4 files changed, 180 insertions, 8 deletions

diff --git a/security/keys/Makefile b/security/keys/Makefile
index 1bf090a885fe..b34cc6ee6900 100644
--- a/security/keys/Makefile
+++ b/security/keys/Makefile
@@ -14,7 +14,7 @@ obj-y := \
         user_defined.o
 
 obj-$(CONFIG_TRUSTED_KEYS) += trusted.o
-obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted.o
+obj-$(CONFIG_ENCRYPTED_KEYS) += ecryptfs_format.o encrypted.o
 obj-$(CONFIG_KEYS_COMPAT) += compat.o
 obj-$(CONFIG_PROC_FS) += proc.o
 obj-$(CONFIG_SYSCTL) += sysctl.o
diff --git a/security/keys/ecryptfs_format.c b/security/keys/ecryptfs_format.c
new file mode 100644
index 000000000000..6daa3b6ff9ed
--- /dev/null
+++ b/security/keys/ecryptfs_format.c
@@ -0,0 +1,81 @@
+/*
+ * ecryptfs_format.c: helper functions for the encrypted key type
+ *
+ * Copyright (C) 2006 International Business Machines Corp.
+ * Copyright (C) 2010 Politecnico di Torino, Italy
+ *                    TORSEC group -- http://security.polito.it
+ *
+ * Authors:
+ * Michael A. Halcrow <mahalcro@us.ibm.com>
+ * Tyler Hicks <tyhicks@ou.edu>
+ * Roberto Sassu <roberto.sassu@polito.it>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 2 of the License.
+ */
+
+#include <linux/module.h>
+#include "ecryptfs_format.h"
+
+u8 *ecryptfs_get_auth_tok_key(struct ecryptfs_auth_tok *auth_tok)
+{
+        return auth_tok->token.password.session_key_encryption_key;
+}
+EXPORT_SYMBOL(ecryptfs_get_auth_tok_key);
+
+/*
+ * ecryptfs_get_versions()
+ *
+ * Source code taken from the software 'ecryptfs-utils' version 83.
+ *
+ */
+void ecryptfs_get_versions(int *major, int *minor, int *file_version)
+{
+        *major = ECRYPTFS_VERSION_MAJOR;
+        *minor = ECRYPTFS_VERSION_MINOR;
+        if (file_version)
+                *file_version = ECRYPTFS_SUPPORTED_FILE_VERSION;
+}
+EXPORT_SYMBOL(ecryptfs_get_versions);
+
+/*
+ * ecryptfs_fill_auth_tok - fill the ecryptfs_auth_tok structure
+ *
+ * Fill the ecryptfs_auth_tok structure with required ecryptfs data.
+ * The source code is inspired to the original function generate_payload()
+ * shipped with the software 'ecryptfs-utils' version 83.
+ *
+ */
+int ecryptfs_fill_auth_tok(struct ecryptfs_auth_tok *auth_tok,
+                           const char *key_desc)
+{
+        int major, minor;
+
+        ecryptfs_get_versions(&major, &minor, NULL);
+        auth_tok->version = (((uint16_t)(major << 8) & 0xFF00)
+                             | ((uint16_t)minor & 0x00FF));
+        auth_tok->token_type = ECRYPTFS_PASSWORD;
+        strncpy((char *)auth_tok->token.password.signature, key_desc,
+                ECRYPTFS_PASSWORD_SIG_SIZE);
+        auth_tok->token.password.session_key_encryption_key_bytes =
+                ECRYPTFS_MAX_KEY_BYTES;
+        /*
+         * Removed auth_tok->token.password.salt and
+         * auth_tok->token.password.session_key_encryption_key
+         * initialization from the original code
+         */
+        /* TODO: Make the hash parameterizable via policy */
+        auth_tok->token.password.flags |=
+                ECRYPTFS_SESSION_KEY_ENCRYPTION_KEY_SET;
+        /* The kernel code will encrypt the session key. */
+        auth_tok->session_key.encrypted_key[0] = 0;
+        auth_tok->session_key.encrypted_key_size = 0;
+        /* Default; subject to change by kernel eCryptfs */
+        auth_tok->token.password.hash_algo = PGP_DIGEST_ALGO_SHA512;
+        auth_tok->token.password.flags &= ~(ECRYPTFS_PERSISTENT_PASSWORD);
+        return 0;
+}
+EXPORT_SYMBOL(ecryptfs_fill_auth_tok);
+
+MODULE_LICENSE("GPL");
diff --git a/security/keys/ecryptfs_format.h b/security/keys/ecryptfs_format.h
new file mode 100644
index 000000000000..40294de238bb
--- /dev/null
+++ b/security/keys/ecryptfs_format.h
@@ -0,0 +1,30 @@
+/*
+ * ecryptfs_format.h: helper functions for the encrypted key type
+ *
+ * Copyright (C) 2006 International Business Machines Corp.
+ * Copyright (C) 2010 Politecnico di Torino, Italy
+ *                    TORSEC group -- http://security.polito.it
+ *
+ * Authors:
+ * Michael A. Halcrow <mahalcro@us.ibm.com>
+ * Tyler Hicks <tyhicks@ou.edu>
+ * Roberto Sassu <roberto.sassu@polito.it>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, version 2 of the License.
+ */
+
+#ifndef __KEYS_ECRYPTFS_H
+#define __KEYS_ECRYPTFS_H
+
+#include <linux/ecryptfs.h>
+
+#define PGP_DIGEST_ALGO_SHA512   10
+
+u8 *ecryptfs_get_auth_tok_key(struct ecryptfs_auth_tok *auth_tok);
+void ecryptfs_get_versions(int *major, int *minor, int *file_version);
+int ecryptfs_fill_auth_tok(struct ecryptfs_auth_tok *auth_tok,
+                           const char *key_desc);
+
+#endif /* __KEYS_ECRYPTFS_H */
diff --git a/security/keys/encrypted.c b/security/keys/encrypted.c
index 89981c987ba7..e7eca9ec4c65 100644
--- a/security/keys/encrypted.c
+++ b/security/keys/encrypted.c
@@ -29,11 +29,13 @@
 #include <linux/rcupdate.h>
 #include <linux/scatterlist.h>
 #include <linux/crypto.h>
+#include <linux/ctype.h>
 #include <crypto/hash.h>
 #include <crypto/sha.h>
 #include <crypto/aes.h>
 
