1feed8258SEric Biggers // SPDX-License-Identifier: GPL-2.0 2feed8258SEric Biggers /* 3feed8258SEric Biggers * Key setup facility for FS encryption support. 4feed8258SEric Biggers * 5feed8258SEric Biggers * Copyright (C) 2015, Google, Inc. 6feed8258SEric Biggers * 7feed8258SEric Biggers * Originally written by Michael Halcrow, Ildar Muslukhov, and Uday Savagaonkar. 8feed8258SEric Biggers * Heavily modified since then. 9feed8258SEric Biggers */ 10feed8258SEric Biggers 11feed8258SEric Biggers #include <crypto/skcipher.h> 12feed8258SEric Biggers #include <linux/key.h> 13a992b20cSEric Biggers #include <linux/random.h> 14feed8258SEric Biggers 15feed8258SEric Biggers #include "fscrypt_private.h" 16feed8258SEric Biggers 1785af90e5SEric Biggers struct fscrypt_mode fscrypt_modes[] = { 18feed8258SEric Biggers [FSCRYPT_MODE_AES_256_XTS] = { 19feed8258SEric Biggers .friendly_name = "AES-256-XTS", 20feed8258SEric Biggers .cipher_str = "xts(aes)", 21feed8258SEric Biggers .keysize = 64, 227f595d6aSEric Biggers .security_strength = 32, 23feed8258SEric Biggers .ivsize = 16, 245fee3609SSatya Tangirala .blk_crypto_mode = BLK_ENCRYPTION_MODE_AES_256_XTS, 25feed8258SEric Biggers }, 26feed8258SEric Biggers [FSCRYPT_MODE_AES_256_CTS] = { 27feed8258SEric Biggers .friendly_name = "AES-256-CTS-CBC", 28feed8258SEric Biggers .cipher_str = "cts(cbc(aes))", 29feed8258SEric Biggers .keysize = 32, 307f595d6aSEric Biggers .security_strength = 32, 31feed8258SEric Biggers .ivsize = 16, 32feed8258SEric Biggers }, 33feed8258SEric Biggers [FSCRYPT_MODE_AES_128_CBC] = { 344006d799SEric Biggers .friendly_name = "AES-128-CBC-ESSIV", 354006d799SEric Biggers .cipher_str = "essiv(cbc(aes),sha256)", 36feed8258SEric Biggers .keysize = 16, 377f595d6aSEric Biggers .security_strength = 16, 38feed8258SEric Biggers .ivsize = 16, 395fee3609SSatya Tangirala .blk_crypto_mode = BLK_ENCRYPTION_MODE_AES_128_CBC_ESSIV, 40feed8258SEric Biggers }, 41feed8258SEric Biggers [FSCRYPT_MODE_AES_128_CTS] = { 42feed8258SEric Biggers .friendly_name = "AES-128-CTS-CBC", 43feed8258SEric Biggers .cipher_str = "cts(cbc(aes))", 44feed8258SEric Biggers .keysize = 16, 457f595d6aSEric Biggers .security_strength = 16, 46feed8258SEric Biggers .ivsize = 16, 47feed8258SEric Biggers }, 48feed8258SEric Biggers [FSCRYPT_MODE_ADIANTUM] = { 49feed8258SEric Biggers .friendly_name = "Adiantum", 50feed8258SEric Biggers .cipher_str = "adiantum(xchacha12,aes)", 51feed8258SEric Biggers .keysize = 32, 527f595d6aSEric Biggers .security_strength = 32, 53feed8258SEric Biggers .ivsize = 32, 545fee3609SSatya Tangirala .blk_crypto_mode = BLK_ENCRYPTION_MODE_ADIANTUM, 55feed8258SEric Biggers }, 56feed8258SEric Biggers }; 57feed8258SEric Biggers 58e3b1078bSEric Biggers static DEFINE_MUTEX(fscrypt_mode_key_setup_mutex); 59e3b1078bSEric Biggers 60feed8258SEric Biggers static struct fscrypt_mode * 615dae460cSEric Biggers select_encryption_mode(const union fscrypt_policy *policy, 625dae460cSEric Biggers const struct inode *inode) 63feed8258SEric Biggers { 643ceb6543SEric Biggers BUILD_BUG_ON(ARRAY_SIZE(fscrypt_modes) != FSCRYPT_MODE_MAX + 1); 653ceb6543SEric Biggers 66feed8258SEric Biggers if (S_ISREG(inode->i_mode)) 6785af90e5SEric Biggers return &fscrypt_modes[fscrypt_policy_contents_mode(policy)]; 68feed8258SEric Biggers 69feed8258SEric Biggers if (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode)) 7085af90e5SEric Biggers return &fscrypt_modes[fscrypt_policy_fnames_mode(policy)]; 71feed8258SEric Biggers 72feed8258SEric Biggers WARN_ONCE(1, "fscrypt: filesystem tried to load encryption info for inode %lu, which is not encryptable (file type %d)\n", 73feed8258SEric Biggers inode->i_ino, (inode->i_mode & S_IFMT)); 74feed8258SEric Biggers return ERR_PTR(-EINVAL); 75feed8258SEric Biggers } 76feed8258SEric Biggers 77feed8258SEric Biggers /* Create a symmetric cipher object for the given encryption mode and key */ 785fee3609SSatya Tangirala static struct crypto_skcipher * 795fee3609SSatya Tangirala fscrypt_allocate_skcipher(struct fscrypt_mode *mode, const u8 *raw_key, 80feed8258SEric Biggers const struct inode *inode) 81feed8258SEric Biggers { 82feed8258SEric Biggers struct crypto_skcipher *tfm; 83feed8258SEric Biggers int err; 84feed8258SEric Biggers 85feed8258SEric Biggers tfm = crypto_alloc_skcipher(mode->cipher_str, 0, 0); 86feed8258SEric Biggers if (IS_ERR(tfm)) { 87feed8258SEric Biggers if (PTR_ERR(tfm) == -ENOENT) { 88feed8258SEric Biggers fscrypt_warn(inode, 89feed8258SEric Biggers "Missing crypto API support for %s (API name: \"%s\")", 90feed8258SEric Biggers mode->friendly_name, mode->cipher_str); 91feed8258SEric Biggers return ERR_PTR(-ENOPKG); 92feed8258SEric Biggers } 93feed8258SEric Biggers fscrypt_err(inode, "Error allocating '%s' transform: %ld", 94feed8258SEric Biggers mode->cipher_str, PTR_ERR(tfm)); 95feed8258SEric Biggers return tfm; 96feed8258SEric Biggers } 97ff73c2c0SEric Biggers if (!xchg(&mode->logged_impl_name, 1)) { 98feed8258SEric Biggers /* 99feed8258SEric Biggers * fscrypt performance can vary greatly depending on which 100feed8258SEric Biggers * crypto algorithm implementation is used. Help people debug 101feed8258SEric Biggers * performance problems by logging the ->cra_driver_name the 102ff73c2c0SEric Biggers * first time a mode is used. 103feed8258SEric Biggers */ 104feed8258SEric Biggers pr_info("fscrypt: %s using implementation \"%s\"\n", 1056e1adb88SEric Biggers mode->friendly_name, crypto_skcipher_driver_name(tfm)); 106feed8258SEric Biggers } 107c64cfb98SEric Biggers if (WARN_ON(crypto_skcipher_ivsize(tfm) != mode->ivsize)) { 108c64cfb98SEric Biggers err = -EINVAL; 109c64cfb98SEric Biggers goto err_free_tfm; 110c64cfb98SEric Biggers } 111feed8258SEric Biggers crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS); 112feed8258SEric Biggers err = crypto_skcipher_setkey(tfm, raw_key, mode->keysize); 113feed8258SEric Biggers if (err) 114feed8258SEric Biggers goto err_free_tfm; 115feed8258SEric Biggers 116feed8258SEric Biggers return tfm; 117feed8258SEric Biggers 118feed8258SEric Biggers err_free_tfm: 119feed8258SEric Biggers crypto_free_skcipher(tfm); 120feed8258SEric Biggers return ERR_PTR(err); 121feed8258SEric Biggers } 122feed8258SEric Biggers 1235fee3609SSatya Tangirala /* 1245fee3609SSatya Tangirala * Prepare the crypto transform object or blk-crypto key in @prep_key, given the 125*b7e072f9SEric Biggers * raw key, encryption mode (@ci->ci_mode), flag indicating which encryption 126*b7e072f9SEric Biggers * implementation (fs-layer or blk-crypto) will be used (@ci->ci_inlinecrypt), 127*b7e072f9SEric Biggers * and IV generation method (@ci->ci_policy.flags). 1285fee3609SSatya Tangirala */ 1295fee3609SSatya Tangirala int fscrypt_prepare_key(struct fscrypt_prepared_key *prep_key, 1305fee3609SSatya Tangirala const u8 *raw_key, const struct fscrypt_info *ci) 131feed8258SEric Biggers { 1324006d799SEric Biggers struct crypto_skcipher *tfm; 133feed8258SEric Biggers 1345fee3609SSatya Tangirala if (fscrypt_using_inline_encryption(ci)) 1355fee3609SSatya Tangirala return fscrypt_prepare_inline_crypt_key(prep_key, raw_key, ci); 1365fee3609SSatya Tangirala 137f592efe7SEric Biggers tfm = fscrypt_allocate_skcipher(ci->ci_mode, raw_key, ci->ci_inode); 1384006d799SEric Biggers if (IS_ERR(tfm)) 1394006d799SEric Biggers return PTR_ERR(tfm); 1405fee3609SSatya Tangirala /* 14197c6327fSEric Biggers * Pairs with the smp_load_acquire() in fscrypt_is_key_prepared(). 14297c6327fSEric Biggers * I.e., here we publish ->tfm with a RELEASE barrier so that 14397c6327fSEric Biggers * concurrent tasks can ACQUIRE it. Note that this concurrency is only 14497c6327fSEric Biggers * possible for per-mode keys, not for per-file keys. 1455fee3609SSatya Tangirala */ 1465fee3609SSatya Tangirala smp_store_release(&prep_key->tfm, tfm); 147feed8258SEric Biggers return 0; 148feed8258SEric Biggers } 149feed8258SEric Biggers 1505fee3609SSatya Tangirala /* Destroy a crypto transform object and/or blk-crypto key. */ 1515fee3609SSatya Tangirala void fscrypt_destroy_prepared_key(struct fscrypt_prepared_key *prep_key) 1525fee3609SSatya Tangirala { 1535fee3609SSatya Tangirala crypto_free_skcipher(prep_key->tfm); 1545fee3609SSatya Tangirala fscrypt_destroy_inline_crypt_key(prep_key); 1555fee3609SSatya Tangirala } 1565fee3609SSatya Tangirala 1575fee3609SSatya Tangirala /* Given a per-file encryption key, set up the file's crypto transform object */ 1585fee3609SSatya Tangirala int fscrypt_set_per_file_enc_key(struct fscrypt_info *ci, const u8 *raw_key) 1595fee3609SSatya Tangirala { 1605fee3609SSatya Tangirala ci->ci_owns_key = true; 1615fee3609SSatya Tangirala return fscrypt_prepare_key(&ci->ci_enc_key, raw_key, ci); 1625fee3609SSatya Tangirala } 1635fee3609SSatya Tangirala 164f592efe7SEric Biggers static int setup_per_mode_enc_key(struct fscrypt_info *ci, 165b103fb76SEric Biggers struct fscrypt_master_key *mk, 1665fee3609SSatya Tangirala struct fscrypt_prepared_key *keys, 167b103fb76SEric Biggers u8 hkdf_context, bool include_fs_uuid) 1685dae460cSEric Biggers { 169b103fb76SEric Biggers const struct inode *inode = ci->ci_inode; 170b103fb76SEric Biggers const struct super_block *sb = inode->i_sb; 1715dae460cSEric Biggers struct fscrypt_mode *mode = ci->ci_mode; 17285af90e5SEric Biggers const u8 mode_num = mode - fscrypt_modes; 1735fee3609SSatya Tangirala struct fscrypt_prepared_key *prep_key; 1745dae460cSEric Biggers u8 mode_key[FSCRYPT_MAX_KEY_SIZE]; 175b103fb76SEric Biggers u8 hkdf_info[sizeof(mode_num) + sizeof(sb->s_uuid)]; 176b103fb76SEric Biggers unsigned int hkdf_infolen = 0; 1775dae460cSEric Biggers int err; 1785dae460cSEric Biggers 1793ceb6543SEric Biggers if (WARN_ON(mode_num > FSCRYPT_MODE_MAX)) 1805dae460cSEric Biggers return -EINVAL; 1815dae460cSEric Biggers 1825fee3609SSatya Tangirala prep_key = &keys[mode_num]; 1835fee3609SSatya Tangirala if (fscrypt_is_key_prepared(prep_key, ci)) { 1845fee3609SSatya Tangirala ci->ci_enc_key = *prep_key; 185e3b1078bSEric Biggers return 0; 186e3b1078bSEric Biggers } 187e3b1078bSEric Biggers 188e3b1078bSEric Biggers mutex_lock(&fscrypt_mode_key_setup_mutex); 189e3b1078bSEric Biggers 1905fee3609SSatya Tangirala if (fscrypt_is_key_prepared(prep_key, ci)) 191e3b1078bSEric Biggers goto done_unlock; 1925dae460cSEric Biggers 1935dae460cSEric Biggers BUILD_BUG_ON(sizeof(mode_num) != 1); 194b103fb76SEric Biggers BUILD_BUG_ON(sizeof(sb->s_uuid) != 16); 195b103fb76SEric Biggers BUILD_BUG_ON(sizeof(hkdf_info) != 17); 196b103fb76SEric Biggers hkdf_info[hkdf_infolen++] = mode_num; 197b103fb76SEric Biggers if (include_fs_uuid) { 198b103fb76SEric Biggers memcpy(&hkdf_info[hkdf_infolen], &sb->s_uuid, 199b103fb76SEric Biggers sizeof(sb->s_uuid)); 200b103fb76SEric Biggers hkdf_infolen += sizeof(sb->s_uuid); 