) { 478 /* 479 * Raced with the last active ref being dropped, so the 480 * key has become, or is about to become, "absent". 481 * Therefore, we need to allocate a new key struct. 482 */ 483 return KEY_DEAD; 484 } 485 move_master_key_secret(&mk->mk_secret, secret); 486 WRITE_ONCE(mk->mk_present, true); 487 } 488 489 return 0; 490 } 491 492 static int do_add_master_key(struct super_block *sb, 493 struct fscrypt_master_key_secret *secret, 494 const struct fscrypt_key_specifier *mk_spec) 495 { 496 static DEFINE_MUTEX(fscrypt_add_key_mutex); 497 struct fscrypt_master_key *mk; 498 int err; 499 500 mutex_lock(&fscrypt_add_key_mutex); /* serialize find + link */ 501 502 mk = fscrypt_find_master_key(sb, mk_spec); 503 if (!mk) { 504 /* Didn't find the key in ->s_master_keys. Add it. */ 505 err = allocate_filesystem_keyring(sb); 506 if (!err) 507 err = add_new_master_key(sb, secret, mk_spec); 508 } else { 509 /* 510 * Found the key in ->s_master_keys. Add the user to ->mk_users 511 * if needed, and make the key "present" again if possible. 512 */ 513 down_write(&mk->mk_sem); 514 err = add_existing_master_key(mk, secret); 515 up_write(&mk->mk_sem); 516 if (err == KEY_DEAD) { 517 /* 518 * We found a key struct, but it's already been fully 519 * removed. Ignore the old struct and add a new one. 520 * fscrypt_add_key_mutex means we don't need to worry 521 * about concurrent adds. 522 */ 523 err = add_new_master_key(sb, secret, mk_spec); 524 } 525 fscrypt_put_master_key(mk); 526 } 527 mutex_unlock(&fscrypt_add_key_mutex); 528 return err; 529 } 530 531 static int add_master_key(struct super_block *sb, 532 struct fscrypt_master_key_secret *secret, 533 struct fscrypt_key_specifier *key_spec) 534 { 535 int err; 536 537 if (key_spec->type == FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER) { 538 u8 sw_secret[BLK_CRYPTO_SW_SECRET_SIZE]; 539 u8 *kdf_key = secret->bytes; 540 unsigned int kdf_key_size = secret->size; 541 u8 keyid_kdf_ctx = HKDF_CONTEXT_KEY_IDENTIFIER_FOR_RAW_KEY; 542 543 /* 544 * For raw keys, the fscrypt master key is used directly as the 545 * fscrypt KDF key. For hardware-wrapped keys, we have to pass 546 * the master key to the hardware to derive the KDF key, which 547 * is then only used to derive non-file-contents subkeys. 548 */ 549 if (secret->is_hw_wrapped) { 550 err = fscrypt_derive_sw_secret(sb, secret->bytes, 551 secret->size, sw_secret); 552 if (err) 553 return err; 554 kdf_key = sw_secret; 555 kdf_key_size = sizeof(sw_secret); 556 /* 557 * To avoid weird behavior if someone manages to 558 * determine sw_secret and add it as a raw key, ensure 559 * that hardware-wrapped keys and raw keys will have 560 * different key identifiers by deriving their key 561 * identifiers using different KDF contexts. 562 */ 563 keyid_kdf_ctx = 564 HKDF_CONTEXT_KEY_IDENTIFIER_FOR_HW_WRAPPED_KEY; 565 } 566 fscrypt_init_hkdf(&secret->hkdf, kdf_key, kdf_key_size); 567 /* 568 * Now that the KDF context is initialized, the raw KDF key is 569 * no longer needed. 570 */ 571 memzero_explicit(kdf_key, kdf_key_size); 572 573 /* Calculate the key identifier */ 574 fscrypt_hkdf_expand(&secret->hkdf, keyid_kdf_ctx, NULL, 0, 575 key_spec->u.identifier, 576 FSCRYPT_KEY_IDENTIFIER_SIZE); 577 } 578 return do_add_master_key(sb, secret, key_spec); 579 } 580 581 /* 582 * Validate the size of an fscrypt master key being added. Note that this is 583 * just an initial check, as we don't know which ciphers will be used yet. 584 * There is a stricter size check later when the key is actually used by a file. 585 */ 586 static inline bool fscrypt_valid_key_size(size_t size, u32 add_key_flags) 587 { 588 u32 max_size = (add_key_flags & FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED) ? 