1 // SPDX-License-Identifier: GPL-2.0
3 * Key setup facility for FS encryption support.
5 * Copyright (C) 2015, Google, Inc.
7 * Originally written by Michael Halcrow, Ildar Muslukhov, and Uday Savagaonkar.
8 * Heavily modified since then.
11 #include <crypto/skcipher.h>
12 #include <linux/key.h>
13 #include <linux/random.h>
15 #include "fscrypt_private.h"
17 struct fscrypt_mode fscrypt_modes[] = {
18 [FSCRYPT_MODE_AES_256_XTS] = {
19 .friendly_name = "AES-256-XTS",
20 .cipher_str = "xts(aes)",
23 .blk_crypto_mode = BLK_ENCRYPTION_MODE_AES_256_XTS,
25 [FSCRYPT_MODE_AES_256_CTS] = {
26 .friendly_name = "AES-256-CTS-CBC",
27 .cipher_str = "cts(cbc(aes))",
31 [FSCRYPT_MODE_AES_128_CBC] = {
32 .friendly_name = "AES-128-CBC-ESSIV",
33 .cipher_str = "essiv(cbc(aes),sha256)",
36 .blk_crypto_mode = BLK_ENCRYPTION_MODE_AES_128_CBC_ESSIV,
38 [FSCRYPT_MODE_AES_128_CTS] = {
39 .friendly_name = "AES-128-CTS-CBC",
40 .cipher_str = "cts(cbc(aes))",
44 [FSCRYPT_MODE_ADIANTUM] = {
45 .friendly_name = "Adiantum",
46 .cipher_str = "adiantum(xchacha12,aes)",
49 .blk_crypto_mode = BLK_ENCRYPTION_MODE_ADIANTUM,
53 static DEFINE_MUTEX(fscrypt_mode_key_setup_mutex);
55 static struct fscrypt_mode *
56 select_encryption_mode(const union fscrypt_policy *policy,
57 const struct inode *inode)
59 if (S_ISREG(inode->i_mode))
60 return &fscrypt_modes[fscrypt_policy_contents_mode(policy)];
62 if (S_ISDIR(inode->i_mode) || S_ISLNK(inode->i_mode))
63 return &fscrypt_modes[fscrypt_policy_fnames_mode(policy)];
65 WARN_ONCE(1, "fscrypt: filesystem tried to load encryption info for inode %lu, which is not encryptable (file type %d)\n",
66 inode->i_ino, (inode->i_mode & S_IFMT));
67 return ERR_PTR(-EINVAL);
70 /* Create a symmetric cipher object for the given encryption mode and key */
71 static struct crypto_skcipher *
72 fscrypt_allocate_skcipher(struct fscrypt_mode *mode, const u8 *raw_key,
73 const struct inode *inode)
75 struct crypto_skcipher *tfm;
78 tfm = crypto_alloc_skcipher(mode->cipher_str, 0, 0);
80 if (PTR_ERR(tfm) == -ENOENT) {
82 "Missing crypto API support for %s (API name: \"%s\")",
83 mode->friendly_name, mode->cipher_str);
84 return ERR_PTR(-ENOPKG);
86 fscrypt_err(inode, "Error allocating '%s' transform: %ld",
87 mode->cipher_str, PTR_ERR(tfm));
90 if (!xchg(&mode->logged_impl_name, 1)) {
92 * fscrypt performance can vary greatly depending on which
93 * crypto algorithm implementation is used. Help people debug
94 * performance problems by logging the ->cra_driver_name the
95 * first time a mode is used.
97 pr_info("fscrypt: %s using implementation \"%s\"\n",
98 mode->friendly_name, crypto_skcipher_driver_name(tfm));
100 if (WARN_ON(crypto_skcipher_ivsize(tfm) != mode->ivsize)) {
104 crypto_skcipher_set_flags(tfm, CRYPTO_TFM_REQ_FORBID_WEAK_KEYS);
105 err = crypto_skcipher_setkey(tfm, raw_key, mode->keysize);
112 crypto_free_skcipher(tfm);
117 * Prepare the crypto transform object or blk-crypto key in @prep_key, given the
118 * raw key, encryption mode, and flag indicating which encryption implementation
119 * (fs-layer or blk-crypto) will be used.
