2 * Encryption policy functions for per-file encryption support.
4 * Copyright (C) 2015, Google, Inc.
5 * Copyright (C) 2015, Motorola Mobility.
7 * Written by Michael Halcrow, 2015.
8 * Modified by Jaegeuk Kim, 2015.
11 #include <linux/random.h>
12 #include <linux/string.h>
13 #include <linux/mount.h>
14 #include "fscrypt_private.h"
17 * check whether an encryption policy is consistent with an encryption context
19 static bool is_encryption_context_consistent_with_policy(
20 const struct fscrypt_context
*ctx
,
21 const struct fscrypt_policy
*policy
)
23 return memcmp(ctx
->master_key_descriptor
, policy
->master_key_descriptor
,
24 FS_KEY_DESCRIPTOR_SIZE
) == 0 &&
25 (ctx
->flags
== policy
->flags
) &&
26 (ctx
->contents_encryption_mode
==
27 policy
->contents_encryption_mode
) &&
28 (ctx
->filenames_encryption_mode
==
29 policy
->filenames_encryption_mode
);
32 static int create_encryption_context_from_policy(struct inode
*inode
,
33 const struct fscrypt_policy
*policy
)
35 struct fscrypt_context ctx
;
38 if (!inode
->i_sb
->s_cop
->set_context
)
41 if (inode
->i_sb
->s_cop
->prepare_context
) {
42 res
= inode
->i_sb
->s_cop
->prepare_context(inode
);
47 ctx
.format
= FS_ENCRYPTION_CONTEXT_FORMAT_V1
;
48 memcpy(ctx
.master_key_descriptor
, policy
->master_key_descriptor
,
49 FS_KEY_DESCRIPTOR_SIZE
);
51 if (!fscrypt_valid_contents_enc_mode(
52 policy
->contents_encryption_mode
))
55 if (!fscrypt_valid_filenames_enc_mode(
56 policy
->filenames_encryption_mode
))
59 if (policy
->flags
& ~FS_POLICY_FLAGS_VALID
)
62 ctx
.contents_encryption_mode
= policy
->contents_encryption_mode
;
63 ctx
.filenames_encryption_mode
= policy
->filenames_encryption_mode
;
64 ctx
.flags
= policy
->flags
;
65 BUILD_BUG_ON(sizeof(ctx
.nonce
) != FS_KEY_DERIVATION_NONCE_SIZE
);
66 get_random_bytes(ctx
.nonce
, FS_KEY_DERIVATION_NONCE_SIZE
);
68 return inode
->i_sb
->s_cop
->set_context(inode
, &ctx
, sizeof(ctx
), NULL
);
71 int fscrypt_ioctl_set_policy(struct file
*filp
, const void __user
*arg
)
73 struct fscrypt_policy policy
;
74 struct inode
*inode
= file_inode(filp
);
76 struct fscrypt_context ctx
;
78 if (copy_from_user(&policy
, arg
, sizeof(policy
)))
81 if (!inode_owner_or_capable(inode
))
84 if (policy
.version
!= 0)
87 ret
= mnt_want_write_file(filp
);
93 ret
= inode
->i_sb
->s_cop
->get_context(inode
, &ctx
, sizeof(ctx
));
94 if (ret
== -ENODATA
) {
95 if (!S_ISDIR(inode
->i_mode
))
97 else if (!inode
->i_sb
->s_cop
->empty_dir
)
99 else if (!inode
->i_sb
->s_cop
->empty_dir(inode
))
102 ret
= create_encryption_context_from_policy(inode
,
104 } else if (ret
== sizeof(ctx
) &&
105 is_encryption_context_consistent_with_policy(&ctx
,
107 /* The file already uses the same encryption policy. */
109 } else if (ret
>= 0 || ret
== -ERANGE
) {
110 /* The file already uses a different encryption policy. */
116 mnt_drop_write_file(filp
);
119 EXPORT_SYMBOL(fscrypt_ioctl_set_policy
);
121 int fscrypt_ioctl_get_policy(struct file
*filp
, void __user
*arg
)
123 struct inode
*inode
= file_inode(filp
);
124 struct fscrypt_context ctx
;
125 struct fscrypt_policy policy
;
128 if (!inode