201b103fb76SEric Biggers } 2025dae460cSEric Biggers err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, 203b103fb76SEric Biggers hkdf_context, hkdf_info, hkdf_infolen, 2045dae460cSEric Biggers mode_key, mode->keysize); 2055dae460cSEric Biggers if (err) 206e3b1078bSEric Biggers goto out_unlock; 2075fee3609SSatya Tangirala err = fscrypt_prepare_key(prep_key, mode_key, ci); 2085dae460cSEric Biggers memzero_explicit(mode_key, mode->keysize); 2095fee3609SSatya Tangirala if (err) 210e3b1078bSEric Biggers goto out_unlock; 211e3b1078bSEric Biggers done_unlock: 2125fee3609SSatya Tangirala ci->ci_enc_key = *prep_key; 213e3b1078bSEric Biggers err = 0; 214e3b1078bSEric Biggers out_unlock: 215e3b1078bSEric Biggers mutex_unlock(&fscrypt_mode_key_setup_mutex); 216e3b1078bSEric Biggers return err; 2175dae460cSEric Biggers } 2185dae460cSEric Biggers 2192fc2b430SEric Biggers /* 2202fc2b430SEric Biggers * Derive a SipHash key from the given fscrypt master key and the given 2212fc2b430SEric Biggers * application-specific information string. 2222fc2b430SEric Biggers * 2232fc2b430SEric Biggers * Note that the KDF produces a byte array, but the SipHash APIs expect the key 2242fc2b430SEric Biggers * as a pair of 64-bit words. Therefore, on big endian CPUs we have to do an 2252fc2b430SEric Biggers * endianness swap in order to get the same results as on little endian CPUs. 2262fc2b430SEric Biggers */ 2272fc2b430SEric Biggers static int fscrypt_derive_siphash_key(const struct fscrypt_master_key *mk, 2282fc2b430SEric Biggers u8 context, const u8 *info, 2292fc2b430SEric Biggers unsigned int infolen, siphash_key_t *key) 2302fc2b430SEric Biggers { 2312fc2b430SEric Biggers int err; 2322fc2b430SEric Biggers 2332fc2b430SEric Biggers err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, context, info, infolen, 2342fc2b430SEric Biggers (u8 *)key, sizeof(*key)); 2352fc2b430SEric Biggers if (err) 2362fc2b430SEric Biggers return err; 2372fc2b430SEric Biggers 2382fc2b430SEric Biggers BUILD_BUG_ON(sizeof(*key) != 16); 2392fc2b430SEric Biggers BUILD_BUG_ON(ARRAY_SIZE(key->key) != 2); 2402fc2b430SEric Biggers le64_to_cpus(&key->key[0]); 2412fc2b430SEric Biggers le64_to_cpus(&key->key[1]); 2422fc2b430SEric Biggers return 0; 2432fc2b430SEric Biggers } 2442fc2b430SEric Biggers 245aa408f83SDaniel Rosenberg int fscrypt_derive_dirhash_key(struct fscrypt_info *ci, 246aa408f83SDaniel Rosenberg const struct fscrypt_master_key *mk) 247aa408f83SDaniel Rosenberg { 248aa408f83SDaniel Rosenberg int err; 249aa408f83SDaniel Rosenberg 2502fc2b430SEric Biggers err = fscrypt_derive_siphash_key(mk, HKDF_CONTEXT_DIRHASH_KEY, 2511d6217a4SEric Biggers ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE, 2522fc2b430SEric Biggers &ci->ci_dirhash_key); 253aa408f83SDaniel Rosenberg if (err) 254aa408f83SDaniel Rosenberg return err; 255aa408f83SDaniel Rosenberg ci->ci_dirhash_key_initialized = true; 256aa408f83SDaniel Rosenberg return 0; 257aa408f83SDaniel Rosenberg } 258aa408f83SDaniel Rosenberg 259a992b20cSEric Biggers void fscrypt_hash_inode_number(struct fscrypt_info *ci, 260a992b20cSEric Biggers const struct fscrypt_master_key *mk) 261a992b20cSEric Biggers { 262a992b20cSEric Biggers WARN_ON(ci->ci_inode->i_ino == 0); 263a992b20cSEric Biggers WARN_ON(!mk->mk_ino_hash_key_initialized); 264a992b20cSEric Biggers 265a992b20cSEric Biggers ci->ci_hashed_ino = (u32)siphash_1u64(ci->ci_inode->i_ino, 266a992b20cSEric Biggers &mk->mk_ino_hash_key); 267a992b20cSEric Biggers } 268a992b20cSEric Biggers 269e3b1078bSEric Biggers static int fscrypt_setup_iv_ino_lblk_32_key(struct fscrypt_info *ci, 270e3b1078bSEric Biggers struct fscrypt_master_key *mk) 271e3b1078bSEric Biggers { 272e3b1078bSEric Biggers int err; 273e3b1078bSEric Biggers 274e3b1078bSEric Biggers err = setup_per_mode_enc_key(ci, mk, mk->mk_iv_ino_lblk_32_keys, 275e3b1078bSEric Biggers HKDF_CONTEXT_IV_INO_LBLK_32_KEY, true); 276e3b1078bSEric Biggers if (err) 277e3b1078bSEric Biggers return err; 278e3b1078bSEric Biggers 279e3b1078bSEric Biggers /* pairs with smp_store_release() below */ 280e3b1078bSEric Biggers if (!smp_load_acquire(&mk->mk_ino_hash_key_initialized)) { 281e3b1078bSEric Biggers 282e3b1078bSEric Biggers mutex_lock(&fscrypt_mode_key_setup_mutex); 283e3b1078bSEric Biggers 284e3b1078bSEric Biggers if (mk->mk_ino_hash_key_initialized) 285e3b1078bSEric Biggers goto unlock; 286e3b1078bSEric Biggers 2872fc2b430SEric Biggers err = fscrypt_derive_siphash_key(mk, 2882fc2b430SEric Biggers HKDF_CONTEXT_INODE_HASH_KEY, 2892fc2b430SEric Biggers NULL, 0, &mk->mk_ino_hash_key); 290e3b1078bSEric Biggers if (err) 291e3b1078bSEric Biggers goto unlock; 292e3b1078bSEric Biggers /* pairs with smp_load_acquire() above */ 293e3b1078bSEric Biggers smp_store_release(&mk->mk_ino_hash_key_initialized, true); 294e3b1078bSEric Biggers unlock: 295e3b1078bSEric Biggers mutex_unlock(&fscrypt_mode_key_setup_mutex); 296e3b1078bSEric Biggers if (err) 297e3b1078bSEric Biggers return err; 298e3b1078bSEric Biggers } 299e3b1078bSEric Biggers 300a992b20cSEric Biggers /* 301a992b20cSEric Biggers * New inodes may not have an inode number assigned yet. 302a992b20cSEric Biggers * Hashing their inode number is delayed until later. 