589 FSCRYPT_MAX_HW_WRAPPED_KEY_SIZE : 590 FSCRYPT_MAX_RAW_KEY_SIZE; 591 592 return size >= FSCRYPT_MIN_KEY_SIZE && size <= max_size; 593 } 594 595 static int fscrypt_provisioning_key_preparse(struct key_preparsed_payload *prep) 596 { 597 const struct fscrypt_provisioning_key_payload *payload = prep->data; 598 599 if (prep->datalen < sizeof(*payload)) 600 return -EINVAL; 601 602 if (!fscrypt_valid_key_size(prep->datalen - sizeof(*payload), 603 payload->flags)) 604 return -EINVAL; 605 606 if (payload->type != FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR && 607 payload->type != FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER) 608 return -EINVAL; 609 610 if (payload->flags & ~FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED) 611 return -EINVAL; 612 613 prep->payload.data[0] = kmemdup(payload, prep->datalen, GFP_KERNEL); 614 if (!prep->payload.data[0]) 615 return -ENOMEM; 616 617 prep->quotalen = prep->datalen; 618 return 0; 619 } 620 621 static void fscrypt_provisioning_key_free_preparse( 622 struct key_preparsed_payload *prep) 623 { 624 kfree_sensitive(prep->payload.data[0]); 625 } 626 627 static void fscrypt_provisioning_key_describe(const struct key *key, 628 struct seq_file *m) 629 { 630 seq_puts(m, key->description); 631 if (key_is_positive(key)) { 632 const struct fscrypt_provisioning_key_payload *payload = 633 key->payload.data[0]; 634 635 seq_printf(m, ": %u [%u]", key->datalen, payload->type); 636 } 637 } 638 639 static void fscrypt_provisioning_key_destroy(struct key *key) 640 { 641 kfree_sensitive(key->payload.data[0]); 642 } 643 644 static struct key_type key_type_fscrypt_provisioning = { 645 .name = "fscrypt-provisioning", 646 .preparse = fscrypt_provisioning_key_preparse, 647 .free_preparse = fscrypt_provisioning_key_free_preparse, 648 .instantiate = generic_key_instantiate, 649 .describe = fscrypt_provisioning_key_describe, 650 .destroy = fscrypt_provisioning_key_destroy, 651 }; 652 653 /* 654 * Retrieve the key from the Linux keyring key specified by 'key_id', and store 655 * it into 'secret'. 656 * 657 * The key must be of type "fscrypt-provisioning" and must have the 'type' and 658 * 'flags' field of the payload set to the given values, indicating that the key 659 * is intended for use for the specified purpose. We don't use the "logon" key 660 * type because there's no way to completely restrict the use of such keys; they 661 * can be used by any kernel API that accepts "logon" keys and doesn't require a 662 * specific service prefix. 663 * 664 * The ability to specify the key via Linux keyring key is intended for cases 665 * where userspace needs to re-add keys after the filesystem is unmounted and 666 * re-mounted. Most users should just provide the key directly instead. 667 */ 668 static int get_keyring_key(u32 key_id, u32 type, u32 flags, 669 struct fscrypt_master_key_secret *secret) 670 { 671 key_ref_t ref; 672 struct key *key; 673 const struct fscrypt_provisioning_key_payload *payload; 674 int err; 675 676 ref = lookup_user_key(key_id, 0, KEY_NEED_SEARCH); 677 if (IS_ERR(ref)) 678 return PTR_ERR(ref); 679 key = key_ref_to_ptr(ref); 680 681 if (key->type != &key_type_fscrypt_provisioning) 682 goto bad_key; 683 payload = key->payload.data[0]; 684 685 /* 686 * Don't allow fscrypt v1 keys to be used as v2 keys and vice versa. 687 * Similarly, don't allow hardware-wrapped keys to be used as 688 * non-hardware-wrapped keys and vice versa. 689 */ 690 if (payload->type != type || payload->flags != flags) 691 goto bad_key; 692 693 secret->size = key->datalen - sizeof(*payload); 694 memcpy(secret->bytes, payload->raw, secret->size); 695 err = 0; 696 goto out_put; 697 698 bad_key: 699 err = -EKEYREJECTED; 700 out_put: 701 key_ref_put(ref); 702 return err; 703 } 704 705 /* 706 * Add a master encryption key to the filesystem, causing all files which were 707 * encrypted with it to appear "unlocked" (decrypted) when accessed. 