 #include "encrypted.h"
+#include "ecryptfs_format.h"
 
 static const char KEY_TRUSTED_PREFIX[] = "trusted:";
 static const char KEY_USER_PREFIX[] = "user:";
@@ -41,11 +43,13 @@ static const char hash_alg[] = "sha256";
 static const char hmac_alg[] = "hmac(sha256)";
 static const char blkcipher_alg[] = "cbc(aes)";
 static const char key_format_default[] = "default";
+static const char key_format_ecryptfs[] = "ecryptfs";
 static unsigned int ivsize;
 static int blksize;
 
 #define KEY_TRUSTED_PREFIX_LEN (sizeof (KEY_TRUSTED_PREFIX) - 1)
 #define KEY_USER_PREFIX_LEN (sizeof (KEY_USER_PREFIX) - 1)
+#define KEY_ECRYPTFS_DESC_LEN 16
 #define HASH_SIZE SHA256_DIGEST_SIZE
 #define MAX_DATA_SIZE 4096
 #define MIN_DATA_SIZE  20
@@ -63,11 +67,12 @@ enum {
 };
 
 enum {
-        Opt_error = -1, Opt_default
+        Opt_error = -1, Opt_default, Opt_ecryptfs
 };
 
 static const match_table_t key_format_tokens = {
         {Opt_default, "default"},
+        {Opt_ecryptfs, "ecryptfs"},
         {Opt_error, NULL}
 };
 
@@ -95,6 +100,34 @@ static int aes_get_sizes(void)
 }
 
 /*
+ * valid_ecryptfs_desc - verify the description of a new/loaded encrypted key
+ *
+ * The description of a encrypted key with format 'ecryptfs' must contain
+ * exactly 16 hexadecimal characters.
+ *
+ */
+static int valid_ecryptfs_desc(const char *ecryptfs_desc)
+{
+        int i;
+
+        if (strlen(ecryptfs_desc) != KEY_ECRYPTFS_DESC_LEN) {
+                pr_err("encrypted_key: key description must be %d hexadecimal "
+                       "characters long\n", KEY_ECRYPTFS_DESC_LEN);
+                return -EINVAL;
+        }
+
+        for (i = 0; i < KEY_ECRYPTFS_DESC_LEN; i++) {
+                if (!isxdigit(ecryptfs_desc[i])) {
+                        pr_err("encrypted_key: key description must contain "
+                               "only hexadecimal characters\n");
+                        return -EINVAL;
+                }
+        }
+
+        return 0;
+}
+
+/*
  * valid_master_desc - verify the 'key-type:desc' of a new/updated master-key
  *
  * key-type:= "trusted:" | "user:"
@@ -158,7 +191,7 @@ static int datablob_parse(char *datablob, const char **format,
         }
         key_cmd = match_token(keyword, key_tokens, args);
 