121 int fscrypt_prepare_key(struct fscrypt_prepared_key *prep_key,
122 const u8 *raw_key, const struct fscrypt_info *ci)
124 struct crypto_skcipher *tfm;
126 if (fscrypt_using_inline_encryption(ci))
127 return fscrypt_prepare_inline_crypt_key(prep_key, raw_key, ci);
129 tfm = fscrypt_allocate_skcipher(ci->ci_mode, raw_key, ci->ci_inode);
133 * Pairs with the smp_load_acquire() in fscrypt_is_key_prepared().
134 * I.e., here we publish ->tfm with a RELEASE barrier so that
135 * concurrent tasks can ACQUIRE it. Note that this concurrency is only
136 * possible for per-mode keys, not for per-file keys.
138 smp_store_release(&prep_key->tfm, tfm);
142 /* Destroy a crypto transform object and/or blk-crypto key. */
143 void fscrypt_destroy_prepared_key(struct fscrypt_prepared_key *prep_key)
145 crypto_free_skcipher(prep_key->tfm);
146 fscrypt_destroy_inline_crypt_key(prep_key);
149 /* Given a per-file encryption key, set up the file's crypto transform object */
150 int fscrypt_set_per_file_enc_key(struct fscrypt_info *ci, const u8 *raw_key)
152 ci->ci_owns_key = true;
153 return fscrypt_prepare_key(&ci->ci_enc_key, raw_key, ci);
156 static int setup_per_mode_enc_key(struct fscrypt_info *ci,
157 struct fscrypt_master_key *mk,
158 struct fscrypt_prepared_key *keys,
159 u8 hkdf_context, bool include_fs_uuid)
161 const struct inode *inode = ci->ci_inode;
162 const struct super_block *sb = inode->i_sb;
163 struct fscrypt_mode *mode = ci->ci_mode;
164 const u8 mode_num = mode - fscrypt_modes;
165 struct fscrypt_prepared_key *prep_key;
166 u8 mode_key[FSCRYPT_MAX_KEY_SIZE];
167 u8 hkdf_info[sizeof(mode_num) + sizeof(sb->s_uuid)];
168 unsigned int hkdf_infolen = 0;
171 if (WARN_ON(mode_num > __FSCRYPT_MODE_MAX))
174 prep_key = &keys[mode_num];
175 if (fscrypt_is_key_prepared(prep_key, ci)) {
176 ci->ci_enc_key = *prep_key;
180 mutex_lock(&fscrypt_mode_key_setup_mutex);
182 if (fscrypt_is_key_prepared(prep_key, ci))
185 BUILD_BUG_ON(sizeof(mode_num) != 1);
186 BUILD_BUG_ON(sizeof(sb->s_uuid) != 16);
187 BUILD_BUG_ON(sizeof(hkdf_info) != 17);
188 hkdf_info[hkdf_infolen++] = mode_num;
189 if (include_fs_uuid) {
190 memcpy(&hkdf_info[hkdf_infolen], &sb->s_uuid,
192 hkdf_infolen += sizeof(sb->s_uuid);
194 err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf,
195 hkdf_context, hkdf_info, hkdf_infolen,
196 mode_key, mode->keysize);
199 err = fscrypt_prepare_key(prep_key, mode_key, ci);
200 memzero_explicit(mode_key, mode->keysize);
204 ci->ci_enc_key = *prep_key;
207 mutex_unlock(&fscrypt_mode_key_setup_mutex);
211 int fscrypt_derive_dirhash_key(struct fscrypt_info *ci,
212 const struct fscrypt_master_key *mk)
216 err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf, HKDF_CONTEXT_DIRHASH_KEY,
217 ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE,
218 (u8 *)&ci->ci_dirhash_key,
219 sizeof(ci->ci_dirhash_key));
222 ci->ci_dirhash_key_initialized = true;
226 void fscrypt_hash_inode_number(struct fscrypt_info *ci,
227 const struct fscrypt_master_key *mk)
229 WARN_ON(ci->ci_inode->i_ino == 0);
230 WARN_ON(!mk->mk_ino_hash_key_initialized);
232 ci->ci_hashed_ino = (u32)siphash_1u64(ci->ci_inode->i_ino,
233 &mk->mk_ino_hash_key);
236 static int fscrypt_setup_iv_ino_lblk_32_key(struct fscrypt_info *ci,
