Lines Matching refs:policy
3 * Encryption policy functions for per-file encryption support.
10 * Modified by Eric Biggers, 2019 for v2 policy support.
22 * @policy1: the first policy
23 * @policy2: the second policy
36 int fscrypt_policy_to_key_spec(const union fscrypt_policy *policy,
39 switch (policy->version) {
42 memcpy(key_spec->u.descriptor, policy->v1.master_key_descriptor,
47 memcpy(key_spec->u.identifier, policy->v2.master_key_identifier,
120 static bool supported_iv_ino_lblk_policy(const struct fscrypt_policy_v2 *policy,
135 if (policy->contents_encryption_mode != FSCRYPT_MODE_AES_256_XTS) {
137 "Can't use %s policy with contents mode other than AES-256-XTS",
149 "Can't use %s policy on filesystem '%s' because it doesn't have stable inode numbers",
157 "Can't use %s policy on filesystem '%s' because its inode numbers are too long",
163 "Can't use %s policy on filesystem '%s' because its block numbers are too long",
170 static bool fscrypt_supported_v1_policy(const struct fscrypt_policy_v1 *policy,
173 if (!fscrypt_valid_enc_modes_v1(policy->contents_encryption_mode,
174 policy->filenames_encryption_mode)) {
177 policy->contents_encryption_mode,
178 policy->filenames_encryption_mode);
182 if (policy->flags & ~(FSCRYPT_POLICY_FLAGS_PAD_MASK |
185 policy->flags);
189 if ((policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) &&
190 !supported_direct_key_modes(inode, policy->contents_encryption_mode,
191 policy->filenames_encryption_mode))
204 static bool fscrypt_supported_v2_policy(const struct fscrypt_policy_v2 *policy,
209 if (!fscrypt_valid_enc_modes_v2(policy->contents_encryption_mode,
210 policy->filenames_encryption_mode)) {
213 policy->contents_encryption_mode,
214 policy->filenames_encryption_mode);
218 if (policy->flags & ~(FSCRYPT_POLICY_FLAGS_PAD_MASK |
223 policy->flags);
227 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY);
228 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64);
229 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32);
232 policy->flags);
236 if ((policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) &&
237 !supported_direct_key_modes(inode, policy->contents_encryption_mode,
238 policy->filenames_encryption_mode))
241 if ((policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64) &&
242 !supported_iv_ino_lblk_policy(policy, inode, "IV_INO_LBLK_64",
252 if ((policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) &&
253 !supported_iv_ino_lblk_policy(policy, inode, "IV_INO_LBLK_32",
257 if (memchr_inv(policy->__reserved, 0, sizeof(policy->__reserved))) {
258 fscrypt_warn(inode, "Reserved bits set in encryption policy");
266 * fscrypt_supported_policy() - check whether an encryption policy is supported
267 * @policy_u: the encryption policy
268 * @inode: the inode on which the policy will be used
270 * Given an encryption policy, check whether all its encryption modes and other
292 * @policy_u: input policy
296 * encryption policy. @nonce must be a new random nonce.
308 const struct fscrypt_policy_v1 *policy = &policy_u->v1;
313 policy->contents_encryption_mode;
315 policy->filenames_encryption_mode;
316 ctx->flags = policy->flags;
318 policy->master_key_descriptor,
324 const struct fscrypt_policy_v2 *policy = &policy_u->v2;
329 policy->contents_encryption_mode;
331 policy->filenames_encryption_mode;
332 ctx->flags = policy->flags;
334 policy->master_key_identifier,
346 * @policy_u: output policy
355 * This does *not* validate the settings within the policy itself, e.g. the
370 struct fscrypt_policy_v1 *policy = &policy_u->v1;
372 policy->version = FSCRYPT_POLICY_V1;
373 policy->contents_encryption_mode =
375 policy->filenames_encryption_mode =
377 policy->flags = ctx->flags;
378 memcpy(policy->master_key_descriptor,
380 sizeof(policy->master_key_descriptor));
385 struct fscrypt_policy_v2 *policy = &policy_u->v2;
387 policy->version = FSCRYPT_POLICY_V2;
388 policy->contents_encryption_mode =
390 policy->filenames_encryption_mode =
392 policy->flags = ctx->flags;
393 memcpy(policy->__reserved, ctx->__reserved,
394 sizeof(policy->__reserved));
395 memcpy(policy->master_key_identifier,
397 sizeof(policy->master_key_identifier));
405 /* Retrieve an inode's encryption policy */
406 static int fscrypt_get_policy(struct inode *inode, union fscrypt_policy *policy)
414 /* key available, use the cached policy */
415 *policy = ci->ci_policy;
426 return fscrypt_policy_from_context(policy, &ctx, ret);
430 const union fscrypt_policy *policy)
437 if (!fscrypt_supported_policy(policy, inode))
440 switch (policy->version) {
443 * The original encryption policy version provided no way of
447 * encryption policy version fixes this and also implies use of
451 * policy version for all new encrypted directories.
