2019-08-04 20:35:45 -06:00
|
|
|
// SPDX-License-Identifier: GPL-2.0
|
|
|
|
/*
|
|
|
|
* Key setup for v1 encryption policies
|
|
|
|
*
|
|
|
|
* Copyright 2015, 2019 Google LLC
|
|
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* This file implements compatibility functions for the original encryption
|
|
|
|
* policy version ("v1"), including:
|
|
|
|
*
|
2020-01-20 15:31:58 -07:00
|
|
|
* - Deriving per-file encryption keys using the AES-128-ECB based KDF
|
2019-08-04 20:35:45 -06:00
|
|
|
* (rather than the new method of using HKDF-SHA512)
|
|
|
|
*
|
|
|
|
* - Retrieving fscrypt master keys from process-subscribed keyrings
|
|
|
|
* (rather than the new method of using a filesystem-level keyring)
|
|
|
|
*
|
|
|
|
* - Handling policies with the DIRECT_KEY flag set using a master key table
|
|
|
|
* (rather than the new method of implementing DIRECT_KEY with per-mode keys
|
|
|
|
* managed alongside the master keys in the filesystem-level keyring)
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <crypto/algapi.h>
|
|
|
|
#include <crypto/skcipher.h>
|
|
|
|
#include <keys/user-type.h>
|
|
|
|
#include <linux/hashtable.h>
|
|
|
|
#include <linux/scatterlist.h>
|
|
|
|
|
|
|
|
#include "fscrypt_private.h"
|
|
|
|
|
|
|
|
/* Table of keys referenced by DIRECT_KEY policies */
|
|
|
|
static DEFINE_HASHTABLE(fscrypt_direct_keys, 6); /* 6 bits = 64 buckets */
|
|
|
|
static DEFINE_SPINLOCK(fscrypt_direct_keys_lock);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* v1 key derivation function. This generates the derived key by encrypting the
|
|
|
|
* master key with AES-128-ECB using the nonce as the AES key. This provides a
|
|
|
|
* unique derived key with sufficient entropy for each inode. However, it's
|
|
|
|
* nonstandard, non-extensible, doesn't evenly distribute the entropy from the
|
|
|
|
* master key, and is trivially reversible: an attacker who compromises a
|
|
|
|
* derived key can "decrypt" it to get back to the master key, then derive any
|
|
|
|
* other key. For all new code, use HKDF instead.
|
|
|
|
*
|
|
|
|
* The master key must be at least as long as the derived key. If the master
|
|
|
|
* key is longer, then only the first 'derived_keysize' bytes are used.
|
|
|
|
*/
|
|
|
|
static int derive_key_aes(const u8 *master_key,
|
2020-07-08 15:57:22 -06:00
|
|
|
const u8 nonce[FSCRYPT_FILE_NONCE_SIZE],
|
2019-08-04 20:35:45 -06:00
|
|
|
u8 *derived_key, unsigned int derived_keysize)
|
|
|
|
{
|
|
|
|
int res = 0;
|
|
|
|
struct skcipher_request *req = NULL;
|
|
|
|
DECLARE_CRYPTO_WAIT(wait);
|
|
|
|
struct scatterlist src_sg, dst_sg;
|
|
|
|
struct crypto_skcipher *tfm = crypto_alloc_skcipher("ecb(aes)", 0, 0);
|
|
|
|
|
|
|
|
if (IS_ERR(tfm)) {
|
|
|
|
res = PTR_ERR(tfm);
|
|
|
|
tfm = NULL;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
|
|
|
|
req = skcipher_request_alloc(tfm, GFP_NOFS);
|
|
|
|
if (!req) {
|
|
|
|
res = -ENOMEM;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
skcipher_request_set_callback(req,
|
|
|
|
CRYPTO_TFM_REQ_MAY_BACKLOG | CRYPTO_TFM_REQ_MAY_SLEEP,
|
|
|
|
crypto_req_done, &wait);
|
2020-07-08 15:57:22 -06:00
|
|
|
res = crypto_skcipher_setkey(tfm, nonce, FSCRYPT_FILE_NONCE_SIZE);
|
2019-08-04 20:35:45 -06:00
|
|
|
if (res < 0)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
sg_init_one(&src_sg, master_key, derived_keysize);
|
|
|
|
sg_init_one(&dst_sg, derived_key, derived_keysize);
|
|
|
|
skcipher_request_set_crypt(req, &src_sg, &dst_sg, derived_keysize,
|
|
|
|
NULL);
|
|
|
|
res = crypto_wait_req(crypto_skcipher_encrypt(req), &wait);
|
|
|
|
out:
|
|
|
|
skcipher_request_free(req);
|
|
|
|
crypto_free_skcipher(tfm);
|
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Search the current task's subscribed keyrings for a "logon" key with
|
|
|
|
* description prefix:descriptor, and if found acquire a read lock on it and
|
|
|
|
* return a pointer to its validated payload in *payload_ret.
