1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
4 #include <openssl/evp.h>
5 #include <openssl/sha.h>
9 #include "errno-util.h"
11 #include "hexdecoct.h"
12 #include "homework-fscrypt.h"
13 #include "homework-mount.h"
14 #include "homework-quota.h"
15 #include "memory-util.h"
16 #include "missing_keyctl.h"
17 #include "missing_syscall.h"
19 #include "mount-util.h"
20 #include "nulstr-util.h"
21 #include "openssl-util.h"
22 #include "parse-util.h"
23 #include "process-util.h"
24 #include "random-util.h"
26 #include "stdio-util.h"
28 #include "tmpfile-util.h"
29 #include "user-util.h"
30 #include "xattr-util.h"
32 static int fscrypt_upload_volume_key(
33 const uint8_t key_descriptor
[static FS_KEY_DESCRIPTOR_SIZE
],
34 const void *volume_key
,
35 size_t volume_key_size
,
38 _cleanup_free_
char *hex
= NULL
;
39 const char *description
;
40 struct fscrypt_key key
;
43 assert(key_descriptor
);
45 assert(volume_key_size
> 0);
47 if (volume_key_size
> sizeof(key
.raw
))
48 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Volume key too long.");
50 hex
= hexmem(key_descriptor
, FS_KEY_DESCRIPTOR_SIZE
);
54 description
= strjoina("fscrypt:", hex
);
56 key
= (struct fscrypt_key
) {
57 .size
= volume_key_size
,
59 memcpy(key
.raw
, volume_key
, volume_key_size
);
61 /* Upload to the kernel */
62 serial
= add_key("logon", description
, &key
, sizeof(key
), where
);
63 explicit_bzero_safe(&key
, sizeof(key
));
66 return log_error_errno(errno
, "Failed to install master key in keyring: %m");
68 log_info("Uploaded encryption key to kernel.");
73 static void calculate_key_descriptor(
76 uint8_t ret_key_descriptor
[static FS_KEY_DESCRIPTOR_SIZE
]) {
78 uint8_t hashed
[512 / 8] = {}, hashed2
[512 / 8] = {};
80 /* Derive the key descriptor from the volume key via double SHA512, in order to be compatible with e4crypt */
82 assert_se(SHA512(key
, key_size
, hashed
) == hashed
);
83 assert_se(SHA512(hashed
, sizeof(hashed
), hashed2
) == hashed2
);
85 assert_cc(sizeof(hashed2
) >= FS_KEY_DESCRIPTOR_SIZE
);
87 memcpy(ret_key_descriptor
, hashed2
, FS_KEY_DESCRIPTOR_SIZE
);
90 static int fscrypt_slot_try_one(
92 const void *salt
, size_t salt_size
,
93 const void *encrypted
, size_t encrypted_size
,
94 const uint8_t match_key_descriptor
[static FS_KEY_DESCRIPTOR_SIZE
],
95 void **ret_decrypted
, size_t *ret_decrypted_size
) {
98 _cleanup_(EVP_CIPHER_CTX_freep
) EVP_CIPHER_CTX
*context
= NULL
;
99 _cleanup_(erase_and_freep
) void *decrypted
= NULL
;
100 uint8_t key_descriptor
[FS_KEY_DESCRIPTOR_SIZE
];
101 int decrypted_size_out1
, decrypted_size_out2
;
102 uint8_t derived
[512 / 8] = {};
103 size_t decrypted_size
;
104 const EVP_CIPHER
*cc
;
109 assert(salt_size
> 0);
111 assert(encrypted_size
> 0);
112 assert(match_key_descriptor
);
114 /* Our construction is like this:
116 * 1. In each key slot we store a salt value plus the encrypted volume key
118 * 2. Unlocking is via calculating PBKDF2-HMAC-SHA512 of the supplied password (in combination with
119 * the salt), then using the first 256 bit of the hash as key for decrypting the encrypted
120 * volume key in AES256 counter mode.
