History

fscrypt: remove kernel-internal constants from UAPI header

There isn't really any valid reason to use __FSCRYPT_MODE_MAX or FSCRYPT_POLICY_FLAGS_VALID in a userspace program. These constants are only meant to be used by the kernel internally, and they are defined in the UAPI header next to the mode numbers and flags only so that kernel developers don't forget to update them when adding new modes or flags. In https://lkml.kernel.org/r/20201005074133.1958633-2-satyat@google.com there was an example of someone wanting to use __FSCRYPT_MODE_MAX in a user program, and it was wrong because the program would have broken if __FSCRYPT_MODE_MAX were ever increased. So having this definition available is harmful. FSCRYPT_POLICY_FLAGS_VALID has the same problem. So, remove these definitions from the UAPI header. Replace FSCRYPT_POLICY_FLAGS_VALID with just listing the valid flags explicitly in the one kernel function that needs it. Move __FSCRYPT_MODE_MAX to fscrypt_private.h, remove the double underscores (which were only present to discourage use by userspace), and add a BUILD_BUG_ON() and comments to (hopefully) ensure it is kept in sync. Keep the old name FS_POLICY_FLAGS_VALID, since it's been around for longer and there's a greater chance that removing it would break source compatibility with some program. Indeed, mtd-utils is using it in an #ifdef, and removing it would introduce compiler warnings (about FS_POLICY_FLAGS_PAD_* being redefined) into the mtd-utils build. However, reduce its value to 0x07 so that it only includes the flags with old names (the ones present before Linux 5.4), and try to make it clear that it's now "frozen" and no new flags should be added to it.