|
|
|
|
*/
|
|
|
|
static struct key *
|
|
|
|
find_and_lock_process_key(const char *prefix,
|
|
|
|
const u8 descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE],
|
|
|
|
unsigned int min_keysize,
|
|
|
|
const struct fscrypt_key **payload_ret)
|
|
|
|
{
|
|
|
|
char *description;
|
|
|
|
struct key *key;
|
|
|
|
const struct user_key_payload *ukp;
|
|
|
|
const struct fscrypt_key *payload;
|
|
|
|
|
|
|
|
description = kasprintf(GFP_NOFS, "%s%*phN", prefix,
|
|
|
|
FSCRYPT_KEY_DESCRIPTOR_SIZE, descriptor);
|
|
|
|
if (!description)
|
|
|
|
return ERR_PTR(-ENOMEM);
|
|
|
|
|
|
|
|
key = request_key(&key_type_logon, description, NULL);
|
|
|
|
kfree(description);
|
|
|
|
if (IS_ERR(key))
|
|
|
|
return key;
|
|
|
|
|
|
|
|
down_read(&key->sem);
|
|
|
|
ukp = user_key_payload_locked(key);
|
|
|
|
|
|
|
|
if (!ukp) /* was the key revoked before we acquired its semaphore? */
|
|
|
|
goto invalid;
|
|
|
|
|
|
|
|
payload = (const struct fscrypt_key *)ukp->data;
|
|
|
|
|
|
|
|
if (ukp->datalen != sizeof(struct fscrypt_key) ||
|
|
|
|
payload->size < 1 || payload->size > FSCRYPT_MAX_KEY_SIZE) {
|
|
|
|
fscrypt_warn(NULL,
|
|
|
|
"key with description '%s' has invalid payload",
|
|
|
|
key->description);
|
|
|
|
goto invalid;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (payload->size < min_keysize) {
|
|
|
|
fscrypt_warn(NULL,
|
|
|
|
"key with description '%s' is too short (got %u bytes, need %u+ bytes)",
|
|
|
|
key->description, payload->size, min_keysize);
|
|
|
|
goto invalid;
|
|
|
|
}
|
|
|
|
|
|
|
|
*payload_ret = payload;
|
|
|
|
return key;
|
|
|
|
|
|
|
|
invalid:
|
|
|
|
up_read(&key->sem);
|
|
|
|
key_put(key);
|
|
|
|
return ERR_PTR(-ENOKEY);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Master key referenced by DIRECT_KEY policy */
|
|
|
|
struct fscrypt_direct_key {
|
|
|
|
struct hlist_node dk_node;
|
|
|
|
refcount_t dk_refcount;
|
|
|
|
const struct fscrypt_mode *dk_mode;
|
2020-07-01 19:56:05 -06:00
|
|
|
struct fscrypt_prepared_key dk_key;
|
2019-08-04 20:35:45 -06:00
|
|
|
u8 dk_descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE];
|
|
|
|
u8 dk_raw[FSCRYPT_MAX_KEY_SIZE];
|
|
|
|
};
|
|
|
|
|
|
|
|
static void free_direct_key(struct fscrypt_direct_key *dk)
|
|
|
|
{
|
|
|
|
if (dk) {
|
2020-07-01 19:56:05 -06:00
|
|
|
fscrypt_destroy_prepared_key(&dk->dk_key);
|
2020-08-07 00:18:13 -06:00
|
|
|
kfree_sensitive(dk);
|
2019-08-04 20:35:45 -06:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void fscrypt_put_direct_key(struct fscrypt_direct_key *dk)
|
|
|
|
{
|
|
|
|
if (!refcount_dec_and_lock(&dk->dk_refcount, &fscrypt_direct_keys_lock))
|
|
|
|
return;
|
|
|
|
hash_del(&dk->dk_node);
|
|
|
|
spin_unlock(&fscrypt_direct_keys_lock);
|
|
|
|
|
|
|
|
free_direct_key(dk);
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Find/insert the given key into the fscrypt_direct_keys table. If found, it
|
|
|
|
* is returned with elevated refcount, and 'to_insert' is freed if non-NULL. If
|
|
|
|
* not found, 'to_insert' is inserted and returned if it's non-NULL; otherwise
|
|
|
|
* NULL is returned.
