1 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ 2 /* 3 * fscrypt user API 4 * 5 * These ioctls can be used on filesystems that support fscrypt. See the 6 * "User API" section of Documentation/filesystems/fscrypt.rst. 7 */ 8 #ifndef _UAPI_LINUX_FSCRYPT_H 9 #define _UAPI_LINUX_FSCRYPT_H 10 11 #include <linux/types.h> 12 13 /* Encryption policy flags */ 14 #define FSCRYPT_POLICY_FLAGS_PAD_4 0x00 15 #define FSCRYPT_POLICY_FLAGS_PAD_8 0x01 16 #define FSCRYPT_POLICY_FLAGS_PAD_16 0x02 17 #define FSCRYPT_POLICY_FLAGS_PAD_32 0x03 18 #define FSCRYPT_POLICY_FLAGS_PAD_MASK 0x03 19 #define FSCRYPT_POLICY_FLAG_DIRECT_KEY 0x04 20 #define FSCRYPT_POLICY_FLAGS_VALID 0x07 21 22 /* Encryption algorithms */ 23 #define FSCRYPT_MODE_AES_256_XTS 1 24 #define FSCRYPT_MODE_AES_256_CTS 4 25 #define FSCRYPT_MODE_AES_128_CBC 5 26 #define FSCRYPT_MODE_AES_128_CTS 6 27 #define FSCRYPT_MODE_ADIANTUM 9 28 #define __FSCRYPT_MODE_MAX 9 29 30 /* 31 * Legacy policy version; ad-hoc KDF and no key verification. 32 * For new encrypted directories, use fscrypt_policy_v2 instead. 33 * 34 * Careful: the .version field for this is actually 0, not 1. 35 */ 36 #define FSCRYPT_POLICY_V1 0 37 #define FSCRYPT_KEY_DESCRIPTOR_SIZE 8 38 struct fscrypt_policy_v1 { 39 __u8 version; 40 __u8 contents_encryption_mode; 41 __u8 filenames_encryption_mode; 42 __u8 flags; 43 __u8 master_key_descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE]; 44 }; 45 #define fscrypt_policy fscrypt_policy_v1 46 47 /* 48 * Process-subscribed "logon" key description prefix and payload format. 49 * Deprecated; prefer FS_IOC_ADD_ENCRYPTION_KEY instead. 50 */ 51 #define FSCRYPT_KEY_DESC_PREFIX "fscrypt:" 52 #define FSCRYPT_KEY_DESC_PREFIX_SIZE 8 53 #define FSCRYPT_MAX_KEY_SIZE 64 54 struct fscrypt_key { 55 __u32 mode; 56 __u8 raw[FSCRYPT_MAX_KEY_SIZE]; 57 __u32 size; 58 }; 59 60 /* 61 * New policy version with HKDF and key verification (recommended). 62 */ 63 #define FSCRYPT_POLICY_V2 2 64 #define FSCRYPT_KEY_IDENTIFIER_SIZE 16 65 struct fscrypt_policy_v2 { 66 __u8 version; 67 __u8 contents_encryption_mode; 68 __u8 filenames_encryption_mode; 69 __u8 flags; 70 __u8 __reserved[4]; 71 __u8 master_key_identifier[FSCRYPT_KEY_IDENTIFIER_SIZE]; 72 }; 73 74 /* Struct passed to FS_IOC_GET_ENCRYPTION_POLICY_EX */ 75 struct fscrypt_get_policy_ex_arg { 76 __u64 policy_size; /* input/output */ 77 union { 78 __u8 version; 79 struct fscrypt_policy_v1 v1; 80 struct fscrypt_policy_v2 v2; 81 } policy; /* output */ 82 }; 83 84 /* 85 * v1 policy keys are specified by an arbitrary 8-byte key "descriptor", 86 * matching fscrypt_policy_v1::master_key_descriptor. 87 */ 88 #define FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR 1 89 90 /* 91 * v2 policy keys are specified by a 16-byte key "identifier" which the kernel 92 * calculates as a cryptographic hash of the key itself, 93 * matching fscrypt_policy_v2::master_key_identifier. 