Lines Matching refs:policy
3 * Encryption policy functions for per-file encryption support.
10 * Modified by Eric Biggers, 2019 for v2 policy support.
21 * @policy1: the first policy
22 * @policy2: the second policy
80 static bool supported_iv_ino_lblk_policy(const struct fscrypt_policy_v2 *policy,
95 if (policy->contents_encryption_mode != FSCRYPT_MODE_AES_256_XTS) {
97 "Can't use %s policy with contents mode other than AES-256-XTS",
109 "Can't use %s policy on filesystem '%s' because it doesn't have stable inode numbers",
117 "Can't use %s policy on filesystem '%s' because its inode numbers are too long",
123 "Can't use %s policy on filesystem '%s' because its block numbers are too long",
130 static bool fscrypt_supported_v1_policy(const struct fscrypt_policy_v1 *policy,
133 if (!fscrypt_valid_enc_modes(policy->contents_encryption_mode,
134 policy->filenames_encryption_mode)) {
137 policy->contents_encryption_mode,
138 policy->filenames_encryption_mode);
142 if (policy->flags & ~(FSCRYPT_POLICY_FLAGS_PAD_MASK |
145 policy->flags);
149 if ((policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) &&
150 !supported_direct_key_modes(inode, policy->contents_encryption_mode,
151 policy->filenames_encryption_mode))
164 static bool fscrypt_supported_v2_policy(const struct fscrypt_policy_v2 *policy,
169 if (!fscrypt_valid_enc_modes(policy->contents_encryption_mode,
170 policy->filenames_encryption_mode)) {
173 policy->contents_encryption_mode,
174 policy->filenames_encryption_mode);
178 if (policy->flags & ~(FSCRYPT_POLICY_FLAGS_PAD_MASK |
183 policy->flags);
187 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY);
188 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64);
189 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32);
192 policy->flags);
196 if ((policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) &&
197 !supported_direct_key_modes(inode, policy->contents_encryption_mode,
198 policy->filenames_encryption_mode))
201 if ((policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64) &&
202 !supported_iv_ino_lblk_policy(policy, inode, "IV_INO_LBLK_64",
212 if ((policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) &&
213 !supported_iv_ino_lblk_policy(policy, inode, "IV_INO_LBLK_32",
217 if (memchr_inv(policy->__reserved, 0, sizeof(policy->__reserved))) {
218 fscrypt_warn(inode, "Reserved bits set in encryption policy");
226 * fscrypt_supported_policy() - check whether an encryption policy is supported
227 * @policy_u: the encryption policy
228 * @inode: the inode on which the policy will be used
230 * Given an encryption policy, check whether all its encryption modes and other
252 * @policy_u: input policy
256 * encryption policy. @nonce must be a new random nonce.
268 const struct fscrypt_policy_v1 *policy = &policy_u->v1;
273 policy->contents_encryption_mode;
275 policy->filenames_encryption_mode;
276 ctx->flags = policy->flags;
278 policy->master_key_descriptor,
284 const struct fscrypt_policy_v2 *policy = &policy_u->v2;
289 policy->contents_encryption_mode;
291 policy->filenames_encryption_mode;
292 ctx->flags = policy->flags;
294 policy->master_key_identifier,
306 * @policy_u: output policy
315 * This does *not* validate the settings within the policy itself, e.g. the
330 struct fscrypt_policy_v1 *policy = &policy_u->v1;
332 policy->version = FSCRYPT_POLICY_V1;
333 policy->contents_encryption_mode =
335 policy->filenames_encryption_mode =
337 policy->flags = ctx->flags;
338 memcpy(policy->master_key_descriptor,
340 sizeof(policy->master_key_descriptor));
345 struct fscrypt_policy_v2 *policy = &policy_u->v2;
347 policy->version = FSCRYPT_POLICY_V2;
348 policy->contents_encryption_mode =
350 policy->filenames_encryption_mode =
352 policy->flags = ctx->flags;
353 memcpy(policy->__reserved, ctx->__reserved,
354 sizeof(policy->__reserved));
355 memcpy(policy->master_key_identifier,
357 sizeof(policy->master_key_identifier));
365 /* Retrieve an inode's encryption policy */
366 static int fscrypt_get_policy(struct inode *inode, union fscrypt_policy *policy)
374 /* key available, use the cached policy */
375 *policy = ci->ci_policy;
386 return fscrypt_policy_from_context(policy, &ctx, ret);
390 const union fscrypt_policy *policy)
397 if (!fscrypt_supported_policy(policy, inode))
400 switch (policy->version) {
403 * The original encryption policy version provided no way of
407 * encryption policy version fixes this and also implies use of
411 * policy version for all new encrypted directories.
