We now try to acquire the key according to the
encryption policy from both key types, 'logon'
as well as 'encrypted'.
Signed-off-by: André Draszik <g...@andred.net>
Cc: "Theodore Y. Ts'o" <ty...@mit.edu>
Cc: Jaegeuk Kim <jaeg...@kernel.org>
Cc: linux-fscr...@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: Eric Biggers <ebigg...@google.com>
---
changes in v2:
* dropped the previously added 'fscrypt' encrypted-key,
and just use the 'default' format
---
fs/crypto/keyinfo.c | 72 +++++++++++++++++++++++++++++++++++++----------------
1 file changed, 50 insertions(+), 22 deletions(-)
diff --git a/fs/crypto/keyinfo.c b/fs/crypto/keyinfo.c
index 5e6e846f5a24..925af599f954 100644
--- a/fs/crypto/keyinfo.c
+++ b/fs/crypto/keyinfo.c
@@ -10,6 +10,7 @@
*/
#include <keys/user-type.h>
+#include <keys/encrypted-type.h>
#include <linux/scatterlist.h>
#include <linux/ratelimit.h>
#include <crypto/aes.h>
@@ -66,14 +67,20 @@ static int derive_key_aes(u8
deriving_key[FS_AES_128_ECB_KEY_SIZE],
return res;
}
-static int validate_user_key(struct fscrypt_info *crypt_info,
+static inline struct key *fscrypt_get_encrypted_key(const char *sig)
+{
+ if (IS_ENABLED(CONFIG_ENCRYPTED_KEYS))
+ return request_key(&key_type_encrypted, sig, NULL);
+ return ERR_PTR(-ENOKEY);
+}
+
+static int validate_keyring_key(struct fscrypt_info *crypt_info,
struct fscrypt_context *ctx, u8 *raw_key,
const char *prefix, int min_keysize)
{
char *description;
struct key *keyring_key;
- struct fscrypt_key *master_key;
- const struct user_key_payload *ukp;
+ struct fscrypt_key *master_key, master_key_;
int res;
description = kasprintf(GFP_NOFS, "%s%*phN", prefix,
@@ -83,28 +90,45 @@ static int validate_user_key(struct fscrypt_info
*crypt_info,
return -ENOMEM;
keyring_key = request_key(&key_type_logon, description, NULL);
+ if (IS_ERR(keyring_key))
+ keyring_key = fscrypt_get_encrypted_key(description);
kfree(description);
if (IS_ERR(keyring_key))
return PTR_ERR(keyring_key);
down_read(&keyring_key->sem);
- if (keyring_key->type != &key_type_logon) {
+ if (keyring_key->type == &key_type_logon) {
+ const struct user_key_payload *ukp;
+
+ ukp = user_key_payload_locked(keyring_key);
+ if (!ukp) {
+ /* key was revoked before we acquired its semaphore */
+ res = -EKEYREVOKED;
+ goto out;
+ }
+ if (ukp->datalen != sizeof(struct fscrypt_key)) {
+ res = -EINVAL;
+ goto out;
+ }
+ master_key = (struct fscrypt_key *)ukp->data;
+ } else if (keyring_key->type == &key_type_encrypted) {
+ const struct encrypted_key_payload *ekp;
+
+ ekp = keyring_key->payload.data[0];
+ master_key = &master_key_;
+
+ master_key->mode = 0;
+ memcpy (master_key->raw, ekp->decrypted_data,
+ min (sizeof (master_key->raw),
+ (size_t) ekp->decrypted_datalen));
+ master_key->size = ekp->decrypted_datalen;
+ } else {
printk_once(KERN_WARNING
- "%s: key type must be logon\n", __func__);
+ "%s: key type must be logon or encrypted\n",
+ __func__);
res = -ENOKEY;
goto out;
}
- ukp = user_key_payload_locked(keyring_key);
- if (!ukp) {
- /* key was revoked before we acquired its semaphore */
- res = -EKEYREVOKED;
- goto out;
- }
- if (ukp->datalen != sizeof(struct fscrypt_key)) {
- res = -EINVAL;
- goto out;
- }
- master_key = (struct fscrypt_key *)ukp->data;
BUILD_BUG_ON(FS_AES_128_ECB_KEY_SIZE != FS_KEY_DERIVATION_NONCE_SIZE);
if (master_key->size < min_keysize || master_key->size > FS_MAX_KEY_SIZE
@@ -113,9 +137,13 @@ static int validate_user_key(struct fscrypt_info
*crypt_info,
"%s: key size incorrect: %d\n",
__func__, master_key->size);
res = -ENOKEY;
- goto out;
+ goto out_clear_key;
}
res = derive_key_aes(ctx->nonce, master_key, raw_key);
+
+out_clear_key:
+ if (master_key == &master_key_)
+ memzero_explicit(master_key->raw, sizeof (master_key->raw));
out:
up_read(&keyring_key->sem);
key_put(keyring_key);
@@ -302,12 +330,12 @@ int fscrypt_get_encryption_info(struct inode *inode)
if (!raw_key)
goto out;
- res = validate_user_key(crypt_info, &ctx, raw_key, FS_KEY_DESC_PREFIX,
- keysize);
+ res = validate_keyring_key(crypt_info, &ctx, raw_key,
+ FS_KEY_DESC_PREFIX, keysize);
if (res && inode->i_sb->s_cop->key_prefix) {
- int res2 = validate_user_key(crypt_info, &ctx, raw_key,
- inode->i_sb->s_cop->key_prefix,
- keysize);
+ int res2 = validate_keyring_key(crypt_info, &ctx, raw_key,
+ inode->i_sb->s_cop->key_prefix,
+ keysize);
if (res2) {
if (res2 == -ENOKEY)
res = -ENOKEY;
--
2.15.1