122 * 3. Writing a password is similar: calculate PBKDF2-HMAC-SHA512 of the supplied password (in
123 * combination with the salt), then encrypt the volume key in AES256 counter mode with the
127 if (PKCS5_PBKDF2_HMAC(
128 password
, strlen(password
),
130 0xFFFF, EVP_sha512(),
131 sizeof(derived
), derived
) != 1) {
132 r
= log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
), "PBKDF2 failed");
136 context
= EVP_CIPHER_CTX_new();
142 /* We use AES256 in counter mode */
143 assert_se(cc
= EVP_aes_256_ctr());
145 /* We only use the first half of the derived key */
146 assert(sizeof(derived
) >= (size_t) EVP_CIPHER_key_length(cc
));
148 if (EVP_DecryptInit_ex(context
, cc
, NULL
, derived
, NULL
) != 1) {
149 r
= log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Failed to initialize decryption context.");
153 /* Flush out the derived key now, we don't need it anymore */
154 explicit_bzero_safe(derived
, sizeof(derived
));
156 decrypted_size
= encrypted_size
+ EVP_CIPHER_key_length(cc
) * 2;
157 decrypted
= malloc(decrypted_size
);
161 if (EVP_DecryptUpdate(context
, (uint8_t*) decrypted
, &decrypted_size_out1
, encrypted
, encrypted_size
) != 1)
162 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Failed to decrypt volume key.");
164 assert((size_t) decrypted_size_out1
<= decrypted_size
);
166 if (EVP_DecryptFinal_ex(context
, (uint8_t*) decrypted_size
+ decrypted_size_out1
, &decrypted_size_out2
) != 1)
167 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Failed to finish decryption of volume key.");
169 assert((size_t) decrypted_size_out1
+ (size_t) decrypted_size_out2
< decrypted_size
);
170 decrypted_size
= (size_t) decrypted_size_out1
+ (size_t) decrypted_size_out2
;
172 calculate_key_descriptor(decrypted
, decrypted_size
, key_descriptor
);
174 if (memcmp(key_descriptor
, match_key_descriptor
, FS_KEY_DESCRIPTOR_SIZE
) != 0)
175 return -ENOANO
; /* don't log here */
177 r
= fscrypt_upload_volume_key(key_descriptor
, decrypted
, decrypted_size
, KEY_SPEC_THREAD_KEYRING
);
182 *ret_decrypted
= TAKE_PTR(decrypted
);
183 if (ret_decrypted_size
)
184 *ret_decrypted_size
= decrypted_size
;
189 explicit_bzero_safe(derived
, sizeof(derived
));
193 static int fscrypt_slot_try_many(
195 const void *salt
, size_t salt_size
,
196 const void *encrypted
, size_t encrypted_size
,
197 const uint8_t match_key_descriptor
[static FS_KEY_DESCRIPTOR_SIZE
],
198 void **ret_decrypted
, size_t *ret_decrypted_size
) {
203 STRV_FOREACH(i
, passwords
) {
204 r
= fscrypt_slot_try_one(*i
, salt
, salt_size
, encrypted
, encrypted_size
, match_key_descriptor
, ret_decrypted
, ret_decrypted_size
);
212 static int fscrypt_setup(
213 const PasswordCache
*cache
,
216 void **ret_volume_key
,
217 size_t *ret_volume_key_size
) {
219 _cleanup_free_
char *xattr_buf
= NULL
;
224 assert(setup
->root_fd
>= 0);
226 r
= flistxattr_malloc(setup
->root_fd
, &xattr_buf
);
228 return log_error_errno(errno
, "Failed to retrieve xattr list: %m");
230 NULSTR_FOREACH(xa
, xattr_buf
) {
231 _cleanup_free_
void *salt
= NULL
, *encrypted
= NULL
;
232 _cleanup_free_
char *value
= NULL
;
233 size_t salt_size
, encrypted_size
;
238 /* Check if this xattr has the format 'trusted.fscrypt_slot<nr>' where '<nr>' is a 32bit unsigned integer */
239 nr
= startswith(xa
, "trusted.fscrypt_slot");
242 if (safe_atou32(nr
, NULL
