From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932368AbcHIR30 (ORCPT ); Tue, 9 Aug 2016 13:29:26 -0400 Received: from mail-ve1eur01on0114.outbound.protection.outlook.com ([104.47.1.114]:43264 "EHLO EUR01-VE1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S932194AbcHIR3Y (ORCPT ); Tue, 9 Aug 2016 13:29:24 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=aryabinin@virtuozzo.com; From: Andrey Ryabinin To: Alasdair Kergon , Mike Snitzer , CC: Mikulas Patocka , Milan Broz , "Igor Sukhih" , , Andrey Ryabinin Subject: [RFC] dm-crypt: add ability to use keys from the kernel key retention service Date: Tue, 9 Aug 2016 16:56:06 +0300 Message-ID: <1470750966-13028-1-git-send-email-aryabinin@virtuozzo.com> X-Mailer: git-send-email 2.7.3 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [195.214.232.10] X-ClientProxiedBy: AM4PR02CA0024.eurprd02.prod.outlook.com (10.165.239.162) To HE1PR0802MB2556.eurprd08.prod.outlook.com (10.175.35.149) X-MS-Office365-Filtering-Correlation-Id: 852c93bb-fab2-482e-e964-08d3c05cc098 X-Microsoft-Exchange-Diagnostics: 1;HE1PR0802MB2556;2:Ou1fBd6fsVK3viholcPnc3uMPth8I7FjkTIn/YotJKQqFU0WmGMx0TpkLo3yJYZ9jkg5bcwAFmn0TyNsw1V47FRrdXnwGVzopzP1MjHYbaPJvkFj5Fw2hVmVk8hz5bqqEdXrTTTVz7n9PEecW5wdm/4gbI14lPtXt5GD1bjNhSRmnkWopNnB7r4la1+y0Iwt;3:na1fMuMteblx55Xxs+AtOpfIAFWb9DhV/C1HVBqKsfjlveyzo5PTAjfgJ5xRJkp0sqSuwpz9h857NPE9F6moRJQ3gpnoS1VMcSMWQ39lAOGB/8oCzS9PD4zYnp8kNhuR X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:HE1PR0802MB2556; X-Microsoft-Exchange-Diagnostics: 1;HE1PR0802MB2556;25:bpNG65CumcixF8NuIjMj+RKtvhKC52fBoAg+kbRciuZTglRzQ7sff/Ox8qCa1znkVva0is31SLk6FTs/o9xLmgIG4njH39jTyoGDFj5w2D+RIiVAvLfKckUO5Y3ei/rhNe1yZJHWxU5Y/Wqcw/7EHj4LF4KvkqRPm2Cudv9j9M5B9iwRuXVwLJhrDlp5Q21rz6UqbH7TkrfnJCIjyQONHSPVVILJSpbU5yP3WsgxXwZACCKSOwZLrhmwNlgHcmh96rLDYzyTVBXUNw13saPsIrk6KMrrWUlmgRp18i07hcQ3ApiXeNOFBCdFrlGL7eaUQnGx1ER9T9AfL3BEhp77bSMnYgd06cMrrwXslZaEM9pNYcEUMCYQDqCiZe09+v9R/mi5qDb8CJW4LDgr6sii7XnWArIORFdb7eu6KzrmejQOAuFXxm6t8fnTjxRy05TTSkwSZurwWHgM3wC42pG+RFl822CTSjb4vyrjXvw3ZolTB/lspIZGHKGSo9MHOymJ3sAiKVK0322UaNzOZbCI0pGVz+W9wpj2zRfYngcUOYJeCPU29+hSGnqaUJFLVHpKOkIVFIMPGBe8Gx8PZlkFq9fwBP2dsqS51yEakb68pBvs6GWcnFFnwupjgYQR7LnMjEDkxOhaq4kny6dTmGVljLwyz+c1UOhkFmj1jnC9juQj5caRkYSPUUyyo4p6qeIcFxblgKowtfcLpAKjxep6lMLMHMJHbyOwdpj9GbrC4YOi11bMNVCR/ojYsZ1kE/GA X-Microsoft-Exchange-Diagnostics: 