]>
Commit | Line | Data |
---|---|---|
b2441318 | 1 | /* SPDX-License-Identifier: GPL-2.0 */ |
3325bea5 TT |
2 | /* |
3 | * fscrypt_private.h | |
4 | * | |
5 | * Copyright (C) 2015, Google, Inc. | |
6 | * | |
3ec4f2a6 EB |
7 | * Originally written by Michael Halcrow, Ildar Muslukhov, and Uday Savagaonkar. |
8 | * Heavily modified since then. | |
3325bea5 TT |
9 | */ |
10 | ||
11 | #ifndef _FSCRYPT_PRIVATE_H | |
12 | #define _FSCRYPT_PRIVATE_H | |
13 | ||
734f0d24 | 14 | #include <linux/fscrypt.h> |
aa408f83 | 15 | #include <linux/siphash.h> |
b7e7cf7a | 16 | #include <crypto/hash.h> |
3325bea5 | 17 | |
22d94f49 EB |
18 | #define CONST_STRLEN(str) (sizeof(str) - 1) |
19 | ||
11b8818e | 20 | #define FS_KEY_DERIVATION_NONCE_SIZE 16 |
cc4e0df0 | 21 | |
22d94f49 EB |
22 | #define FSCRYPT_MIN_KEY_SIZE 16 |
23 | ||
5dae460c EB |
24 | #define FSCRYPT_CONTEXT_V1 1 |
25 | #define FSCRYPT_CONTEXT_V2 2 | |
26 | ||
27 | struct fscrypt_context_v1 { | |
28 | u8 version; /* FSCRYPT_CONTEXT_V1 */ | |
cc4e0df0 TT |
29 | u8 contents_encryption_mode; |
30 | u8 filenames_encryption_mode; | |
31 | u8 flags; | |
3b6df59b | 32 | u8 master_key_descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE]; |
cc4e0df0 | 33 | u8 nonce[FS_KEY_DERIVATION_NONCE_SIZE]; |
5dae460c | 34 | }; |
cc4e0df0 | 35 | |
5dae460c EB |
36 | struct fscrypt_context_v2 { |
37 | u8 version; /* FSCRYPT_CONTEXT_V2 */ | |
38 | u8 contents_encryption_mode; | |
39 | u8 filenames_encryption_mode; | |
40 | u8 flags; | |
41 | u8 __reserved[4]; | |
42 | u8 master_key_identifier[FSCRYPT_KEY_IDENTIFIER_SIZE]; | |
43 | u8 nonce[FS_KEY_DERIVATION_NONCE_SIZE]; | |
44 | }; | |
45 | ||
d2fe9754 | 46 | /* |
5dae460c EB |
47 | * fscrypt_context - the encryption context of an inode |
48 | * | |
49 | * This is the on-disk equivalent of an fscrypt_policy, stored alongside each | |
50 | * encrypted file usually in a hidden extended attribute. It contains the | |
51 | * fields from the fscrypt_policy, in order to identify the encryption algorithm | |
52 | * and key with which the file is encrypted. It also contains a nonce that was | |
53 | * randomly generated by fscrypt itself; this is used as KDF input or as a tweak | |
54 | * to cause different files to be encrypted differently. | |
55 | */ | |
56 | union fscrypt_context { | |
57 | u8 version; | |
58 | struct fscrypt_context_v1 v1; | |
59 | struct fscrypt_context_v2 v2; | |
60 | }; | |
61 | ||
62 | /* | |
63 | * Return the size expected for the given fscrypt_context based on its version | |
64 | * number, or 0 if the context version is unrecognized. | |
65 | */ | |
66 | static inline int fscrypt_context_size(const union fscrypt_context *ctx) | |
67 | { | |
68 | switch (ctx->version) { | |
69 | case FSCRYPT_CONTEXT_V1: | |
70 | BUILD_BUG_ON(sizeof(ctx->v1) != 28); | |
71 | return sizeof(ctx->v1); | |
72 | case FSCRYPT_CONTEXT_V2: | |
73 | BUILD_BUG_ON(sizeof(ctx->v2) != 40); | |
74 | return sizeof(ctx->v2); | |
75 | } | |
76 | return 0; | |
77 | } | |
78 | ||
e98ad464 EB |
79 | /* Check whether an fscrypt_context has a recognized version number and size */ |
80 | static inline bool fscrypt_context_is_valid(const union fscrypt_context *ctx, | |
81 | int ctx_size) | |
82 | { | |
83 | return ctx_size >= 1 && ctx_size == fscrypt_context_size(ctx); | |
84 | } | |
85 | ||
86 | /* Retrieve the context's nonce, assuming the context was already validated */ | |