|
|
|
|
*/
|
|
|
|
static struct fscrypt_direct_key *
|
|
|
|
find_or_insert_direct_key(struct fscrypt_direct_key *to_insert,
|
|
|
|
const u8 *raw_key, const struct fscrypt_info *ci)
|
|
|
|
{
|
|
|
|
unsigned long hash_key;
|
|
|
|
struct fscrypt_direct_key *dk;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Careful: to avoid potentially leaking secret key bytes via timing
|
|
|
|
* information, we must key the hash table by descriptor rather than by
|
|
|
|
* raw key, and use crypto_memneq() when comparing raw keys.
|
|
|
|
*/
|
|
|
|
|
|
|
|
BUILD_BUG_ON(sizeof(hash_key) > FSCRYPT_KEY_DESCRIPTOR_SIZE);
|
fscrypt: v2 encryption policy support
Add a new fscrypt policy version, "v2". It has the following changes
from the original policy version, which we call "v1" (*):
- Master keys (the user-provided encryption keys) are only ever used as
input to HKDF-SHA512. This is more flexible and less error-prone, and
it avoids the quirks and limitations of the AES-128-ECB based KDF.
Three classes of cryptographically isolated subkeys are defined:
- Per-file keys, like used in v1 policies except for the new KDF.
- Per-mode keys. These implement the semantics of the DIRECT_KEY
flag, which for v1 policies made the master key be used directly.
These are also planned to be used for inline encryption when
support for it is added.
- Key identifiers (see below).
- Each master key is identified by a 16-byte master_key_identifier,
which is derived from the key itself using HKDF-SHA512. This prevents
users from associating the wrong key with an encrypted file or
directory. This was easily possible with v1 policies, which
identified the key by an arbitrary 8-byte master_key_descriptor.
- The key must be provided in the filesystem-level keyring, not in a
process-subscribed keyring.
The following UAPI additions are made:
- The existing ioctl FS_IOC_SET_ENCRYPTION_POLICY can now be passed a
fscrypt_policy_v2 to set a v2 encryption policy. It's disambiguated
from fscrypt_policy/fscrypt_policy_v1 by the version code prefix.
- A new ioctl FS_IOC_GET_ENCRYPTION_POLICY_EX is added. It allows
getting the v1 or v2 encryption policy of an encrypted file or
directory. The existing FS_IOC_GET_ENCRYPTION_POLICY ioctl could not
be used because it did not have a way for userspace to indicate which
policy structure is expected. The new ioctl includes a size field, so
it is extensible to future fscrypt policy versions.
- The ioctls FS_IOC_ADD_ENCRYPTION_KEY, FS_IOC_REMOVE_ENCRYPTION_KEY,
and FS_IOC_GET_ENCRYPTION_KEY_STATUS now support managing keys for v2
encryption policies. Such keys are kept logically separate from keys
for v1 encryption policies, and are identified by 'identifier' rather
than by 'descriptor'. The 'identifier' need not be provided when
adding a key, since the kernel will calculate it anyway.
This patch temporarily keeps adding/removing v2 policy keys behind the
same permission check done for adding/removing v1 policy keys:
capable(CAP_SYS_ADMIN). However, the next patch will carefully take
advantage of the cryptographically secure master_key_identifier to allow
non-root users to add/remove v2 policy keys, thus providing a full
replacement for v1 policies.
(*) Actually, in the API fscrypt_policy::version is 0 while on-disk
fscrypt_context::format is 1. But I believe it makes the most sense
to advance both to '2' to have them be in sync, and to consider the
numbering to start at 1 except for the API quirk.
