linux-kernel - [RFC 4/4] fs: make fscrypt support a UBIFS config option

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20221110141225.2308856-5-ndevos@redhat.com>
Date:   Thu, 10 Nov 2022 15:12:25 +0100
From:   Niels de Vos <ndevos@...hat.com>
To:     linux-fscrypt@...r.kernel.org, linux-fsdevel@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org, Xiubo Li <xiubli@...hat.com>,
        Marcel Lauhoff <marcel.lauhoff@...e.com>,
        Niels de Vos <ndevos@...hat.com>
Subject: [RFC 4/4] fs: make fscrypt support a UBIFS config option

Add CONFIG_UBIFS_FS_ENCRYPTION as a config option, which depends on the
global CONFIG_FS_ENCRYPTION setting. This makes it possible to opt-out
of fscrypt for UBIFS, while enabling it for others.

Signed-off-by: Niels de Vos <ndevos@...hat.com>
---
 fs/crypto/Kconfig |  1 +
 fs/ubifs/Kconfig  | 14 ++++++++++++--
 fs/ubifs/Makefile |  2 +-
 fs/ubifs/sb.c     |  4 ++--
 fs/ubifs/ubifs.h  |  6 +++---
 5 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/fs/crypto/Kconfig b/fs/crypto/Kconfig
index a809847e820d..2aef21786449 100644
--- a/fs/crypto/Kconfig
+++ b/fs/crypto/Kconfig
@@ -8,6 +8,7 @@ config FS_ENCRYPTION
 	select KEYS
 	imply EXT4_FS_ENCRYPTION
 	imply F2FS_FS_ENCRYPTION
+	imply UBIFS_FS_ENCRYPTION
 	help
 	  Enable encryption of files and directories.  This
 	  feature is similar to ecryptfs, but it is more memory
diff --git a/fs/ubifs/Kconfig b/fs/ubifs/Kconfig
index 45d3d207fb99..886056777d68 100644
--- a/fs/ubifs/Kconfig
+++ b/fs/ubifs/Kconfig
@@ -11,8 +11,6 @@ config UBIFS_FS
 	select CRYPTO_DEFLATE if UBIFS_FS_ZLIB
 	select CRYPTO_ZSTD if UBIFS_FS_ZSTD
 	select CRYPTO_HASH_INFO
-	select UBIFS_FS_XATTR if FS_ENCRYPTION
-	select FS_ENCRYPTION_ALGS if FS_ENCRYPTION
 	depends on MTD_UBI
 	help
 	  UBIFS is a file system for flash devices which works on top of UBI.
@@ -98,4 +96,16 @@ config UBIFS_FS_AUTHENTICATION
 	  sha256, these are not selected automatically since there are many
 	  different options.
 
+config UBIFS_FS_ENCRYPTION
+	bool "UBIFS with support for filesystem encryption"
+	depends on FS_ENCRYPTION
+	select UBIFS_FS_XATTR
+	select FS_ENCRYPTION_ALGS if FS_ENCRYPTION
+	help
+	  Enable encryption of files and directories. This feature is similar
+	  to ecryptfs, but it is more memory efficient since it avoids caching
+          the encrypted and decrypted pages in the page cache.
+
+	  If unsure, say N.
+
 endif # UBIFS_FS
diff --git a/fs/ubifs/Makefile b/fs/ubifs/Makefile
index 314c80b24a76..df49a573f8bd 100644
--- a/fs/ubifs/Makefile
+++ b/fs/ubifs/Makefile
@@ -6,6 +6,6 @@ ubifs-y += tnc.o master.o scan.o replay.o log.o commit.o gc.o orphan.o
 ubifs-y += budget.o find.o tnc_commit.o compress.o lpt.o lprops.o
 ubifs-y += recovery.o ioctl.o lpt_commit.o tnc_misc.o debug.o
 ubifs-y += misc.o sysfs.o
-ubifs-$(CONFIG_FS_ENCRYPTION) += crypto.o
+ubifs-$(CONFIG_UBIFS_FS_ENCRYPTION) += crypto.o
 ubifs-$(CONFIG_UBIFS_FS_XATTR) += xattr.o
 ubifs-$(CONFIG_UBIFS_FS_AUTHENTICATION) += auth.o
diff --git a/fs/ubifs/sb.c b/fs/ubifs/sb.c
index e7693b94e5b5..1eb2a9be1177 100644
--- a/fs/ubifs/sb.c
+++ b/fs/ubifs/sb.c
@@ -746,7 +746,7 @@ int ubifs_read_superblock(struct ubifs_info *c)
 		goto out;
 	}
 
-	if (!IS_ENABLED(CONFIG_FS_ENCRYPTION) && c->encrypted) {
+	if (!IS_ENABLED(CONFIG_UBIFS_FS_ENCRYPTION) && c->encrypted) {
 		ubifs_err(c, "file system contains encrypted files but UBIFS"
 			     " was built without crypto support.");
 		err = -EINVAL;
@@ -932,7 +932,7 @@ int ubifs_enable_encryption(struct ubifs_info *c)
 	int err;
 	struct ubifs_sb_node *sup = c->sup_node;
 
-	if (!IS_ENABLED(CONFIG_FS_ENCRYPTION))
+	if (!IS_ENABLED(CONFIG_UBIFS_FS_ENCRYPTION))
 		return -EOPNOTSUPP;
 
 	if (c->encrypted)
diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h
index 3ef0e9ef5015..e20f3284f504 100644
--- a/fs/ubifs/ubifs.h
+++ b/fs/ubifs/ubifs.h
@@ -33,7 +33,7 @@
 #include <crypto/hash.h>
 #include <crypto/algapi.h>
 
-#ifdef CONFIG_FS_ENCRYPTION
+#ifdef CONFIG_UBIFS_FS_ENCRYPTION
 #define USE_FS_ENCRYPTION
 #endif
 #include <linux/fscrypt.h>
@@ -134,7 +134,7 @@
  */
 #define WORST_COMPR_FACTOR 2
 
-#ifdef CONFIG_FS_ENCRYPTION
+#ifdef CONFIG_UBIFS_FS_ENCRYPTION
 #define UBIFS_CIPHER_BLOCK_SIZE FSCRYPT_CONTENTS_ALIGNMENT
 #else
 #define UBIFS_CIPHER_BLOCK_SIZE 0
@@ -2114,7 +2114,7 @@ void ubifs_sysfs_unregister(struct ubifs_info *c);
 #include "misc.h"
 #include "key.h"
 
-#ifndef CONFIG_FS_ENCRYPTION
+#ifndef CONFIG_UBIFS_FS_ENCRYPTION
 static inline int ubifs_encrypt(const struct inode *inode,
 				struct ubifs_data_node *dn,
 				unsigned int in_len, unsigned int *out_len,
-- 
2.37.3