87 | static inline const u8 *fscrypt_context_nonce(const union fscrypt_context *ctx) | |
88 | { | |
89 | switch (ctx->version) { | |
90 | case FSCRYPT_CONTEXT_V1: | |
91 | return ctx->v1.nonce; | |
92 | case FSCRYPT_CONTEXT_V2: | |
93 | return ctx->v2.nonce; | |
94 | } | |
95 | WARN_ON(1); | |
96 | return NULL; | |
97 | } | |
98 | ||
5dae460c EB |
99 | #undef fscrypt_policy |
100 | union fscrypt_policy { | |
101 | u8 version; | |
102 | struct fscrypt_policy_v1 v1; | |
103 | struct fscrypt_policy_v2 v2; | |
104 | }; | |
105 | ||
106 | /* | |
107 | * Return the size expected for the given fscrypt_policy based on its version | |
108 | * number, or 0 if the policy version is unrecognized. | |
109 | */ | |
110 | static inline int fscrypt_policy_size(const union fscrypt_policy *policy) | |
111 | { | |
112 | switch (policy->version) { | |
113 | case FSCRYPT_POLICY_V1: | |
114 | return sizeof(policy->v1); | |
115 | case FSCRYPT_POLICY_V2: | |
116 | return sizeof(policy->v2); | |
117 | } | |
118 | return 0; | |
119 | } | |
120 | ||
121 | /* Return the contents encryption mode of a valid encryption policy */ | |
122 | static inline u8 | |
123 | fscrypt_policy_contents_mode(const union fscrypt_policy *policy) | |
124 | { | |
125 | switch (policy->version) { | |
126 | case FSCRYPT_POLICY_V1: | |
127 | return policy->v1.contents_encryption_mode; | |
128 | case FSCRYPT_POLICY_V2: | |
129 | return policy->v2.contents_encryption_mode; | |
130 | } | |
131 | BUG(); | |
132 | } | |
133 | ||
134 | /* Return the filenames encryption mode of a valid encryption policy */ | |
135 | static inline u8 | |
136 | fscrypt_policy_fnames_mode(const union fscrypt_policy *policy) | |
137 | { | |
138 | switch (policy->version) { | |
139 | case FSCRYPT_POLICY_V1: | |
140 | return policy->v1.filenames_encryption_mode; | |
141 | case FSCRYPT_POLICY_V2: | |
142 | return policy->v2.filenames_encryption_mode; | |
143 | } | |
144 | BUG(); | |
145 | } | |
146 | ||
147 | /* Return the flags (FSCRYPT_POLICY_FLAG*) of a valid encryption policy */ | |
148 | static inline u8 | |
149 | fscrypt_policy_flags(const union fscrypt_policy *policy) | |
150 | { | |
151 | switch (policy->version) { | |
152 | case FSCRYPT_POLICY_V1: | |
153 | return policy->v1.flags; | |
154 | case FSCRYPT_POLICY_V2: | |
155 | return policy->v2.flags; | |
156 | } | |
157 | BUG(); | |
158 | } | |
159 | ||
d2fe9754 | 160 | /* |
0eaab5b1 EB |
161 | * For encrypted symlinks, the ciphertext length is stored at the beginning |
162 | * of the string in little-endian format. | |
163 | */ | |
164 | struct fscrypt_symlink_data { | |
165 | __le16 len; | |
166 | char encrypted_path[1]; | |
167 | } __packed; | |
168 | ||
cc4e0df0 | 169 | /* |
8094c3ce EB |
170 | * fscrypt_info - the "encryption key" for an inode |
171 | * | |
172 | * When an encrypted file's key is made available, an instance of this struct is | |
173 | * allocated and stored in ->i_crypt_info. Once created, it remains until the | |
174 | * inode is evicted. | |
cc4e0df0 TT |
175 | */ |
176 | struct fscrypt_info { | |
8094c3ce EB |
177 | |
178 | /* The actual crypto transform used for encryption and decryption */ | |
179 | struct crypto_skcipher *ci_ctfm; | |
180 | ||
b103fb76 EB |
181 | /* True if the key should be freed when this fscrypt_info is freed */ |
182 | bool ci_owns_key; | |
183 | ||
8094c3ce | 184 | /* |
5dae460c EB |
185 | * Encryption mode used for this inode. It corresponds to either the |