237 struct fscrypt_master_key *mk)
241 err = setup_per_mode_enc_key(ci, mk, mk->mk_iv_ino_lblk_32_keys,
242 HKDF_CONTEXT_IV_INO_LBLK_32_KEY, true);
246 /* pairs with smp_store_release() below */
247 if (!smp_load_acquire(&mk->mk_ino_hash_key_initialized)) {
249 mutex_lock(&fscrypt_mode_key_setup_mutex);
251 if (mk->mk_ino_hash_key_initialized)
254 err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf,
255 HKDF_CONTEXT_INODE_HASH_KEY, NULL, 0,
256 (u8 *)&mk->mk_ino_hash_key,
257 sizeof(mk->mk_ino_hash_key));
260 /* pairs with smp_load_acquire() above */
261 smp_store_release(&mk->mk_ino_hash_key_initialized, true);
263 mutex_unlock(&fscrypt_mode_key_setup_mutex);
269 * New inodes may not have an inode number assigned yet.
270 * Hashing their inode number is delayed until later.
272 if (ci->ci_inode->i_ino == 0)
273 WARN_ON(!(ci->ci_inode->i_state & I_CREATING));
275 fscrypt_hash_inode_number(ci, mk);
279 static int fscrypt_setup_v2_file_key(struct fscrypt_info *ci,
280 struct fscrypt_master_key *mk,
281 bool need_dirhash_key)
285 if (ci->ci_policy.v2.flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) {
287 * DIRECT_KEY: instead of deriving per-file encryption keys, the
288 * per-file nonce will be included in all the IVs. But unlike
289 * v1 policies, for v2 policies in this case we don't encrypt
290 * with the master key directly but rather derive a per-mode
291 * encryption key. This ensures that the master key is
292 * consistently used only for HKDF, avoiding key reuse issues.
294 err = setup_per_mode_enc_key(ci, mk, mk->mk_direct_keys,
295 HKDF_CONTEXT_DIRECT_KEY, false);
296 } else if (ci->ci_policy.v2.flags &
297 FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64) {
299 * IV_INO_LBLK_64: encryption keys are derived from (master_key,
300 * mode_num, filesystem_uuid), and inode number is included in
301 * the IVs. This format is optimized for use with inline
302 * encryption hardware compliant with the UFS standard.
304 err = setup_per_mode_enc_key(ci, mk, mk->mk_iv_ino_lblk_64_keys,
305 HKDF_CONTEXT_IV_INO_LBLK_64_KEY,
307 } else if (ci->ci_policy.v2.flags &
308 FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) {
309 err = fscrypt_setup_iv_ino_lblk_32_key(ci, mk);
311 u8 derived_key[FSCRYPT_MAX_KEY_SIZE];
313 err = fscrypt_hkdf_expand(&mk->mk_secret.hkdf,
314 HKDF_CONTEXT_PER_FILE_ENC_KEY,
315 ci->ci_nonce, FSCRYPT_FILE_NONCE_SIZE,
316 derived_key, ci->ci_mode->keysize);
320 err = fscrypt_set_per_file_enc_key(ci, derived_key);
321 memzero_explicit(derived_key, ci->ci_mode->keysize);
326 /* Derive a secret dirhash key for directories that need it. */
327 if (need_dirhash_key) {
328 err = fscrypt_derive_dirhash_key(ci, mk);
337 * Find the master key, then set up the inode's actual encryption key.
339 * If the master key is found in the filesystem-level keyring, then the
340 * corresponding 'struct key' is returned in *master_key_ret with
341 * ->mk_secret_sem read-locked. This is needed to ensure that only one task
342 * links the fscrypt_info into ->mk_decrypted_inodes (as multiple tasks may race
343 * to create an fscrypt_info for the same inode), and to synchronize the master
344 * key being removed with a new inode starting to use it.
