7a52021908
commit 1b53cf9815bb4744958d41f3795d5d5a1d365e2d upstream.
Filesystem encryption ostensibly supported revoking a keyring key that
had been used to "unlock" encrypted files, causing those files to become
"locked" again. This was, however, buggy for several reasons, the most
severe of which was that when key revocation happened to be detected for
an inode, its fscrypt_info was immediately freed, even while other
threads could be using it for encryption or decryption concurrently.
This could be exploited to crash the kernel or worse.
This patch fixes the use-after-free by removing the code which detects
the keyring key having been revoked, invalidated, or expired. Instead,
an encrypted inode that is "unlocked" now simply remains unlocked until
it is evicted from memory. Note that this is no worse than the case for
block device-level encryption, e.g. dm-crypt, and it still remains
possible for a privileged user to evict unused pages, inodes, and
dentries by running 'sync; echo 3 > /proc/sys/vm/drop_caches', or by
simply unmounting the filesystem. In fact, one of those actions was
already needed anyway for key revocation to work even somewhat sanely.
This change is not expected to break any applications.
In the future I'd like to implement a real API for fscrypt key
revocation that interacts sanely with ongoing filesystem operations ---
waiting for existing operations to complete and blocking new operations,
and invalidating and sanitizing key material and plaintext from the VFS
caches. But this is a hard problem, and for now this bug must be fixed.
This bug affected almost all versions of ext4, f2fs, and ubifs
encryption, and it was potentially reachable in any kernel configured
with encryption support (CONFIG_EXT4_ENCRYPTION=y,
CONFIG_EXT4_FS_ENCRYPTION=y, CONFIG_F2FS_FS_ENCRYPTION=y, or
CONFIG_UBIFS_FS_ENCRYPTION=y). Note that older kernels did not use the
shared fs/crypto/ code, but due to the potential security implications
of this bug, it may still be worthwhile to backport this fix to them.
Fixes: b7236e21d5 ("ext4 crypto: reorganize how we store keys in the inode")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Acked-by: Michael Halcrow <mhalcrow@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
158 lines
3.9 KiB
C
158 lines
3.9 KiB
C
/*
|
|
* linux/fs/ext4/ext4_crypto.h
|
|
*
|
|
* Copyright (C) 2015, Google, Inc.
|
|
*
|
|
* This contains encryption header content for ext4
|
|
*
|
|
* Written by Michael Halcrow, 2015.
|
|
*/
|
|
|
|
#ifndef _EXT4_CRYPTO_H
|
|
#define _EXT4_CRYPTO_H
|
|
|
|
#include <linux/fs.h>
|
|
|
|
#define EXT4_KEY_DESCRIPTOR_SIZE 8
|
|
|
|
/* Policy provided via an ioctl on the topmost directory */
|
|
struct ext4_encryption_policy {
|
|
char version;
|
|
char contents_encryption_mode;
|
|
char filenames_encryption_mode;
|
|
char flags;
|
|
char master_key_descriptor[EXT4_KEY_DESCRIPTOR_SIZE];
|
|
} __attribute__((__packed__));
|
|
|
|
#define EXT4_ENCRYPTION_CONTEXT_FORMAT_V1 1
|
|
#define EXT4_KEY_DERIVATION_NONCE_SIZE 16
|
|
|
|
#define EXT4_POLICY_FLAGS_PAD_4 0x00
|
|
#define EXT4_POLICY_FLAGS_PAD_8 0x01
|
|
#define EXT4_POLICY_FLAGS_PAD_16 0x02
|
|
#define EXT4_POLICY_FLAGS_PAD_32 0x03
|
|
#define EXT4_POLICY_FLAGS_PAD_MASK 0x03
|
|
#define EXT4_POLICY_FLAGS_VALID 0x03
|
|
|
|
/**
|
|
* Encryption context for inode
|
|
*
|
|
* Protector format:
|
|