186 | * contents or filenames encryption mode, depending on the inode type. | |
8094c3ce EB |
187 | */ |
188 | struct fscrypt_mode *ci_mode; | |
189 | ||
59dc6a8e EB |
190 | /* Back-pointer to the inode */ |
191 | struct inode *ci_inode; | |
192 | ||
b1c0ec35 EB |
193 | /* |
194 | * The master key with which this inode was unlocked (decrypted). This | |
195 | * will be NULL if the master key was found in a process-subscribed | |
196 | * keyring rather than in the filesystem-level keyring. | |
197 | */ | |
198 | struct key *ci_master_key; | |
199 | ||
200 | /* | |
201 | * Link in list of inodes that were unlocked with the master key. | |
202 | * Only used when ->ci_master_key is set. | |
203 | */ | |
204 | struct list_head ci_master_key_link; | |
205 | ||
8094c3ce | 206 | /* |
a828daab EB |
207 | * If non-NULL, then encryption is done using the master key directly |
208 | * and ci_ctfm will equal ci_direct_key->dk_ctfm. | |
8094c3ce | 209 | */ |
a828daab | 210 | struct fscrypt_direct_key *ci_direct_key; |
8094c3ce | 211 | |
aa408f83 DR |
212 | /* |
213 | * This inode's hash key for filenames. This is a 128-bit SipHash-2-4 | |
214 | * key. This is only set for directories that use a keyed dirhash over | |
215 | * the plaintext filenames -- currently just casefolded directories. | |
216 | */ | |
217 | siphash_key_t ci_dirhash_key; | |
218 | bool ci_dirhash_key_initialized; | |
219 | ||
5dae460c EB |
220 | /* The encryption policy used by this inode */ |
221 | union fscrypt_policy ci_policy; | |
222 | ||
223 | /* This inode's nonce, copied from the fscrypt_context */ | |
8094c3ce | 224 | u8 ci_nonce[FS_KEY_DERIVATION_NONCE_SIZE]; |
e3b1078b EB |
225 | |
226 | /* Hashed inode number. Only set for IV_INO_LBLK_32 */ | |
227 | u32 ci_hashed_ino; | |
cc4e0df0 TT |
228 | }; |
229 | ||
58ae7468 RW |
230 | typedef enum { |
231 | FS_DECRYPT = 0, | |
232 | FS_ENCRYPT, | |
233 | } fscrypt_direction_t; | |
234 | ||
b98701df | 235 | /* crypto.c */ |
e4de782a | 236 | extern struct kmem_cache *fscrypt_info_cachep; |
60700902 EB |
237 | int fscrypt_initialize(unsigned int cop_flags); |
238 | int fscrypt_crypt_block(const struct inode *inode, fscrypt_direction_t rw, | |
239 | u64 lblk_num, struct page *src_page, | |
240 | struct page *dest_page, unsigned int len, | |
241 | unsigned int offs, gfp_t gfp_flags); | |
242 | struct page *fscrypt_alloc_bounce_page(gfp_t gfp_flags); | |
243 | ||
244 | void __printf(3, 4) __cold | |
886da8b3 | 245 | fscrypt_msg(const struct inode *inode, const char *level, const char *fmt, ...); |
544d08fd | 246 | |
886da8b3 EB |
247 | #define fscrypt_warn(inode, fmt, ...) \ |
248 | fscrypt_msg((inode), KERN_WARNING, fmt, ##__VA_ARGS__) | |
249 | #define fscrypt_err(inode, fmt, ...) \ | |
250 | fscrypt_msg((inode), KERN_ERR, fmt, ##__VA_ARGS__) | |
544d08fd | 251 | |
8094c3ce EB |
252 | #define FSCRYPT_MAX_IV_SIZE 32 |
253 | ||
254 | union fscrypt_iv { | |
255 | struct { | |
256 | /* logical block number within the file */ | |
257 | __le64 lblk_num; | |
258 | ||
259 | /* per-file nonce; only set in DIRECT_KEY mode */ | |
260 | u8 nonce[FS_KEY_DERIVATION_NONCE_SIZE]; | |
261 | }; | |
262 | u8 raw[FSCRYPT_MAX_IV_SIZE]; | |
263 | }; | |
264 | ||
265 | void fscrypt_generate_iv(union fscrypt_iv *iv, u64 lblk_num, | |
266 | const struct fscrypt_info *ci); | |
267 | ||
76e81d6d | 268 | /* fname.c */ |
60700902 EB |
269 | int fscrypt_fname_encrypt(const struct inode *inode, const struct qstr *iname, |