Reviewed-by: Paul Crowley <paulcrowley@google.com>
Reviewed-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Eric Biggers <ebiggers@google.com>
2019-08-04 20:35:47 -06:00
|
|
|
memcpy(&hash_key, ci->ci_policy.v1.master_key_descriptor,
|
|
|
|
sizeof(hash_key));
|
2019-08-04 20:35:45 -06:00
|
|
|
|
|
|
|
spin_lock(&fscrypt_direct_keys_lock);
|
|
|
|
hash_for_each_possible(fscrypt_direct_keys, dk, dk_node, hash_key) {
|
fscrypt: v2 encryption policy support
Add a new fscrypt policy version, "v2". It has the following changes
from the original policy version, which we call "v1" (*):
- Master keys (the user-provided encryption keys) are only ever used as
input to HKDF-SHA512. This is more flexible and less error-prone, and
it avoids the quirks and limitations of the AES-128-ECB based KDF.
Three classes of cryptographically isolated subkeys are defined:
- Per-file keys, like used in v1 policies except for the new KDF.
- Per-mode keys. These implement the semantics of the DIRECT_KEY
flag, which for v1 policies made the master key be used directly.
These are also planned to be used for inline encryption when
support for it is added.
- Key identifiers (see below).
- Each master key is identified by a 16-byte master_key_identifier,
which is derived from the key itself using HKDF-SHA512. This prevents
users from associating the wrong key with an encrypted file or
directory. This was easily possible with v1 policies, which
identified the key by an arbitrary 8-byte master_key_descriptor.
- The key must be provided in the filesystem-level keyring, not in a
process-subscribed keyring.
The following UAPI additions are made:
- The existing ioctl FS_IOC_SET_ENCRYPTION_POLICY can now be passed a
fscrypt_policy_v2 to set a v2 encryption policy. It's disambiguated
from fscrypt_policy/fscrypt_policy_v1 by the version code prefix.
- A new ioctl FS_IOC_GET_ENCRYPTION_POLICY_EX is added. It allows
getting the v1 or v2 encryption policy of an encrypted file or
directory. The existing FS_IOC_GET_ENCRYPTION_POLICY ioctl could not
be used because it did not have a way for userspace to indicate which
policy structure is expected. The new ioctl includes a size field, so
it is extensible to future fscrypt policy versions.
- The ioctls FS_IOC_ADD_ENCRYPTION_KEY, FS_IOC_REMOVE_ENCRYPTION_KEY,
and FS_IOC_GET_ENCRYPTION_KEY_STATUS now support managing keys for v2
encryption policies. Such keys are kept logically separate from keys
for v1 encryption policies, and are identified by 'identifier' rather
than by 'descriptor'. The 'identifier' need not be provided when
adding a key, since the kernel will calculate it anyway.
This patch temporarily keeps adding/removing v2 policy keys behind the
same permission check done for adding/removing v1 policy keys:
capable(CAP_SYS_ADMIN). However, the next patch will carefully take
advantage of the cryptographically secure master_key_identifier to allow
non-root users to add/remove v2 policy keys, thus providing a full
replacement for v1 policies.
(*) Actually, in the API fscrypt_policy::version is 0 while on-disk
fscrypt_context::format is 1. But I believe it makes the most sense
to advance both to '2' to have them be in sync, and to consider the
numbering to start at 1 except for the API quirk.
Reviewed-by: Paul Crowley <paulcrowley@google.com>
Reviewed-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Eric Biggers <ebiggers@google.com>
2019-08-04 20:35:47 -06:00
|
|
|
if (memcmp(ci->ci_policy.v1.master_key_descriptor,
|
|
|
|
dk->dk_descriptor, FSCRYPT_KEY_DESCRIPTOR_SIZE) != 0)
|
2019-08-04 20:35:45 -06:00
|
|
|
continue;
|
|
|
|
if (ci->ci_mode != dk->dk_mode)
|
|
|
|
continue;
|
2020-07-01 19:56:05 -06:00
|
|
|
if (!fscrypt_is_key_prepared(&dk->dk_key, ci))
|
|
|
|
continue;
|
2019-08-04 20:35:45 -06:00
|
|
|
if (crypto_memneq(raw_key, dk->dk_raw, ci->ci_mode->keysize))
|
|
|
|
continue;
|
|
|
|
/* using existing tfm with same (descriptor, mode, raw_key) */
|
|
|
|
refcount_inc(&dk->dk_refcount);