346 static int setup_file_encryption_key(struct fscrypt_info *ci,
347 bool need_dirhash_key,
348 struct key **master_key_ret)
351 struct fscrypt_master_key *mk = NULL;
352 struct fscrypt_key_specifier mk_spec;
355 err = fscrypt_select_encryption_impl(ci);
359 switch (ci->ci_policy.version) {
360 case FSCRYPT_POLICY_V1:
361 mk_spec.type = FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR;
362 memcpy(mk_spec.u.descriptor,
363 ci->ci_policy.v1.master_key_descriptor,
364 FSCRYPT_KEY_DESCRIPTOR_SIZE);
366 case FSCRYPT_POLICY_V2:
367 mk_spec.type = FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER;
368 memcpy(mk_spec.u.identifier,
369 ci->ci_policy.v2.master_key_identifier,
370 FSCRYPT_KEY_IDENTIFIER_SIZE);
377 key = fscrypt_find_master_key(ci->ci_inode->i_sb, &mk_spec);
379 if (key != ERR_PTR(-ENOKEY) ||
380 ci->ci_policy.version != FSCRYPT_POLICY_V1)
384 * As a legacy fallback for v1 policies, search for the key in
385 * the current task's subscribed keyrings too. Don't move this
386 * to before the search of ->s_master_keys, since users
387 * shouldn't be able to override filesystem-level keys.
389 return fscrypt_setup_v1_file_key_via_subscribed_keyrings(ci);
392 mk = key->payload.data[0];
393 down_read(&mk->mk_secret_sem);
395 /* Has the secret been removed (via FS_IOC_REMOVE_ENCRYPTION_KEY)? */
396 if (!is_master_key_secret_present(&mk->mk_secret)) {
398 goto out_release_key;
402 * Require that the master key be at least as long as the derived key.
403 * Otherwise, the derived key cannot possibly contain as much entropy as
404 * that required by the encryption mode it will be used for. For v1
405 * policies it's also required for the KDF to work at all.
407 if (mk->mk_secret.size < ci->ci_mode->keysize) {
409 "key with %s %*phN is too short (got %u bytes, need %u+ bytes)",
410 master_key_spec_type(&mk_spec),
411 master_key_spec_len(&mk_spec), (u8 *)&mk_spec.u,
412 mk->mk_secret.size, ci->ci_mode->keysize);
414 goto out_release_key;
417 switch (ci->ci_policy.version) {
418 case FSCRYPT_POLICY_V1:
419 err = fscrypt_setup_v1_file_key(ci, mk->mk_secret.raw);
421 case FSCRYPT_POLICY_V2:
422 err = fscrypt_setup_v2_file_key(ci, mk, need_dirhash_key);
430 goto out_release_key;
432 *master_key_ret = key;
436 up_read(&mk->mk_secret_sem);
441 static void put_crypt_info(struct fscrypt_info *ci)
448 if (ci->ci_direct_key)
449 fscrypt_put_direct_key(ci->ci_direct_key);
450 else if (ci->ci_owns_key)
451 fscrypt_destroy_prepared_key(&ci->ci_enc_key);
453 key = ci->ci_master_key;
455 struct fscrypt_master_key *mk = key->payload.data[0];
458 * Remove this inode from the list of inodes that were unlocked
459 * with the master key.
461 * In addition, if we're removing the last inode from a key that
462 * already had its secret removed, invalidate the key so that it
463 * gets removed from ->s_master_keys.