270 | u8 *out, unsigned int olen); | |
271 | bool fscrypt_fname_encrypted_size(const struct inode *inode, u32 orig_len, | |
272 | u32 max_len, u32 *encrypted_len_ret); | |
2ebdef6d | 273 | extern const struct dentry_operations fscrypt_d_ops; |
76e81d6d | 274 | |
c1144c9b EB |
275 | /* hkdf.c */ |
276 | ||
277 | struct fscrypt_hkdf { | |
278 | struct crypto_shash *hmac_tfm; | |
279 | }; | |
280 | ||
60700902 EB |
281 | int fscrypt_init_hkdf(struct fscrypt_hkdf *hkdf, const u8 *master_key, |
282 | unsigned int master_key_size); | |
c1144c9b | 283 | |
5dae460c EB |
284 | /* |
285 | * The list of contexts in which fscrypt uses HKDF. These values are used as | |
286 | * the first byte of the HKDF application-specific info string to guarantee that | |
287 | * info strings are never repeated between contexts. This ensures that all HKDF | |
288 | * outputs are unique and cryptographically isolated, i.e. knowledge of one | |
289 | * output doesn't reveal another. | |
290 | */ | |
291 | #define HKDF_CONTEXT_KEY_IDENTIFIER 1 | |
f592efe7 | 292 | #define HKDF_CONTEXT_PER_FILE_ENC_KEY 2 |
b103fb76 EB |
293 | #define HKDF_CONTEXT_DIRECT_KEY 3 |
294 | #define HKDF_CONTEXT_IV_INO_LBLK_64_KEY 4 | |
aa408f83 | 295 | #define HKDF_CONTEXT_DIRHASH_KEY 5 |
e3b1078b EB |
296 | #define HKDF_CONTEXT_IV_INO_LBLK_32_KEY 6 |
297 | #define HKDF_CONTEXT_INODE_HASH_KEY 7 | |
5dae460c | 298 | |
60700902 EB |
299 | int fscrypt_hkdf_expand(const struct fscrypt_hkdf *hkdf, u8 context, |
300 | const u8 *info, unsigned int infolen, | |
301 | u8 *okm, unsigned int okmlen); | |
c1144c9b | 302 | |
60700902 | 303 | void fscrypt_destroy_hkdf(struct fscrypt_hkdf *hkdf); |
c1144c9b | 304 | |
22d94f49 EB |
305 | /* keyring.c */ |
306 | ||
307 | /* | |
308 | * fscrypt_master_key_secret - secret key material of an in-use master key | |
309 | */ | |
310 | struct fscrypt_master_key_secret { | |
311 | ||
5dae460c EB |
312 | /* |
313 | * For v2 policy keys: HKDF context keyed by this master key. | |
314 | * For v1 policy keys: not set (hkdf.hmac_tfm == NULL). | |
315 | */ | |
316 | struct fscrypt_hkdf hkdf; | |
317 | ||
318 | /* Size of the raw key in bytes. Set even if ->raw isn't set. */ | |
22d94f49 EB |
319 | u32 size; |
320 | ||
5dae460c | 321 | /* For v1 policy keys: the raw key. Wiped for v2 policy keys. */ |
22d94f49 EB |
322 | u8 raw[FSCRYPT_MAX_KEY_SIZE]; |
323 | ||
324 | } __randomize_layout; | |
325 | ||
326 | /* | |
327 | * fscrypt_master_key - an in-use master key | |
328 | * | |
329 | * This represents a master encryption key which has been added to the | |
330 | * filesystem and can be used to "unlock" the encrypted files which were | |
331 | * encrypted with it. | |
332 | */ | |
333 | struct fscrypt_master_key { | |
334 | ||
b1c0ec35 EB |
335 | /* |
336 | * The secret key material. After FS_IOC_REMOVE_ENCRYPTION_KEY is | |
337 | * executed, this is wiped and no new inodes can be unlocked with this | |
338 | * key; however, there may still be inodes in ->mk_decrypted_inodes | |
339 | * which could not be evicted. As long as some inodes still remain, | |
340 | * FS_IOC_REMOVE_ENCRYPTION_KEY can be retried, or | |
341 | * FS_IOC_ADD_ENCRYPTION_KEY can add the secret again. | |
342 | * | |
23c688b5 EB |
343 | * Locking: protected by key->sem (outer) and mk_secret_sem (inner). |
344 | * The reason for two locks is that key->sem also protects modifying | |