|
|
|
|
spin_unlock(&fscrypt_direct_keys_lock);
|
|
|
|
free_direct_key(to_insert);
|
|
|
|
return dk;
|
|
|
|
}
|
|
|
|
if (to_insert)
|
|
|
|
hash_add(fscrypt_direct_keys, &to_insert->dk_node, hash_key);
|
|
|
|
spin_unlock(&fscrypt_direct_keys_lock);
|
|
|
|
return to_insert;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Prepare to encrypt directly using the master key in the given mode */
|
|
|
|
static struct fscrypt_direct_key *
|
|
|
|
fscrypt_get_direct_key(const struct fscrypt_info *ci, const u8 *raw_key)
|
|
|
|
{
|
|
|
|
struct fscrypt_direct_key *dk;
|
|
|
|
int err;
|
|
|
|
|
|
|
|
/* Is there already a tfm for this key? */
|
|
|
|
dk = find_or_insert_direct_key(NULL, raw_key, ci);
|
|
|
|
if (dk)
|
|
|
|
return dk;
|
|
|
|
|
|
|
|
/* Nope, allocate one. */
|
|
|
|
dk = kzalloc(sizeof(*dk), GFP_NOFS);
|
|
|
|
if (!dk)
|
|
|
|
return ERR_PTR(-ENOMEM);
|
|
|
|
refcount_set(&dk->dk_refcount, 1);
|
|
|
|
dk->dk_mode = ci->ci_mode;
|
2020-07-01 19:56:05 -06:00
|
|
|
err = fscrypt_prepare_key(&dk->dk_key, raw_key, ci);
|
|
|
|
if (err)
|
2019-08-04 20:35:45 -06:00
|
|
|
goto err_free_dk;
|
fscrypt: v2 encryption policy support
Add a new fscrypt policy version, "v2". It has the following changes
from the original policy version, which we call "v1" (*):
- Master keys (the user-provided encryption keys) are only ever used as
input to HKDF-SHA512. This is more flexible and less error-prone, and
it avoids the quirks and limitations of the AES-128-ECB based KDF.
Three classes of cryptographically isolated subkeys are defined:
- Per-file keys, like used in v1 policies except for the new KDF.
- Per-mode keys. These implement the semantics of the DIRECT_KEY
flag, which for v1 policies made the master key be used directly.
These are also planned to be used for inline encryption when
support for it is added.
- Key identifiers (see below).
- Each master key is identified by a 16-byte master_key_identifier,
which is derived from the key itself using HKDF-SHA512. This prevents
users from associating the wrong key with an encrypted file or
directory. This was easily possible with v1 policies, which
identified the key by an arbitrary 8-byte master_key_descriptor.
- The key must be provided in the filesystem-level keyring, not in a
process-subscribed keyring.
The following UAPI additions are made:
- The existing ioctl FS_IOC_SET_ENCRYPTION_POLICY can now be passed a
fscrypt_policy_v2 to set a v2 encryption policy. It's disambiguated
from fscrypt_policy/fscrypt_policy_v1 by the version code prefix.
- A new ioctl FS_IOC_GET_ENCRYPTION_POLICY_EX is added. It allows
getting the v1 or v2 encryption policy of an encrypted file or
directory. The existing FS_IOC_GET_ENCRYPTION_POLICY ioctl could not
be used because it did not have a way for userspace to indicate which
policy structure is expected. The new ioctl includes a size field, so
it is extensible to future fscrypt policy versions.
- The ioctls FS_IOC_ADD_ENCRYPTION_KEY, FS_IOC_REMOVE_ENCRYPTION_KEY,
and FS_IOC_GET_ENCRYPTION_KEY_STATUS now support managing keys for v2
encryption policies. Such keys are kept logically separate from keys
for v1 encryption policies, and are identified by 'identifier' rather
than by 'descriptor'. The 'identifier' need not be provided when
adding a key, since the kernel will calculate it anyway.
This patch temporarily keeps adding/removing v2 policy keys behind the
same permission check done for adding/removing v1 policy keys:
capable(CAP_SYS_ADMIN). However, the next patch will carefully take
advantage of the cryptographically secure master_key_identifier to allow
non-root users to add/remove v2 policy keys, thus providing a full
replacement for v1 policies.
(*) Actually, in the API fscrypt_policy::version is 0 while on-disk
fscrypt_context::format is 1. But I believe it makes the most sense
to advance both to '2' to have them be in sync, and to consider the
numbering to start at 1 except for the API quirk.
