From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?UTF-8?q?Andr=C3=A9=20Draszik?= Date: Wed, 10 Jan 2018 12:44:17 +0000 Subject: [PATCH 2/3] fscrypt: add support for the encrypted key type Message-Id: <20180110124418.24385-2-git@andred.net> MIME-Version: 1.0 Content-Type: text/plain; charset="windows-1258" Content-Transfer-Encoding: base64 List-Id: References: <20180110124418.24385-1-git@andred.net> In-Reply-To: <20180110124418.24385-1-git@andred.net> To: linux-kernel@vger.kernel.org Cc: Mimi Zohar , David Howells , James Morris , "Serge E. Hallyn" , "Theodore Y. Ts'o" , Jaegeuk Kim , Kees Cook , linux-integrity@vger.kernel.org, keyrings@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fscrypt@vger.kernel.org V2Ugbm93IHRyeSB0byBhY3F1aXJlIHRoZSBrZXkgYWNjb3JkaW5nIHRvIHRoZQplbmNyeXB0aW9u IHBvbGljeSBmcm9tIGJvdGgga2V5IHR5cGVzLCAnbG9nb24nCmFzIHdlbGwgYXMgJ2VuY3J5cHRl ZCcuCgpTaWduZWQtb2ZmLWJ5OiBBbmRyw6kgRHJhc3ppayA8Z2l0QGFuZHJlZC5uZXQ+CkNjOiBN aW1pIFpvaGFyIDx6b2hhckBsaW51eC52bmV0LmlibS5jb20+CkNjOiBEYXZpZCBIb3dlbGxzIDxk aG93ZWxsc0ByZWRoYXQuY29tPgpDYzogSmFtZXMgTW9ycmlzIDxqYW1lcy5sLm1vcnJpc0BvcmFj bGUuY29tPgpDYzogIlNlcmdlIEUuIEhhbGx5biIgPHNlcmdlQGhhbGx5bi5jb20+CkNjOiAiVGhl b2RvcmUgWS4gVHMnbyIgPHR5dHNvQG1pdC5lZHU+CkNjOiBKYWVnZXVrIEtpbSA8amFlZ2V1a0Br ZXJuZWwub3JnPgpDYzogS2VlcyBDb29rIDxrZWVzY29va0BjaHJvbWl1bS5vcmc+CkNjOiBsaW51 eC1pbnRlZ3JpdHlAdmdlci5rZXJuZWwub3JnCkNjOiBrZXlyaW5nc0B2Z2VyLmtlcm5lbC5vcmcK Q2M6IGxpbnV4LXNlY3VyaXR5LW1vZHVsZUB2Z2VyLmtlcm5lbC5vcmcKQ2M6IGxpbnV4LWZzY3J5 cHRAdmdlci5rZXJuZWwub3JnCi0tLQogZnMvY3J5cHRvL2tleWluZm8uYyB8IDU4ICsrKysrKysr KysrKysrKysrKysrKysrKysrKysrKysrKysrLS0tLS0tLS0tLS0tLS0tLS0tCiAxIGZpbGUgY2hh bmdlZCwgMzggaW5zZXJ0aW9ucygrKSwgMjAgZGVsZXRpb25zKC0pCgpkaWZmIC0tZ2l0IGEvZnMv Y3J5cHRvL2tleWluZm8uYyBiL2ZzL2NyeXB0by9rZXlpbmZvLmMKaW5kZXggNWU2ZTg0NmY1YTI0 Li4wMjNmYTE5ZmVjNDggMTAwNjQ0Ci0tLSBhL2ZzL2NyeXB0by9rZXlpbmZvLmMKKysrIGIvZnMv Y3J5cHRvL2tleWluZm8uYwpAQCAtMTAsNiArMTAsNyBAQAogICovCiAKICNpbmNsdWRlIDxrZXlz L3VzZXItdHlwZS5oPgorI2luY2x1ZGUgPGtleXMvZW5jcnlwdGVkLXR5cGUuaD4KICNpbmNsdWRl IDxsaW51eC9zY2F0dGVybGlzdC5oPgogI2luY2x1ZGUgPGxpbnV4L3JhdGVsaW1pdC5oPgogI2lu Y2x1ZGUgPGNyeXB0by9hZXMuaD4KQEAgLTY2LDE0ICs2NywyMCBAQCBzdGF0aWMgaW50IGRlcml2 ZV9rZXlfYWVzKHU4IGRlcml2aW5nX2tleVtGU19BRVNfMTI4X0VDQl9LRVlfU0laRV0sCiAJcmV0 dXJuIHJlczsKIH0KIAotc3RhdGljIGludCB2YWxpZGF0ZV91c2VyX2tleShzdHJ1Y3QgZnNjcnlw dF9pbmZvICpjcnlwdF9pbmZvLAorc3RhdGljIGlubGluZSBzdHJ1Y3Qga2V5ICpmc2NyeXB0X2dl dF9lbmNyeXB0ZWRfa2V5KGNvbnN0IGNoYXIgKnNpZykKK3sKKwlpZiAoSVNfRU5BQkxFRChDT05G SUdfRU5DUllQVEVEX0tFWVMpKQorCQlyZXR1cm4gcmVxdWVzdF9rZXkoJmtleV90eXBlX2VuY3J5 cHRlZCwgc2lnLCBOVUxMKTsKKwlyZXR1cm4gRVJSX1BUUigtRU5PS0VZKTsKK30KKworc3RhdGlj IGludCB2YWxpZGF0ZV9rZXlyaW5nX2tleShzdHJ1Y3QgZnNjcnlwdF9pbmZvICpjcnlwdF9pbmZv LAogCQkJc3RydWN0IGZzY3J5cHRfY29udGV4dCAqY3R4LCB1OCAqcmF3X2tleSwKIAkJCWNvbnN0 