303a992b20cSEric Biggers */ 30492cfcd03SEric Biggers if (ci->ci_inode->i_ino) 305a992b20cSEric Biggers fscrypt_hash_inode_number(ci, mk); 306e3b1078bSEric Biggers return 0; 307e3b1078bSEric Biggers } 308e3b1078bSEric Biggers 3095dae460cSEric Biggers static int fscrypt_setup_v2_file_key(struct fscrypt_info *ci, 310a992b20cSEric Biggers struct fscrypt_master_key *mk, 311a992b20cSEric Biggers bool need_dirhash_key) 3125dae460cSEric Biggers { 3135dae460cSEric Biggers int err; 3145dae460cSEric Biggers 3155dae460cSEric Biggers if (ci->ci_policy.v2.flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) { 3165dae460cSEric Biggers /* 317f592efe7SEric Biggers * DIRECT_KEY: instead of deriving per-file encryption keys, the 318f592efe7SEric Biggers * per-file nonce will be included in all the IVs. But unlike 319f592efe7SEric Biggers * v1 policies, for v2 policies in this case we don't encrypt 320f592efe7SEric Biggers * with the master key directly but rather derive a per-mode 321f592efe7SEric Biggers * encryption key. This ensures that the master key is 322f592efe7SEric Biggers * consistently used only for HKDF, avoiding key reuse issues. 3235dae460cSEric Biggers */ 324e3b1078bSEric Biggers err = setup_per_mode_enc_key(ci, mk, mk->mk_direct_keys, 325b103fb76SEric Biggers HKDF_CONTEXT_DIRECT_KEY, false); 326b103fb76SEric Biggers } else if (ci->ci_policy.v2.flags & 327b103fb76SEric Biggers FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64) { 328b103fb76SEric Biggers /* 329b103fb76SEric Biggers * IV_INO_LBLK_64: encryption keys are derived from (master_key, 330b103fb76SEric Biggers * mode_num, filesystem_uuid), and inode number is included in 331b103fb76SEric Biggers * the IVs. This format is optimized for use with inline 332e3b1078bSEric Biggers * encryption hardware compliant with the UFS standard. 333b103fb76SEric Biggers */ 334e3b1078bSEric Biggers err = setup_per_mode_enc_key(ci, mk, mk->mk_iv_ino_lblk_64_keys, 335f592efe7SEric Biggers HKDF_CONTEXT_IV_INO_LBLK_64_KEY, 336f592efe7SEric Biggers true); 337e3b1078bSEric Biggers } else if (ci->ci_policy.v2.flags & 338e3b1078bSEric Biggers FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) { 339e3b1078bSEric Biggers err = fscrypt_setup_iv_ino_lblk_32_key(ci, mk); 340aa408f83SDaniel Rosenberg } else { 341aa408f83SDaniel Rosenberg u8 derived_key[FSCRYPT_MAX_KEY_SIZE]; 3425dae460cSEric Biggers 3435dae460cSEric Biggers err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, 344f592efe7SEric Biggers HKDF_CONTEXT_PER_FILE_ENC_KEY, 3451d6217a4SEric Biggers ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE, 3465dae460cSEric Biggers derived_key, ci->ci_mode->keysize); 3475dae460cSEric Biggers if (err) 3485dae460cSEric Biggers return err; 3495dae460cSEric Biggers 350f592efe7SEric Biggers err = fscrypt_set_per_file_enc_key(ci, derived_key); 3515dae460cSEric Biggers memzero_explicit(derived_key, ci->ci_mode->keysize); 352aa408f83SDaniel Rosenberg } 353aa408f83SDaniel Rosenberg if (err) 3545dae460cSEric Biggers return err; 355aa408f83SDaniel Rosenberg 356aa408f83SDaniel Rosenberg /* Derive a secret dirhash key for directories that need it. */ 357a992b20cSEric Biggers if (need_dirhash_key) { 358aa408f83SDaniel Rosenberg err = fscrypt_derive_dirhash_key(ci, mk); 359aa408f83SDaniel Rosenberg if (err) 360aa408f83SDaniel Rosenberg return err; 361aa408f83SDaniel Rosenberg } 362aa408f83SDaniel Rosenberg 363aa408f83SDaniel Rosenberg return 0; 3645dae460cSEric Biggers } 3655dae460cSEric Biggers 366feed8258SEric Biggers /* 3677f595d6aSEric Biggers * Check whether the size of the given master key (@mk) is appropriate for the 3687f595d6aSEric Biggers * encryption settings which a particular file will use (@ci). 3697f595d6aSEric Biggers * 3707f595d6aSEric Biggers * If the file uses a v1 encryption policy, then the master key must be at least 3717f595d6aSEric Biggers * as long as the derived key, as this is a requirement of the v1 KDF. 3727f595d6aSEric Biggers * 3737f595d6aSEric Biggers * Otherwise, the KDF can accept any size key, so we enforce a slightly looser 3747f595d6aSEric Biggers * requirement: we require that the size of the master key be at least the 3757f595d6aSEric Biggers * maximum security strength of any algorithm whose key will be derived from it 3767f595d6aSEric Biggers * (but in practice we only need to consider @ci->ci_mode, since any other 3777f595d6aSEric Biggers * possible subkeys such as DIRHASH and INODE_HASH will never increase the 3787f595d6aSEric Biggers * required key size over @ci->ci_mode). This allows AES-256-XTS keys to be 3797f595d6aSEric Biggers * derived from a 256-bit master key, which is cryptographically sufficient, 3807f595d6aSEric Biggers * rather than requiring a 512-bit master key which is unnecessarily long. (We 3817f595d6aSEric Biggers * still allow 512-bit master keys if the user chooses to use them, though.) 