Reviewed-by: Paul Crowley <paulcrowley@google.com>
Reviewed-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Eric Biggers <ebiggers@google.com>
2019-08-04 20:35:47 -06:00
|
|
|
memcpy(dk->dk_descriptor, ci->ci_policy.v1.master_key_descriptor,
|
2019-08-04 20:35:45 -06:00
|
|
|
FSCRYPT_KEY_DESCRIPTOR_SIZE);
|
|
|
|
memcpy(dk->dk_raw, raw_key, ci->ci_mode->keysize);
|
|
|
|
|
|
|
|
return find_or_insert_direct_key(dk, raw_key, ci);
|
|
|
|
|
|
|
|
err_free_dk:
|
|
|
|
free_direct_key(dk);
|
|
|
|
return ERR_PTR(err);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* v1 policy, DIRECT_KEY: use the master key directly */
|
|
|
|
static int setup_v1_file_key_direct(struct fscrypt_info *ci,
|
|
|
|
const u8 *raw_master_key)
|
|
|
|
{
|
|
|
|
struct fscrypt_direct_key *dk;
|
|
|
|
|
|
|
|
dk = fscrypt_get_direct_key(ci, raw_master_key);
|
|
|
|
if (IS_ERR(dk))
|
|
|
|
return PTR_ERR(dk);
|
|
|
|
ci->ci_direct_key = dk;
|
2020-07-01 19:56:05 -06:00
|
|
|
ci->ci_enc_key = dk->dk_key;
|
2019-08-04 20:35:45 -06:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* v1 policy, !DIRECT_KEY: derive the file's encryption key */
|
|
|
|
static int setup_v1_file_key_derived(struct fscrypt_info *ci,
|
|
|
|
const u8 *raw_master_key)
|
|
|
|
{
|
|
|
|
u8 *derived_key;
|
|
|
|
int err;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* This cannot be a stack buffer because it will be passed to the
|
|
|
|
* scatterlist crypto API during derive_key_aes().
|
|
|
|
*/
|
|
|
|
derived_key = kmalloc(ci->ci_mode->keysize, GFP_NOFS);
|
|
|
|
if (!derived_key)
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
err = derive_key_aes(raw_master_key, ci->ci_nonce,
|
|
|
|
derived_key, ci->ci_mode->keysize);
|
|
|
|
if (err)
|
|
|
|
goto out;
|
|
|
|
|
2020-01-20 15:31:58 -07:00
|
|
|
err = fscrypt_set_per_file_enc_key(ci, derived_key);
|
2019-08-04 20:35:45 -06:00
|
|
|
out:
|
2020-08-07 00:18:13 -06:00
|
|
|
kfree_sensitive(derived_key);
|
2019-08-04 20:35:45 -06:00
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
|
|
|
int fscrypt_setup_v1_file_key(struct fscrypt_info *ci, const u8 *raw_master_key)
|
|
|
|
{
|
fscrypt: v2 encryption policy support
Add a new fscrypt policy version, "v2". It has the following changes
from the original policy version, which we call "v1" (*):
- Master keys (the user-provided encryption keys) are only ever used as
input to HKDF-SHA512. This is more flexible and less error-prone, and
it avoids the quirks and limitations of the AES-128-ECB based KDF.
Three classes of cryptographically isolated subkeys are defined:
- Per-file keys, like used in v1 policies except for the new KDF.
- Per-mode keys. These implement the semantics of the DIRECT_KEY
flag, which for v1 policies made the master key be used directly.
These are also planned to be used for inline encryption when
support for it is added.
- Key identifiers (see below).
- Each master key is identified by a 16-byte master_key_identifier,
which is derived from the key itself using HKDF-SHA512. This prevents
users from associating the wrong key with an encrypted file or
directory. This was easily possible with v1 policies, which
identified the key by an arbitrary 8-byte master_key_descriptor.
- The key must be provided in the filesystem-level keyring, not in a
process-subscribed keyring.
The following UAPI additions are made:
- The existing ioctl FS_IOC_SET_ENCRYPTION_POLICY can now be passed a
fscrypt_policy_v2 to set a v2 encryption policy. It's disambiguated
from fscrypt_policy/fscrypt_policy_v1 by the version code prefix.
- A new ioctl FS_IOC_GET_ENCRYPTION_POLICY_EX is added. It allows
getting the v1 or v2 encryption policy of an encrypted file or
directory. The existing FS_IOC_GET_ENCRYPTION_POLICY ioctl could not
be used because it did not have a way for userspace to indicate which
policy structure is expected. The new ioctl includes a size field, so
it is extensible to future fscrypt policy versions.
