198 lines · c
1/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */2/*3 * fscrypt user API4 *5 * These ioctls can be used on filesystems that support fscrypt. See the6 * "User API" section of Documentation/filesystems/fscrypt.rst.7 */8#ifndef _UAPI_LINUX_FSCRYPT_H9#define _UAPI_LINUX_FSCRYPT_H10 11#include <linux/ioctl.h>12#include <linux/types.h>13 14/* Encryption policy flags */15#define FSCRYPT_POLICY_FLAGS_PAD_4 0x0016#define FSCRYPT_POLICY_FLAGS_PAD_8 0x0117#define FSCRYPT_POLICY_FLAGS_PAD_16 0x0218#define FSCRYPT_POLICY_FLAGS_PAD_32 0x0319#define FSCRYPT_POLICY_FLAGS_PAD_MASK 0x0320#define FSCRYPT_POLICY_FLAG_DIRECT_KEY 0x0421#define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_64 0x0822#define FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32 0x1023 24/* Encryption algorithms */25#define FSCRYPT_MODE_AES_256_XTS 126#define FSCRYPT_MODE_AES_256_CTS 427#define FSCRYPT_MODE_AES_128_CBC 528#define FSCRYPT_MODE_AES_128_CTS 629#define FSCRYPT_MODE_SM4_XTS 730#define FSCRYPT_MODE_SM4_CTS 831#define FSCRYPT_MODE_ADIANTUM 932#define FSCRYPT_MODE_AES_256_HCTR2 1033/* If adding a mode number > 10, update FSCRYPT_MODE_MAX in fscrypt_private.h */34 35/*36 * Legacy policy version; ad-hoc KDF and no key verification.37 * For new encrypted directories, use fscrypt_policy_v2 instead.38 *39 * Careful: the .version field for this is actually 0, not 1.40 */41#define FSCRYPT_POLICY_V1 042#define FSCRYPT_KEY_DESCRIPTOR_SIZE 843struct fscrypt_policy_v1 {44 __u8 version;45 __u8 contents_encryption_mode;46 __u8 filenames_encryption_mode;47 __u8 flags;48 __u8 master_key_descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE];49};50 51/*52 * Process-subscribed "logon" key description prefix and payload format.53 * Deprecated; prefer FS_IOC_ADD_ENCRYPTION_KEY instead.54 */55#define FSCRYPT_KEY_DESC_PREFIX "fscrypt:"56#define FSCRYPT_KEY_DESC_PREFIX_SIZE 857#define FSCRYPT_MAX_KEY_SIZE 6458struct fscrypt_key {59 __u32 mode;60 __u8 raw[FSCRYPT_MAX_KEY_SIZE];61 __u32 size;62};63 64/*65 * New policy version with HKDF and key verification (recommended).66 */67#define FSCRYPT_POLICY_V2 268#define FSCRYPT_KEY_IDENTIFIER_SIZE 1669struct fscrypt_policy_v2 {70 __u8 version;71 __u8 contents_encryption_mode;72 __u8 filenames_encryption_mode;73 __u8 flags;74 __u8 log2_data_unit_size;75 __u8 __reserved[3];76 __u8 master_key_identifier[FSCRYPT_KEY_IDENTIFIER_SIZE];77};78 79/* Struct passed to FS_IOC_GET_ENCRYPTION_POLICY_EX */80struct fscrypt_get_policy_ex_arg {81 __u64 policy_size; /* input/output */82 union {83 __u8 version;84 struct fscrypt_policy_v1 v1;85 struct fscrypt_policy_v2 v2;86 } policy; /* output */87};88 89/*90 * v1 policy keys are specified by an arbitrary 8-byte key "descriptor",91 * matching fscrypt_policy_v1::master_key_descriptor.92 */93#define FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR 194 95/*96 * v2 policy keys are specified by a 16-byte key "identifier" which the kernel97 * calculates as a cryptographic hash of the key itself,98 * matching fscrypt_policy_v2::master_key_identifier.99 */100#define FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER 2101 102/*103 * Specifies a key, either for v1 or v2 policies. This doesn't contain the104 * actual key itself; this is just the "name" of the key.105 */106struct fscrypt_key_specifier {107 __u32 type; /* one of FSCRYPT_KEY_SPEC_TYPE_* */108 __u32 __reserved;109 union {110 __u8 __reserved[32]; /* reserve some extra space */111 __u8 descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE];112 __u8 identifier[FSCRYPT_KEY_IDENTIFIER_SIZE];113 } u;114};115 116/*117 * Payload of Linux keyring key of type "fscrypt-provisioning", referenced by118 * fscrypt_add_key_arg::key_id as an alternative to fscrypt_add_key_arg::raw.119 */120struct fscrypt_provisioning_key_payload {121 __u32 type;122 __u32 __reserved;123 __u8 raw[];124};125 126/* Struct passed to FS_IOC_ADD_ENCRYPTION_KEY */127struct fscrypt_add_key_arg {128 struct fscrypt_key_specifier key_spec;129 __u32 raw_size;130 __u32 key_id;131 __u32 __reserved[8];132 __u8 raw[];133};134 135/* Struct passed to FS_IOC_REMOVE_ENCRYPTION_KEY */136struct fscrypt_remove_key_arg {137 struct fscrypt_key_specifier key_spec;138#define FSCRYPT_KEY_REMOVAL_STATUS_FLAG_FILES_BUSY 0x00000001139#define FSCRYPT_KEY_REMOVAL_STATUS_FLAG_OTHER_USERS 0x00000002140 __u32 removal_status_flags; /* output */141 __u32 __reserved[5];142};143 144/* Struct passed to FS_IOC_GET_ENCRYPTION_KEY_STATUS */145struct fscrypt_get_key_status_arg {146 /* input */147 struct fscrypt_key_specifier key_spec;148 __u32 __reserved[6];149 150 /* output */151#define FSCRYPT_KEY_STATUS_ABSENT 1152#define FSCRYPT_KEY_STATUS_PRESENT 2153#define FSCRYPT_KEY_STATUS_INCOMPLETELY_REMOVED 3154 __u32 status;155#define FSCRYPT_KEY_STATUS_FLAG_ADDED_BY_SELF 0x00000001156 __u32 status_flags;157 __u32 user_count;158 __u32 __out_reserved[13];159};160 161#define FS_IOC_SET_ENCRYPTION_POLICY _IOR('f', 19, struct fscrypt_policy_v1)162#define FS_IOC_GET_ENCRYPTION_PWSALT _IOW('f', 20, __u8[16])163#define FS_IOC_GET_ENCRYPTION_POLICY _IOW('f', 21, struct fscrypt_policy_v1)164#define FS_IOC_GET_ENCRYPTION_POLICY_EX _IOWR('f', 22, __u8[9]) /* size + version */165#define FS_IOC_ADD_ENCRYPTION_KEY _IOWR('f', 23, struct fscrypt_add_key_arg)166#define FS_IOC_REMOVE_ENCRYPTION_KEY _IOWR('f', 24, struct fscrypt_remove_key_arg)167#define FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS _IOWR('f', 25, struct fscrypt_remove_key_arg)168#define FS_IOC_GET_ENCRYPTION_KEY_STATUS _IOWR('f', 26, struct fscrypt_get_key_status_arg)169#define FS_IOC_GET_ENCRYPTION_NONCE _IOR('f', 27, __u8[16])170 171/**********************************************************************/172 173/* old names; don't add anything new here! */174#ifndef __KERNEL__175#define fscrypt_policy fscrypt_policy_v1176#define FS_KEY_DESCRIPTOR_SIZE FSCRYPT_KEY_DESCRIPTOR_SIZE177#define FS_POLICY_FLAGS_PAD_4 FSCRYPT_POLICY_FLAGS_PAD_4178#define FS_POLICY_FLAGS_PAD_8 FSCRYPT_POLICY_FLAGS_PAD_8179#define FS_POLICY_FLAGS_PAD_16 FSCRYPT_POLICY_FLAGS_PAD_16180#define FS_POLICY_FLAGS_PAD_32 FSCRYPT_POLICY_FLAGS_PAD_32181#define FS_POLICY_FLAGS_PAD_MASK FSCRYPT_POLICY_FLAGS_PAD_MASK182#define FS_POLICY_FLAG_DIRECT_KEY FSCRYPT_POLICY_FLAG_DIRECT_KEY183#define FS_POLICY_FLAGS_VALID 0x07 /* contains old flags only */184#define FS_ENCRYPTION_MODE_INVALID 0 /* never used */185#define FS_ENCRYPTION_MODE_AES_256_XTS FSCRYPT_MODE_AES_256_XTS186#define FS_ENCRYPTION_MODE_AES_256_GCM 2 /* never used */187#define FS_ENCRYPTION_MODE_AES_256_CBC 3 /* never used */188#define FS_ENCRYPTION_MODE_AES_256_CTS FSCRYPT_MODE_AES_256_CTS189#define FS_ENCRYPTION_MODE_AES_128_CBC FSCRYPT_MODE_AES_128_CBC190#define FS_ENCRYPTION_MODE_AES_128_CTS FSCRYPT_MODE_AES_128_CTS191#define FS_ENCRYPTION_MODE_ADIANTUM FSCRYPT_MODE_ADIANTUM192#define FS_KEY_DESC_PREFIX FSCRYPT_KEY_DESC_PREFIX193#define FS_KEY_DESC_PREFIX_SIZE FSCRYPT_KEY_DESC_PREFIX_SIZE194#define FS_MAX_KEY_SIZE FSCRYPT_MAX_KEY_SIZE195#endif /* !__KERNEL__ */196 197#endif /* _UAPI_LINUX_FSCRYPT_H */198