3827f595d6aSEric Biggers */ 3837f595d6aSEric Biggers static bool fscrypt_valid_master_key_size(const struct fscrypt_master_key *mk, 3847f595d6aSEric Biggers const struct fscrypt_info *ci) 3857f595d6aSEric Biggers { 3867f595d6aSEric Biggers unsigned int min_keysize; 3877f595d6aSEric Biggers 3887f595d6aSEric Biggers if (ci->ci_policy.version == FSCRYPT_POLICY_V1) 3897f595d6aSEric Biggers min_keysize = ci->ci_mode->keysize; 3907f595d6aSEric Biggers else 3917f595d6aSEric Biggers min_keysize = ci->ci_mode->security_strength; 3927f595d6aSEric Biggers 3937f595d6aSEric Biggers if (mk->mk_secret.size < min_keysize) { 3947f595d6aSEric Biggers fscrypt_warn(NULL, 3957f595d6aSEric Biggers "key with %s %*phN is too short (got %u bytes, need %u+ bytes)", 3967f595d6aSEric Biggers master_key_spec_type(&mk->mk_spec), 3977f595d6aSEric Biggers master_key_spec_len(&mk->mk_spec), 3987f595d6aSEric Biggers (u8 *)&mk->mk_spec.u, 3997f595d6aSEric Biggers mk->mk_secret.size, min_keysize); 4007f595d6aSEric Biggers return false; 4017f595d6aSEric Biggers } 4027f595d6aSEric Biggers return true; 4037f595d6aSEric Biggers } 4047f595d6aSEric Biggers 4057f595d6aSEric Biggers /* 406feed8258SEric Biggers * Find the master key, then set up the inode's actual encryption key. 407b1c0ec35SEric Biggers * 408b1c0ec35SEric Biggers * If the master key is found in the filesystem-level keyring, then the 4094a4b8721SEric Biggers * corresponding 'struct key' is returned in *master_key_ret with its semaphore 4104a4b8721SEric Biggers * read-locked. This is needed to ensure that only one task links the 4114a4b8721SEric Biggers * fscrypt_info into ->mk_decrypted_inodes (as multiple tasks may race to create 4124a4b8721SEric Biggers * an fscrypt_info for the same inode), and to synchronize the master key being 4134a4b8721SEric Biggers * removed with a new inode starting to use it. 414feed8258SEric Biggers */ 415b1c0ec35SEric Biggers static int setup_file_encryption_key(struct fscrypt_info *ci, 416a992b20cSEric Biggers bool need_dirhash_key, 417b1c0ec35SEric Biggers struct key **master_key_ret) 418feed8258SEric Biggers { 41922d94f49SEric Biggers struct key *key; 42022d94f49SEric Biggers struct fscrypt_master_key *mk = NULL; 42122d94f49SEric Biggers struct fscrypt_key_specifier mk_spec; 42222d94f49SEric Biggers int err; 42322d94f49SEric Biggers 4245fee3609SSatya Tangirala err = fscrypt_select_encryption_impl(ci); 4255fee3609SSatya Tangirala if (err) 4265fee3609SSatya Tangirala return err; 4275fee3609SSatya Tangirala 4285dae460cSEric Biggers switch (ci->ci_policy.version) { 4295dae460cSEric Biggers case FSCRYPT_POLICY_V1: 43022d94f49SEric Biggers mk_spec.type = FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR; 4315dae460cSEric Biggers memcpy(mk_spec.u.descriptor, 4325dae460cSEric Biggers ci->ci_policy.v1.master_key_descriptor, 43322d94f49SEric Biggers FSCRYPT_KEY_DESCRIPTOR_SIZE); 4345dae460cSEric Biggers break; 4355dae460cSEric Biggers case FSCRYPT_POLICY_V2: 4365dae460cSEric Biggers mk_spec.type = FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER; 4375dae460cSEric Biggers memcpy(mk_spec.u.identifier, 4385dae460cSEric Biggers ci->ci_policy.v2.master_key_identifier, 4395dae460cSEric Biggers FSCRYPT_KEY_IDENTIFIER_SIZE); 4405dae460cSEric Biggers break; 4415dae460cSEric Biggers default: 4425dae460cSEric Biggers WARN_ON(1); 4435dae460cSEric Biggers return -EINVAL; 4445dae460cSEric Biggers } 44522d94f49SEric Biggers 44622d94f49SEric Biggers key = fscrypt_find_master_key(ci->ci_inode->i_sb, &mk_spec); 44722d94f49SEric Biggers if (IS_ERR(key)) { 4485dae460cSEric Biggers if (key != ERR_PTR(-ENOKEY) || 4495dae460cSEric Biggers ci->ci_policy.version != FSCRYPT_POLICY_V1) 45022d94f49SEric Biggers return PTR_ERR(key); 45122d94f49SEric Biggers 4525dae460cSEric Biggers /* 4535dae460cSEric Biggers * As a legacy fallback for v1 policies, search for the key in 4545dae460cSEric Biggers * the current task's subscribed keyrings too. Don't move this 4555dae460cSEric Biggers * to before the search of ->s_master_keys, since users 4565dae460cSEric Biggers * shouldn't be able to override filesystem-level keys. 4575dae460cSEric Biggers */ 458feed8258SEric Biggers return fscrypt_setup_v1_file_key_via_subscribed_keyrings(ci); 459feed8258SEric Biggers } 460feed8258SEric Biggers 46122d94f49SEric Biggers mk = key->payload.data[0]; 4624a4b8721SEric Biggers down_read(&key->sem); 463b1c0ec35SEric Biggers 464b1c0ec35SEric Biggers /* Has the secret been removed (via FS_IOC_REMOVE_ENCRYPTION_KEY)? */ 465b1c0ec35SEric Biggers if (!is_master_key_secret_present(&mk->mk_secret)) { 466b1c0ec35SEric Biggers err = -ENOKEY; 467b1c0ec35SEric Biggers goto out_release_key; 468b1c0ec35SEric Biggers } 46922d94f49SEric Biggers 4707f595d6aSEric Biggers if (!fscrypt_valid_master_key_size(mk, ci)) { 47122d94f49SEric Biggers err = -ENOKEY; 47222d94f49SEric Biggers goto out_release_key; 47322d94f49SEric Biggers } 47422d94f49SEric Biggers 4755dae460cSEric Biggers switch (ci->ci_policy.version) { 4765dae460cSEric Biggers case FSCRYPT_POLICY_V1: 47722d94f49SEric Biggers err = fscrypt_setup_v1_file_key(ci, mk->mk_secret.raw); 4785dae460cSEric Biggers break; 4795dae460cSEric Biggers case FSCRYPT_POLICY_V2: 480a992b20cSEric Biggers err = fscrypt_setup_v2_file_key(ci, mk, need_dirhash_key); 4815dae460cSEric Biggers break; 4825dae460cSEric Biggers default: 4835dae460cSEric Biggers WARN_ON(1); 4845dae460cSEric Biggers err = -EINVAL; 4855dae460cSEric Biggers break; 4865dae460cSEric Biggers } 487b1c0ec35SEric Biggers if (err) 488b1c0ec35SEric Biggers goto out_release_key; 489b1c0ec35SEric Biggers 490b1c0ec35SEric Biggers *master_key_ret = key; 491b1c0ec35SEric Biggers return 0; 49222d94f49SEric Biggers 49322d94f49SEric Biggers out_release_key: 4944a4b8721SEric Biggers up_read(&key->sem); 49522d94f49SEric Biggers key_put(key); 49622d94f49SEric Biggers return err; 49722d94f49SEric Biggers } 49822d94f49SEric Biggers 499feed8258SEric Biggers static void put_crypt_info(struct fscrypt_info *ci) 