IGNoYXIgKnByZWZpeCwgaW50IG1pbl9rZXlzaXplKQogewogCWNoYXIgKmRlc2NyaXB0aW9uOwog CXN0cnVjdCBrZXkgKmtleXJpbmdfa2V5OwogCXN0cnVjdCBmc2NyeXB0X2tleSAqbWFzdGVyX2tl eTsKLQljb25zdCBzdHJ1Y3QgdXNlcl9rZXlfcGF5bG9hZCAqdWtwOwogCWludCByZXM7CiAKIAlk ZXNjcmlwdGlvbiA9IGthc3ByaW50ZihHRlBfTk9GUywgIiVzJSpwaE4iLCBwcmVmaXgsCkBAIC04 MywyOCArOTAsMzkgQEAgc3RhdGljIGludCB2YWxpZGF0ZV91c2VyX2tleShzdHJ1Y3QgZnNjcnlw dF9pbmZvICpjcnlwdF9pbmZvLAogCQlyZXR1cm4gLUVOT01FTTsKIAogCWtleXJpbmdfa2V5ID0g cmVxdWVzdF9rZXkoJmtleV90eXBlX2xvZ29uLCBkZXNjcmlwdGlvbiwgTlVMTCk7CisJaWYgKElT X0VSUihrZXlyaW5nX2tleSkpCisJCWtleXJpbmdfa2V5ID0gZnNjcnlwdF9nZXRfZW5jcnlwdGVk X2tleShkZXNjcmlwdGlvbik7CiAJa2ZyZWUoZGVzY3JpcHRpb24pOwogCWlmIChJU19FUlIoa2V5 cmluZ19rZXkpKQogCQlyZXR1cm4gUFRSX0VSUihrZXlyaW5nX2tleSk7CiAJZG93bl9yZWFkKCZr ZXlyaW5nX2tleS0+c2VtKTsKIAotCWlmIChrZXlyaW5nX2tleS0+dHlwZSAhPSAma2V5X3R5cGVf bG9nb24pIHsKKwlpZiAoa2V5cmluZ19rZXktPnR5cGUgPSAma2V5X3R5cGVfbG9nb24pIHsKKwkJ Y29uc3Qgc3RydWN0IHVzZXJfa2V5X3BheWxvYWQgKnVrcDsKKworCQl1a3AgPSB1c2VyX2tleV9w YXlsb2FkX2xvY2tlZChrZXlyaW5nX2tleSk7CisJCWlmICghdWtwKSB7CisJCQkvKiBrZXkgd2Fz IHJldm9rZWQgYmVmb3JlIHdlIGFjcXVpcmVkIGl0cyBzZW1hcGhvcmUgKi8KKwkJCXJlcyA9IC1F S0VZUkVWT0tFRDsKKwkJCWdvdG8gb3V0OworCQl9CisJCWlmICh1a3AtPmRhdGFsZW4gIT0gc2l6 ZW9mKHN0cnVjdCBmc2NyeXB0X2tleSkpIHsKKwkJCXJlcyA9IC1FSU5WQUw7CisJCQlnb3RvIG91 dDsKKwkJfQorCQltYXN0ZXJfa2V5ID0gKHN0cnVjdCBmc2NyeXB0X2tleSAqKXVrcC0+ZGF0YTsK Kwl9IGVsc2UgaWYgKGtleXJpbmdfa2V5LT50eXBlID0gJmtleV90eXBlX2VuY3J5cHRlZCkgewor CQljb25zdCBzdHJ1Y3QgZW5jcnlwdGVkX2tleV9wYXlsb2FkICpla3A7CisKKwkJZWtwID0ga2V5 cmluZ19rZXktPnBheWxvYWQuZGF0YVswXTsKKwkJbWFzdGVyX2tleSA9IChzdHJ1Y3QgZnNjcnlw dF9rZXkgKilla3AtPnBheWxvYWRfZGF0YTsKKwl9IGVsc2UgewogCQlwcmludGtfb25jZShLRVJO X1dBUk5JTkcKLQkJCQkiJXM6IGtleSB0eXBlIG11c3QgYmUgbG9nb25cbiIsIF9fZnVuY19fKTsK KwkJCQkiJXM6IGtleSB0eXBlIG11c3QgYmUgbG9nb24gb3IgZW5jcnlwdGVkXG4iLAorCQkJCV9f ZnVuY19fKTsKIAkJcmVzID0gLUVOT0tFWTsKIAkJZ290byBvdXQ7CiAJfQotCXVrcCA9IHVzZXJf a2V5X3BheWxvYWRfbG9ja2VkKGtleXJpbmdfa2V5KTsKLQlpZiAoIXVrcCkgewotCQkvKiBrZXkg d2FzIHJldm9rZWQgYmVmb3JlIHdlIGFjcXVpcmVkIGl0cyBzZW1hcGhvcmUgKi8KLQkJcmVzID0g LUVLRVlSRVZPS0VEOwotCQlnb3RvIG91dDsKLQl9Ci0JaWYgKHVrcC0+ZGF0YWxlbiAhPSBzaXpl b2Yoc3RydWN0IGZzY3J5cHRfa2V5KSkgewotCQlyZXMgPSAtRUlOVkFMOwotCQlnb3RvIG91dDsK LQl9Ci0JbWFzdGVyX2tleSA9IChzdHJ1Y3QgZnNjcnlwdF9rZXkgKil1a3AtPmRhdGE7CiAJQlVJ TERfQlVHX09OKEZTX0FFU18xMjhfRUNCX0tFWV9TSVpFICE9IEZTX0tFWV9ERVJJVkFUSU9OX05P TkNFX1NJWkUpOwogCiAJaWYgKG1hc3Rlcl9rZXktPnNpemUgPCBtaW5fa2V5c2l6ZSB8fCBtYXN0 ZXJfa2V5LT5zaXplID4gRlNfTUFYX0tFWV9TSVpFCkBAIC0zMDIsMTIgKzMyMCwxMiBAQCBpbnQg ZnNjcnlwdF9nZXRfZW5jcnlwdGlvbl9pbmZvKHN0cnVjdCBpbm9kZSAqaW5vZGUpCiAJaWYgKCFy YXdfa2V5KQogCQlnb3RvIG91dDsKIAotCXJlcyA9IHZhbGlkYXRlX3VzZXJfa2V5KGNyeXB0X2lu Zm8sICZjdHgsIHJhd19rZXksIEZTX0tFWV9ERVNDX1BSRUZJWCwKLQkJCQlrZXlzaXplKTsKKwly