Lines Matching refs:policy
3 * Encryption policy functions for per-file encryption support.
10 * Modified by Eric Biggers, 2019 for v2 policy support.
22 * @policy1: the first policy
23 * @policy2: the second policy
36 int fscrypt_policy_to_key_spec(const union fscrypt_policy *policy,
39 switch (policy->version) {
42 memcpy(key_spec->u.descriptor, policy->v1.master_key_descriptor,
47 memcpy(key_spec->u.identifier, policy->v2.master_key_identifier,
120 static bool supported_iv_ino_lblk_policy(const struct fscrypt_policy_v2 *policy,
123 const char *type = (policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64)
134 if (policy->contents_encryption_mode != FSCRYPT_MODE_AES_256_XTS) {
136 "Can't use %s policy with contents mode other than AES-256-XTS",
148 "Can't use %s policy on filesystem '%s' because it doesn't have stable inode numbers",
162 "Can't use %s policy on filesystem '%s' because its inode numbers are too long",
172 fscrypt_policy_v2_du_bits(policy, inode)) > 32) {
174 "Can't use %s policy on filesystem '%s' because its maximum file size is too large",
181 static bool fscrypt_supported_v1_policy(const struct fscrypt_policy_v1 *policy,
184 if (!fscrypt_valid_enc_modes_v1(policy->contents_encryption_mode,
185 policy->filenames_encryption_mode)) {
188 policy->contents_encryption_mode,
189 policy->filenames_encryption_mode);
193 if (policy->flags & ~(FSCRYPT_POLICY_FLAGS_PAD_MASK |
196 policy->flags);
200 if ((policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) &&
201 !supported_direct_key_modes(inode, policy->contents_encryption_mode,
202 policy->filenames_encryption_mode))
215 static bool fscrypt_supported_v2_policy(const struct fscrypt_policy_v2 *policy,
220 if (!fscrypt_valid_enc_modes_v2(policy->contents_encryption_mode,
221 policy->filenames_encryption_mode)) {
224 policy->contents_encryption_mode,
225 policy->filenames_encryption_mode);
229 if (policy->flags & ~(FSCRYPT_POLICY_FLAGS_PAD_MASK |
234 policy->flags);
238 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY);
239 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64);
240 count += !!(policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32);
243 policy->flags);
247 if (policy->log2_data_unit_size) {
253 if (policy->log2_data_unit_size > inode->i_blkbits ||
254 policy->log2_data_unit_size < SECTOR_SHIFT /* 9 */) {
256 "Unsupported log2_data_unit_size in encryption policy: %d",
257 policy->log2_data_unit_size);
260 if (policy->log2_data_unit_size != inode->i_blkbits &&
261 (policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32)) {
272 if ((policy->flags & FSCRYPT_POLICY_FLAG_DIRECT_KEY) &&
273 !supported_direct_key_modes(inode, policy->contents_encryption_mode,
274 policy->filenames_encryption_mode))
277 if ((policy->flags & (FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 |
279 !supported_iv_ino_lblk_policy(policy, inode))
282 if (memchr_inv(policy->__reserved, 0, sizeof(policy->__reserved))) {
283 fscrypt_warn(inode, "Reserved bits set in encryption policy");
291 * fscrypt_supported_policy() - check whether an encryption policy is supported
292 * @policy_u: the encryption policy
293 * @inode: the inode on which the policy will be used
295 * Given an encryption policy, check whether all its encryption modes and other
317 * @policy_u: input policy
321 * encryption policy. @nonce must be a new random nonce.