500feed8258SEric Biggers { 501b1c0ec35SEric Biggers struct key *key; 502b1c0ec35SEric Biggers 503feed8258SEric Biggers if (!ci) 504feed8258SEric Biggers return; 505feed8258SEric Biggers 5064006d799SEric Biggers if (ci->ci_direct_key) 507feed8258SEric Biggers fscrypt_put_direct_key(ci->ci_direct_key); 508b103fb76SEric Biggers else if (ci->ci_owns_key) 5095fee3609SSatya Tangirala fscrypt_destroy_prepared_key(&ci->ci_enc_key); 510b1c0ec35SEric Biggers 511b1c0ec35SEric Biggers key = ci->ci_master_key; 512b1c0ec35SEric Biggers if (key) { 513b1c0ec35SEric Biggers struct fscrypt_master_key *mk = key->payload.data[0]; 514b1c0ec35SEric Biggers 515b1c0ec35SEric Biggers /* 516b1c0ec35SEric Biggers * Remove this inode from the list of inodes that were unlocked 517b1c0ec35SEric Biggers * with the master key. 518b1c0ec35SEric Biggers * 519b1c0ec35SEric Biggers * In addition, if we're removing the last inode from a key that 520b1c0ec35SEric Biggers * already had its secret removed, invalidate the key so that it 521b1c0ec35SEric Biggers * gets removed from ->s_master_keys. 522b1c0ec35SEric Biggers */ 523b1c0ec35SEric Biggers spin_lock(&mk->mk_decrypted_inodes_lock); 524b1c0ec35SEric Biggers list_del(&ci->ci_master_key_link); 525b1c0ec35SEric Biggers spin_unlock(&mk->mk_decrypted_inodes_lock); 526b1c0ec35SEric Biggers if (refcount_dec_and_test(&mk->mk_refcount)) 527b1c0ec35SEric Biggers key_invalidate(key); 528b1c0ec35SEric Biggers key_put(key); 529b1c0ec35SEric Biggers } 5306f99756dSEric Biggers memzero_explicit(ci, sizeof(*ci)); 531feed8258SEric Biggers kmem_cache_free(fscrypt_info_cachep, ci); 532feed8258SEric Biggers } 533feed8258SEric Biggers 534a992b20cSEric Biggers static int 535a992b20cSEric Biggers fscrypt_setup_encryption_info(struct inode *inode, 536a992b20cSEric Biggers const union fscrypt_policy *policy, 537a992b20cSEric Biggers const u8 nonce[FSCRYPT_FILE_NONCE_SIZE], 538a992b20cSEric Biggers bool need_dirhash_key) 539feed8258SEric Biggers { 540feed8258SEric Biggers struct fscrypt_info *crypt_info; 541feed8258SEric Biggers struct fscrypt_mode *mode; 542b1c0ec35SEric Biggers struct key *master_key = NULL; 543feed8258SEric Biggers int res; 544feed8258SEric Biggers 545feed8258SEric Biggers res = fscrypt_initialize(inode->i_sb->s_cop->flags); 546feed8258SEric Biggers if (res) 547feed8258SEric Biggers return res; 548feed8258SEric Biggers 5499dad5febSEric Biggers crypt_info = kmem_cache_zalloc(fscrypt_info_cachep, GFP_KERNEL); 550feed8258SEric Biggers if (!crypt_info) 551feed8258SEric Biggers return -ENOMEM; 552feed8258SEric Biggers 553feed8258SEric Biggers crypt_info->ci_inode = inode; 554a992b20cSEric Biggers crypt_info->ci_policy = *policy; 555a992b20cSEric Biggers memcpy(crypt_info->ci_nonce, nonce, FSCRYPT_FILE_NONCE_SIZE); 5565dae460cSEric Biggers 5575dae460cSEric Biggers mode = select_encryption_mode(&crypt_info->ci_policy, inode); 558feed8258SEric Biggers if (IS_ERR(mode)) { 559feed8258SEric Biggers res = PTR_ERR(mode); 560feed8258SEric Biggers goto out; 561feed8258SEric Biggers } 562feed8258SEric Biggers WARN_ON(mode->ivsize > FSCRYPT_MAX_IV_SIZE); 563feed8258SEric Biggers crypt_info->ci_mode = mode; 564feed8258SEric Biggers 565a992b20cSEric Biggers res = setup_file_encryption_key(crypt_info, need_dirhash_key, 566a992b20cSEric Biggers &master_key); 567feed8258SEric Biggers if (res) 568feed8258SEric Biggers goto out; 569feed8258SEric Biggers 570ab673b98SEric Biggers /* 571a992b20cSEric Biggers * For existing inodes, multiple tasks may race to set ->i_crypt_info. 572a992b20cSEric Biggers * So use cmpxchg_release(). This pairs with the smp_load_acquire() in 573ab673b98SEric Biggers * fscrypt_get_info(). I.e., here we publish ->i_crypt_info with a 574ab673b98SEric Biggers * RELEASE barrier so that other tasks can ACQUIRE it. 575ab673b98SEric Biggers */ 576b1c0ec35SEric Biggers if (cmpxchg_release(&inode->i_crypt_info, NULL, crypt_info) == NULL) { 577ab673b98SEric Biggers /* 578ab673b98SEric Biggers * We won the race and set ->i_crypt_info to our crypt_info. 579ab673b98SEric Biggers * Now link it into the master key's inode list. 580ab673b98SEric Biggers */ 581b1c0ec35SEric Biggers if (master_key) { 582b1c0ec35SEric Biggers struct fscrypt_master_key *mk = 583b1c0ec35SEric Biggers master_key->payload.data[0]; 584b1c0ec35SEric Biggers 585b1c0ec35SEric Biggers refcount_inc(&mk->mk_refcount); 586b1c0ec35SEric Biggers crypt_info->ci_master_key = key_get(master_key); 587b1c0ec35SEric Biggers spin_lock(&mk->mk_decrypted_inodes_lock); 588b1c0ec35SEric Biggers list_add(&crypt_info->ci_master_key_link, 589b1c0ec35SEric Biggers &mk->mk_decrypted_inodes); 590b1c0ec35SEric Biggers spin_unlock(&mk->mk_decrypted_inodes_lock); 591b1c0ec35SEric Biggers } 592feed8258SEric Biggers crypt_info = NULL; 593b1c0ec35SEric Biggers } 594b1c0ec35SEric Biggers res = 0; 595feed8258SEric Biggers out: 596b1c0ec35SEric Biggers if (master_key) { 5974a4b8721SEric Biggers up_read(&master_key->sem); 598b1c0ec35SEric Biggers key_put(master_key); 599b1c0ec35SEric Biggers } 600feed8258SEric Biggers put_crypt_info(crypt_info); 601feed8258SEric Biggers return res; 602feed8258SEric Biggers } 603a992b20cSEric Biggers 604a992b20cSEric Biggers /** 605a992b20cSEric Biggers * fscrypt_get_encryption_info() - set up an inode's encryption key 606ac4acb1fSEric Biggers * @inode: the inode to set up the key for. Must be encrypted. 