- The ioctls FS_IOC_ADD_ENCRYPTION_KEY, FS_IOC_REMOVE_ENCRYPTION_KEY,
and FS_IOC_GET_ENCRYPTION_KEY_STATUS now support managing keys for v2
encryption policies. Such keys are kept logically separate from keys
for v1 encryption policies, and are identified by 'identifier' rather
than by 'descriptor'. The 'identifier' need not be provided when
adding a key, since the kernel will calculate it anyway.
This patch temporarily keeps adding/removing v2 policy keys behind the
same permission check done for adding/removing v1 policy keys:
capable(CAP_SYS_ADMIN). However, the next patch will carefully take
advantage of the cryptographically secure master_key_identifier to allow
non-root users to add/remove v2 policy keys, thus providing a full
replacement for v1 policies.
(*) Actually, in the API fscrypt_policy::version is 0 while on-disk
fscrypt_context::format is 1. But I believe it makes the most sense
to advance both to '2' to have them be in sync, and to consider the
numbering to start at 1 except for the API quirk.
Reviewed-by: Paul Crowley <paulcrowley@google.com>
Reviewed-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Eric Biggers <ebiggers@google.com>
2019-08-04 20:35:47 -06:00
|
|
|
if (ci->ci_policy.v1.flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY)
|
2019-08-04 20:35:45 -06:00
|
|
|
return setup_v1_file_key_direct(ci, raw_master_key);
|
|
|
|
else
|
|
|
|
return setup_v1_file_key_derived(ci, raw_master_key);
|
|
|
|
}
|
|
|
|
|
|
|
|
int fscrypt_setup_v1_file_key_via_subscribed_keyrings(struct fscrypt_info *ci)
|
|
|
|
{
|
|
|
|
struct key *key;
|
|
|
|
const struct fscrypt_key *payload;
|
|
|
|
int err;
|
|
|
|
|
|
|
|
key = find_and_lock_process_key(FSCRYPT_KEY_DESC_PREFIX,
|
fscrypt: v2 encryption policy support
Add a new fscrypt policy version, "v2". It has the following changes
from the original policy version, which we call "v1" (*):
- Master keys (the user-provided encryption keys) are only ever used as
input to HKDF-SHA512. This is more flexible and less error-prone, and
it avoids the quirks and limitations of the AES-128-ECB based KDF.
Three classes of cryptographically isolated subkeys are defined:
- Per-file keys, like used in v1 policies except for the new KDF.
- Per-mode keys. These implement the semantics of the DIRECT_KEY
flag, which for v1 policies made the master key be used directly.
These are also planned to be used for inline encryption when
support for it is added.
- Key identifiers (see below).
- Each master key is identified by a 16-byte master_key_identifier,
which is derived from the key itself using HKDF-SHA512. This prevents
users from associating the wrong key with an encrypted file or
directory. This was easily possible with v1 policies, which
identified the key by an arbitrary 8-byte master_key_descriptor.
- The key must be provided in the filesystem-level keyring, not in a
process-subscribed keyring.
The following UAPI additions are made:
- The existing ioctl FS_IOC_SET_ENCRYPTION_POLICY can now be passed a
fscrypt_policy_v2 to set a v2 encryption policy. It's disambiguated
from fscrypt_policy/fscrypt_policy_v1 by the version code prefix.
- A new ioctl FS_IOC_GET_ENCRYPTION_POLICY_EX is added. It allows
getting the v1 or v2 encryption policy of an encrypted file or
directory. The existing FS_IOC_GET_ENCRYPTION_POLICY ioctl could not
be used because it did not have a way for userspace to indicate which
policy structure is expected. The new ioctl includes a size field, so
it is extensible to future fscrypt policy versions.
- The ioctls FS_IOC_ADD_ENCRYPTION_KEY, FS_IOC_REMOVE_ENCRYPTION_KEY,
and FS_IOC_GET_ENCRYPTION_KEY_STATUS now support managing keys for v2
encryption policies. Such keys are kept logically separate from keys
for v1 encryption policies, and are identified by 'identifier' rather
than by 'descriptor'. The 'identifier' need not be provided when
adding a key, since the kernel will calculate it anyway.
This patch temporarily keeps adding/removing v2 policy keys behind the
same permission check done for adding/removing v1 policy keys:
capable(CAP_SYS_ADMIN). However, the next patch will carefully take
advantage of the cryptographically secure master_key_identifier to allow
non-root users to add/remove v2 policy keys, thus providing a full
replacement for v1 policies.