Eric Biggers committed 6 years ago

Commit 3ceb6541 parent 09162bc5 files · +16 −9Browse files

Unified · Split

5 files
  1. fs/crypto/fscrypt_private.h +6 −3
  2. fs/crypto/keyring.c +1 −1
  3. fs/crypto/keysetup.c +3 −1
  4. fs/crypto/policy.c +4 −1
  5. include/uapi/linux/fscrypt.h +2 −3
fs/crypto/fscrypt_private.h+6−3
@@ -25,6 +25,9 @@ · 24 unmodified lines
25#define FSCRYPT_CONTEXT_V1 125#define FSCRYPT_CONTEXT_V1 1
26#define FSCRYPT_CONTEXT_V2 226#define FSCRYPT_CONTEXT_V2 2
27 27
28/* Keep this in sync with include/uapi/linux/fscrypt.h */
29#define FSCRYPT_MODE_MAX FSCRYPT_MODE_ADIANTUM
30
28struct fscrypt_context_v1 {31struct fscrypt_context_v1 {
29 u8 version; /* FSCRYPT_CONTEXT_V1 */32 u8 version; /* FSCRYPT_CONTEXT_V1 */
30 u8 contents_encryption_mode;33 u8 contents_encryption_mode;
@@ -491,9 +494,9 @@ struct fscrypt_master_key { · 460 unmodified lines
491 * Per-mode encryption keys for the various types of encryption policies494 * Per-mode encryption keys for the various types of encryption policies
492 * that use them. Allocated and derived on-demand.495 * that use them. Allocated and derived on-demand.
493 */496 */
494 struct fscrypt_prepared_key mk_direct_keys[__FSCRYPT_MODE_MAX + 1];497 struct fscrypt_prepared_key mk_direct_keys[FSCRYPT_MODE_MAX + 1];
495 struct fscrypt_prepared_key mk_iv_ino_lblk_64_keys[__FSCRYPT_MODE_MAX + 1];498 struct fscrypt_prepared_key mk_iv_ino_lblk_64_keys[FSCRYPT_MODE_MAX + 1];
496 struct fscrypt_prepared_key mk_iv_ino_lblk_32_keys[__FSCRYPT_MODE_MAX + 1];499 struct fscrypt_prepared_key mk_iv_ino_lblk_32_keys[FSCRYPT_MODE_MAX + 1];
497 500
498 /* Hash key for inode numbers. Initialized only when needed. */501 /* Hash key for inode numbers. Initialized only when needed. */
499 siphash_key_t mk_ino_hash_key;502 siphash_key_t mk_ino_hash_key;
fs/crypto/keyring.c+1−1
@@ -44,7 +44,7 @@ static void free_master_key(struct fscrypt_master_key *mk) · 43 unmodified lines
44 44
45 wipe_master_key_secret(&mk->mk_secret);45 wipe_master_key_secret(&mk->mk_secret);
46 46
47 for (i = 0; i <= __FSCRYPT_MODE_MAX; i++) {47 for (i = 0; i <= FSCRYPT_MODE_MAX; i++) {
48 fscrypt_destroy_prepared_key(&mk->mk_direct_keys[i]);48 fscrypt_destroy_prepared_key(&mk->mk_direct_keys[i]);
49 fscrypt_destroy_prepared_key(&mk->mk_iv_ino_lblk_64_keys[i]);49 fscrypt_destroy_prepared_key(&mk->mk_iv_ino_lblk_64_keys[i]);
50 fscrypt_destroy_prepared_key(&mk->mk_iv_ino_lblk_32_keys[i]);50 fscrypt_destroy_prepared_key(&mk->mk_iv_ino_lblk_32_keys[i]);
fs/crypto/keysetup.c+3−1
@@ -56,6 +56,8 @@ static struct fscrypt_mode * · 55 unmodified lines
56select_encryption_mode(const union fscrypt_policy *policy,56select_encryption_mode(const union fscrypt_policy *policy,
57 const struct inode *inode)57 const struct inode *inode)
58{58{
59 BUILD_BUG_ON(ARRAY_SIZE(fscrypt_modes) != FSCRYPT_MODE_MAX + 1);
60
59 if (S_ISREG(inode->i_mode))61 if (S_ISREG(inode->i_mode))
60 return &fscrypt_modes[fscrypt_policy_contents_mode(policy)];62 return &fscrypt_modes[fscrypt_policy_contents_mode(policy)];
61 63
@@ -168,7 +170,7 @@ static int setup_per_mode_enc_key(struct fscrypt_info *ci, · 106 unmodified lines
168 unsigned int hkdf_infolen = 0;170 unsigned int hkdf_infolen = 0;
169 int err;171 int err;
170 172
171 if (WARN_ON(mode_num > __FSCRYPT_MODE_MAX))173 if (WARN_ON(mode_num > FSCRYPT_MODE_MAX))
172 return -EINVAL;174 return -EINVAL;
173 175
174 prep_key = &keys[mode_num];176 prep_key = &keys[mode_num];
fs/crypto/policy.c+4−1
@@ -175,7 +175,10 @@ static bool fscrypt_supported_v2_policy(const struct fscrypt_policy_v2 *policy, · 174 unmodified lines
175 return false;175 return false;
176 }176 }
177 177
178 if (policy->flags & ~FSCRYPT_POLICY_FLAGS_VALID) {178 if (policy->flags & ~(FSCRYPT_POLICY_FLAGS_PAD_MASK |
179 FSCRYPT_POLICY_FLAG_DIRECT_KEY |
180 FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 |
181 FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32)) {
179 fscrypt_warn(inode, "Unsupported encryption flags (0x%02x)",182 fscrypt_warn(inode, "Unsupported encryption flags (0x%02x)",
180 policy->flags);183 policy->flags);
181 return false;184 return false;
include/uapi/linux/fscrypt.h+2−3
@@ -20,7 +20,6 @@ · 19 unmodified lines
20#define FSCRYPT_POLICY_FLAG_DIRECT_KEY 0x0420#define FSCRYPT_POLICY_FLAG_DIRECT_KEY 0x04
21#define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 0x0821#define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 0x08
22#define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32 0x1022#define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32 0x10
23#define FSCRYPT_POLICY_FLAGS_VALID 0x1F
24 23
25/* Encryption algorithms */24/* Encryption algorithms */
26#define FSCRYPT_MODE_AES_256_XTS 125#define FSCRYPT_MODE_AES_256_XTS 1
@@ -28,7 +27,7 @@ · 1 unmodified line
28#define FSCRYPT_MODE_AES_128_CBC 527#define FSCRYPT_MODE_AES_128_CBC 5
29#define FSCRYPT_MODE_AES_128_CTS 628#define FSCRYPT_MODE_AES_128_CTS 6
30#define FSCRYPT_MODE_ADIANTUM 929#define FSCRYPT_MODE_ADIANTUM 9
31#define __FSCRYPT_MODE_MAX 930/* If adding a mode number > 9, update FSCRYPT_MODE_MAX in fscrypt_private.h */
32 31
33/*32/*
34 * Legacy policy version; ad-hoc KDF and no key verification.33 * Legacy policy version; ad-hoc KDF and no key verification.
@@ -177,7 +176,7 @@ struct fscrypt_get_key_status_arg { · 142 unmodified lines
177#define FS_POLICY_FLAGS_PAD_32 FSCRYPT_POLICY_FLAGS_PAD_32176#define FS_POLICY_FLAGS_PAD_32 FSCRYPT_POLICY_FLAGS_PAD_32
178#define FS_POLICY_FLAGS_PAD_MASK FSCRYPT_POLICY_FLAGS_PAD_MASK177#define FS_POLICY_FLAGS_PAD_MASK FSCRYPT_POLICY_FLAGS_PAD_MASK
179#define FS_POLICY_FLAG_DIRECT_KEY FSCRYPT_POLICY_FLAG_DIRECT_KEY178#define FS_POLICY_FLAG_DIRECT_KEY FSCRYPT_POLICY_FLAG_DIRECT_KEY
180#define FS_POLICY_FLAGS_VALID FSCRYPT_POLICY_FLAGS_VALID179#define FS_POLICY_FLAGS_VALID 0x07 /* contains old flags only */
181#define FS_ENCRYPTION_MODE_INVALID 0 /* never used */180#define FS_ENCRYPTION_MODE_INVALID 0 /* never used */
182#define FS_ENCRYPTION_MODE_AES_256_XTS FSCRYPT_MODE_AES_256_XTS181#define FS_ENCRYPTION_MODE_AES_256_XTS FSCRYPT_MODE_AES_256_XTS
183#define FS_ENCRYPTION_MODE_AES_256_GCM 2 /* never used */182#define FS_ENCRYPTION_MODE_AES_256_GCM 2 /* never used */