607a14d0b67SEric Biggers * @allow_unsupported: if %true, treat an unsupported encryption policy (or 608a14d0b67SEric Biggers * unrecognized encryption context) the same way as the key 609a14d0b67SEric Biggers * being unavailable, instead of returning an error. Use 610a14d0b67SEric Biggers * %false unless the operation being performed is needed in 611a14d0b67SEric Biggers * order for files (or directories) to be deleted. 612a992b20cSEric Biggers * 613a992b20cSEric Biggers * Set up ->i_crypt_info, if it hasn't already been done. 614a992b20cSEric Biggers * 615a992b20cSEric Biggers * Note: unless ->i_crypt_info is already set, this isn't %GFP_NOFS-safe. So 616a992b20cSEric Biggers * generally this shouldn't be called from within a filesystem transaction. 617a992b20cSEric Biggers * 618a992b20cSEric Biggers * Return: 0 if ->i_crypt_info was set or was already set, *or* if the 619a992b20cSEric Biggers * encryption key is unavailable. (Use fscrypt_has_encryption_key() to 620a992b20cSEric Biggers * distinguish these cases.) Also can return another -errno code. 621a992b20cSEric Biggers */ 622a14d0b67SEric Biggers int fscrypt_get_encryption_info(struct inode *inode, bool allow_unsupported) 623a992b20cSEric Biggers { 624a992b20cSEric Biggers int res; 625a992b20cSEric Biggers union fscrypt_context ctx; 626a992b20cSEric Biggers union fscrypt_policy policy; 627a992b20cSEric Biggers 628a992b20cSEric Biggers if (fscrypt_has_encryption_key(inode)) 629a992b20cSEric Biggers return 0; 630a992b20cSEric Biggers 631a992b20cSEric Biggers res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx)); 632a992b20cSEric Biggers if (res < 0) { 633a14d0b67SEric Biggers if (res == -ERANGE && allow_unsupported) 634a14d0b67SEric Biggers return 0; 635ac4acb1fSEric Biggers fscrypt_warn(inode, "Error %d getting encryption context", res); 636a992b20cSEric Biggers return res; 637a992b20cSEric Biggers } 638a992b20cSEric Biggers 639a992b20cSEric Biggers res = fscrypt_policy_from_context(&policy, &ctx, res); 640a992b20cSEric Biggers if (res) { 641a14d0b67SEric Biggers if (allow_unsupported) 642a14d0b67SEric Biggers return 0; 643a992b20cSEric Biggers fscrypt_warn(inode, 644a992b20cSEric Biggers "Unrecognized or corrupt encryption context"); 645a992b20cSEric Biggers return res; 646a992b20cSEric Biggers } 647a992b20cSEric Biggers 648a14d0b67SEric Biggers if (!fscrypt_supported_policy(&policy, inode)) { 649a14d0b67SEric Biggers if (allow_unsupported) 650a14d0b67SEric Biggers return 0; 651a992b20cSEric Biggers return -EINVAL; 652a14d0b67SEric Biggers } 653a992b20cSEric Biggers 654a992b20cSEric Biggers res = fscrypt_setup_encryption_info(inode, &policy, 655a992b20cSEric Biggers fscrypt_context_nonce(&ctx), 656a992b20cSEric Biggers IS_CASEFOLDED(inode) && 657a992b20cSEric Biggers S_ISDIR(inode->i_mode)); 658a14d0b67SEric Biggers 659a14d0b67SEric Biggers if (res == -ENOPKG && allow_unsupported) /* Algorithm unavailable? */ 660a14d0b67SEric Biggers res = 0; 661a992b20cSEric Biggers if (res == -ENOKEY) 662a992b20cSEric Biggers res = 0; 663a992b20cSEric Biggers return res; 664a992b20cSEric Biggers } 665feed8258SEric Biggers 666feed8258SEric Biggers /** 667a992b20cSEric Biggers * fscrypt_prepare_new_inode() - prepare to create a new inode in a directory 668a992b20cSEric Biggers * @dir: a possibly-encrypted directory 669a992b20cSEric Biggers * @inode: the new inode. ->i_mode must be set already. 670a992b20cSEric Biggers * ->i_ino doesn't need to be set yet. 671a992b20cSEric Biggers * @encrypt_ret: (output) set to %true if the new inode will be encrypted 672a992b20cSEric Biggers * 673a992b20cSEric Biggers * If the directory is encrypted, set up its ->i_crypt_info in preparation for 674a992b20cSEric Biggers * encrypting the name of the new file. Also, if the new inode will be 675a992b20cSEric Biggers * encrypted, set up its ->i_crypt_info and set *encrypt_ret=true. 676a992b20cSEric Biggers * 677a992b20cSEric Biggers * This isn't %GFP_NOFS-safe, and therefore it should be called before starting 678a992b20cSEric Biggers * any filesystem transaction to create the inode. For this reason, ->i_ino 679a992b20cSEric Biggers * isn't required to be set yet, as the filesystem may not have set it yet. 680a992b20cSEric Biggers * 681a992b20cSEric Biggers * This doesn't persist the new inode's encryption context. That still needs to 682a992b20cSEric Biggers * be done later by calling fscrypt_set_context(). 683a992b20cSEric Biggers * 684a992b20cSEric Biggers * Return: 0 on success, -ENOKEY if the encryption key is missing, or another 685a992b20cSEric Biggers * -errno code 686a992b20cSEric Biggers */ 687a992b20cSEric Biggers int fscrypt_prepare_new_inode(struct inode *dir, struct inode *inode, 688a992b20cSEric Biggers bool *encrypt_ret) 689a992b20cSEric Biggers { 690ac4acb1fSEric Biggers const union fscrypt_policy *policy; 691a992b20cSEric Biggers u8 nonce[FSCRYPT_FILE_NONCE_SIZE]; 692a992b20cSEric Biggers 693ac4acb1fSEric Biggers policy = fscrypt_policy_to_inherit(dir); 694ac4acb1fSEric Biggers if (policy == NULL) 695a992b20cSEric Biggers return 0; 696ac4acb1fSEric Biggers if (IS_ERR(policy)) 697ac4acb1fSEric Biggers return PTR_ERR(policy); 698a992b20cSEric Biggers 699a992b20cSEric Biggers if (WARN_ON_ONCE(inode->i_mode == 0)) 700a992b20cSEric Biggers return -EINVAL; 701a992b20cSEric Biggers 702a992b20cSEric Biggers /* 703a992b20cSEric Biggers * Only regular files, directories, and symlinks are encrypted. 