shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-05 18:41:58 +09:00
Code Issues Packages Projects Releases Wiki Activity

fscrypt: Restrict access to files protected by FBE [1/1]

Browse Source 
PD#SWPL-130061

Problem:
RDK reference design wants to restrict accessing to files
protected by FBE

Solution:
Only owner of master key is allowed to access encrypted file

Verify:
1. on SC2(ah212) + RDK(firebolt-dunfell) + kernel 5.15

Change-Id: I136bf11ee8ae6e81fb8f6dab2af801a7ff984697
Signed-off-by: Mingyen Hung <mingyen.hung@amlogic.com>
This commit is contained in:
Mingyen Hung
2022-11-08 01:35:29 -08:00
committed by Dongjin Kim
parent a531d58543
commit 82ea56cf8c
3 changed files with 40 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
fs/crypto/fscrypt_private.h
View File

@@ -709,6 +709,9 @@ int fscrypt_derive_dirhash_key(struct fscrypt_info *ci,
void fscrypt_hash_inode_number(struct fscrypt_info *ci,
const struct fscrypt_master_key *mk);
#if IS_ENABLED(CONFIG_AMLOGIC_LINUX_FBE_RDK)
int fscrypt_check_accessibility(struct inode *inode);
#endif
int fscrypt_get_encryption_info(struct inode *inode, bool allow_unsupported);
/**
@@ -728,11 +731,14 @@ static inline int fscrypt_require_key(struct inode *inode)
{
if (IS_ENCRYPTED(inode)) {
int err = fscrypt_get_encryption_info(inode, false);
if (err)
return err;
if (!fscrypt_has_encryption_key(inode))
return -ENOKEY;
#if IS_ENABLED(CONFIG_AMLOGIC_LINUX_FBE_RDK)
if (fscrypt_check_accessibility(inode))
return -EPERM;
#endif
}
return 0;
}

8
fs/crypto/hooks.c
View File

@@ -143,7 +143,15 @@ EXPORT_SYMBOL_GPL(fscrypt_prepare_lookup_partial);
int __fscrypt_prepare_readdir(struct inode *dir)
{
#if IS_ENABLED(CONFIG_AMLOGIC_LINUX_FBE_RDK)
int ret = fscrypt_get_encryption_info(dir, true);
if (fscrypt_check_accessibility(dir))
return -EPERM;
return ret;
#else
return fscrypt_get_encryption_info(dir, true);
#endif
}
EXPORT_SYMBOL_GPL(__fscrypt_prepare_readdir);

25
fs/crypto/keyring.c
View File

@@ -131,6 +131,25 @@ static inline bool valid_key_spec(const struct fscrypt_key_specifier *spec)
return master_key_spec_len(spec) != 0;
}
#if IS_ENABLED(CONFIG_AMLOGIC_LINUX_FBE_RDK)
int fscrypt_check_accessibility(struct inode *inode)
{
struct fscrypt_info *ci = inode->i_crypt_info;
int ret = 0;
if (ci && ci->ci_policy.version == FSCRYPT_POLICY_V2) {
ret = fscrypt_verify_key_added(inode->i_sb,
ci->ci_policy.v2.master_key_identifier);
if (ret) {
fscrypt_err(inode,
"Not owner of master key. Access denied!(%d)", ret);
return -EPERM;
}
}
return ret;
}
#endif
static int fscrypt_user_key_instantiate(struct key *key,
struct key_preparsed_payload *prep)
{
@@ -901,8 +920,14 @@ int fscrypt_verify_key_added(struct super_block *sb,
up_read(&mk->mk_sem);
fscrypt_put_master_key(mk);
out:
#if IS_ENABLED(CONFIG_AMLOGIC_LINUX_FBE_RDK)
/* Make root(uid 0) unable to access other users' file */
/* NOP */
#else
if (err == -ENOKEY && capable(CAP_FOWNER))
err = 0;
#endif
return err;
}