linux-ext4 - Re: [PATCH 4/5] ext4: support direct I/O with fscrypt using blk-crypto

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 9 Jul 2020 15:30:34 -0700
From:   Eric Biggers <ebiggers@...nel.org>
To:     Satya Tangirala <satyat@...gle.com>
Cc:     linux-fscrypt@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        linux-f2fs-devel@...ts.sourceforge.net, linux-ext4@...r.kernel.org
Subject: Re: [PATCH 4/5] ext4: support direct I/O with fscrypt using
 blk-crypto

On Thu, Jul 09, 2020 at 07:47:50PM +0000, Satya Tangirala wrote:
> From: Eric Biggers <ebiggers@...gle.com>
> 
> Wire up ext4 with fscrypt direct I/O support.
> 
> Signed-off-by: Eric Biggers <ebiggers@...gle.com>
> Signed-off-by: Satya Tangirala <satyat@...gle.com>

This commit message could use some more details.  I think it should clarify that
the direct I/O support is limited to cases where the filesystem has been mounted
with '-o inlinecrypt' and CONFIG_BLK_INLINE_ENCRYPTION has been enabled, along
with CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK if hardware support isn't present.

As-is, it sounds a bit over-promising.

Likewise for f2fs.

We need to properly document this too.  At the very least, in the fscrypt patch,
Documentation/filesystems/fscrypt.rst needs to be updated because it currently
says "Direct I/O is not supported on encrypted files."

fscrypt.rst could also use some information about inline encryption.  Currently
inline encryption for fscrypt is only documented in the ext4 and f2fs
documentation in the context of the inlinecrypt mount option.  (Though, this
suggestion applies even without direct I/O support.)

- Eric