453 pr_warn_once("%s (pid %d) is setting deprecated v1 encryption policy; recommend upgrading to v2.\n",
458 policy->v2.master_key_identifier);
461 if (policy->v2.flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32)
462 pr_warn_once("%s (pid %d) is setting an IV_INO_LBLK_32 encryption policy. This should only be used if there are certain hardware limitations.\n",
471 ctxsize = fscrypt_new_context(&ctx, policy, nonce);
478 union fscrypt_policy policy;
485 if (get_user(policy.version, (const u8 __user *)arg))
488 size = fscrypt_policy_size(&policy);
503 version = policy.version;
504 if (copy_from_user(&policy, arg, size))
506 policy.version = version;
526 ret = set_encryption_policy(inode, &policy);
528 (ret == 0 && !fscrypt_policies_equal(&policy,
530 /* The file already uses a different encryption policy. */
541 /* Original ioctl version; can only get the original policy version */
544 union fscrypt_policy policy;
547 err = fscrypt_get_policy(file_inode(filp), &policy);
551 if (policy.version != FSCRYPT_POLICY_V1)
554 if (copy_to_user(arg, &policy, sizeof(policy.v1)))
564 union fscrypt_policy *policy = (union fscrypt_policy *)&arg.policy;
568 /* arg is policy_size, then policy */
571 offsetof(typeof(arg), policy));
572 BUILD_BUG_ON(sizeof(arg.policy) != sizeof(*policy));
574 err = fscrypt_get_policy(file_inode(filp), policy);
577 policy_size = fscrypt_policy_size(policy);
612 * fscrypt_has_permitted_context() - is a file's encryption policy permitted
624 * same encryption policy. The pre-access check is needed to detect potentially
650 * encryption policy. Compare the fscrypt_info structs if the keys are
675 * encryption policy, so that files with an unrecognized encryption
676 * policy can be deleted.
689 * Return the encryption policy that new files in the directory will inherit, or
710 * @inode: inode from which to fetch policy and nonce
768 * @dummy_policy: (input/output) the place to write the dummy policy that will
769 * result from parsing the option. Zero-initialize this. If a policy is
780 union fscrypt_policy *policy;
786 policy = kzalloc(sizeof(*policy), GFP_KERNEL);
787 if (!policy)
791 policy->version = FSCRYPT_POLICY_V1;
792 policy->v1.contents_encryption_mode = FSCRYPT_MODE_AES_256_XTS;
793 policy->v1.filenames_encryption_mode = FSCRYPT_MODE_AES_256_CTS;
794 memset(policy->v1.master_key_descriptor, 0x42,
797 policy->version = FSCRYPT_POLICY_V2;
798 policy->v2.contents_encryption_mode = FSCRYPT_MODE_AES_256_XTS;
799 policy->v2.filenames_encryption_mode = FSCRYPT_MODE_AES_256_CTS;
801 policy->v2.master_key_identifier);
809 if (dummy_policy->policy) {
810 if (fscrypt_policies_equal(policy, dummy_policy->policy))
816 dummy_policy->policy = policy;
817 policy = NULL;
820 kfree(policy);
827 * @p1: the first test dummy policy (may be unset)
828 * @p2: the second test dummy policy (may be unset)
835 if (!p1->policy && !p2->policy)
837 if (!p1->policy || !p2->policy)
839 return fscrypt_policies_equal(p1->policy, p2->policy);
855 const union fscrypt_policy *policy = fscrypt_get_dummy_policy(sb);
858 if (!policy)
861 vers = policy->version;