1 /* Large capacity key type
3 * Copyright (C) 2013 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public Licence
8 * as published by the Free Software Foundation; either version
9 * 2 of the Licence, or (at your option) any later version.
12 #include <linux/init.h>
13 #include <linux/seq_file.h>
14 #include <linux/file.h>
15 #include <linux/shmem_fs.h>
16 #include <linux/err.h>
17 #include <linux/scatterlist.h>
18 #include <keys/user-type.h>
19 #include <keys/big_key-type.h>
20 #include <crypto/rng.h>
23 * Layout of key payload words.
28 big_key_path_2nd_part
,
33 * Crypto operation with big_key data
41 * If the data is under this limit, there's no point creating a shm file to
42 * hold it as the permanently resident metadata for the shmem fs will be at
43 * least as large as the data.
45 #define BIG_KEY_FILE_THRESHOLD (sizeof(struct inode) + sizeof(struct dentry))
48 * Key size for big_key data encryption
50 #define ENC_KEY_SIZE 16
53 * big_key defined keys take an arbitrary string as the description and an
54 * arbitrary blob of data as the payload
56 struct key_type key_type_big_key
= {
58 .preparse
= big_key_preparse
,
59 .free_preparse
= big_key_free_preparse
,
60 .instantiate
= generic_key_instantiate
,
61 .revoke
= big_key_revoke
,
62 .destroy
= big_key_destroy
,
63 .describe
= big_key_describe
,
68 * Crypto names for big_key data encryption
70 static const char big_key_rng_name
[] = "stdrng";
71 static const char big_key_alg_name
[] = "ecb(aes)";
74 * Crypto algorithms for big_key data encryption
76 static struct crypto_rng
*big_key_rng
;
77 static struct crypto_blkcipher
*big_key_blkcipher
;
80 * Generate random key to encrypt big_key data
82 static inline int big_key_gen_enckey(u8
*key
)
84 return crypto_rng_get_bytes(big_key_rng
, key
, ENC_KEY_SIZE
);
88 * Encrypt/decrypt big_key data
90 static int big_key_crypt(enum big_key_op op
, u8
*data
, size_t datalen
, u8
*key
)
93 struct scatterlist sgio
;
94 struct blkcipher_desc desc
;
96 if (crypto_blkcipher_setkey(big_key_blkcipher
, key
, ENC_KEY_SIZE
)) {
102 desc
.tfm
= big_key_blkcipher
;
104 sg_init_one(&sgio
, data
, datalen
);
106 if (op
== BIG_KEY_ENC
)
107 ret
= crypto_blkcipher_encrypt(&desc
, &sgio
, &sgio
, datalen
);
109 ret
= crypto_blkcipher_decrypt(&desc
, &sgio
, &sgio
, datalen
);
118 int big_key_preparse(struct key_preparsed_payload
*prep
)
120 struct path
*path
= (struct path
*)&prep
->payload
.data
[big_key_path
];
125 size_t datalen
= prep
->datalen
;
129 if (datalen
<= 0 || datalen
> 1024 * 1024 || !prep
->data
)
132 /* Set an arbitrary quota */
135 prep
->payload
.data
[big_key_len
] = (void *)(unsigned long)datalen
;
137 if (datalen
> BIG_KEY_FILE_THRESHOLD
) {
138 /* Create a shmem file to store the data in. This will permit the data
139 * to be swapped out if needed.
141 * File content is stored encrypted with randomly generated key.
143 size_t enclen
= ALIGN(datalen
, crypto_blkcipher_blocksize(big_key_blkcipher
));
145 /* prepare aligned data to encrypt */
146 data
= kmalloc(enclen
, GFP_KERNEL
);
150 memcpy(data
, prep
->data
, datalen
);
151 memset(data
+ datalen
, 0x00, enclen
- datalen
);
153 /* generate random key */
154 enckey
= kmalloc(ENC_KEY_SIZE
, GFP_KERNEL
);
160 ret
= big_key_gen_enckey(enckey
);
164 /* encrypt aligned data */
165 ret
= big_key_crypt(BIG_KEY_ENC
, data
, enclen
, enckey
);
169 /* save aligned data to file */
170 file
= shmem_kernel_file_setup("", enclen
, 0);
176 written
= kernel_write(file
, data
, enclen
, 0);
177 if (written
!= enclen
) {
184 /* Pin the mount and dentry to the key so that we can open it again
187 prep
->payload
.data
[big_key_data
] = enckey
;
188 *path
= file
->f_path
;
193 /* Just store the data in a buffer */
194 void *data
= kmalloc(datalen
, GFP_KERNEL
);
199 prep
->payload
.data
[big_key_data
] = data
;
200 memcpy(data
, prep
->data
, prep
->datalen
);
214 * Clear preparsement.