345 | * mk_users, which ranks it above the semaphore for the keyring key | |
346 | * type, which is in turn above page faults (via keyring_read). But | |
347 | * sometimes filesystems call fscrypt_get_encryption_info() from within | |
348 | * a transaction, which ranks it below page faults. So we need a | |
349 | * separate lock which protects mk_secret but not also mk_users. | |
b1c0ec35 | 350 | */ |
22d94f49 | 351 | struct fscrypt_master_key_secret mk_secret; |
23c688b5 | 352 | struct rw_semaphore mk_secret_sem; |
22d94f49 | 353 | |
5dae460c EB |
354 | /* |
355 | * For v1 policy keys: an arbitrary key descriptor which was assigned by | |
356 | * userspace (->descriptor). | |
357 | * | |
358 | * For v2 policy keys: a cryptographic hash of this key (->identifier). | |
359 | */ | |
22d94f49 EB |
360 | struct fscrypt_key_specifier mk_spec; |
361 | ||
23c688b5 EB |
362 | /* |
363 | * Keyring which contains a key of type 'key_type_fscrypt_user' for each | |
364 | * user who has added this key. Normally each key will be added by just | |
365 | * one user, but it's possible that multiple users share a key, and in | |
366 | * that case we need to keep track of those users so that one user can't | |
367 | * remove the key before the others want it removed too. | |
368 | * | |
369 | * This is NULL for v1 policy keys; those can only be added by root. | |
370 | * | |
371 | * Locking: in addition to this keyrings own semaphore, this is | |
372 | * protected by the master key's key->sem, so we can do atomic | |
373 | * search+insert. It can also be searched without taking any locks, but | |
374 | * in that case the returned key may have already been removed. | |
375 | */ | |
376 | struct key *mk_users; | |
377 | ||
b1c0ec35 EB |
378 | /* |
379 | * Length of ->mk_decrypted_inodes, plus one if mk_secret is present. | |
380 | * Once this goes to 0, the master key is removed from ->s_master_keys. | |
381 | * The 'struct fscrypt_master_key' will continue to live as long as the | |
382 | * 'struct key' whose payload it is, but we won't let this reference | |
383 | * count rise again. | |
384 | */ | |
385 | refcount_t mk_refcount; | |
386 | ||
387 | /* | |
388 | * List of inodes that were unlocked using this key. This allows the | |
389 | * inodes to be evicted efficiently if the key is removed. | |
390 | */ | |
391 | struct list_head mk_decrypted_inodes; | |
392 | spinlock_t mk_decrypted_inodes_lock; | |
393 | ||
b103fb76 | 394 | /* |
e3b1078b EB |
395 | * Per-mode encryption keys for the various types of encryption policies |
396 | * that use them. Allocated and derived on-demand. | |
b103fb76 | 397 | */ |
e3b1078b EB |
398 | struct crypto_skcipher *mk_direct_keys[__FSCRYPT_MODE_MAX + 1]; |
399 | struct crypto_skcipher *mk_iv_ino_lblk_64_keys[__FSCRYPT_MODE_MAX + 1]; | |
400 | struct crypto_skcipher *mk_iv_ino_lblk_32_keys[__FSCRYPT_MODE_MAX + 1]; | |
401 | ||
402 | /* Hash key for inode numbers. Initialized only when needed. */ | |
403 | siphash_key_t mk_ino_hash_key; | |
404 | bool mk_ino_hash_key_initialized; | |
5dae460c | 405 | |
22d94f49 EB |
406 | } __randomize_layout; |
407 | ||
b1c0ec35 EB |
408 | static inline bool |
409 | is_master_key_secret_present(const struct fscrypt_master_key_secret *secret) | |
410 | { | |
411 | /* | |
412 | * The READ_ONCE() is only necessary for fscrypt_drop_inode() and | |
413 | * fscrypt_key_describe(). These run in atomic context, so they can't | |
23c688b5 EB |
