Commit | Line | Data |
---|---|---|
7af0ab0d EB |
1 | /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ |
2 | /* | |
3 | * fscrypt user API | |
4 | * | |
5 | * These ioctls can be used on filesystems that support fscrypt. See the | |
6 | * "User API" section of Documentation/filesystems/fscrypt.rst. | |
7 | */ | |
8 | #ifndef _UAPI_LINUX_FSCRYPT_H | |
9 | #define _UAPI_LINUX_FSCRYPT_H | |
10 | ||
11 | #include <linux/types.h> | |
12 | ||
7af0ab0d | 13 | /* Encryption policy flags */ |
2336d0de EB |
14 | #define FSCRYPT_POLICY_FLAGS_PAD_4 0x00 |
15 | #define FSCRYPT_POLICY_FLAGS_PAD_8 0x01 | |
16 | #define FSCRYPT_POLICY_FLAGS_PAD_16 0x02 | |
17 | #define FSCRYPT_POLICY_FLAGS_PAD_32 0x03 | |
18 | #define FSCRYPT_POLICY_FLAGS_PAD_MASK 0x03 | |
5dae460c | 19 | #define FSCRYPT_POLICY_FLAG_DIRECT_KEY 0x04 |
b103fb76 EB |
20 | #define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 0x08 |
21 | #define FSCRYPT_POLICY_FLAGS_VALID 0x0F | |
7af0ab0d EB |
22 | |
23 | /* Encryption algorithms */ | |
2336d0de EB |
24 | #define FSCRYPT_MODE_AES_256_XTS 1 |
25 | #define FSCRYPT_MODE_AES_256_CTS 4 | |
26 | #define FSCRYPT_MODE_AES_128_CBC 5 | |
27 | #define FSCRYPT_MODE_AES_128_CTS 6 | |
28 | #define FSCRYPT_MODE_ADIANTUM 9 | |
5dae460c | 29 | #define __FSCRYPT_MODE_MAX 9 |
7af0ab0d | 30 | |
5dae460c EB |
31 | /* |
32 | * Legacy policy version; ad-hoc KDF and no key verification. | |
33 | * For new encrypted directories, use fscrypt_policy_v2 instead. | |
34 | * | |
35 | * Careful: the .version field for this is actually 0, not 1. | |
36 | */ | |
37 | #define FSCRYPT_POLICY_V1 0 | |
38 | #define FSCRYPT_KEY_DESCRIPTOR_SIZE 8 | |
39 | struct fscrypt_policy_v1 { | |
7af0ab0d EB |
40 | __u8 version; |
41 | __u8 contents_encryption_mode; | |
42 | __u8 filenames_encryption_mode; | |
43 | __u8 flags; | |
2336d0de | 44 | __u8 master_key_descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE]; |
7af0ab0d | 45 | }; |
5dae460c | 46 | #define fscrypt_policy fscrypt_policy_v1 |
7af0ab0d | 47 | |
22d94f49 EB |
48 | /* |
49 | * Process-subscribed "logon" key description prefix and payload format. | |
50 | * Deprecated; prefer FS_IOC_ADD_ENCRYPTION_KEY instead. | |
51 | */ | |
2336d0de | 52 | #define FSCRYPT_KEY_DESC_PREFIX "fscrypt:" |
22d94f49 EB |
53 | #define FSCRYPT_KEY_DESC_PREFIX_SIZE 8 |
54 | #define FSCRYPT_MAX_KEY_SIZE 64 | |
7af0ab0d EB |
55 | struct fscrypt_key { |
56 | __u32 mode; | |
2336d0de | 57 | __u8 raw[FSCRYPT_MAX_KEY_SIZE]; |
7af0ab0d EB |
58 | __u32 size; |
59 | }; | |
22d94f49 EB |
60 | |
61 | /* | |
5dae460c EB |
62 | * New policy version with HKDF and key verification (recommended). |
63 | */ | |
64 | #define FSCRYPT_POLICY_V2 2 | |
65 | #define FSCRYPT_KEY_IDENTIFIER_SIZE 16 | |
66 | struct fscrypt_policy_v2 { | |
67 | __u8 version; | |