* 1 byte: Protector format (1 = this version)
|
|
* 1 byte: File contents encryption mode
|
|
* 1 byte: File names encryption mode
|
|
* 1 byte: Reserved
|
|
* 8 bytes: Master Key descriptor
|
|
* 16 bytes: Encryption Key derivation nonce
|
|
*/
|
|
struct ext4_encryption_context {
|
|
char format;
|
|
char contents_encryption_mode;
|
|
char filenames_encryption_mode;
|
|
char flags;
|
|
char master_key_descriptor[EXT4_KEY_DESCRIPTOR_SIZE];
|
|
char nonce[EXT4_KEY_DERIVATION_NONCE_SIZE];
|
|
} __attribute__((__packed__));
|
|
|
|
/* Encryption parameters */
|
|
#define EXT4_XTS_TWEAK_SIZE 16
|
|
#define EXT4_AES_128_ECB_KEY_SIZE 16
|
|
#define EXT4_AES_256_GCM_KEY_SIZE 32
|
|
#define EXT4_AES_256_CBC_KEY_SIZE 32
|
|
#define EXT4_AES_256_CTS_KEY_SIZE 32
|
|
#define EXT4_AES_256_XTS_KEY_SIZE 64
|
|
#define EXT4_MAX_KEY_SIZE 64
|
|
|
|
#define EXT4_KEY_DESC_PREFIX "ext4:"
|
|
#define EXT4_KEY_DESC_PREFIX_SIZE 5
|
|
|
|
/* This is passed in from userspace into the kernel keyring */
|
|
struct ext4_encryption_key {
|
|
__u32 mode;
|
|
char raw[EXT4_MAX_KEY_SIZE];
|
|
__u32 size;
|
|
} __attribute__((__packed__));
|
|
|
|
struct ext4_crypt_info {
|
|
char ci_data_mode;
|
|
char ci_filename_mode;
|
|
char ci_flags;
|
|
struct crypto_ablkcipher *ci_ctfm;
|
|
char ci_master_key[EXT4_KEY_DESCRIPTOR_SIZE];
|
|
};
|
|
|
|
#define EXT4_CTX_REQUIRES_FREE_ENCRYPT_FL 0x00000001
|
|
#define EXT4_WRITE_PATH_FL 0x00000002
|
|
|
|
struct ext4_crypto_ctx {
|
|
union {
|
|
struct {
|
|
struct page *bounce_page; /* Ciphertext page */
|
|
struct page *control_page; /* Original page */
|
|
} w;
|
|
struct {
|
|
struct bio *bio;
|
|
struct work_struct work;
|
|
} r;
|
|
struct list_head free_list; /* Free list */
|
|
};
|
|
char flags; /* Flags */
|
|
char mode; /* Encryption mode for tfm */
|
|
};
|
|
|
|
struct ext4_completion_result {
|
|
struct completion completion;
|
|
int res;
|
|
};
|
|
|
|
#define DECLARE_EXT4_COMPLETION_RESULT(ecr) \
|
|
struct ext4_completion_result ecr = { \
|
|
COMPLETION_INITIALIZER((ecr).completion), 0 }
|
|
|
|
static inline int ext4_encryption_key_size(int mode)
|
|
{
|
|
switch (mode) {
|
|
case EXT4_ENCRYPTION_MODE_AES_256_XTS:
|
|
return EXT4_AES_256_XTS_KEY_SIZE;
|
|
case EXT4_ENCRYPTION_MODE_AES_256_GCM:
|
|
return EXT4_AES_256_GCM_KEY_SIZE;
|
|
case EXT4_ENCRYPTION_MODE_AES_256_CBC:
|
|
return EXT4_AES_256_CBC_KEY_SIZE;
|
|
case EXT4_ENCRYPTION_MODE_AES_256_CTS:
|
|
return EXT4_AES_256_CTS_KEY_SIZE;
|
|
default:
|
|
BUG();
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
#define EXT4_FNAME_NUM_SCATTER_ENTRIES 4
|
|
#define EXT4_CRYPTO_BLOCK_SIZE 16
|
|
#define EXT4_FNAME_CRYPTO_DIGEST_SIZE 32
|
|
|
|
struct ext4_str {
|
|
unsigned char *name;
|
|
u32 len;
|
|
};
|
|
|
|
/**
|
|
* For encrypted symlinks, the ciphertext length is stored at the beginning
|
|
* of the string in little-endian format.
|
|
*/
|
|
struct ext4_encrypted_symlink_data {
|
|
__le16 len;
|
|
char encrypted_path[1];
|
|
} __attribute__((__packed__));
|
|
|
|
/**
|
|
* This function is used to calculate the disk space required to
|
|
* store a filename of length l in encrypted symlink format.
|
|
*/
|
|
static inline u32 encrypted_symlink_data_len(u32 l)
|
|
{
|
|
if (l < EXT4_CRYPTO_BLOCK_SIZE)
|
|
l = EXT4_CRYPTO_BLOCK_SIZE;
|
|
return (l + sizeof(struct ext4_encrypted_symlink_data) - 1);
|
|
}
|
|
|
|
#endif /* _EXT4_CRYPTO_H */
|