465 spin_lock(&mk->mk_decrypted_inodes_lock);
466 list_del(&ci->ci_master_key_link);
467 spin_unlock(&mk->mk_decrypted_inodes_lock);
468 if (refcount_dec_and_test(&mk->mk_refcount))
472 memzero_explicit(ci, sizeof(*ci));
473 kmem_cache_free(fscrypt_info_cachep, ci);
477 fscrypt_setup_encryption_info(struct inode *inode,
478 const union fscrypt_policy *policy,
479 const u8 nonce[FSCRYPT_FILE_NONCE_SIZE],
480 bool need_dirhash_key)
482 struct fscrypt_info *crypt_info;
483 struct fscrypt_mode *mode;
484 struct key *master_key = NULL;
487 res = fscrypt_initialize(inode->i_sb->s_cop->flags);
491 crypt_info = kmem_cache_zalloc(fscrypt_info_cachep, GFP_KERNEL);
495 crypt_info->ci_inode = inode;
496 crypt_info->ci_policy = *policy;
497 memcpy(crypt_info->ci_nonce, nonce, FSCRYPT_FILE_NONCE_SIZE);
499 mode = select_encryption_mode(&crypt_info->ci_policy, inode);
504 WARN_ON(mode->ivsize > FSCRYPT_MAX_IV_SIZE);
505 crypt_info->ci_mode = mode;
507 res = setup_file_encryption_key(crypt_info, need_dirhash_key,
513 * For existing inodes, multiple tasks may race to set ->i_crypt_info.
514 * So use cmpxchg_release(). This pairs with the smp_load_acquire() in
515 * fscrypt_get_info(). I.e., here we publish ->i_crypt_info with a
516 * RELEASE barrier so that other tasks can ACQUIRE it.
518 if (cmpxchg_release(&inode->i_crypt_info, NULL, crypt_info) == NULL) {
520 * We won the race and set ->i_crypt_info to our crypt_info.
521 * Now link it into the master key's inode list.
524 struct fscrypt_master_key *mk =
525 master_key->payload.data[0];
527 refcount_inc(&mk->mk_refcount);
528 crypt_info->ci_master_key = key_get(master_key);
529 spin_lock(&mk->mk_decrypted_inodes_lock);
530 list_add(&crypt_info->ci_master_key_link,
531 &mk->mk_decrypted_inodes);
532 spin_unlock(&mk->mk_decrypted_inodes_lock);
539 struct fscrypt_master_key *mk = master_key->payload.data[0];
541 up_read(&mk->mk_secret_sem);
544 put_crypt_info(crypt_info);
549 * fscrypt_get_encryption_info() - set up an inode's encryption key
550 * @inode: the inode to set up the key for. Must be encrypted.
552 * Set up ->i_crypt_info, if it hasn't already been done.
554 * Note: unless ->i_crypt_info is already set, this isn't %GFP_NOFS-safe. So
555 * generally this shouldn't be called from within a filesystem transaction.
557 * Return: 0 if ->i_crypt_info was set or was already set, *or* if the
558 * encryption key is unavailable. (Use fscrypt_has_encryption_key() to
559 * distinguish these cases.) Also can return another -errno code.
561 int fscrypt_get_encryption_info(struct inode *inode)
564 union fscrypt_context ctx;
565 union fscrypt_policy policy;
567 if (fscrypt_has_encryption_key(inode))
570 res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx));
572 fscrypt_warn(inode, "Error %d getting encryption context", res);
576 res = fscrypt_policy_from_context(&policy, &ctx, res);
579 "Unrecognized or corrupt encryption context");
583 if (!fscrypt_supported_policy(&policy, inode))
586 res = fscrypt_setup_encryption_info(inode, &policy,
587 fscrypt_context_nonce(&ctx),
588 IS_CASEFOLDED(inode) &&
589 S_ISDIR(inode->i_mode));
594 EXPORT_SYMBOL(fscrypt_get_encryption_info);
597 * fscrypt_prepare_new_inode() - prepare to create a new inode in a directory
598 * @dir: a possibly-encrypted directory
599 * @inode: the new inode. ->i_mode must be set already.
600 * ->i_ino doesn't need to be set yet.
601 * @encrypt_ret: (output) set to %true if the new inode will be encrypted
603 * If the directory is encrypted, set up its ->i_crypt_info in preparation for
604 * encrypting the name of the new file. Also, if the new inode will be
605 * encrypted, set up its ->i_crypt_info and set *encrypt_ret=true.
607 * This isn't %GFP_NOFS-safe, and therefore it should be called before starting
608 * any filesystem transaction to create the inode. For this reason, ->i_ino
609 * isn't required to be set yet, as the filesystem may not have set it yet.