ZXMgPSB2YWxpZGF0ZV9rZXlyaW5nX2tleShjcnlwdF9pbmZvLCAmY3R4LCByYXdfa2V5LAorCQkJ CSAgIEZTX0tFWV9ERVNDX1BSRUZJWCwga2V5c2l6ZSk7CiAJaWYgKHJlcyAmJiBpbm9kZS0+aV9z Yi0+c19jb3AtPmtleV9wcmVmaXgpIHsKLQkJaW50IHJlczIgPSB2YWxpZGF0ZV91c2VyX2tleShj cnlwdF9pbmZvLCAmY3R4LCByYXdfa2V5LAotCQkJCQkgICAgIGlub2RlLT5pX3NiLT5zX2NvcC0+ a2V5X3ByZWZpeCwKLQkJCQkJICAgICBrZXlzaXplKTsKKwkJaW50IHJlczIgPSB2YWxpZGF0ZV9r ZXlyaW5nX2tleShjcnlwdF9pbmZvLCAmY3R4LCByYXdfa2V5LAorCQkJCQkJaW5vZGUtPmlfc2It PnNfY29wLT5rZXlfcHJlZml4LAorCQkJCQkJa2V5c2l6ZSk7CiAJCWlmIChyZXMyKSB7CiAJCQlp ZiAocmVzMiA9IC1FTk9LRVkpCiAJCQkJcmVzID0gLUVOT0tFWTsKLS0gCjIuMTUuMQoKLS0KVG8g dW5zdWJzY3JpYmUgZnJvbSB0aGlzIGxpc3Q6IHNlbmQgdGhlIGxpbmUgInVuc3Vic2NyaWJlIGtl eXJpbmdzIiBpbgp0aGUgYm9keSBvZiBhIG1lc3NhZ2UgdG8gbWFqb3Jkb21vQHZnZXIua2VybmVs Lm9yZwpNb3JlIG1ham9yZG9tbyBpbmZvIGF0ICBodHRwOi8vdmdlci5rZXJuZWwub3JnL21ham9y ZG9tby1pbmZvLmh0bWw= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f68.google.com ([74.125.82.68]:44019 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933445AbeAJMoX (ORCPT ); Wed, 10 Jan 2018 07:44:23 -0500 From: =?UTF-8?q?Andr=C3=A9=20Draszik?= Subject: [PATCH 2/3] fscrypt: add support for the encrypted key type Date: Wed, 10 Jan 2018 12:44:17 +0000 Message-Id: <20180110124418.24385-2-git@andred.net> In-Reply-To: <20180110124418.24385-1-git@andred.net> References: <20180110124418.24385-1-git@andred.net> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-fscrypt-owner@vger.kernel.org To: linux-kernel@vger.kernel.org Cc: Mimi Zohar , David Howells , James Morris , "Serge E. Hallyn" , "Theodore Y. Ts'o" , Jaegeuk Kim , Kees Cook , linux-integrity@vger.kernel.org, keyrings@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fscrypt@vger.kernel.org List-ID: We now try to acquire the key according to the encryption policy from both key types, 'logon' as well as 'encrypted'. Signed-off-by: André Draszik Cc: Mimi Zohar Cc: David Howells Cc: James Morris Cc: "Serge E. Hallyn" Cc: "Theodore Y. Ts'o" Cc: Jaegeuk Kim Cc: Kees Cook Cc: linux-integrity@vger.kernel.org Cc: keyrings@vger.kernel.org Cc: linux-security-module@vger.kernel.org Cc: linux-fscrypt@vger.kernel.org --- fs/crypto/keyinfo.c | 58 +++++++++++++++++++++++++++++++++++------------------ 1 file changed, 38 insertions(+), 20 deletions(-) diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c index 5e6e846f5a24..023fa19fec48 100644 --- a/fs/crypto/keyinfo.c +++ b/fs/crypto/keyinfo.c @@ -10,6 +10,7 @@ */ #include +#include #include #include #include @@ -66,14 +67,20 @@ static int derive_key_aes(u8 deriving_key[FS_AES_128_ECB_KEY_SIZE], return res; } -static int validate_user_key(struct fscrypt_info *crypt_info, +static inline struct key *fscrypt_get_encrypted_key(const char *sig) +{ + if (IS_ENABLED(CONFIG_ENCRYPTED_KEYS)) + return