1;HE1PR0802MB2556;31:L8C3n7mi2fSNtP4pOnD0DfWc393Z8WAOsJ9IUh5yEaoQh5bd3qoE8bWHymafHuEusrMWKxtzRwRq/W4VauwBsX8NyZySDVHE20TK8jB4bNxIoshh4Dh2nSZ85zIKY63vN99Fsdl5CFfdNCZefCOBmvVIZulTtfkfYfJr7hssJXHDdWP7de4qqKlQdMpFMFictAiSB3NNt19mJYyV6shHDUMfdHZqjqGEftiMTB8T2uE=;4:+oglM8CjtpTnL/MvcPnqpArN77xnaPcbL/4N2Z17OWvS8UDqt8FWmwgeU44pme3wJmZMrh08PhGlpFpwkxzskGjLlei1gVB5gFg52AsW+YPVcPEvKFY1APAoOUgRLX+DcVSgLmhgcpvgpDgioxWgZ49D9eeIWuplWSKqoxSYM6L3J11AztROuTcXQ5A0flSLu3AiC3nSjXv+pVFzomJDEMgN++kGqmk5ZqZfqystM4HGl7GxAFsNeTumxRQPH8iij533gBecXjgx2nZoB+sqfNNdRi8n0U043naFp4/+IQyrPVCGzEMrAO8GkAADDvmZcylHDHTMMrZDSVSNXSB3NVe3sEMn0lQYIipp089MretqETidfCiXIk+46w2dSkSl2BOKiAQIr1R41tFsR7gOQBtF6cnVhMTAi0vJKCbjvL0= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040130)(601004)(2401047)(8121501046)(5005006)(10201501046)(3002001)(6041072)(6043046);SRVR:HE1PR0802MB2556;BCL:0;PCL:0;RULEID:;SRVR:HE1PR0802MB2556; X-Forefront-PRVS: 0029F17A3F X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6069001)(6009001)(7916002)(199003)(189002)(6116002)(3846002)(4326007)(47776003)(50986999)(19580405001)(66066001)(586003)(19580395003)(7846002)(305945005)(107886002)(42186005)(92566002)(2906002)(7736002)(77096005)(50226002)(48376002)(5003940100001)(50466002)(97736004)(5001770100001)(81166006)(189998001)(4001430100002)(101416001)(106356001)(8676002)(229853001)(76506005)(68736007)(33646002)(36756003)(53416004)(86362001)(105586002)(69596002)(81156014);DIR:OUT;SFP:1102;SCL:1;SRVR:HE1PR0802MB2556;H:localhost.sw.ru;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;HE1PR0802MB2556;23:BzYqLtI2M6c8x948Th7BjWiT5F/DVp9aItCxGT8?= =?us-ascii?Q?D/GEh3wF1YSHprHvZR6fjMixsd9KxiHJ35Z0SBbwXg4n8BJL/AWrXWynzGhp?= =?us-ascii?Q?oWit5SjUamB/ilbVb3U4TXVJ2q8bqDQ8GX0CIgsXomMXSOA22o+w/GCOgmd5?= =?us-ascii?Q?+Xns2DHw7kmGziONgLFMqGO4WVw9sICHT1MZFITHjdphX6a0IU6HfbAzJLQM?= =?us-ascii?Q?qtB7mhv03+T+gcctKTObof8bCVpG4bj2RM8SKb7I/+yuB8m9Snd31CAScQ4P?= =?us-ascii?Q?BVSZZDOUNVw3JR9UvlY24Td+RkxjtsyZtw42Yao78P4yYk6Jp2dlKmg5GDO2?= =?us-ascii?Q?HWwcJR70uS1SfTj31iaP7o6+M1XyQL1fYYMjsA0x/uAgyYvAiVMSob9yWhsm?= =?us-ascii?Q?sLcoJP2jB8y/nyVa7dQwWetwlqSqbc3kGpTZdzdEN2bOsFLKcZnWzGw0nIbU?= =?us-ascii?Q?rFOGmUDlTNmrARx5poYKjHc74S9Y9BICirjJFmVPbq7SrkMdL0L0nJbVTvR/?= =?us-ascii?Q?8nYR5nTvNy57FCaM8WuyI7T2Ru42/7ySE7pxV++a//XxZFGkoUBNaJuBsXPs?= =?us-ascii?Q?rJW9YbbY9xUpuVe79AfTtV5poc6FAEuozqX43QdNV2SQsXAyxfHjtjC2JUxF?= =?us-ascii?Q?By50lGeO9mNsuGj3tnC/t0vEGm1owR6xy4jCEITHEWfxkoVChXlLONWHGNiv?= =?us-ascii?Q?3ohBDRfSTBwQkiaDaJy2GsX1sc/qiwS0ivw3eiFy7QBOE3OpDFGQEurXu9+L?= =?us-ascii?Q?ylU4m7hknLdA7DHiU8gVbVuB9zly4Xa36g0bHCgMfNEqoxaMeaas7lGKAMk7?= =?us-ascii?Q?4nxgGGdXAjnQlZwBXbMolKEKGYUZEyFLSepwY1pCBDhrUL9LxtuOYvdItgcU?= =?us-ascii?Q?Z3EUeEJN1+q0blO0qdv1MERGSy1l557Hkqo9zvM71rP0R2eCsoWswa+6jWoj?= =?us-ascii?Q?vnLZsIN4pa+HWv4CC3CPP6InsqDTWR2GbkkrJ7glgy83nS5CUlV+R34PmyJB?= =?us-ascii?Q?fkA/qT0eFBteKYFq2voA5lr747sfDW6EZp88wU5UqyDLwrIR6bF2rjxNHJo4?