708 * 709 * When adding a key for use by v1 encryption policies, this ioctl is 710 * privileged, and userspace must provide the 'key_descriptor'. 711 * 712 * When adding a key for use by v2+ encryption policies, this ioctl is 713 * unprivileged. This is needed, in general, to allow non-root users to use 714 * encryption without encountering the visibility problems of process-subscribed 715 * keyrings and the inability to properly remove keys. This works by having 716 * each key identified by its cryptographically secure hash --- the 717 * 'key_identifier'. The cryptographic hash ensures that a malicious user 718 * cannot add the wrong key for a given identifier. Furthermore, each added key 719 * is charged to the appropriate user's quota for the keyrings service, which 720 * prevents a malicious user from adding too many keys. Finally, we forbid a 721 * user from removing a key while other users have added it too, which prevents 722 * a user who knows another user's key from causing a denial-of-service by 723 * removing it at an inopportune time. (We tolerate that a user who knows a key 724 * can prevent other users from removing it.) 725 * 726 * For more details, see the "FS_IOC_ADD_ENCRYPTION_KEY" section of 727 * Documentation/filesystems/fscrypt.rst. 728 */ 729 int fscrypt_ioctl_add_key(struct file *filp, void __user *_uarg) 730 { 731 struct super_block *sb = file_inode(filp)->i_sb; 732 struct fscrypt_add_key_arg __user *uarg = _uarg; 733 struct fscrypt_add_key_arg arg; 734 struct fscrypt_master_key_secret secret; 735 int err; 736 737 if (copy_from_user(&arg, uarg, sizeof(arg))) 738 return -EFAULT; 739 740 if (!valid_key_spec(&arg.key_spec)) 741 return -EINVAL; 742 743 if (memchr_inv(arg.__reserved, 0, sizeof(arg.__reserved))) 744 return -EINVAL; 745 746 /* 747 * Only root can add keys that are identified by an arbitrary descriptor 748 * rather than by a cryptographic hash --- since otherwise a malicious 749 * user could add the wrong key. 750 */ 751 if (arg.key_spec.type == FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR && 752 !capable(CAP_SYS_ADMIN)) 753 return -EACCES; 754 755 memset(&secret, 0, sizeof(secret)); 756 757 if (arg.flags) { 758 if (arg.flags & ~FSCRYPT_ADD_KEY_FLAG_HW_WRAPPED) 759 return -EINVAL; 760 if (arg.key_spec.type != FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER) 761 return -EINVAL; 762 secret.is_hw_wrapped = true; 763 } 764 765 if (arg.key_id) { 766 if (arg.raw_size != 0) 767 return -EINVAL; 768 err = get_keyring_key(arg.key_id, arg.key_spec.type, arg.flags, 769 &secret); 770 if (err) 771 goto out_wipe_secret; 772 } else { 773 if (!fscrypt_valid_key_size(arg.raw_size, arg.flags)) 774 return -EINVAL; 775 secret.size = arg.raw_size; 776 err = -EFAULT; 777 if (copy_from_user(secret.bytes, uarg->raw, secret.size)) 778 goto out_wipe_secret; 779 } 780 781 err = add_master_key(sb, &secret, &arg.key_spec); 782 if (err) 783 goto out_wipe_secret; 784 785 /* Return the key identifier to userspace, if applicable */ 786 err = -EFAULT; 787 if (arg.key_spec.type == FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER && 788 copy_to_user(uarg->key_spec.u.identifier, arg.key_spec.u.identifier, 789 FSCRYPT_KEY_IDENTIFIER_SIZE)) 790 goto out_wipe_secret; 791 err = 0; 792 out_wipe_secret: 793 wipe_master_key_secret(&secret); 794 return err; 795 } 796 EXPORT_SYMBOL_GPL(fscrypt_ioctl_add_key); 797 798 static void 799 fscrypt_get_test_dummy_secret(struct fscrypt_master_key_secret *secret) 800 { 801 static u8 