request_key(&key_type_encrypted, sig, NULL); + return ERR_PTR(-ENOKEY); +} + +static int validate_keyring_key(struct fscrypt_info *crypt_info, struct fscrypt_context *ctx, u8 *raw_key, const char *prefix, int min_keysize) { char *description; struct key *keyring_key; struct fscrypt_key *master_key; - const struct user_key_payload *ukp; int res; description = kasprintf(GFP_NOFS, "%s%*phN", prefix, @@ -83,28 +90,39 @@ static int validate_user_key(struct fscrypt_info *crypt_info, return -ENOMEM; keyring_key = request_key(&key_type_logon, description, NULL); + if (IS_ERR(keyring_key)) + keyring_key = fscrypt_get_encrypted_key(description); kfree(description); if (IS_ERR(keyring_key)) return PTR_ERR(keyring_key); down_read(&keyring_key->sem); - if (keyring_key->type != &key_type_logon) { + if (keyring_key->type == &key_type_logon) { + const struct user_key_payload *ukp; + + ukp = user_key_payload_locked(keyring_key); + if (!ukp) { + /* key was revoked before we acquired its semaphore */ + res = -EKEYREVOKED; + goto out; + } + if (ukp->datalen != sizeof(struct fscrypt_key)) { + res = -EINVAL; + goto out; + } + master_key = (struct fscrypt_key *)ukp->data; + } else if (keyring_key->type == &key_type_encrypted) { + const struct encrypted_key_payload *ekp; + + ekp = keyring_key->payload.data[0]; + master_key = (struct fscrypt_key *)ekp->payload_data; + } else { printk_once(KERN_WARNING - "%s: key type must be logon\n", __func__); + "%s: key type must be logon or encrypted\n", + __func__); res = -ENOKEY; goto out; } - ukp = user_key_payload_locked(keyring_key); - if (!ukp) { - /* key was revoked before we acquired its semaphore */ - res = -EKEYREVOKED; - goto out; - } - if (ukp->datalen != sizeof(struct fscrypt_key)) { - res = -EINVAL; - goto out; - } - master_key = (struct fscrypt_key *)ukp->data; BUILD_BUG_ON(FS_AES_128_ECB_KEY_SIZE != FS_KEY_DERIVATION_NONCE_SIZE); if (master_key->size < min_keysize || master_key->size > FS_MAX_KEY_SIZE @@ -302,12 +320,12 @@ int fscrypt_get_encryption_info(struct inode *inode) if (!raw_key) goto out; - res = validate_user_key(crypt_info, &ctx, raw_key, FS_KEY_DESC_PREFIX, - keysize); + res = validate_keyring_key(crypt_info, &ctx, raw_key, + FS_KEY_DESC_PREFIX, keysize); if (res && inode->i_sb->s_cop->key_prefix) { - int res2 = validate_user_key(crypt_info, &ctx, raw_key, - inode->i_sb->s_cop->key_prefix, - keysize); + int res2 = validate_keyring_key(crypt_info, &ctx, raw_key, + inode->i_sb->s_cop->key_prefix, + keysize); if (res2) { if (res2 == -ENOKEY) res = -ENOKEY; -- 2.15.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f68.google.com ([74.125.82.68]:44019 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933445AbeAJMoX (ORCPT ); Wed, 10 Jan 2018 07:44:23 -0500 From: =?UTF-8?q?Andr=C3=A9=20Draszik?