216 void big_key_free_preparse(struct key_preparsed_payload
*prep
)
218 if (prep
->datalen
> BIG_KEY_FILE_THRESHOLD
) {
219 struct path
*path
= (struct path
*)&prep
->payload
.data
[big_key_path
];
223 kfree(prep
->payload
.data
[big_key_data
]);
227 * dispose of the links from a revoked keyring
228 * - called with the key sem write-locked
230 void big_key_revoke(struct key
*key
)
232 struct path
*path
= (struct path
*)&key
->payload
.data
[big_key_path
];
234 /* clear the quota */
235 key_payload_reserve(key
, 0);
236 if (key_is_instantiated(key
) &&
237 (size_t)key
->payload
.data
[big_key_len
] > BIG_KEY_FILE_THRESHOLD
)
238 vfs_truncate(path
, 0);
242 * dispose of the data dangling from the corpse of a big_key key
244 void big_key_destroy(struct key
*key
)
246 size_t datalen
= (size_t)key
->payload
.data
[big_key_len
];
248 if (datalen
> BIG_KEY_FILE_THRESHOLD
) {
249 struct path
*path
= (struct path
*)&key
->payload
.data
[big_key_path
];
255 kfree(key
->payload
.data
[big_key_data
]);
256 key
->payload
.data
[big_key_data
] = NULL
;
260 * describe the big_key key
262 void big_key_describe(const struct key
*key
, struct seq_file
*m
)
264 size_t datalen
= (size_t)key
->payload
.data
[big_key_len
];
266 seq_puts(m
, key
->description
);
268 if (key_is_instantiated(key
))
269 seq_printf(m
, ": %zu [%s]",
271 datalen
> BIG_KEY_FILE_THRESHOLD
? "file" : "buff");
276 * - the key's semaphore is read-locked
278 long big_key_read(const struct key
*key
, char __user
*buffer
, size_t buflen
)
280 size_t datalen
= (size_t)key
->payload
.data
[big_key_len
];
283 if (!buffer
|| buflen
< datalen
)
286 if (datalen
> BIG_KEY_FILE_THRESHOLD
) {
287 struct path
*path
= (struct path
*)&key
->payload
.data
[big_key_path
];
290 u8
*enckey
= (u8
*)key
->payload
.data
[big_key_data
];
291 size_t enclen
= ALIGN(datalen
, crypto_blkcipher_blocksize(big_key_blkcipher
));
293 data
= kmalloc(enclen
, GFP_KERNEL
);
297 file
= dentry_open(path
, O_RDONLY
, current_cred());
303 /* read file to kernel and decrypt */
304 ret
= kernel_read(file
, 0, data
, enclen
);
305 if (ret
>= 0 && ret
!= enclen
) {
310 ret
= big_key_crypt(BIG_KEY_DEC
, data
, enclen
, enckey
);
316 /* copy decrypted data to user */
317 if (copy_to_user(buffer
, data
, datalen
) != 0)
326 if (copy_to_user(buffer
, key
->payload
.data
[big_key_data
],
337 static int __init
big_key_init(void)
339 return register_key_type(&key_type_big_key
);
343 * Initialize big_key crypto and RNG algorithms
345 static int __init
big_key_crypto_init(void)
350 big_key_rng
= crypto_alloc_rng(big_key_rng_name
, 0, 0);
351 if (IS_ERR(big_key_rng
)) {
357 ret
= crypto_rng_reset(big_key_rng
, NULL
, crypto_rng_seedsize(big_key_rng
));
361 /* init block cipher */
362 big_key_blkcipher
= crypto_alloc_blkcipher(big_key_alg_name
, 0, 0);
363 if (IS_ERR(big_key_blkcipher
)) {
364 big_key_blkcipher
= NULL
;
372 crypto_free_rng(big_key_rng
);
377 device_initcall(big_key_init
);
378 late_initcall(big_key_crypto_init
);