lkml.org 
[lkml]   [2008]   [Nov]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[PATCH 5/5] eCryptfs: Filename Encryption: mount option
    Enable mount-wide filename encryption by providing the Filename
    Encryption Key (FNEK) signature as a mount option. Note that the
    ecryptfs-utils userspace package versions 61 or later support
    this option.

    Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com>
    ---
    fs/ecryptfs/main.c | 126 ++++++++++++++++++++++++++++++++++++++++-----------
    1 files changed, 99 insertions(+), 27 deletions(-)

    diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
    index fd63071..789cf2e 100644
    --- a/fs/ecryptfs/main.c
    +++ b/fs/ecryptfs/main.c
    @@ -206,7 +206,9 @@ enum { ecryptfs_opt_sig, ecryptfs_opt_ecryptfs_sig,
    ecryptfs_opt_cipher, ecryptfs_opt_ecryptfs_cipher,
    ecryptfs_opt_ecryptfs_key_bytes,
    ecryptfs_opt_passthrough, ecryptfs_opt_xattr_metadata,
    - ecryptfs_opt_encrypted_view, ecryptfs_opt_err };
    + ecryptfs_opt_encrypted_view, ecryptfs_opt_fnek_sig,
    + ecryptfs_opt_fn_cipher, ecryptfs_opt_fn_cipher_key_bytes,
    + ecryptfs_opt_err };

    static const match_table_t tokens = {
    {ecryptfs_opt_sig, "sig=%s"},
    @@ -217,6 +219,9 @@ static const match_table_t tokens = {
    {ecryptfs_opt_passthrough, "ecryptfs_passthrough"},
    {ecryptfs_opt_xattr_metadata, "ecryptfs_xattr_metadata"},
    {ecryptfs_opt_encrypted_view, "ecryptfs_encrypted_view"},
    + {ecryptfs_opt_fnek_sig, "ecryptfs_fnek_sig=%s"},
    + {ecryptfs_opt_fn_cipher, "ecryptfs_fn_cipher=%s"},
    + {ecryptfs_opt_fn_cipher_key_bytes, "ecryptfs_fn_key_bytes=%u"},
    {ecryptfs_opt_err, NULL}
    };

    @@ -281,8 +286,11 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
    int rc = 0;
    int sig_set = 0;
    int cipher_name_set = 0;
    + int fn_cipher_name_set = 0;
    int cipher_key_bytes;
    int cipher_key_bytes_set = 0;
    + int fn_cipher_key_bytes;
    + int fn_cipher_key_bytes_set = 0;
    struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
    &ecryptfs_superblock_to_private(sb)->mount_crypt_stat;
    substring_t args[MAX_OPT_ARGS];
    @@ -290,7 +298,12 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
    char *sig_src;
    char *cipher_name_dst;
    char *cipher_name_src;
    + char *fn_cipher_name_dst;
    + char *fn_cipher_name_src;
    + char *fnek_dst;
    + char *fnek_src;
    char *cipher_key_bytes_src;
    + char *fn_cipher_key_bytes_src;

    if (!options) {
    rc = -EINVAL;
    @@ -322,10 +335,7 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
    global_default_cipher_name;
    strncpy(cipher_name_dst, cipher_name_src,
    ECRYPTFS_MAX_CIPHER_NAME_SIZE);
    - ecryptfs_printk(KERN_DEBUG,
    - "The mount_crypt_stat "
    - "global_default_cipher_name set to: "
    - "[%s]\n", cipher_name_dst);
    + cipher_name_dst[ECRYPTFS_MAX_CIPHER_NAME_SIZE] = '\0';
    cipher_name_set = 1;
    break;
    case ecryptfs_opt_ecryptfs_key_bytes:
    @@ -335,11 +345,6 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
    &cipher_key_bytes_src, 0);
    mount_crypt_stat->global_default_cipher_key_size =
    cipher_key_bytes;
    - ecryptfs_printk(KERN_DEBUG,
    - "The mount_crypt_stat "
    - "global_default_cipher_key_size "
    - "set to: [%d]\n", mount_crypt_stat->
    - global_default_cipher_key_size);
    cipher_key_bytes_set = 1;
    break;
    case ecryptfs_opt_passthrough:
    @@ -356,11 +361,51 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
    mount_crypt_stat->flags |=
    ECRYPTFS_ENCRYPTED_VIEW_ENABLED;
    break;
    + case ecryptfs_opt_fnek_sig:
    + fnek_src = args[0].from;
    + fnek_dst =
    + mount_crypt_stat->global_default_fnek_sig;
    + strncpy(fnek_dst, fnek_src, ECRYPTFS_SIG_SIZE_HEX);
    + mount_crypt_stat->global_default_fnek_sig[
    + ECRYPTFS_SIG_SIZE_HEX] = '\0';
    + rc = ecryptfs_add_global_auth_tok(
    + mount_crypt_stat,
    + mount_crypt_stat->global_default_fnek_sig);
    + if (rc) {
    + printk(KERN_ERR "Error attempting to register "
    + "global fnek sig [%s]; rc = [%d]\n",
    + mount_crypt_stat->global_default_fnek_sig,
    + rc);
    + goto out;
    + }
    + mount_crypt_stat->flags |=
    + (ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES
    + | ECRYPTFS_GLOBAL_ENCFN_USE_MOUNT_FNEK);
    + break;
    + case ecryptfs_opt_fn_cipher:
    + fn_cipher_name_src = args[0].from;
    + fn_cipher_name_dst =
    + mount_crypt_stat->global_default_fn_cipher_name;
    + strncpy(fn_cipher_name_dst, fn_cipher_name_src,
    + ECRYPTFS_MAX_CIPHER_NAME_SIZE);
    + mount_crypt_stat->global_default_fn_cipher_name[
    + ECRYPTFS_MAX_CIPHER_NAME_SIZE] = '\0';
    + fn_cipher_name_set = 1;
    + break;
    + case ecryptfs_opt_fn_cipher_key_bytes:
    + fn_cipher_key_bytes_src = args[0].from;
    + fn_cipher_key_bytes =
    + (int)simple_strtol(fn_cipher_key_bytes_src,
    + &fn_cipher_key_bytes_src, 0);
    + mount_crypt_stat->global_default_fn_cipher_key_bytes =
    + fn_cipher_key_bytes;
    + fn_cipher_key_bytes_set = 1;
    + break;
    case ecryptfs_opt_err:
    default:
    - ecryptfs_printk(KERN_WARNING,
    - "eCryptfs: unrecognized option '%s'\n",
    - p);
    + printk(KERN_WARNING
    + "%s: eCryptfs: unrecognized option [%s]\n",
    + __func__, p);
    }
    }
    if (!sig_set) {
    @@ -374,33 +419,60 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options)
    int cipher_name_len = strlen(ECRYPTFS_DEFAULT_CIPHER);