(*) Actually, in the API fscrypt_policy::version is 0 while on-disk
fscrypt_context::format is 1. But I believe it makes the most sense
to advance both to '2' to have them be in sync, and to consider the
numbering to start at 1 except for the API quirk.
Reviewed-by: Paul Crowley <paulcrowley@google.com>
Reviewed-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Eric Biggers <ebiggers@google.com>
2019-08-04 20:35:47 -06:00
|
|
|
ci->ci_policy.v1.master_key_descriptor,
|
2019-08-04 20:35:45 -06:00
|
|
|
ci->ci_mode->keysize, &payload);
|
|
|
|
if (key == ERR_PTR(-ENOKEY) && ci->ci_inode->i_sb->s_cop->key_prefix) {
|
|
|
|
key = find_and_lock_process_key(ci->ci_inode->i_sb->s_cop->key_prefix,
|
fscrypt: v2 encryption policy support
Add a new fscrypt policy version, "v2". It has the following changes
from the original policy version, which we call "v1" (*):
- Master keys (the user-provided encryption keys) are only ever used as
input to HKDF-SHA512. This is more flexible and less error-prone, and
it avoids the quirks and limitations of the AES-128-ECB based KDF.
Three classes of cryptographically isolated subkeys are defined:
- Per-file keys, like used in v1 policies except for the new KDF.
- Per-mode keys. These implement the semantics of the DIRECT_KEY
flag, which for v1 policies made the master key be used directly.
These are also planned to be used for inline encryption when
support for it is added.
- Key identifiers (see below).
- Each master key is identified by a 16-byte master_key_identifier,
which is derived from the key itself using HKDF-SHA512. This prevents
users from associating the wrong key with an encrypted file or
directory. This was easily possible with v1 policies, which
identified the key by an arbitrary 8-byte master_key_descriptor.
- The key must be provided in the filesystem-level keyring, not in a
process-subscribed keyring.
The following UAPI additions are made:
- The existing ioctl FS_IOC_SET_ENCRYPTION_POLICY can now be passed a
fscrypt_policy_v2 to set a v2 encryption policy. It's disambiguated
from fscrypt_policy/fscrypt_policy_v1 by the version code prefix.
- A new ioctl FS_IOC_GET_ENCRYPTION_POLICY_EX is added. It allows
getting the v1 or v2 encryption policy of an encrypted file or
directory. The existing FS_IOC_GET_ENCRYPTION_POLICY ioctl could not
be used because it did not have a way for userspace to indicate which
policy structure is expected. The new ioctl includes a size field, so
it is extensible to future fscrypt policy versions.
- The ioctls FS_IOC_ADD_ENCRYPTION_KEY, FS_IOC_REMOVE_ENCRYPTION_KEY,
and FS_IOC_GET_ENCRYPTION_KEY_STATUS now support managing keys for v2
encryption policies. Such keys are kept logically separate from keys
for v1 encryption policies, and are identified by 'identifier' rather
than by 'descriptor'. The 'identifier' need not be provided when
adding a key, since the kernel will calculate it anyway.
This patch temporarily keeps adding/removing v2 policy keys behind the
same permission check done for adding/removing v1 policy keys:
capable(CAP_SYS_ADMIN). However, the next patch will carefully take
advantage of the cryptographically secure master_key_identifier to allow
non-root users to add/remove v2 policy keys, thus providing a full
replacement for v1 policies.
(*) Actually, in the API fscrypt_policy::version is 0 while on-disk
fscrypt_context::format is 1. But I believe it makes the most sense
to advance both to '2' to have them be in sync, and to consider the
numbering to start at 1 except for the API quirk.
Reviewed-by: Paul Crowley <paulcrowley@google.com>
Reviewed-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Eric Biggers <ebiggers@google.com>
2019-08-04 20:35:47 -06:00
|
|
|
ci->ci_policy.v1.master_key_descriptor,
|
2019-08-04 20:35:45 -06:00
|
|
|
ci->ci_mode->keysize, &payload);
|
|
|
|
}
|
|
|
|
if (IS_ERR(key))
|
|
|
|
return PTR_ERR(key);
|
|
|
|
|
|
|
|
err = fscrypt_setup_v1_file_key(ci, payload->raw);
|
|
|
|
up_read(&key->sem);
|
|
|
|
key_put(key);
|
|
|
|
return err;
|
|
|
|
}
|