333 const struct fscrypt_policy_v1 *policy = &policy_u->v1;
338 policy->contents_encryption_mode;
340 policy->filenames_encryption_mode;
341 ctx->flags = policy->flags;
343 policy->master_key_descriptor,
349 const struct fscrypt_policy_v2 *policy = &policy_u->v2;
354 policy->contents_encryption_mode;
356 policy->filenames_encryption_mode;
357 ctx->flags = policy->flags;
358 ctx->log2_data_unit_size = policy->log2_data_unit_size;
360 policy->master_key_identifier,
372 * @policy_u: output policy
381 * This does *not* validate the settings within the policy itself, e.g. the
396 struct fscrypt_policy_v1 *policy = &policy_u->v1;
398 policy->version = FSCRYPT_POLICY_V1;
399 policy->contents_encryption_mode =
401 policy->filenames_encryption_mode =
403 policy->flags = ctx->flags;
404 memcpy(policy->master_key_descriptor,
406 sizeof(policy->master_key_descriptor));
411 struct fscrypt_policy_v2 *policy = &policy_u->v2;
413 policy->version = FSCRYPT_POLICY_V2;
414 policy->contents_encryption_mode =
416 policy->filenames_encryption_mode =
418 policy->flags = ctx->flags;
419 policy->log2_data_unit_size = ctx->log2_data_unit_size;
420 memcpy(policy->__reserved, ctx->__reserved,
421 sizeof(policy->__reserved));
422 memcpy(policy->master_key_identifier,
424 sizeof(policy->master_key_identifier));
432 /* Retrieve an inode's encryption policy */
433 static int fscrypt_get_policy(struct inode *inode, union fscrypt_policy *policy)
441 /* key available, use the cached policy */
442 *policy = ci->ci_policy;
453 return fscrypt_policy_from_context(policy, &ctx, ret);
457 const union fscrypt_policy *policy)
464 if (!fscrypt_supported_policy(policy, inode))
467 switch (policy->version) {
470 * The original encryption policy version provided no way of
474 * encryption policy version fixes this and also implies use of
478 * policy version for all new encrypted directories.
480 pr_warn_once("%s (pid %d) is setting deprecated v1 encryption policy; recommend upgrading to v2.\n",
485 policy->v2.master_key_identifier);
488 if (policy->v2.flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32)
489 pr_warn_once("%s (pid %d) is setting an IV_INO_LBLK_32 encryption policy. This should only be used if there are certain hardware limitations.\n",
498 ctxsize = fscrypt_new_context(&ctx, policy, nonce);
505 union fscrypt_policy policy;
512 if (get_user(policy.version, (const u8 __user *)arg))
515 size = fscrypt_policy_size(&policy);
530 version = policy.version;
531 if (copy_from_user(&policy, arg, size))
533 policy.version = version;
553 ret = set_encryption_policy(inode, &policy);
555 (ret == 0 && !fscrypt_policies_equal(&policy,
557 /* The file already uses a different encryption policy. */
568 /* Original ioctl version; can only get the original policy version */
571 union fscrypt_policy policy;
574 err = fscrypt_get_policy(file_inode(filp), &policy);
578 if (policy.version != FSCRYPT_POLICY_V1)
581 if (copy_to_user(arg, &policy, sizeof(policy.v1)))
591 union fscrypt_policy *policy = (union fscrypt_policy *)&arg.policy;
595 /* arg is policy_size, then policy */
598 offsetof(typeof(arg), policy));
599 BUILD_BUG_ON(sizeof(arg.policy) != sizeof(*policy));
601 err = fscrypt_get_policy(file_inode(filp), policy);
604 policy_size = fscrypt_policy_size(policy);
639 * fscrypt_has_permitted_context() - is a file's encryption policy permitted
651 * same encryption policy. The pre-access check is needed to detect potentially
677 * encryption policy. Compare the cached policies if the keys are
702 * encryption policy, so that files with an unrecognized encryption
703 * policy can be deleted.
716 * Return the encryption policy that new files in the directory will inherit, or
737 * @inode: inode from which to fetch policy and nonce
795 * @dummy_policy: (input/output) the place to write the dummy policy that will
796 * result from parsing the option. Zero-initialize this. If a policy is
807 union fscrypt_policy *policy;
813 policy = kzalloc(sizeof(*policy), GFP_KERNEL);
814 if (!policy)
818 policy->version = FSCRYPT_POLICY_V1;
819 policy->v1.contents_encryption_mode = FSCRYPT_MODE_AES_256_XTS;
820 policy->v1.filenames_encryption_mode = FSCRYPT_MODE_AES_256_CTS;
821 memset(policy->v1.master_key_descriptor, 0x42,
824 policy->version = FSCRYPT_POLICY_V2;
825 policy->v2.contents_encryption_mode = FSCRYPT_MODE_AES_256_XTS;
826 policy->v2.filenames_encryption_mode = FSCRYPT_MODE_AES_256_CTS;
828 policy->v2.master_key_identifier);
836 if (dummy_policy->policy) {
837 if (fscrypt_policies_equal(policy, dummy_policy->policy))
843 dummy_policy->policy = policy;
844 policy = NULL;
847 kfree(policy);
854 * @p1: the first test dummy policy (may be unset)
855 * @p2: the second test dummy policy (may be unset)
862 if (!p1->policy && !p2->policy)
864 if (!p1->policy || !p2->policy)
866 return fscrypt_policies_equal(p1->policy, p2->policy);
882 const union fscrypt_policy *policy = fscrypt_get_dummy_policy(sb);
885 if (!policy)
888 vers = policy->version;