    BUG_ON(cipher_name_len >= ECRYPTFS_MAX_CIPHER_NAME_SIZE);
    -
    strcpy(mount_crypt_stat->global_default_cipher_name,
    ECRYPTFS_DEFAULT_CIPHER);
    }
    - if (!cipher_key_bytes_set) {
    + if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
    + && !fn_cipher_name_set)
    + strcpy(mount_crypt_stat->global_default_fn_cipher_name,
    + mount_crypt_stat->global_default_cipher_name);
    + if (!cipher_key_bytes_set)
    mount_crypt_stat->global_default_cipher_key_size = 0;
    - }
    + if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
    + && !fn_cipher_key_bytes_set)
    + mount_crypt_stat->global_default_fn_cipher_key_bytes =
    + mount_crypt_stat->global_default_cipher_key_size;
    mutex_lock(&key_tfm_list_mutex);
    if (!ecryptfs_tfm_exists(mount_crypt_stat->global_default_cipher_name,
    - NULL))
    + NULL)) {
    rc = ecryptfs_add_new_key_tfm(
    NULL, mount_crypt_stat->global_default_cipher_name,
    mount_crypt_stat->global_default_cipher_key_size);
    - mutex_unlock(&key_tfm_list_mutex);
    - if (rc) {
    - printk(KERN_ERR "Error attempting to initialize cipher with "
    - "name = [%s] and key size = [%td]; rc = [%d]\n",
    - mount_crypt_stat->global_default_cipher_name,
    - mount_crypt_stat->global_default_cipher_key_size, rc);
    - rc = -EINVAL;
    - goto out;
    + if (rc) {
    + printk(KERN_ERR "Error attempting to initialize "
    + "cipher with name = [%s] and key size = [%td]; "
    + "rc = [%d]\n",
    + mount_crypt_stat->global_default_cipher_name,
    + mount_crypt_stat->global_default_cipher_key_size,
    + rc);
    + rc = -EINVAL;
    + mutex_unlock(&key_tfm_list_mutex);
    + goto out;
    + }
    }
    + if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
    + && !ecryptfs_tfm_exists(
    + mount_crypt_stat->global_default_fn_cipher_name, NULL)) {
    + rc = ecryptfs_add_new_key_tfm(
    + NULL, mount_crypt_stat->global_default_fn_cipher_name,
    + mount_crypt_stat->global_default_fn_cipher_key_bytes);
    + if (rc) {
    + printk(KERN_ERR "Error attempting to initialize "
    + "cipher with name = [%s] and key size = [%td]; "
    + "rc = [%d]\n",
    + mount_crypt_stat->global_default_fn_cipher_name,
    + mount_crypt_stat->global_default_fn_cipher_key_bytes,
    + rc);
    + rc = -EINVAL;
    + mutex_unlock(&key_tfm_list_mutex);
    + goto out;
    + }
    + }
    + mutex_unlock(&key_tfm_list_mutex);
    rc = ecryptfs_init_global_auth_toks(mount_crypt_stat);
    - if (rc) {
    + if (rc)
    printk(KERN_WARNING "One or more global auth toks could not "
    "properly register; rc = [%d]\n", rc);
    - }
    out:
    return rc;
    }
    --
    1.5.3.6


    \
     
     \ /
      Last update: 2008-11-04 22:45    [W:0.067 / U:119.844 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site