test_key[FSCRYPT_MAX_RAW_KEY_SIZE]; 802 803 get_random_once(test_key, sizeof(test_key)); 804 805 memset(secret, 0, sizeof(*secret)); 806 secret->size = sizeof(test_key); 807 memcpy(secret->bytes, test_key, sizeof(test_key)); 808 } 809 810 void fscrypt_get_test_dummy_key_identifier( 811 u8 key_identifier[FSCRYPT_KEY_IDENTIFIER_SIZE]) 812 { 813 struct fscrypt_master_key_secret secret; 814 815 fscrypt_get_test_dummy_secret(&secret); 816 fscrypt_init_hkdf(&secret.hkdf, secret.bytes, secret.size); 817 fscrypt_hkdf_expand(&secret.hkdf, 818 HKDF_CONTEXT_KEY_IDENTIFIER_FOR_RAW_KEY, NULL, 0, 819 key_identifier, FSCRYPT_KEY_IDENTIFIER_SIZE); 820 wipe_master_key_secret(&secret); 821 } 822 823 /** 824 * fscrypt_add_test_dummy_key() - add the test dummy encryption key 825 * @sb: the filesystem instance to add the key to 826 * @key_spec: the key specifier of the test dummy encryption key 827 * 828 * Add the key for the test_dummy_encryption mount option to the filesystem. To 829 * prevent misuse of this mount option, a per-boot random key is used instead of 830 * a hardcoded one. This makes it so that any encrypted files created using 831 * this option won't be accessible after a reboot. 832 * 833 * Return: 0 on success, -errno on failure 834 */ 835 int fscrypt_add_test_dummy_key(struct super_block *sb, 836 struct fscrypt_key_specifier *key_spec) 837 { 838 struct fscrypt_master_key_secret secret; 839 int err; 840 841 fscrypt_get_test_dummy_secret(&secret); 842 err = add_master_key(sb, &secret, key_spec); 843 wipe_master_key_secret(&secret); 844 return err; 845 } 846 847 /* 848 * Verify that the current user has added a master key with the given identifier 849 * (returns -ENOKEY if not). This is needed to prevent a user from encrypting 850 * their files using some other user's key which they don't actually know. 851 * Cryptographically this isn't much of a problem, but the semantics of this 852 * would be a bit weird, so it's best to just forbid it. 853 * 854 * The system administrator (CAP_FOWNER) can override this, which should be 855 * enough for any use cases where encryption policies are being set using keys 856 * that were chosen ahead of time but aren't available at the moment. 857 * 858 * Note that the key may have already removed by the time this returns, but 859 * that's okay; we just care whether the key was there at some point. 860 * 861 * Return: 0 if the key is added, -ENOKEY if it isn't, or another -errno code 862 */ 863 int fscrypt_verify_key_added(struct super_block *sb, 864 const u8 identifier[FSCRYPT_KEY_IDENTIFIER_SIZE]) 865 { 866 struct fscrypt_key_specifier mk_spec; 867 struct fscrypt_master_key *mk; 868 int err; 869 870 mk_spec.type = FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER; 871 memcpy(mk_spec.u.identifier, identifier, FSCRYPT_KEY_IDENTIFIER_SIZE); 872 873 mk = fscrypt_find_master_key(sb, &mk_spec); 874 if (!mk) { 875 err = -ENOKEY; 876 goto out; 877 } 878 down_read(&mk->mk_sem); 879 if (find_master_key_user(mk) != NULL) 880 err = 0; 881 else 882 err = -ENOKEY; 883 up_read(&mk->mk_sem); 884 fscrypt_put_master_key(mk); 885 out: 886 if (err == -ENOKEY && capable(CAP_FOWNER)) 887 err = 0; 888 return err; 889 } 890 891 /* 892 * Try to evict the inode's dentries from the dentry cache. If the inode is a 893 * directory, then it can have at most one dentry; however, that dentry may be 894 * pinned by child dentries, so first try to evict the children too. 895 */ 896 static void shrink_dcache_inode(struct inode *inode) 897 { 898 struct dentry *dentry; 899 900 if (S_ISDIR(inode->i_mode)) { 901 dentry = d_find_any_alias(inode); 902 if (dentry) { 903 shrink_dcache_parent(dentry); 904 dput(dentry); 905 } 906 } 907 d_prune_aliases(inode); 