mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-01-15 18:07:04 +07:00
b1c0ec3599
Add a new fscrypt ioctl, FS_IOC_REMOVE_ENCRYPTION_KEY. This ioctl
removes an encryption key that was added by FS_IOC_ADD_ENCRYPTION_KEY.
It wipes the secret key itself, then "locks" the encrypted files and
directories that had been unlocked using that key -- implemented by
evicting the relevant dentries and inodes from the VFS caches.
The problem this solves is that many fscrypt users want the ability to
remove encryption keys, causing the corresponding encrypted directories
to appear "locked" (presented in ciphertext form) again. Moreover,
users want removing an encryption key to *really* remove it, in the
sense that the removed keys cannot be recovered even if kernel memory is
compromised, e.g. by the exploit of a kernel security vulnerability or
by a physical attack. This is desirable after a user logs out of the
system, for example. In many cases users even already assume this to be
the case and are surprised to hear when it's not.
It is not sufficient to simply unlink the master key from the keyring
(or to revoke or invalidate it), since the actual encryption transform
objects are still pinned in memory by their inodes. Therefore, to
really remove a key we must also evict the relevant inodes.
Currently one workaround is to run 'sync && echo 2 >
/proc/sys/vm/drop_caches'. But, that evicts all unused inodes in the
system rather than just the inodes associated with the key being
removed, causing severe performance problems. Moreover, it requires
root privileges, so regular users can't "lock" their encrypted files.
Another workaround, used in Chromium OS kernels, is to add a new
VFS-level ioctl FS_IOC_DROP_CACHE which is a more restricted version of
drop_caches that operates on a single super_block. It does:
shrink_dcache_sb(sb);
invalidate_inodes(sb, false);
But it's still a hack. Yet, the major users of filesystem encryption
want this feature badly enough that they are actually using these hacks.
To properly solve the problem, start maintaining a list of the inodes
which have been "unlocked" using each master key. Originally this
wasn't possible because the kernel didn't keep track of in-use master
keys at all. But, with the ->s_master_keys keyring it is now possible.
Then, add an ioctl FS_IOC_REMOVE_ENCRYPTION_KEY. It finds the specified
master key in ->s_master_keys, then wipes the secret key itself, which
prevents any additional inodes from being unlocked with the key. Then,
it syncs the filesystem and evicts the inodes in the key's list. The
normal inode eviction code will free and wipe the per-file keys (in
->i_crypt_info). Note that freeing ->i_crypt_info without evicting the
inodes was also considered, but would have been racy.
Some inodes may still be in use when a master key is removed, and we
can't simply revoke random file descriptors, mmap's, etc. Thus, the
ioctl simply skips in-use inodes, and returns -EBUSY to indicate that
some inodes weren't evicted. The master key *secret* is still removed,
but the fscrypt_master_key struct remains to keep track of the remaining
inodes. Userspace can then retry the ioctl to evict the remaining
inodes. Alternatively, if userspace adds the key again, the refreshed
secret will be associated with the existing list of inodes so they
remain correctly tracked for future key removals.
The ioctl doesn't wipe pagecache pages. Thus, we tolerate that after a
kernel compromise some portions of plaintext file contents may still be
recoverable from memory. This can be solved by enabling page poisoning
system-wide, which security conscious users may choose to do. But it's
very difficult to solve otherwise, e.g. note that plaintext file
contents may have been read in other places than pagecache pages.
Like FS_IOC_ADD_ENCRYPTION_KEY, FS_IOC_REMOVE_ENCRYPTION_KEY is
initially restricted to privileged users only. This is sufficient for
some use cases, but not all. A later patch will relax this restriction,
but it will require introducing key hashes, among other changes.
Reviewed-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Eric Biggers <ebiggers@google.com>
121 lines
4.1 KiB
C
121 lines
4.1 KiB
C
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
|
|
/*
|
|
* fscrypt user API
|
|
*
|
|
* These ioctls can be used on filesystems that support fscrypt. See the
|
|
* "User API" section of Documentation/filesystems/fscrypt.rst.
|
|
*/
|
|
#ifndef _UAPI_LINUX_FSCRYPT_H
|
|
#define _UAPI_LINUX_FSCRYPT_H
|
|
|
|
#include <linux/types.h>
|
|
|
|
#define FSCRYPT_KEY_DESCRIPTOR_SIZE 8
|
|
|
|
/* Encryption policy flags */
|
|
#define FSCRYPT_POLICY_FLAGS_PAD_4 0x00
|
|
#define FSCRYPT_POLICY_FLAGS_PAD_8 0x01
|
|
#define FSCRYPT_POLICY_FLAGS_PAD_16 0x02
|
|
#define FSCRYPT_POLICY_FLAGS_PAD_32 0x03
|
|
#define FSCRYPT_POLICY_FLAGS_PAD_MASK 0x03
|
|
#define FSCRYPT_POLICY_FLAG_DIRECT_KEY 0x04 /* use master key directly */
|
|
#define FSCRYPT_POLICY_FLAGS_VALID 0x07
|
|
|
|
/* Encryption algorithms */
|
|
#define FSCRYPT_MODE_AES_256_XTS 1
|
|
#define FSCRYPT_MODE_AES_256_CTS 4
|
|
#define FSCRYPT_MODE_AES_128_CBC 5
|
|
#define FSCRYPT_MODE_AES_128_CTS 6
|
|
#define FSCRYPT_MODE_ADIANTUM 9
|
|
|
|
struct fscrypt_policy {
|
|
__u8 version;
|
|
__u8 contents_encryption_mode;
|
|
__u8 filenames_encryption_mode;
|
|
__u8 flags;
|
|
__u8 master_key_descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE];
|
|
};
|
|
|
|
/*
|
|
* Process-subscribed "logon" key description prefix and payload format.