94 */ 95 #define FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER 2 96 97 /* 98 * Specifies a key, either for v1 or v2 policies. This doesn't contain the 99 * actual key itself; this is just the "name" of the key. 100 */ 101 struct fscrypt_key_specifier { 102 __u32 type; /* one of FSCRYPT_KEY_SPEC_TYPE_* */ 103 __u32 __reserved; 104 union { 105 __u8 __reserved[32]; /* reserve some extra space */ 106 __u8 descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE]; 107 __u8 identifier[FSCRYPT_KEY_IDENTIFIER_SIZE]; 108 } u; 109 }; 110 111 /* Struct passed to FS_IOC_ADD_ENCRYPTION_KEY */ 112 struct fscrypt_add_key_arg { 113 struct fscrypt_key_specifier key_spec; 114 __u32 raw_size; 115 __u32 __reserved[9]; 116 __u8 raw[]; 117 }; 118 119 /* Struct passed to FS_IOC_REMOVE_ENCRYPTION_KEY */ 120 struct fscrypt_remove_key_arg { 121 struct fscrypt_key_specifier key_spec; 122 #define FSCRYPT_KEY_REMOVAL_STATUS_FLAG_FILES_BUSY 0x00000001 123 #define FSCRYPT_KEY_REMOVAL_STATUS_FLAG_OTHER_USERS 0x00000002 124 __u32 removal_status_flags; /* output */ 125 __u32 __reserved[5]; 126 }; 127 128 /* Struct passed to FS_IOC_GET_ENCRYPTION_KEY_STATUS */ 129 struct fscrypt_get_key_status_arg { 130 /* input */ 131 struct fscrypt_key_specifier key_spec; 132 __u32 __reserved[6]; 133 134 /* output */ 135 #define FSCRYPT_KEY_STATUS_ABSENT 1 136 #define FSCRYPT_KEY_STATUS_PRESENT 2 137 #define FSCRYPT_KEY_STATUS_INCOMPLETELY_REMOVED 3 138 __u32 status; 139 #define FSCRYPT_KEY_STATUS_FLAG_ADDED_BY_SELF 0x00000001 140 __u32 status_flags; 141 __u32 user_count; 142 __u32 __out_reserved[13]; 143 }; 144 145 #define FS_IOC_SET_ENCRYPTION_POLICY _IOR('f', 19, struct fscrypt_policy) 146 #define FS_IOC_GET_ENCRYPTION_PWSALT _IOW('f', 20, __u8[16]) 147 #define FS_IOC_GET_ENCRYPTION_POLICY _IOW('f', 21, struct fscrypt_policy) 148 #define FS_IOC_GET_ENCRYPTION_POLICY_EX _IOWR('f', 22, __u8[9]) /* size + version */ 149 #define FS_IOC_ADD_ENCRYPTION_KEY _IOWR('f', 23, struct fscrypt_add_key_arg) 150 #define FS_IOC_REMOVE_ENCRYPTION_KEY _IOWR('f', 24, struct fscrypt_remove_key_arg) 151 #define FS_IOC_REMOVE_ENCRYPTION_KEY_ALL_USERS _IOWR('f', 25, struct fscrypt_remove_key_arg) 152 #define FS_IOC_GET_ENCRYPTION_KEY_STATUS _IOWR('f', 26, struct fscrypt_get_key_status_arg) 153 154 /**********************************************************************/ 155 156 /* old names; don't add anything new here! */ 157 #ifndef __KERNEL__ 158 #define FS_KEY_DESCRIPTOR_SIZE FSCRYPT_KEY_DESCRIPTOR_SIZE 159 #define FS_POLICY_FLAGS_PAD_4 FSCRYPT_POLICY_FLAGS_PAD_4 160 #define FS_POLICY_FLAGS_PAD_8 FSCRYPT_POLICY_FLAGS_PAD_8 161 #define FS_POLICY_FLAGS_PAD_16 FSCRYPT_POLICY_FLAGS_PAD_16 162 #define FS_POLICY_FLAGS_PAD_32 FSCRYPT_POLICY_FLAGS_PAD_32 163 #define FS_POLICY_FLAGS_PAD_MASK FSCRYPT_POLICY_FLAGS_PAD_MASK 164 #define FS_POLICY_FLAG_DIRECT_KEY FSCRYPT_POLICY_FLAG_DIRECT_KEY 165 #define FS_POLICY_FLAGS_VALID FSCRYPT_POLICY_FLAGS_VALID 166 #define FS_ENCRYPTION_MODE_INVALID 0 /* never used */ 167 #define FS_ENCRYPTION_MODE_AES_256_XTS FSCRYPT_MODE_AES_256_XTS 168 #define FS_ENCRYPTION_MODE_AES_256_GCM 2 /* never used */ 169 #define FS_ENCRYPTION_MODE_AES_256_CBC 3 /* never used */ 170 #define FS_ENCRYPTION_MODE_AES_256_CTS FSCRYPT_MODE_AES_256_CTS 171 #define FS_ENCRYPTION_MODE_AES_128_CBC FSCRYPT_MODE_AES_128_CBC 172 #define FS_ENCRYPTION_MODE_AES_128_CTS FSCRYPT_MODE_AES_128_CTS 173 #define FS_ENCRYPTION_MODE_SPECK128_256_XTS 7 /* removed */ 174 #define FS_ENCRYPTION_MODE_SPECK128_256_CTS 8 /* removed */ 175 #define FS_ENCRYPTION_MODE_ADIANTUM FSCRYPT_MODE_ADIANTUM 176 #define FS_KEY_DESC_PREFIX FSCRYPT_KEY_DESC_PREFIX 177 #define FS_KEY_DESC_PREFIX_SIZE FSCRYPT_KEY_DESC_PREFIX_SIZE 178 #define FS_MAX_KEY_SIZE FSCRYPT_MAX_KEY_SIZE 179 #endif /* !__KERNEL__ */ 180 181 #endif /* _UAPI_LINUX_FSCRYPT_H */ 182