908 } 909 910 static void evict_dentries_for_decrypted_inodes(struct fscrypt_master_key *mk) 911 { 912 struct fscrypt_inode_info *ci; 913 struct inode *inode; 914 struct inode *toput_inode = NULL; 915 916 spin_lock(&mk->mk_decrypted_inodes_lock); 917 918 list_for_each_entry(ci, &mk->mk_decrypted_inodes, ci_master_key_link) { 919 inode = ci->ci_inode; 920 spin_lock(&inode->i_lock); 921 if (inode_state_read(inode) & (I_FREEING | I_WILL_FREE | I_NEW)) { 922 spin_unlock(&inode->i_lock); 923 continue; 924 } 925 __iget(inode); 926 spin_unlock(&inode->i_lock); 927 spin_unlock(&mk->mk_decrypted_inodes_lock); 928 929 shrink_dcache_inode(inode); 930 iput(toput_inode); 931 toput_inode = inode; 932 933 spin_lock(&mk->mk_decrypted_inodes_lock); 934 } 935 936 spin_unlock(&mk->mk_decrypted_inodes_lock); 937 iput(toput_inode); 938 } 939 940 static int check_for_busy_inodes(struct super_block *sb, 941 struct fscrypt_master_key *mk) 942 { 943 struct list_head *pos; 944 size_t busy_count = 0; 945 char ino_str[50] = ""; 946 u64 ino; 947 948 spin_lock(&mk->mk_decrypted_inodes_lock); 949 950 list_for_each(pos, &mk->mk_decrypted_inodes) 951 busy_count++; 952 953 if (busy_count == 0) { 954 spin_unlock(&mk->mk_decrypted_inodes_lock); 955 return 0; 956 } 957 958 { 959 /* select an example file to show for debugging purposes */ 960 struct inode *inode = 961 list_first_entry(&mk->mk_decrypted_inodes, 962 struct fscrypt_inode_info, 963 ci_master_key_link)->ci_inode; 964 ino = inode->i_ino; 965 } 966 spin_unlock(&mk->mk_decrypted_inodes_lock); 967 968 /* If the inode is currently being created, ino may still be 0. */ 969 if (ino) 970 snprintf(ino_str, sizeof(ino_str), ", including ino %llu", ino); 971 972 fscrypt_warn(NULL, 973 "%s: %zu inode(s) still busy after removing key with %s %*phN%s", 974 sb->s_id, busy_count, master_key_spec_type(&mk->mk_spec), 975 master_key_spec_len(&mk->mk_spec), (u8 *)&mk->mk_spec.u, 976 ino_str); 977 return -EBUSY; 978 } 979 980 static int try_to_lock_encrypted_files(struct super_block *sb, 981 struct fscrypt_master_key *mk) 982 { 983 int err1; 984 int err2; 985 986 /* 987 * An inode can't be evicted while it is dirty or has dirty pages. 988 * Thus, we first have to clean the inodes in ->mk_decrypted_inodes. 989 * 990 * Just do it the easy way: call sync_filesystem(). It's overkill, but 991 * it works, and it's more important to minimize the amount of caches we 992 * drop than the amount of data we sync. Also, unprivileged users can 993 * already call sync_filesystem() via sys_syncfs() or sys_sync(). 994 */ 995 down_read(&sb->s_umount); 996 err1 = sync_filesystem(sb); 997 up_read(&sb->s_umount); 998 /* If a sync error occurs, still try to evict as much as possible. */ 999 1000 /* 1001 * Inodes are pinned by their dentries, so we have to evict their 1002 * dentries. shrink_dcache_sb() would suffice, but would be overkill 1003 * and inappropriate for use by unprivileged users. So instead go 1004 * through the inodes' alias lists and try to evict each dentry. 1005 */ 1006 evict_dentries_for_decrypted_inodes(mk); 1007 1008 /* 1009 * evict_dentries_for_decrypted_inodes() already iput() each inode in 1010 * the list; any inodes for which that dropped the last reference will 1011 * have been evicted due to fscrypt_drop_inode() detecting the key 1012 * removal and telling the VFS to evict the inode. So to finish, we 1013 * just need to check whether any inodes couldn't be evicted. 1014 */ 1015 err2 = check_for_busy_inodes(sb, mk); 1016 1017 return err1 ?: err2; 1018 } 1019 1020 /* 1021 * Try to remove an fscrypt master encryption key. 1022 * 1023 * FS_IOC_REMOVE_ENCRYPTION_KEY (all_users=false) removes the current user's 1024 * claim to the key, then removes the key itself if no other users have claims. 