= To: linux-kernel@vger.kernel.org Cc: Mimi Zohar , David Howells , James Morris , "Serge E. Hallyn" , "Theodore Y. Ts'o" , Jaegeuk Kim , Kees Cook , linux-integrity@vger.kernel.org, keyrings@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fscrypt@vger.kernel.org Subject: [PATCH 2/3] fscrypt: add support for the encrypted key type Date: Wed, 10 Jan 2018 12:44:17 +0000 Message-Id: <20180110124418.24385-2-git@andred.net> In-Reply-To: <20180110124418.24385-1-git@andred.net> References: <20180110124418.24385-1-git@andred.net> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-integrity-owner@vger.kernel.org List-ID: We now try to acquire the key according to the encryption policy from both key types, 'logon' as well as 'encrypted'. Signed-off-by: Andre Draszik Cc: Mimi Zohar Cc: David Howells Cc: James Morris Cc: "Serge E. Hallyn" Cc: "Theodore Y. Ts'o" Cc: Jaegeuk Kim Cc: Kees Cook Cc: linux-integrity@vger.kernel.org Cc: keyrings@vger.kernel.org Cc: linux-security-module@vger.kernel.org Cc: linux-fscrypt@vger.kernel.org --- fs/crypto/keyinfo.c | 58 +++++++++++++++++++++++++++++++++++------------------ 1 file changed, 38 insertions(+), 20 deletions(-) diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c index 5e6e846f5a24..023fa19fec48 100644 --- a/fs/crypto/keyinfo.c +++ b/fs/crypto/keyinfo.c @@ -10,6 +10,7 @@ */ #include +#include #include #include #include @@ -66,14 +67,20 @@ static int derive_key_aes(u8 deriving_key[FS_AES_128_ECB_KEY_SIZE], return res; } -static int validate_user_key(struct fscrypt_info *crypt_info, +static inline struct key *fscrypt_get_encrypted_key(const char *sig) +{ + if (IS_ENABLED(CONFIG_ENCRYPTED_KEYS)) + return request_key(&key_type_encrypted, sig, NULL); + return ERR_PTR(-ENOKEY); +} + +static int validate_keyring_key(struct fscrypt_info *crypt_info, struct fscrypt_context *ctx, u8 *raw_key, const char *prefix, int min_keysize) { char *description; struct key *keyring_key; struct fscrypt_key *master_key; - const struct user_key_payload *ukp; int res; description = kasprintf(GFP_NOFS, "%s%*phN", prefix, @@ -83,28 +90,39 @@ static int validate_user_key(struct fscrypt_info *crypt_info, return -ENOMEM; keyring_key = request_key(&key_type_logon, description, NULL); + if (IS_ERR(keyring_key)) + keyring_key = fscrypt_get_encrypted_key(description); kfree(description); if (IS_ERR(keyring_key)) return PTR_ERR(keyring_key); down_read(&keyring_key->sem); - if (keyring_key->type != &key_type_logon) { + if (keyring_key->type == &key_type_logon) { + const struct user_key_payload *ukp; + + ukp = user_key_payload_locked(keyring_key); + if (!ukp) { + /* key was revoked before we acquired its semaphore */ + res = -EKEYREVOKED; + goto out; + } + if (ukp->datalen != sizeof(struct