413 pr_warn_once("%s (pid %d) is setting deprecated v1 encryption policy; recommend upgrading to v2.\n",
418 policy->v2.master_key_identifier);
421 if (policy->v2.flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32)
422 pr_warn_once("%s (pid %d) is setting an IV_INO_LBLK_32 encryption policy. This should only be used if there are certain hardware limitations.\n",
431 ctxsize = fscrypt_new_context(&ctx, policy, nonce);
438 union fscrypt_policy policy;
445 if (get_user(policy.version, (const u8 __user *)arg))
448 size = fscrypt_policy_size(&policy);
463 version = policy.version;
464 if (copy_from_user(&policy, arg, size))
466 policy.version = version;
486 ret = set_encryption_policy(inode, &policy);
488 (ret == 0 && !fscrypt_policies_equal(&policy,
490 /* The file already uses a different encryption policy. */
501 /* Original ioctl version; can only get the original policy version */
504 union fscrypt_policy policy;
507 err = fscrypt_get_policy(file_inode(filp), &policy);
511 if (policy.version != FSCRYPT_POLICY_V1)
514 if (copy_to_user(arg, &policy, sizeof(policy.v1)))
524 union fscrypt_policy *policy = (union fscrypt_policy *)&arg.policy;
528 /* arg is policy_size, then policy */
531 offsetof(typeof(arg), policy));
532 BUILD_BUG_ON(sizeof(arg.policy) != sizeof(*policy));
534 err = fscrypt_get_policy(file_inode(filp), policy);
537 policy_size = fscrypt_policy_size(policy);
572 * fscrypt_has_permitted_context() - is a file's encryption policy permitted
584 * same encryption policy. The pre-access check is needed to detect potentially
610 * encryption policy. Compare the fscrypt_info structs if the keys are
643 * Return the encryption policy that new files in the directory will inherit, or
700 * @dummy_policy: the filesystem's current dummy policy (input/output, see
704 * policy, saving it in @dummy_policy, and adding the corresponding dummy
709 * Return: 0 on success (dummy policy set, or the same policy is already set);
710 * -EEXIST if a different dummy policy is already set;
718 union fscrypt_policy *policy = NULL;
738 policy = kzalloc(sizeof(*policy), GFP_KERNEL);
739 if (!policy) {
748 policy->version = version;
749 switch (policy->version) {
751 policy->v1.contents_encryption_mode = FSCRYPT_MODE_AES_256_XTS;
752 policy->v1.filenames_encryption_mode = FSCRYPT_MODE_AES_256_CTS;
753 memcpy(policy->v1.master_key_descriptor, key_spec.u.descriptor,
757 policy->v2.contents_encryption_mode = FSCRYPT_MODE_AES_256_XTS;
758 policy->v2.filenames_encryption_mode = FSCRYPT_MODE_AES_256_CTS;
759 memcpy(policy->v2.master_key_identifier, key_spec.u.identifier,
768 if (dummy_policy->policy) {
769 if (fscrypt_policies_equal(policy, dummy_policy->policy))
775 dummy_policy->policy = policy;
776 policy = NULL;
779 kfree(policy);
796 const union fscrypt_policy *policy = fscrypt_get_dummy_policy(sb);
799 if (!policy)
802 vers = policy->version;