1025 * FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS (all_users=true) always removes the 1026 * key itself. 1027 * 1028 * To "remove the key itself", first we transition the key to the "incompletely 1029 * removed" state, so that no more inodes can be unlocked with it. Then we try 1030 * to evict all cached inodes that had been unlocked with the key. 1031 * 1032 * If all inodes were evicted, then we unlink the fscrypt_master_key from the 1033 * keyring. Otherwise it remains in the keyring in the "incompletely removed" 1034 * state where it tracks the list of remaining inodes. Userspace can execute 1035 * the ioctl again later to retry eviction, or alternatively can re-add the key. 1036 * 1037 * For more details, see the "Removing keys" section of 1038 * Documentation/filesystems/fscrypt.rst. 1039 */ 1040 static int do_remove_key(struct file *filp, void __user *_uarg, bool all_users) 1041 { 1042 struct super_block *sb = file_inode(filp)->i_sb; 1043 struct fscrypt_remove_key_arg __user *uarg = _uarg; 1044 struct fscrypt_remove_key_arg arg; 1045 struct fscrypt_master_key *mk; 1046 u32 status_flags = 0; 1047 int err; 1048 bool inodes_remain; 1049 1050 if (copy_from_user(&arg, uarg, sizeof(arg))) 1051 return -EFAULT; 1052 1053 if (!valid_key_spec(&arg.key_spec)) 1054 return -EINVAL; 1055 1056 if (memchr_inv(arg.__reserved, 0, sizeof(arg.__reserved))) 1057 return -EINVAL; 1058 1059 /* 1060 * Only root can add and remove keys that are identified by an arbitrary 1061 * descriptor rather than by a cryptographic hash. 1062 */ 1063 if (arg.key_spec.type == FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR && 1064 !capable(CAP_SYS_ADMIN)) 1065 return -EACCES; 1066 1067 /* Find the key being removed. */ 1068 mk = fscrypt_find_master_key(sb, &arg.key_spec); 1069 if (!mk) 1070 return -ENOKEY; 1071 down_write(&mk->mk_sem); 1072 1073 /* If relevant, remove current user's (or all users) claim to the key */ 1074 if (!list_empty(&mk->mk_users)) { 1075 if (all_users) { 1076 clear_mk_users(mk); 1077 err = 0; 1078 } else { 1079 err = remove_master_key_user(mk); 1080 } 1081 if (err) { 1082 up_write(&mk->mk_sem); 1083 goto out_put_key; 1084 } 1085 if (!list_empty(&mk->mk_users)) { 1086 /* 1087 * Other users have still added the key too. We removed 1088 * the current user's claim to the key, but we still 1089 * can't remove the key itself. 1090 */ 1091 status_flags |= 1092 FSCRYPT_KEY_REMOVAL_STATUS_FLAG_OTHER_USERS; 1093 err = 0; 1094 up_write(&mk->mk_sem); 1095 goto out_put_key; 1096 } 1097 } 1098 1099 /* No user claims remaining. Initiate removal of the key. */ 1100 err = -ENOKEY; 1101 if (mk->mk_present) { 1102 fscrypt_initiate_key_removal(sb, mk); 1103 err = 0; 1104 } 1105 inodes_remain = refcount_read(&mk->mk_active_refs) > 0; 1106 up_write(&mk->mk_sem); 1107 1108 if (inodes_remain) { 1109 /* Some inodes still reference this key; try to evict them. */ 1110 err = try_to_lock_encrypted_files(sb, mk); 1111 if (err == -EBUSY) { 1112 status_flags |= 1113 FSCRYPT_KEY_REMOVAL_STATUS_FLAG_FILES_BUSY; 1114 err = 0; 1115 } 1116 } 1117 /* 1118 * We return 0 if we successfully did something: removed a claim to the 1119 * key, initiated removal of the key, or tried locking the files again. 1120 * Users need to check the informational status flags if they care 1121 * whether the key has been fully removed including all files locked. 