fscrypt_key)) { + res = -EINVAL; + goto out; + } + master_key = (struct fscrypt_key *)ukp->data; + } else if (keyring_key->type == &key_type_encrypted) { + const struct encrypted_key_payload *ekp; + + ekp = keyring_key->payload.data[0]; + master_key = (struct fscrypt_key *)ekp->payload_data; + } else { printk_once(KERN_WARNING - "%s: key type must be logon\n", __func__); + "%s: key type must be logon or encrypted\n", + __func__); res = -ENOKEY; goto out; } - ukp = user_key_payload_locked(keyring_key); - if (!ukp) { - /* key was revoked before we acquired its semaphore */ - res = -EKEYREVOKED; - goto out; - } - if (ukp->datalen != sizeof(struct fscrypt_key)) { - res = -EINVAL; - goto out; - } - master_key = (struct fscrypt_key *)ukp->data; BUILD_BUG_ON(FS_AES_128_ECB_KEY_SIZE != FS_KEY_DERIVATION_NONCE_SIZE); if (master_key->size < min_keysize || master_key->size > FS_MAX_KEY_SIZE @@ -302,12 +320,12 @@ int fscrypt_get_encryption_info(struct inode *inode) if (!raw_key) goto out; - res = validate_user_key(crypt_info, &ctx, raw_key, FS_KEY_DESC_PREFIX, - keysize); + res = validate_keyring_key(crypt_info, &ctx, raw_key, + FS_KEY_DESC_PREFIX, keysize); if (res && inode->i_sb->s_cop->key_prefix) { - int res2 = validate_user_key(crypt_info, &ctx, raw_key, - inode->i_sb->s_cop->key_prefix, - keysize); + int res2 = validate_keyring_key(crypt_info, &ctx, raw_key, + inode->i_sb->s_cop->key_prefix, + keysize); if (res2) { if (res2 == -ENOKEY) res = -ENOKEY; -- 2.15.1 From mboxrd@z Thu Jan 1 00:00:00 1970 From: git@andred.net (=?UTF-8?q?Andr=C3=A9=20Draszik?=) Date: Wed, 10 Jan 2018 12:44:17 +0000 Subject: [PATCH 2/3] fscrypt: add support for the encrypted key type In-Reply-To: <20180110124418.24385-1-git@andred.net> References: <20180110124418.24385-1-git@andred.net> Message-ID: <20180110124418.24385-2-git@andred.net> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org We now try to acquire the key according to the encryption policy from both key types, 'logon' as well as 'encrypted'. Signed-off-by: Andr? Draszik Cc: Mimi Zohar Cc: David Howells Cc: James Morris Cc: "Serge E. Hallyn" Cc: "Theodore Y. Ts'o" Cc: Jaegeuk Kim Cc: Kees Cook Cc: linux-integrity at vger.kernel.org Cc: keyrings at vger.kernel.org Cc: linux-security-module at vger.kernel.org Cc: linux-fscrypt at vger.kernel.org --- fs/crypto/keyinfo.c | 58 +++++++++++++++++++++++++++++++++++------------------ 1 file changed, 38 insertions(+), 20 deletions(-) diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c index 5e6e846f5a24..023fa19fec48 100644 --- a/fs/crypto/keyinfo.c +++ b/fs/crypto/keyinfo.c @@ -10,6 +10,7 @@ */ #include +#include #include #include #include @@ -66,14 +67,20 @@ static int derive_key_aes(u8 deriving_key[FS_AES_128_ECB_KEY_SIZE], return res; } -static int