68 | __u8 contents_encryption_mode; | |
69 | __u8 filenames_encryption_mode; | |
70 | __u8 flags; | |
71 | __u8 __reserved[4]; | |
72 | __u8 master_key_identifier[FSCRYPT_KEY_IDENTIFIER_SIZE]; | |
73 | }; | |
74 | ||
75 | /* Struct passed to FS_IOC_GET_ENCRYPTION_POLICY_EX */ | |
76 | struct fscrypt_get_policy_ex_arg { | |
77 | __u64 policy_size; /* input/output */ | |
78 | union { | |
79 | __u8 version; | |
80 | struct fscrypt_policy_v1 v1; | |
81 | struct fscrypt_policy_v2 v2; | |
82 | } policy; /* output */ | |
83 | }; | |
84 | ||
85 | /* | |
86 | * v1 policy keys are specified by an arbitrary 8-byte key "descriptor", | |
87 | * matching fscrypt_policy_v1::master_key_descriptor. | |
22d94f49 EB |
88 | */ |
89 | #define FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR 1 | |
90 | ||
91 | /* | |
5dae460c EB |
92 | * v2 policy keys are specified by a 16-byte key "identifier" which the kernel |
93 | * calculates as a cryptographic hash of the key itself, | |
94 | * matching fscrypt_policy_v2::master_key_identifier. | |
95 | */ | |
96 | #define FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER 2 | |
97 | ||
98 | /* | |
99 | * Specifies a key, either for v1 or v2 policies. This doesn't contain the | |
100 | * actual key itself; this is just the "name" of the key. | |
22d94f49 EB |
101 | */ |
102 | struct fscrypt_key_specifier { | |
103 | __u32 type; /* one of FSCRYPT_KEY_SPEC_TYPE_* */ | |
104 | __u32 __reserved; | |
105 | union { | |
106 | __u8 __reserved[32]; /* reserve some extra space */ | |
107 | __u8 descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE]; | |
5dae460c | 108 | __u8 identifier[FSCRYPT_KEY_IDENTIFIER_SIZE]; |
22d94f49 EB |
109 | } u; |
110 | }; | |
111 | ||
112 | /* Struct passed to FS_IOC_ADD_ENCRYPTION_KEY */ | |
113 | struct fscrypt_add_key_arg { | |
114 | struct fscrypt_key_specifier key_spec; | |
115 | __u32 raw_size; | |
116 | __u32 __reserved[9]; | |
117 | __u8 raw[]; | |
118 | }; | |
119 | ||
b1c0ec35 EB |
120 | /* Struct passed to FS_IOC_REMOVE_ENCRYPTION_KEY */ |
121 | struct fscrypt_remove_key_arg { | |
122 | struct fscrypt_key_specifier key_spec; | |
123 | #define FSCRYPT_KEY_REMOVAL_STATUS_FLAG_FILES_BUSY 0x00000001 | |
23c688b5 | 124 | #define FSCRYPT_KEY_REMOVAL_STATUS_FLAG_OTHER_USERS 0x00000002 |
b1c0ec35 EB |
125 | __u32 removal_status_flags; /* output */ |
126 | __u32 __reserved[5]; | |
127 | }; | |
128 | ||
5a7e2992 EB |
129 | /* Struct passed to FS_IOC_GET_ENCRYPTION_KEY_STATUS */ |
130 | struct fscrypt_get_key_status_arg { | |
131 | /* input */ | |
132 | struct fscrypt_key_specifier key_spec; | |
133 | __u32 __reserved[6]; | |
134 | ||
135 | /* output */ | |
136 | #define FSCRYPT_KEY_STATUS_ABSENT 1 | |
137 | #define FSCRYPT_KEY_STATUS_PRESENT 2 | |
138 | #define FSCRYPT_KEY_STATUS_INCOMPLETELY_REMOVED 3 | |