414 | * take ->mk_secret_sem and thus 'secret' can change concurrently which |
415 | * would be a data race. But they only need to know whether the secret | |
416 | * *was* present at the time of check, so READ_ONCE() suffices. | |
b1c0ec35 EB |
417 | */ |
418 | return READ_ONCE(secret->size) != 0; | |
419 | } | |
420 | ||
22d94f49 EB |
421 | static inline const char *master_key_spec_type( |
422 | const struct fscrypt_key_specifier *spec) | |
423 | { | |
424 | switch (spec->type) { | |
425 | case FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR: | |
426 | return "descriptor"; | |
5dae460c EB |
427 | case FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER: |
428 | return "identifier"; | |
22d94f49 EB |
429 | } |
430 | return "[unknown]"; | |
431 | } | |
432 | ||
433 | static inline int master_key_spec_len(const struct fscrypt_key_specifier *spec) | |
434 | { | |
435 | switch (spec->type) { | |
436 | case FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR: | |
437 | return FSCRYPT_KEY_DESCRIPTOR_SIZE; | |
5dae460c EB |
438 | case FSCRYPT_KEY_SPEC_TYPE_IDENTIFIER: |
439 | return FSCRYPT_KEY_IDENTIFIER_SIZE; | |
22d94f49 EB |
440 | } |
441 | return 0; | |
442 | } | |
443 | ||
60700902 | 444 | struct key * |
22d94f49 EB |
445 | fscrypt_find_master_key(struct super_block *sb, |
446 | const struct fscrypt_key_specifier *mk_spec); | |
447 | ||
cdeb21da EB |
448 | int fscrypt_add_test_dummy_key(struct super_block *sb, |
449 | struct fscrypt_key_specifier *key_spec); | |
450 | ||
60700902 EB |
451 | int fscrypt_verify_key_added(struct super_block *sb, |
452 | const u8 identifier[FSCRYPT_KEY_IDENTIFIER_SIZE]); | |
5ab7189a | 453 | |
60700902 | 454 | int __init fscrypt_init_keyring(void); |
22d94f49 | 455 | |
feed8258 | 456 | /* keysetup.c */ |
8094c3ce EB |
457 | |
458 | struct fscrypt_mode { | |
459 | const char *friendly_name; | |
460 | const char *cipher_str; | |
461 | int keysize; | |
462 | int ivsize; | |
ff73c2c0 | 463 | int logged_impl_name; |
8094c3ce EB |
464 | }; |
465 | ||
85af90e5 | 466 | extern struct fscrypt_mode fscrypt_modes[]; |
3ec4f2a6 | 467 | |
60700902 EB |
468 | struct crypto_skcipher *fscrypt_allocate_skcipher(struct fscrypt_mode *mode, |
469 | const u8 *raw_key, | |
470 | const struct inode *inode); | |
0109ce76 | 471 | |
60700902 | 472 | int fscrypt_set_per_file_enc_key(struct fscrypt_info *ci, const u8 *raw_key); |
0109ce76 | 473 | |
60700902 EB |
474 | int fscrypt_derive_dirhash_key(struct fscrypt_info *ci, |
475 | const struct fscrypt_master_key *mk); | |
aa408f83 | 476 | |
0109ce76 EB |
477 | /* keysetup_v1.c */ |
478 | ||
60700902 | 479 | void fscrypt_put_direct_key(struct fscrypt_direct_key *dk); |
0109ce76 | 480 | |
60700902 EB |
481 | int fscrypt_setup_v1_file_key(struct fscrypt_info *ci, |
482 | const u8 *raw_master_key); | |
483 | ||
484 | int fscrypt_setup_v1_file_key_via_subscribed_keyrings(struct fscrypt_info *ci); | |
0109ce76 | 485 | |
5dae460c EB |
486 | /* policy.c */ |
487 | ||
60700902 EB |
488 | bool fscrypt_policies_equal(const union fscrypt_policy *policy1, |
489 | const union fscrypt_policy *policy2); | |
490 | bool fscrypt_supported_policy(const union fscrypt_policy *policy_u, | |
491 | const struct inode *inode); | |
492 | int fscrypt_policy_from_context(union fscrypt_policy *policy_u, | |
493 | const union fscrypt_context *ctx_u, | |
494 | int ctx_size); | |
0109ce76 | 495 | |
3325bea5 | 496 | #endif /* _FSCRYPT_PRIVATE_H */ |