|
|
* Deprecated; prefer FS_IOC_ADD_ENCRYPTION_KEY instead.
|
|
*/
|
|
#define FSCRYPT_KEY_DESC_PREFIX "fscrypt:"
|
|
#define FSCRYPT_KEY_DESC_PREFIX_SIZE 8
|
|
#define FSCRYPT_MAX_KEY_SIZE 64
|
|
struct fscrypt_key {
|
|
__u32 mode;
|
|
__u8 raw[FSCRYPT_MAX_KEY_SIZE];
|
|
__u32 size;
|
|
};
|
|
|
|
/*
|
|
* Keys are specified by an arbitrary 8-byte key "descriptor",
|
|
* matching fscrypt_policy::master_key_descriptor.
|
|
*/
|
|
#define FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR 1
|
|
|
|
/*
|
|
* Specifies a key. This doesn't contain the actual key itself; this is just
|
|
* the "name" of the key.
|
|
*/
|
|
struct fscrypt_key_specifier {
|
|
__u32 type; /* one of FSCRYPT_KEY_SPEC_TYPE_* */
|
|
__u32 __reserved;
|
|
union {
|
|
__u8 __reserved[32]; /* reserve some extra space */
|
|
__u8 descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE];
|
|
} u;
|
|
};
|
|
|
|
/* Struct passed to FS_IOC_ADD_ENCRYPTION_KEY */
|
|
struct fscrypt_add_key_arg {
|
|
struct fscrypt_key_specifier key_spec;
|
|
__u32 raw_size;
|
|
__u32 __reserved[9];
|
|
__u8 raw[];
|
|
};
|
|
|
|
/* Struct passed to FS_IOC_REMOVE_ENCRYPTION_KEY */
|
|
struct fscrypt_remove_key_arg {
|
|
struct fscrypt_key_specifier key_spec;
|
|
#define FSCRYPT_KEY_REMOVAL_STATUS_FLAG_FILES_BUSY 0x00000001
|
|
__u32 removal_status_flags; /* output */
|
|
__u32 __reserved[5];
|
|
};
|
|
|
|
#define FS_IOC_SET_ENCRYPTION_POLICY _IOR('f', 19, struct fscrypt_policy)
|
|
#define FS_IOC_GET_ENCRYPTION_PWSALT _IOW('f', 20, __u8[16])
|
|
#define FS_IOC_GET_ENCRYPTION_POLICY _IOW('f', 21, struct fscrypt_policy)
|
|
#define FS_IOC_ADD_ENCRYPTION_KEY _IOWR('f', 23, struct fscrypt_add_key_arg)
|
|
#define FS_IOC_REMOVE_ENCRYPTION_KEY _IOWR('f', 24, struct fscrypt_remove_key_arg)
|
|
|
|
/**********************************************************************/
|
|
|
|
/* old names; don't add anything new here! */
|
|
#ifndef __KERNEL__
|
|
#define FS_KEY_DESCRIPTOR_SIZE FSCRYPT_KEY_DESCRIPTOR_SIZE
|
|
#define FS_POLICY_FLAGS_PAD_4 FSCRYPT_POLICY_FLAGS_PAD_4
|
|
#define FS_POLICY_FLAGS_PAD_8 FSCRYPT_POLICY_FLAGS_PAD_8
|
|
#define FS_POLICY_FLAGS_PAD_16 FSCRYPT_POLICY_FLAGS_PAD_16
|
|
#define FS_POLICY_FLAGS_PAD_32 FSCRYPT_POLICY_FLAGS_PAD_32
|
|
#define FS_POLICY_FLAGS_PAD_MASK FSCRYPT_POLICY_FLAGS_PAD_MASK
|
|
#define FS_POLICY_FLAG_DIRECT_KEY FSCRYPT_POLICY_FLAG_DIRECT_KEY
|
|
#define FS_POLICY_FLAGS_VALID FSCRYPT_POLICY_FLAGS_VALID
|
|
#define FS_ENCRYPTION_MODE_INVALID 0 /* never used */
|
|
#define FS_ENCRYPTION_MODE_AES_256_XTS FSCRYPT_MODE_AES_256_XTS
|
|
#define FS_ENCRYPTION_MODE_AES_256_GCM 2 /* never used */
|
|
#define FS_ENCRYPTION_MODE_AES_256_CBC 3 /* never used */
|
|
#define FS_ENCRYPTION_MODE_AES_256_CTS FSCRYPT_MODE_AES_256_CTS
|
|
#define FS_ENCRYPTION_MODE_AES_128_CBC FSCRYPT_MODE_AES_128_CBC
|
|
#define FS_ENCRYPTION_MODE_AES_128_CTS FSCRYPT_MODE_AES_128_CTS
|
|
#define FS_ENCRYPTION_MODE_SPECK128_256_XTS 7 /* removed */
|
|
#define FS_ENCRYPTION_MODE_SPECK128_256_CTS 8 /* removed */
|
|
#define FS_ENCRYPTION_MODE_ADIANTUM FSCRYPT_MODE_ADIANTUM
|
|
#define FS_KEY_DESC_PREFIX FSCRYPT_KEY_DESC_PREFIX
|
|
#define FS_KEY_DESC_PREFIX_SIZE FSCRYPT_KEY_DESC_PREFIX_SIZE
|
|
#define FS_MAX_KEY_SIZE FSCRYPT_MAX_KEY_SIZE
|
|
#endif /* !__KERNEL__ */
|
|
|
|
#endif /* _UAPI_LINUX_FSCRYPT_H */
|