->i_sb
->s_cop
->get_context
||
129 !inode
->i_sb
->s_cop
->is_encrypted(inode
))
132 res
= inode
->i_sb
->s_cop
->get_context(inode
, &ctx
, sizeof(ctx
));
133 if (res
< 0 && res
!= -ERANGE
)
135 if (res
!= sizeof(ctx
))
137 if (ctx
.format
!= FS_ENCRYPTION_CONTEXT_FORMAT_V1
)
141 policy
.contents_encryption_mode
= ctx
.contents_encryption_mode
;
142 policy
.filenames_encryption_mode
= ctx
.filenames_encryption_mode
;
143 policy
.flags
= ctx
.flags
;
144 memcpy(policy
.master_key_descriptor
, ctx
.master_key_descriptor
,
145 FS_KEY_DESCRIPTOR_SIZE
);
147 if (copy_to_user(arg
, &policy
, sizeof(policy
)))
151 EXPORT_SYMBOL(fscrypt_ioctl_get_policy
);
153 int fscrypt_has_permitted_context(struct inode
*parent
, struct inode
*child
)
155 struct fscrypt_info
*parent_ci
, *child_ci
;
158 if ((parent
== NULL
) || (child
== NULL
)) {
159 printk(KERN_ERR
"parent %p child %p\n", parent
, child
);
163 /* No restrictions on file types which are never encrypted */
164 if (!S_ISREG(child
->i_mode
) && !S_ISDIR(child
->i_mode
) &&
165 !S_ISLNK(child
->i_mode
))
168 /* no restrictions if the parent directory is not encrypted */
169 if (!parent
->i_sb
->s_cop
->is_encrypted(parent
))
171 /* if the child directory is not encrypted, this is always a problem */
172 if (!parent
->i_sb
->s_cop
->is_encrypted(child
))
174 res
= fscrypt_get_encryption_info(parent
);
177 res
= fscrypt_get_encryption_info(child
);
180 parent_ci
= parent
->i_crypt_info
;
181 child_ci
= child
->i_crypt_info
;
182 if (!parent_ci
&& !child_ci
)
184 if (!parent_ci
|| !child_ci
)
187 return (memcmp(parent_ci
->ci_master_key
,
188 child_ci
->ci_master_key
,
189 FS_KEY_DESCRIPTOR_SIZE
) == 0 &&
190 (parent_ci
->ci_data_mode
== child_ci
->ci_data_mode
) &&
191 (parent_ci
->ci_filename_mode
== child_ci
->ci_filename_mode
) &&
192 (parent_ci
->ci_flags
== child_ci
->ci_flags
));
194 EXPORT_SYMBOL(fscrypt_has_permitted_context
);
197 * fscrypt_inherit_context() - Sets a child context from its parent
198 * @parent: Parent inode from which the context is inherited.
199 * @child: Child inode that inherits the context from @parent.
200 * @fs_data: private data given by FS.
201 * @preload: preload child i_crypt_info if true
203 * Return: 0 on success, -errno on failure
205 int fscrypt_inherit_context(struct inode
*parent
, struct inode
*child
,
206 void *fs_data
, bool preload
)
208 struct fscrypt_context ctx
;
209 struct fscrypt_info
*ci
;
212 if (!parent
->i_sb
->s_cop
->set_context
)
215 res
= fscrypt_get_encryption_info(parent
);
219 ci
= parent
->i_crypt_info
;
223 ctx
.format
= FS_ENCRYPTION_CONTEXT_FORMAT_V1
;
224 ctx
.contents_encryption_mode
= ci
->ci_data_mode
;
225 ctx
.filenames_encryption_mode
= ci
->ci_filename_mode
;
226 ctx
.flags
= ci
->ci_flags
;
227 memcpy(ctx
.master_key_descriptor
, ci
->ci_master_key
,
228 FS_KEY_DESCRIPTOR_SIZE
);
229 get_random_bytes(ctx
.nonce
, FS_KEY_DERIVATION_NONCE_SIZE
);
230 res
= parent
->i_sb
->s_cop
->set_context(child
, &ctx
,
231 sizeof(ctx
), fs_data
);
234 return preload
? fscrypt_get_encryption_info(child
): 0;
236 EXPORT_SYMBOL(fscrypt_inherit_context
);