= =?us-ascii?Q?NLTtDUJoZQA2Lyu/87/6xCsgh+ffkDlwB+Pu6jSNPIyQaYspv0dGzxSdHYFK?= =?us-ascii?Q?mdvkvWDs6cC1hkx5p3u6r6h0TAPMIurgt?= X-Microsoft-Exchange-Diagnostics: 1;HE1PR0802MB2556;6:INstR4EpKqwe1uN1vkrJSzmMty8jCKOYlYE4a4aRVkKLaU43RYKgc19QiiwhY/vSpmWIEePb61O4VsUQUjAk/U4+7jh0UA6wcWXu5q+45t1gAxJ4rDfNEByskkL6siTyzeYtVipB+ySXymfD5MjKhwiUvwBD167nSkfmdQBsxt0koqT0F/83ycmPOsqw9m8Xr4l+YSmRF9mVyEQeayVwRJ1bFoD9MXqW92xy4VEkZymLE4Xi9lvFVkQFeELu66Jgds3ZSzJ4WTbBYJeKBEYxxF9CreJB+v3WPEHHrUJV78bVi0yumBPgMFirPy1zZdMj;5:Brkru1glqWe+UmywnsEiG7uloDhjYSELZNxe03Aj20BMYsmDKuot4HBPmU8xhkYfGEcS7OYaMsSK7UF3/Ulh6dPKCDxz8Zs52ZgtZl1AQyWJCl2xGnmH3lInG2T4NMy33wvO69hpD0+4lxK/Mqv3HQ==;24:Rs566KFUtqMfr9NciTO2QXSbHPmh2UVM/UEgSSOIdIiTygxnweiIDh1RLkjOBAjR1o+kXXkh9PjZcIPFb1rXRZMEdkXvzGVGtnBXfRMc0zk=;7:G7Dy6MKgqpgqy3NnVU29AVkBz1jsLIObaEhka7/ZDUPtznlAzUgqu5kbcicGPcUu27UXDyRoxcHbwuxUcPqIh73X2T5fpA9KYMDybYIlhcIQkFD4QkF3v4nxDGjDFXZWuoLD7KrebUDsoeorfbs9GBXBqNKVD18PnHVetCdHCuWb7qm314Vh+kbkSq1WgGLd7wCKzhExLEhxN4g35nVa0Yv33Dzjsy7Zi1JAGhaF+QxJpteOxeuCqZeCCiwoDK3l SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;HE1PR0802MB2556;20:Y5NCdcplyaaj3omDhrGklZrgpSujkQgTgVqp/oSNXrNpMvydMxE3420vHSpgLsXa1KwkfTE0kKhlPobub3q34OhVCK3Gn2LHFNGE4Jnx68Ks+WkE2ZUGU39PNqutd+S6f+lYF+1Xvy4homqt4cTvk8EEDqQPQpo9z6Qu6HQrr1U= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Aug 2016 13:54:58.2246 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: HE1PR0802MB2556 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The kernel key service is a generic way to store keys for the use of other subsystems. Currently there is no way to use kernel keys in dm-crypt. This patch aims to fix that. Instead of key userspace may pass a key description with preceding ':'. So message that constructs encryption mapping now looks like this: [|:] [<#opt_params> ] (I could propose another possible way to distinguish key from the key description. This would be to add new opt_param, something like 'key_in_keyring'. So if key_in_keyring is set than we have key description instead of key.) Note: We haven't implemented userspace part for this yet. Signed-off-by: Andrey Ryabinin --- drivers/md/dm-crypt.c | 95 ++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 86 insertions(+), 9 deletions(-) diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index 4e9784b..5a7899d 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -12,6 +12,7 @@ #include #include #include +#include #include #include #include @@ -29,6 +30,7 @@ #include #include #include +#include #include @@ -1489,21 +1491,91 @@ static int crypt_setkey_allcpus(struct