139 | __u32 status; | |
23c688b5 EB |
140 | #define FSCRYPT_KEY_STATUS_FLAG_ADDED_BY_SELF 0x00000001 |
141 | __u32 status_flags; | |
142 | __u32 user_count; | |
143 | __u32 __out_reserved[13]; | |
5a7e2992 EB |
144 | }; |
145 | ||
22d94f49 EB |
146 | #define FS_IOC_SET_ENCRYPTION_POLICY _IOR('f', 19, struct fscrypt_policy) |
147 | #define FS_IOC_GET_ENCRYPTION_PWSALT _IOW('f', 20, __u8[16]) | |
148 | #define FS_IOC_GET_ENCRYPTION_POLICY _IOW('f', 21, struct fscrypt_policy) | |
5dae460c | 149 | #define FS_IOC_GET_ENCRYPTION_POLICY_EX _IOWR('f', 22, __u8[9]) /* size + version */ |
22d94f49 | 150 | #define FS_IOC_ADD_ENCRYPTION_KEY _IOWR('f', 23, struct fscrypt_add_key_arg) |
b1c0ec35 | 151 | #define FS_IOC_REMOVE_ENCRYPTION_KEY _IOWR('f', 24, struct fscrypt_remove_key_arg) |
78a1b96b | 152 | #define FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS _IOWR('f', 25, struct fscrypt_remove_key_arg) |
5a7e2992 | 153 | #define FS_IOC_GET_ENCRYPTION_KEY_STATUS _IOWR('f', 26, struct fscrypt_get_key_status_arg) |
22d94f49 | 154 | |
2336d0de EB |
155 | /**********************************************************************/ |
156 | ||
157 | /* old names; don't add anything new here! */ | |
3b6df59b | 158 | #ifndef __KERNEL__ |
2336d0de EB |
159 | #define FS_KEY_DESCRIPTOR_SIZE FSCRYPT_KEY_DESCRIPTOR_SIZE |
160 | #define FS_POLICY_FLAGS_PAD_4 FSCRYPT_POLICY_FLAGS_PAD_4 | |
161 | #define FS_POLICY_FLAGS_PAD_8 FSCRYPT_POLICY_FLAGS_PAD_8 | |
162 | #define FS_POLICY_FLAGS_PAD_16 FSCRYPT_POLICY_FLAGS_PAD_16 | |
163 | #define FS_POLICY_FLAGS_PAD_32 FSCRYPT_POLICY_FLAGS_PAD_32 | |
164 | #define FS_POLICY_FLAGS_PAD_MASK FSCRYPT_POLICY_FLAGS_PAD_MASK | |
165 | #define FS_POLICY_FLAG_DIRECT_KEY FSCRYPT_POLICY_FLAG_DIRECT_KEY | |
166 | #define FS_POLICY_FLAGS_VALID FSCRYPT_POLICY_FLAGS_VALID | |
167 | #define FS_ENCRYPTION_MODE_INVALID 0 /* never used */ | |
168 | #define FS_ENCRYPTION_MODE_AES_256_XTS FSCRYPT_MODE_AES_256_XTS | |
169 | #define FS_ENCRYPTION_MODE_AES_256_GCM 2 /* never used */ | |
170 | #define FS_ENCRYPTION_MODE_AES_256_CBC 3 /* never used */ | |
171 | #define FS_ENCRYPTION_MODE_AES_256_CTS FSCRYPT_MODE_AES_256_CTS | |
172 | #define FS_ENCRYPTION_MODE_AES_128_CBC FSCRYPT_MODE_AES_128_CBC | |
173 | #define FS_ENCRYPTION_MODE_AES_128_CTS FSCRYPT_MODE_AES_128_CTS | |
174 | #define FS_ENCRYPTION_MODE_SPECK128_256_XTS 7 /* removed */ | |
175 | #define FS_ENCRYPTION_MODE_SPECK128_256_CTS 8 /* removed */ | |
176 | #define FS_ENCRYPTION_MODE_ADIANTUM FSCRYPT_MODE_ADIANTUM | |
177 | #define FS_KEY_DESC_PREFIX FSCRYPT_KEY_DESC_PREFIX | |
178 | #define FS_KEY_DESC_PREFIX_SIZE FSCRYPT_KEY_DESC_PREFIX_SIZE | |
179 | #define FS_MAX_KEY_SIZE FSCRYPT_MAX_KEY_SIZE | |
3b6df59b | 180 | #endif /* !__KERNEL__ */ |
7af0ab0d EB |
181 | |
182 | #endif /* _UAPI_LINUX_FSCRYPT_H */ |