611 * This doesn't persist the new inode's encryption context. That still needs to
612 * be done later by calling fscrypt_set_context().
614 * Return: 0 on success, -ENOKEY if the encryption key is missing, or another
617 int fscrypt_prepare_new_inode(struct inode *dir, struct inode *inode,
620 const union fscrypt_policy *policy;
621 u8 nonce[FSCRYPT_FILE_NONCE_SIZE];
623 policy = fscrypt_policy_to_inherit(dir);
627 return PTR_ERR(policy);
629 if (WARN_ON_ONCE(inode->i_mode == 0))
633 * Only regular files, directories, and symlinks are encrypted.
634 * Special files like device nodes and named pipes aren't.
636 if (!S_ISREG(inode->i_mode) &&
637 !S_ISDIR(inode->i_mode) &&
638 !S_ISLNK(inode->i_mode))
643 get_random_bytes(nonce, FSCRYPT_FILE_NONCE_SIZE);
644 return fscrypt_setup_encryption_info(inode, policy, nonce,
645 IS_CASEFOLDED(dir) &&
646 S_ISDIR(inode->i_mode));
648 EXPORT_SYMBOL_GPL(fscrypt_prepare_new_inode);
651 * fscrypt_put_encryption_info() - free most of an inode's fscrypt data
652 * @inode: an inode being evicted
654 * Free the inode's fscrypt_info. Filesystems must call this when the inode is
655 * being evicted. An RCU grace period need not have elapsed yet.
657 void fscrypt_put_encryption_info(struct inode *inode)
659 put_crypt_info(inode->i_crypt_info);
660 inode->i_crypt_info = NULL;
662 EXPORT_SYMBOL(fscrypt_put_encryption_info);
665 * fscrypt_free_inode() - free an inode's fscrypt data requiring RCU delay
666 * @inode: an inode being freed
668 * Free the inode's cached decrypted symlink target, if any. Filesystems must
669 * call this after an RCU grace period, just before they free the inode.
671 void fscrypt_free_inode(struct inode *inode)
673 if (IS_ENCRYPTED(inode) && S_ISLNK(inode->i_mode)) {
674 kfree(inode->i_link);
675 inode->i_link = NULL;
678 EXPORT_SYMBOL(fscrypt_free_inode);
681 * fscrypt_drop_inode() - check whether the inode's master key has been removed
682 * @inode: an inode being considered for eviction
684 * Filesystems supporting fscrypt must call this from their ->drop_inode()
685 * method so that encrypted inodes are evicted as soon as they're no longer in
686 * use and their master key has been removed.
688 * Return: 1 if fscrypt wants the inode to be evicted now, otherwise 0
690 int fscrypt_drop_inode(struct inode *inode)
692 const struct fscrypt_info *ci = fscrypt_get_info(inode);
693 const struct fscrypt_master_key *mk;
696 * If ci is NULL, then the inode doesn't have an encryption key set up
697 * so it's irrelevant. If ci_master_key is NULL, then the master key
698 * was provided via the legacy mechanism of the process-subscribed
699 * keyrings, so we don't know whether it's been removed or not.
701 if (!ci || !ci->ci_master_key)
703 mk = ci->ci_master_key->payload.data[0];
706 * With proper, non-racy use of FS_IOC_REMOVE_ENCRYPTION_KEY, all inodes
707 * protected by the key were cleaned by sync_filesystem(). But if
708 * userspace is still using the files, inodes can be dirtied between
709 * then and now. We mustn't lose any writes, so skip dirty inodes here.
711 if (inode->i_state & I_DIRTY_ALL)
715 * Note: since we aren't holding ->mk_secret_sem, the result here can
716 * immediately become outdated. But there's no correctness problem with
717 * unnecessarily evicting. Nor is there a correctness problem with not
718 * evicting while iput() is racing with the key being removed, since
719 * then the thread removing the key will either evict the inode itself
720 * or will correctly detect that it wasn't evicted due to the race.
722 return !is_master_key_secret_present(&mk->mk_secret);
724 EXPORT_SYMBOL_GPL(fscrypt_drop_inode);