704a992b20cSEric Biggers * Special files like device nodes and named pipes aren't. 705a992b20cSEric Biggers */ 706a992b20cSEric Biggers if (!S_ISREG(inode->i_mode) && 707a992b20cSEric Biggers !S_ISDIR(inode->i_mode) && 708a992b20cSEric Biggers !S_ISLNK(inode->i_mode)) 709a992b20cSEric Biggers return 0; 710a992b20cSEric Biggers 711a992b20cSEric Biggers *encrypt_ret = true; 712a992b20cSEric Biggers 713a992b20cSEric Biggers get_random_bytes(nonce, FSCRYPT_FILE_NONCE_SIZE); 714ac4acb1fSEric Biggers return fscrypt_setup_encryption_info(inode, policy, nonce, 715a992b20cSEric Biggers IS_CASEFOLDED(dir) && 716a992b20cSEric Biggers S_ISDIR(inode->i_mode)); 717a992b20cSEric Biggers } 718a992b20cSEric Biggers EXPORT_SYMBOL_GPL(fscrypt_prepare_new_inode); 719a992b20cSEric Biggers 720a992b20cSEric Biggers /** 721d2fe9754SEric Biggers * fscrypt_put_encryption_info() - free most of an inode's fscrypt data 722d2fe9754SEric Biggers * @inode: an inode being evicted 723feed8258SEric Biggers * 724feed8258SEric Biggers * Free the inode's fscrypt_info. Filesystems must call this when the inode is 725feed8258SEric Biggers * being evicted. An RCU grace period need not have elapsed yet. 726feed8258SEric Biggers */ 727feed8258SEric Biggers void fscrypt_put_encryption_info(struct inode *inode) 728feed8258SEric Biggers { 729feed8258SEric Biggers put_crypt_info(inode->i_crypt_info); 730feed8258SEric Biggers inode->i_crypt_info = NULL; 731feed8258SEric Biggers } 732feed8258SEric Biggers EXPORT_SYMBOL(fscrypt_put_encryption_info); 733feed8258SEric Biggers 734feed8258SEric Biggers /** 735d2fe9754SEric Biggers * fscrypt_free_inode() - free an inode's fscrypt data requiring RCU delay 736d2fe9754SEric Biggers * @inode: an inode being freed 737feed8258SEric Biggers * 738feed8258SEric Biggers * Free the inode's cached decrypted symlink target, if any. Filesystems must 739feed8258SEric Biggers * call this after an RCU grace period, just before they free the inode. 740feed8258SEric Biggers */ 741feed8258SEric Biggers void fscrypt_free_inode(struct inode *inode) 742feed8258SEric Biggers { 743feed8258SEric Biggers if (IS_ENCRYPTED(inode) && S_ISLNK(inode->i_mode)) { 744feed8258SEric Biggers kfree(inode->i_link); 745feed8258SEric Biggers inode->i_link = NULL; 746feed8258SEric Biggers } 747feed8258SEric Biggers } 748feed8258SEric Biggers EXPORT_SYMBOL(fscrypt_free_inode); 749b1c0ec35SEric Biggers 750b1c0ec35SEric Biggers /** 751d2fe9754SEric Biggers * fscrypt_drop_inode() - check whether the inode's master key has been removed 752d2fe9754SEric Biggers * @inode: an inode being considered for eviction 753b1c0ec35SEric Biggers * 754b1c0ec35SEric Biggers * Filesystems supporting fscrypt must call this from their ->drop_inode() 755b1c0ec35SEric Biggers * method so that encrypted inodes are evicted as soon as they're no longer in 756b1c0ec35SEric Biggers * use and their master key has been removed. 757b1c0ec35SEric Biggers * 758b1c0ec35SEric Biggers * Return: 1 if fscrypt wants the inode to be evicted now, otherwise 0 759b1c0ec35SEric Biggers */ 760b1c0ec35SEric Biggers int fscrypt_drop_inode(struct inode *inode) 761b1c0ec35SEric Biggers { 762ab673b98SEric Biggers const struct fscrypt_info *ci = fscrypt_get_info(inode); 763b1c0ec35SEric Biggers const struct fscrypt_master_key *mk; 764b1c0ec35SEric Biggers 765b1c0ec35SEric Biggers /* 766b1c0ec35SEric Biggers * If ci is NULL, then the inode doesn't have an encryption key set up 767b1c0ec35SEric Biggers * so it's irrelevant. If ci_master_key is NULL, then the master key 768b1c0ec35SEric Biggers * was provided via the legacy mechanism of the process-subscribed 769b1c0ec35SEric Biggers * keyrings, so we don't know whether it's been removed or not. 770b1c0ec35SEric Biggers */ 771b1c0ec35SEric Biggers if (!ci || !ci->ci_master_key) 772b1c0ec35SEric Biggers return 0; 773b1c0ec35SEric Biggers mk = ci->ci_master_key->payload.data[0]; 774b1c0ec35SEric Biggers 775b1c0ec35SEric Biggers /* 7762b4eae95SEric Biggers * With proper, non-racy use of FS_IOC_REMOVE_ENCRYPTION_KEY, all inodes 7772b4eae95SEric Biggers * protected by the key were cleaned by sync_filesystem(). But if 7782b4eae95SEric Biggers * userspace is still using the files, inodes can be dirtied between 7792b4eae95SEric Biggers * then and now. We mustn't lose any writes, so skip dirty inodes here. 7802b4eae95SEric Biggers */ 7812b4eae95SEric Biggers if (inode->i_state & I_DIRTY_ALL) 7822b4eae95SEric Biggers return 0; 7832b4eae95SEric Biggers 7842b4eae95SEric Biggers /* 7854a4b8721SEric Biggers * Note: since we aren't holding the key semaphore, the result here can 786b1c0ec35SEric Biggers * immediately become outdated. But there's no correctness problem with 787b1c0ec35SEric Biggers * unnecessarily evicting. Nor is there a correctness problem with not 788b1c0ec35SEric Biggers * evicting while iput() is racing with the key being removed, since 789b1c0ec35SEric Biggers * then the thread removing the key will either evict the inode itself 790b1c0ec35SEric Biggers * or will correctly detect that it wasn't evicted due to the race. 791b1c0ec35SEric Biggers */ 792b1c0ec35SEric Biggers return !is_master_key_secret_present(&mk->mk_secret); 793b1c0ec35SEric Biggers } 794b1c0ec35SEric Biggers EXPORT_SYMBOL_GPL(fscrypt_drop_inode); 795