validate_user_key(struct fscrypt_info *crypt_info, +static inline struct key *fscrypt_get_encrypted_key(const char *sig) +{ + if (IS_ENABLED(CONFIG_ENCRYPTED_KEYS)) + return request_key(&key_type_encrypted, sig, NULL); + return ERR_PTR(-ENOKEY); +} + +static int validate_keyring_key(struct fscrypt_info *crypt_info, struct fscrypt_context *ctx, u8 *raw_key, const char *prefix, int min_keysize) { char *description; struct key *keyring_key; struct fscrypt_key *master_key; - const struct user_key_payload *ukp; int res; description = kasprintf(GFP_NOFS, "%s%*phN", prefix, @@ -83,28 +90,39 @@ static int validate_user_key(struct fscrypt_info *crypt_info, return -ENOMEM; keyring_key = request_key(&key_type_logon, description, NULL); + if (IS_ERR(keyring_key)) + keyring_key = fscrypt_get_encrypted_key(description); kfree(description); if (IS_ERR(keyring_key)) return PTR_ERR(keyring_key); down_read(&keyring_key->sem); - if (keyring_key->type != &key_type_logon) { + if (keyring_key->type == &key_type_logon) { + const struct user_key_payload *ukp; + + ukp = user_key_payload_locked(keyring_key); + if (!ukp) { + /* key was revoked before we acquired its semaphore */ + res = -EKEYREVOKED; + goto out; + } + if (ukp->datalen != sizeof(struct fscrypt_key)) { + res = -EINVAL; + goto out; + } + master_key = (struct fscrypt_key *)ukp->data; + } else if (keyring_key->type == &key_type_encrypted) { + const struct encrypted_key_payload *ekp; + + ekp = keyring_key->payload.data[0]; + master_key = (struct fscrypt_key *)ekp->payload_data; + } else { printk_once(KERN_WARNING - "%s: key type must be logon\n", __func__); + "%s: key type must be logon or encrypted\n", + __func__); res = -ENOKEY; goto out; } - ukp = user_key_payload_locked(keyring_key); - if (!ukp) { - /* key was revoked before we acquired its semaphore */ - res = -EKEYREVOKED; - goto out; - } - if (ukp->datalen != sizeof(struct fscrypt_key)) { - res = -EINVAL; - goto out; - } - master_key = (struct fscrypt_key *)ukp->data; BUILD_BUG_ON(FS_AES_128_ECB_KEY_SIZE != FS_KEY_DERIVATION_NONCE_SIZE); if (master_key->size < min_keysize || master_key->size > FS_MAX_KEY_SIZE @@ -302,12 +320,12 @@ int fscrypt_get_encryption_info(struct inode *inode) if (!raw_key) goto out; - res = validate_user_key(crypt_info, &ctx, raw_key, FS_KEY_DESC_PREFIX, - keysize); + res = validate_keyring_key(crypt_info, &ctx, raw_key, + FS_KEY_DESC_PREFIX, keysize); if (res && inode->i_sb->s_cop->key_prefix) { - int res2 = validate_user_key(crypt_info, &ctx, raw_key, - inode->i_sb->s_cop->key_prefix, - keysize); + int res2 = validate_keyring_key(crypt_info, &ctx, raw_key, + inode->i_sb->s_cop->key_prefix, + keysize); if (res2) { if (res2 == -ENOKEY) res = -ENOKEY; -- 2.15.1 -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html