-        /* Get optional format: default */
+        /* Get optional format: default | ecryptfs */
         p = strsep(&datablob, " \t");
         if (!p) {
                 pr_err("encrypted_key: insufficient parameters specified\n");
@@ -167,6 +200,7 @@ static int datablob_parse(char *datablob, const char **format,
 
         key_format = match_token(p, key_format_tokens, args);
         switch (key_format) {
+        case Opt_ecryptfs:
         case Opt_default:
                 *format = p;
                 *master_desc = strsep(&datablob, " \t");
@@ -601,6 +635,17 @@ static struct encrypted_key_payload *encrypted_key_alloc(struct key *key,
         format_len = (!format) ? strlen(key_format_default) : strlen(format);
         decrypted_datalen = dlen;
         payload_datalen = decrypted_datalen;
+        if (format && !strcmp(format, key_format_ecryptfs)) {
+                if (dlen != ECRYPTFS_MAX_KEY_BYTES) {
+                        pr_err("encrypted_key: keylen for the ecryptfs format "
+                               "must be equal to %d bytes\n",
+                               ECRYPTFS_MAX_KEY_BYTES);
+                        return ERR_PTR(-EINVAL);
+                }
+                decrypted_datalen = ECRYPTFS_MAX_KEY_BYTES;
+                payload_datalen = sizeof(struct ecryptfs_auth_tok);
+        }
+
         encrypted_datalen = roundup(decrypted_datalen, blksize);
 
         datablob_len = format_len + 1 + strlen(master_desc) + 1
@@ -686,8 +731,14 @@ static void __ekey_init(struct encrypted_key_payload *epayload,
 
         if (!format)
                 memcpy(epayload->format, key_format_default, format_len);
-        else
+        else {
+                if (!strcmp(format, key_format_ecryptfs))
+                        epayload->decrypted_data =
+                                ecryptfs_get_auth_tok_key((struct ecryptfs_auth_tok *)epayload->payload_data);
+
                 memcpy(epayload->format, format, format_len);
+        }
+
         memcpy(epayload->master_desc, master_desc, strlen(master_desc));
         memcpy(epayload->datalen, datalen, strlen(datalen));
 }
@@ -699,11 +750,21 @@ static void __ekey_init(struct encrypted_key_payload *epayload,
  * itself.  For an old key, decrypt the hex encoded data.
  */
 static int encrypted_init(struct encrypted_key_payload *epayload,
-                          const char *format, const char *master_desc,
-                          const char *datalen, const char *hex_encoded_iv)
+                          const char *key_desc, const char *format,
+                          const char *master_desc, const char *datalen,
+                          const char *hex_encoded_iv)
 {
         int ret = 0;
 
+        if (format && !strcmp(format, key_format_ecryptfs)) {
+                ret = valid_ecryptfs_desc(key_desc);
+                if (ret < 0)
+                        return ret;
+
+                ecryptfs_fill_auth_tok((struct ecryptfs_auth_tok *)epayload->payload_data,
+                                       key_desc);
+        }
+
         __ekey_init(epayload, format, master_desc, datalen);
         if (!hex_encoded_iv) {
                 get_random_bytes(epayload->iv, ivsize);
@@ -753,8 +814,8 @@ static int encrypted_instantiate(struct key *key, const void *data,
                 ret = PTR_ERR(epayload);
                 goto out;
         }
-        ret = encrypted_init(epayload, format, master_desc, decrypted_datalen,
-                             hex_encoded_iv);
+        ret = encrypted_init(epayload, key->description, format, master_desc,
+                             decrypted_datalen, hex_encoded_iv);
         if (ret < 0) {
                 kfree(epayload);
                 goto out;