mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-13 22:25:03 +00:00
93edd392ca
Extend the FS_IOC_ADD_ENCRYPTION_KEY ioctl to allow the raw key to be specified by a Linux keyring key, rather than specified directly. This is useful because fscrypt keys belong to a particular filesystem instance, so they are destroyed when that filesystem is unmounted. Usually this is desired. But in some cases, userspace may need to unmount and re-mount the filesystem while keeping the keys, e.g. during a system update. This requires keeping the keys somewhere else too. The keys could be kept in memory in a userspace daemon. But depending on the security architecture and assumptions, it can be preferable to keep them only in kernel memory, where they are unreadable by userspace. We also can't solve this by going back to the original fscrypt API (where for each file, the master key was looked up in the process's keyring hierarchy) because that caused lots of problems of its own. Therefore, add the ability for FS_IOC_ADD_ENCRYPTION_KEY to accept a Linux keyring key. This solves the problem by allowing userspace to (if needed) save the keys securely in a Linux keyring for re-provisioning, while still using the new fscrypt key management ioctls. This is analogous to how dm-crypt accepts a Linux keyring key, but the key is then stored internally in the dm-crypt data structures rather than being looked up again each time the dm-crypt device is accessed. Use a custom key type "fscrypt-provisioning" rather than one of the existing key types such as "logon". This is strongly desired because it enforces that these keys are only usable for a particular purpose: for fscrypt as input to a particular KDF. Otherwise, the keys could also be passed to any kernel API that accepts a "logon" key with any service prefix, e.g. dm-crypt, UBIFS, or (recently proposed) AF_ALG. This would risk leaking information about the raw key despite it ostensibly being unreadable. Of course, this mistake has already been made for multiple kernel APIs; but since this is a new API, let's do it right. This patch has been tested using an xfstest which I wrote to test it. Link: https://lore.kernel.org/r/20191119222447.226853-1-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> |
||
|---|---|---|
| .. | ||
| caching | ||
| cifs | ||
| configfs | ||
| ext4 | ||
| nfs | ||
| 9p.txt | ||
| adfs.txt | ||
| affs.txt | ||
| afs.txt | ||
| api-summary.rst | ||
| autofs-mount-control.txt | ||
| autofs.rst | ||
| automount-support.txt | ||
| befs.txt | ||
| bfs.txt | ||
| btrfs.txt | ||
| ceph.txt | ||
| coda.txt | ||
| cramfs.txt | ||
| dax.txt | ||
| debugfs.txt | ||
| devpts.txt | ||
| directory-locking.rst | ||
| dlmfs.txt | ||
| dnotify.txt | ||
| ecryptfs.txt | ||
| efivarfs.txt | ||
| erofs.txt | ||
| ext2.txt | ||
| ext3.txt | ||
| f2fs.txt | ||
| fiemap.txt | ||
| files.txt | ||
| fscrypt.rst | ||
| fsverity.rst | ||
| fuse-io.txt | ||
| fuse.txt | ||
| gfs2-glocks.txt | ||
| gfs2-uevents.txt | ||
| gfs2.txt | ||
| hfs.txt | ||
| hfsplus.txt | ||
| hpfs.txt | ||
| index.rst | ||
| inotify.txt | ||
| isofs.txt | ||
| journalling.rst | ||
| locking.rst | ||
| locks.txt | ||
| mandatory-locking.txt | ||
| mount_api.txt | ||
| nilfs2.txt | ||
| ntfs.txt | ||
| ocfs2-online-filecheck.txt | ||
| ocfs2.txt | ||
| omfs.txt | ||
| orangefs.txt | ||
| overlayfs.rst | ||
| path-lookup.rst | ||
| path-lookup.txt | ||
| porting.rst | ||
| proc.txt | ||
| qnx6.txt | ||
| quota.txt | ||
| ramfs-rootfs-initramfs.txt | ||
| relay.txt | ||
| romfs.txt | ||
| seq_file.txt | ||
| sharedsubtree.txt | ||
| splice.rst | ||
| spufs.txt | ||
| squashfs.txt | ||
| sysfs-pci.txt | ||
| sysfs-tagging.txt | ||
| sysfs.txt | ||
| sysv-fs.txt | ||
| tmpfs.txt | ||
| ubifs-authentication.rst | ||
| ubifs.txt | ||
| udf.txt | ||
| vfat.txt | ||
| vfs.rst | ||
| virtiofs.rst | ||
| xfs-delayed-logging-design.txt | ||
| xfs-self-describing-metadata.txt | ||