mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-12-27 08:45:26 -05:00
0bbb838f38
eCryptfs uses MD5 for a couple unusual purposes: to "mix" the key into
the IVs for file contents encryption (similar to ESSIV), and to prepend
some key-dependent bytes to the plaintext when encrypting filenames
(which is useless since eCryptfs encrypts the filenames with ECB).
Currently, eCryptfs computes these MD5 hashes using the crypto_shash
API. Update it to instead use the MD5 library API. This is simpler and
faster: the library doesn't require memory allocations, can't fail, and
provides direct access to MD5 without overhead such as indirect calls.
To preserve the existing behavior of eCryptfs support being disabled
when the kernel is booted with "fips=1", make ecryptfs_get_tree() check
fips_enabled itself. Previously it relied on crypto_alloc_shash("md5")
failing. I don't know for sure that this is actually needed; e.g., it
could be argued that eCryptfs's use of MD5 isn't for a security purpose
as far as FIPS is concerned. But this preserves the existing behavior.
Tested by verifying that an existing eCryptfs can still be mounted with
a kernel that has this commit, with all the files matching. Also tested
creating a filesystem with this commit and mounting+reading it without.
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Link: https://patch.msgid.link/20251011200010.193140-1-ebiggers@kernel.org
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
24 lines
847 B
Plaintext
24 lines
847 B
Plaintext
# SPDX-License-Identifier: GPL-2.0-only
|
|
config ECRYPT_FS
|
|
tristate "eCrypt filesystem layer support"
|
|
depends on KEYS && CRYPTO && (ENCRYPTED_KEYS || ENCRYPTED_KEYS=n)
|
|
select CRYPTO_ECB
|
|
select CRYPTO_CBC
|
|
select CRYPTO_LIB_MD5
|
|
help
|
|
Encrypted filesystem that operates on the VFS layer. See
|
|
<file:Documentation/filesystems/ecryptfs.rst> to learn more about
|
|
eCryptfs. Userspace components are required and can be
|
|
obtained from <http://ecryptfs.sf.net>.
|
|
|
|
To compile this file system support as a module, choose M here: the
|
|
module will be called ecryptfs.
|
|
|
|
config ECRYPT_FS_MESSAGING
|
|
bool "Enable notifications for userspace key wrap/unwrap"
|
|
depends on ECRYPT_FS
|
|
help
|
|
Enables the /dev/ecryptfs entry for use by ecryptfsd. This allows
|
|
for userspace to wrap/unwrap file encryption keys by other
|
|
backends, like OpenSSL.
|