diff options
| author | Eric Biggers <ebiggers@google.com> | 2019-08-05 05:35:48 +0300 |
|---|---|---|
| committer | Eric Biggers <ebiggers@google.com> | 2019-08-13 05:18:50 +0300 |
| commit | 5ab7189a31bad40e4b44020cae6e56c8074721a1 (patch) | |
| tree | d9cea4d978ce732bd9e97ded7782ebb2ec600829 /fs/crypto/policy.c | |
| parent | 78a1b96bcf7a0721c7852bb1475218c3cbef884a (diff) | |
| download | linux-5ab7189a31bad40e4b44020cae6e56c8074721a1.tar.xz | |
fscrypt: require that key be added when setting a v2 encryption policy
By looking up the master keys in a filesystem-level keyring rather than
in the calling processes' key hierarchy, it becomes possible for a user
to set an encryption policy which refers to some key they don't actually
know, then encrypt their files using that key. Cryptographically this
isn't much of a problem, but the semantics of this would be a bit weird.
Thus, enforce that a v2 encryption policy can only be set if the user
has previously added the key, or has capable(CAP_FOWNER).
We tolerate that this problem will continue to exist for v1 encryption
policies, however; there is no way around that.
Reviewed-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Diffstat (limited to 'fs/crypto/policy.c')
| -rw-r--r-- | fs/crypto/policy.c | 14 |
1 files changed, 13 insertions, 1 deletions
diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c index 0141d338c1fd..4072ba644595 100644 --- a/fs/crypto/policy.c +++ b/fs/crypto/policy.c @@ -233,11 +233,13 @@ static int set_encryption_policy(struct inode *inode, { union fscrypt_context ctx; int ctxsize; + int err; if (!fscrypt_supported_policy(policy, inode)) return -EINVAL; - if (policy->version == FSCRYPT_POLICY_V1) { + switch (policy->version) { + case FSCRYPT_POLICY_V1: /* * The original encryption policy version provided no way of * verifying that the correct master key was supplied, which was @@ -251,6 +253,16 @@ static int set_encryption_policy(struct inode *inode, */ pr_warn_once("%s (pid %d) is setting deprecated v1 encryption policy; recommend upgrading to v2.\n", current->comm, current->pid); + break; + case FSCRYPT_POLICY_V2: + err = fscrypt_verify_key_added(inode->i_sb, + policy->v2.master_key_identifier); + if (err) + return err; + break; + default: + WARN_ON(1); + return -EINVAL; } ctxsize = fscrypt_new_context_from_policy(&ctx, policy); |