crypt_config *cc) return err; } +#ifdef CONFIG_KEYS +static int crypt_set_keyring_key(struct crypt_config *cc, char *key_desc) +{ + int ret = 0; + struct key *key; + const struct user_key_payload *ukp; + + key = request_key(&key_type_user, key_desc, NULL); + if (IS_ERR(key)) + return PTR_ERR(key); + + rcu_read_lock(); + ret = key_validate(key); + if (ret < 0) + goto out; + + ukp = user_key_payload(key); + if (cc->key_size != ukp->datalen) { + ret = -EINVAL; + goto out; + } + memcpy(cc->key, ukp->data, cc->key_size); +out: + rcu_read_unlock(); + key_put(key); + return ret; +} + +static int get_key_size(const char *key_desc) +{ + int ret; + struct key *key; + + if (key_desc[0] != ':') + return strlen(key_desc) >> 1; + + key = request_key(&key_type_user, key_desc + 1, NULL); + if (IS_ERR(key)) + return PTR_ERR(key); + + rcu_read_lock(); + ret = key_validate(key); + if (ret < 0) + goto out; + + ret = user_key_payload(key)->datalen; +out: + rcu_read_unlock(); + key_put(key); + return ret; +} +#else +static int crypt_set_keyring_key(struct crypt_config *cc, char *key_desc) +{ + return -EINVAL; +} + +static int get_key_size(const char *key) +{ + return strlen(key) >> 1; +} +#endif + static int crypt_set_key(struct crypt_config *cc, char *key) { int r = -EINVAL; int key_string_len = strlen(key); - /* The key size may not be changed. */ - if (cc->key_size != (key_string_len >> 1)) - goto out; - /* Hyphen (which gives a key_size of zero) means there is no key. */ if (!cc->key_size && strcmp(key, "-")) goto out; - if (cc->key_size && crypt_decode_key(cc->key, key, cc->key_size) < 0) - goto out; + /* ':' means that the key is in kernel keyring */ + if (key[0] == ':') { + if (crypt_set_keyring_key(cc, key + 1)) + goto out; + } else { + /* The key size may not be changed. */ + if (cc->key_size != (key_string_len >> 1)) + goto out; + + if (cc->key_size && + crypt_decode_key(cc->key, key, cc->key_size) < 0) + goto out; + } set_bit(DM_CRYPT_KEY_VALID, &cc->flags); @@ -1730,12 +1802,13 @@ bad_mem: /* * Construct an encryption mapping: - * + * [|:] */ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv) { struct crypt_config *cc; - unsigned int key_size, opt_params; + int key_size; + unsigned int opt_params; unsigned long long tmpll; int ret; size_t iv_size_padding; @@ -1752,7 +1825,11 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv) return -EINVAL; } - key_size = strlen(argv[1]) >> 1; + key_size = get_key_size(argv[1]); + if (key_size < 0) { + ti->error = "Cannot parse key"; + return -EINVAL; + } cc = kzalloc(sizeof(*cc) + key_size * sizeof(u8), GFP_KERNEL); if (!cc) { -- 2.7.3