1122 */ 1123 out_put_key: 1124 fscrypt_put_master_key(mk); 1125 if (err == 0) 1126 err = put_user(status_flags, &uarg->removal_status_flags); 1127 return err; 1128 } 1129 1130 int fscrypt_ioctl_remove_key(struct file *filp, void __user *uarg) 1131 { 1132 return do_remove_key(filp, uarg, false); 1133 } 1134 EXPORT_SYMBOL_GPL(fscrypt_ioctl_remove_key); 1135 1136 int fscrypt_ioctl_remove_key_all_users(struct file *filp, void __user *uarg) 1137 { 1138 if (!capable(CAP_SYS_ADMIN)) 1139 return -EACCES; 1140 return do_remove_key(filp, uarg, true); 1141 } 1142 EXPORT_SYMBOL_GPL(fscrypt_ioctl_remove_key_all_users); 1143 1144 /* 1145 * Retrieve the status of an fscrypt master encryption key. 1146 * 1147 * We set ->status to indicate whether the key is absent, present, or 1148 * incompletely removed. (For an explanation of what these statuses mean and 1149 * how they are represented internally, see struct fscrypt_master_key.) This 1150 * field allows applications to easily determine the status of an encrypted 1151 * directory without using a hack such as trying to open a regular file in it 1152 * (which can confuse the "incompletely removed" status with absent or present). 1153 * 1154 * In addition, for v2 policy keys we allow applications to determine, via 1155 * ->status_flags and ->user_count, whether the key has been added by the 1156 * current user, by other users, or by both. Most applications should not need 1157 * this, since ordinarily only one user should know a given key. However, if a 1158 * secret key is shared by multiple users, applications may wish to add an 1159 * already-present key to prevent other users from removing it. This ioctl can 1160 * be used to check whether that really is the case before the work is done to 1161 * add the key --- which might e.g. require prompting the user for a passphrase. 1162 * 1163 * For more details, see the "FS_IOC_GET_ENCRYPTION_KEY_STATUS" section of 1164 * Documentation/filesystems/fscrypt.rst. 1165 */ 1166 int fscrypt_ioctl_get_key_status(struct file *filp, void __user *uarg) 1167 { 1168 struct super_block *sb = file_inode(filp)->i_sb; 1169 struct fscrypt_get_key_status_arg arg; 1170 struct fscrypt_master_key *mk; 1171 kuid_t uid; 1172 const struct fscrypt_master_key_user *mk_user; 1173 int err; 1174 1175 if (copy_from_user(&arg, uarg, sizeof(arg))) 1176 return -EFAULT; 1177 1178 if (!valid_key_spec(&arg.key_spec)) 1179 return -EINVAL; 1180 1181 if (memchr_inv(arg.__reserved, 0, sizeof(arg.__reserved))) 1182 return -EINVAL; 1183 1184 arg.status_flags = 0; 1185 arg.user_count = 0; 1186 memset(arg.__out_reserved, 0, sizeof(arg.__out_reserved)); 1187 1188 mk = fscrypt_find_master_key(sb, &arg.key_spec); 1189 if (!mk) { 1190 arg.status = FSCRYPT_KEY_STATUS_ABSENT; 1191 err = 0; 1192 goto out; 1193 } 1194 down_read(&mk->mk_sem); 1195 1196 if (!mk->mk_present) { 1197 arg.status = refcount_read(&mk->mk_active_refs) > 0 ? 1198 FSCRYPT_KEY_STATUS_INCOMPLETELY_REMOVED : 1199 FSCRYPT_KEY_STATUS_ABSENT /* raced with full removal */; 1200 err = 0; 1201 goto out_release_key; 1202 } 1203 1204 arg.status = FSCRYPT_KEY_STATUS_PRESENT; 1205 1206 uid = current_fsuid(); 1207 list_for_each_entry(mk_user, &mk->mk_users, link) { 1208 arg.user_count++; 1209 if (uid_eq(mk_user->uid, uid)) 1210 arg.status_flags |= 1211 FSCRYPT_KEY_STATUS_FLAG_ADDED_BY_SELF; 1212 } 1213 err = 0; 1214 out_release_key: 1215 up_read(&mk->mk_sem); 1216 fscrypt_put_master_key(mk); 1217 out: 1218 if (!err && copy_to_user(uarg, &arg, sizeof(arg))) 1219 err = -EFAULT; 1220 return err; 1221 } 1222 EXPORT_SYMBOL_GPL(fscrypt_ioctl_get_key_status); 1223 1224 int __init fscrypt_init_keyring(void) 1225 { 1226 int err; 1227 1228 err = register_key_type(&key_type_fscrypt_user); 1229 if (err) 1230 return err; 1231 1232 err = register_key_type(&key_type_fscrypt_provisioning); 1233 if (err) 1234 goto err_unregister_fscrypt_user; 1235 1236 return 0; 1237 1238 err_unregister_fscrypt_user: 1239 unregister_key_type(&key_type_fscrypt_user); 1240 return err; 1241 } 1242