There isn't really any valid reason to use __FSCRYPT_MODE_MAX or FSCRYPT_POLICY_FLAGS_VALID in a userspace program. These constants are only meant to be used by the kernel internally, and they are defined in the UAPI header next to the mode numbers and flags only so that kernel developers don't forget to update them when adding new modes or flags. In https://lkml.kernel.org/r/20201005074133.1958633-2-satyat@google.com there was an example of someone wanting to use __FSCRYPT_MODE_MAX in a user program, and it was wrong because the program would have broken if __FSCRYPT_MODE_MAX were ever increased. So having this definition available is harmful. FSCRYPT_POLICY_FLAGS_VALID has the same problem. So, remove these definitions from the UAPI header. Replace FSCRYPT_POLICY_FLAGS_VALID with just listing the valid flags explicitly in the one kernel function that needs it. Move __FSCRYPT_MODE_MAX to fscrypt_private.h, remove the double underscores (which were only present to discourage use by userspace), and add a BUILD_BUG_ON() and comments to (hopefully) ensure it is kept in sync. Keep the old name FS_POLICY_FLAGS_VALID, since it's been around for longer and there's a greater chance that removing it would break source compatibility with some program. Indeed, mtd-utils is using it in an #ifdef, and removing it would introduce compiler warnings (about FS_POLICY_FLAGS_PAD_* being redefined) into the mtd-utils build. However, reduce its value to 0x07 so that it only includes the flags with old names (the ones present before Linux 5.4), and try to make it clear that it's now "frozen" and no new flags should be added to it.
Showing the changes to include/uapi/linux (1 of 5 files). Show all
Unified · Split
| @@ -20,7 +20,6 @@ · 19 unmodified lines | |||
| 20 | #define FSCRYPT_POLICY_FLAG_DIRECT_KEY 0x04 | 20 | #define FSCRYPT_POLICY_FLAG_DIRECT_KEY 0x04 |
| 21 | #define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 0x08 | 21 | #define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 0x08 |
| 22 | #define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32 0x10 | 22 | #define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32 0x10 |
| 23 | #define FSCRYPT_POLICY_FLAGS_VALID 0x1F | ||
| 24 | 23 | ||
| 25 | /* Encryption algorithms */ | 24 | /* Encryption algorithms */ |
| 26 | #define FSCRYPT_MODE_AES_256_XTS 1 | 25 | #define FSCRYPT_MODE_AES_256_XTS 1 |
| @@ -28,7 +27,7 @@ · 1 unmodified line | |||
| 28 | #define FSCRYPT_MODE_AES_128_CBC 5 | 27 | #define FSCRYPT_MODE_AES_128_CBC 5 |
| 29 | #define FSCRYPT_MODE_AES_128_CTS 6 | 28 | #define FSCRYPT_MODE_AES_128_CTS 6 |
| 30 | #define FSCRYPT_MODE_ADIANTUM 9 | 29 | #define FSCRYPT_MODE_ADIANTUM 9 |
| 31 | #define __FSCRYPT_MODE_MAX 9 | 30 | /* If adding a mode number > 9, update FSCRYPT_MODE_MAX in fscrypt_private.h */ |
| 32 | 31 | ||
| 33 | /* | 32 | /* |
| 34 | * Legacy policy version; ad-hoc KDF and no key verification. | 33 | * Legacy policy version; ad-hoc KDF and no key verification. |
| @@ -177,7 +176,7 @@ struct fscrypt_get_key_status_arg { · 142 unmodified lines | |||
| 177 | #define FS_POLICY_FLAGS_PAD_32 FSCRYPT_POLICY_FLAGS_PAD_32 | 176 | #define FS_POLICY_FLAGS_PAD_32 FSCRYPT_POLICY_FLAGS_PAD_32 |
| 178 | #define FS_POLICY_FLAGS_PAD_MASK FSCRYPT_POLICY_FLAGS_PAD_MASK | 177 | #define FS_POLICY_FLAGS_PAD_MASK FSCRYPT_POLICY_FLAGS_PAD_MASK |
| 179 | #define FS_POLICY_FLAG_DIRECT_KEY FSCRYPT_POLICY_FLAG_DIRECT_KEY | 178 | #define FS_POLICY_FLAG_DIRECT_KEY FSCRYPT_POLICY_FLAG_DIRECT_KEY |
| 180 | #define FS_POLICY_FLAGS_VALID FSCRYPT_POLICY_FLAGS_VALID | 179 | #define FS_POLICY_FLAGS_VALID 0x07 /* contains old flags only */ |
| 181 | #define FS_ENCRYPTION_MODE_INVALID 0 /* never used */ | 180 | #define FS_ENCRYPTION_MODE_INVALID 0 /* never used */ |
| 182 | #define FS_ENCRYPTION_MODE_AES_256_XTS FSCRYPT_MODE_AES_256_XTS | 181 | #define FS_ENCRYPTION_MODE_AES_256_XTS FSCRYPT_MODE_AES_256_XTS |
| 183 | #define FS_ENCRYPTION_MODE_AES_256_GCM 2 /* never used */ | 182 | #define FS_ENCRYPTION_MODE_AES_256_GCM 2 /* never used */ |