) < 0)
245 n
= fgetxattr_malloc(setup
->root_fd
, xa
, &value
);
246 if (n
== -ENODATA
) /* deleted by now? */
249 return log_error_errno(n
, "Failed to read %s xattr: %m", xa
);
251 e
= memchr(value
, ':', n
);
253 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "xattr %s lacks ':' separator: %m", xa
);
255 r
= unbase64mem(value
, e
- value
, &salt
, &salt_size
);
257 return log_error_errno(r
, "Failed to decode salt of %s: %m", xa
);
258 r
= unbase64mem(e
+1, n
- (e
- value
) - 1, &encrypted
, &encrypted_size
);
260 return log_error_errno(r
, "Failed to decode encrypted key of %s: %m", xa
);
263 FOREACH_POINTER(list
, cache
->pkcs11_passwords
, cache
->fido2_passwords
, password
) {
264 r
= fscrypt_slot_try_many(
267 encrypted
, encrypted_size
,
268 setup
->fscrypt_key_descriptor
,
269 ret_volume_key
, ret_volume_key_size
);
280 return log_error_errno(SYNTHETIC_ERRNO(ENOKEY
), "Failed to set up home directory with provided passwords.");
283 int home_setup_fscrypt(
286 const PasswordCache
*cache
) {
288 _cleanup_(erase_and_freep
) void *volume_key
= NULL
;
289 struct fscrypt_policy policy
= {};
290 size_t volume_key_size
= 0;
295 assert(user_record_storage(h
) == USER_FSCRYPT
);
297 assert(setup
->root_fd
< 0);
299 assert_se(ip
= user_record_image_path(h
));
301 setup
->root_fd
= open(ip
, O_RDONLY
|O_CLOEXEC
|O_DIRECTORY
);
302 if (setup
->root_fd
< 0)
303 return log_error_errno(errno
, "Failed to open home directory: %m");
305 if (ioctl(setup
->root_fd
, FS_IOC_GET_ENCRYPTION_POLICY
, &policy
) < 0) {
306 if (errno
== ENODATA
)
307 return log_error_errno(errno
, "Home directory %s is not encrypted.", ip
);
308 if (ERRNO_IS_NOT_SUPPORTED(errno
)) {
309 log_error_errno(errno
, "File system does not support fscrypt: %m");
310 return -ENOLINK
; /* make recognizable */
312 return log_error_errno(errno
, "Failed to acquire encryption policy of %s: %m", ip
);
315 memcpy(setup
->fscrypt_key_descriptor
, policy
.master_key_descriptor
, FS_KEY_DESCRIPTOR_SIZE
);
326 /* Also install the access key in the user's own keyring */
328 if (uid_is_valid(h
->uid
)) {
329 r
= safe_fork("(sd-addkey)",
330 FORK_RESET_SIGNALS
|FORK_CLOSE_ALL_FDS
|FORK_DEATHSIG
|FORK_LOG
|FORK_WAIT
|FORK_REOPEN_LOG
,
333 return log_error_errno(r
, "Failed install encryption key in user's keyring: %m");
339 gid
= user_record_gid(h
);
340 if (setresgid(gid
, gid
, gid
) < 0) {
341 log_error_errno(errno
, "Failed to change GID to " GID_FMT
": %m", gid
);
345 if (setgroups(0, NULL
) < 0) {
346 log_error_errno(errno
, "Failed to reset auxiliary groups list: %m");
350 if (setresuid(h
->uid
, h
->uid
, h
->uid
) < 0) {
351 log_error_errno(errno
, "Failed to change UID to " UID_FMT
": %m", h
->uid
);
355 r
= fscrypt_upload_volume_key(
356 setup
->fscrypt_key_descriptor
,
359 KEY_SPEC_USER_KEYRING
);
367 /* We'll bind mount the image directory to a new mount point where we'll start adjusting it. Only
368 * once that's complete we'll move the thing to its final place eventually. */
369 r
= home_unshare_and_mkdir();
373 r
= mount_follow_verbose(LOG_ERR
, ip
, HOME_RUNTIME_WORK_DIR
, NULL
, MS_BIND
, NULL
);
377 setup
->undo_mount
= true;
379 /* Turn off any form of propagation for this */
380 r
= mount_nofollow_verbose(LOG_ERR
, NULL
, HOME_RUNTIME_WORK_DIR
, NULL
, MS_PRIVATE
, NULL
);
384 /* Adjust MS_SUID and similar flags */
385 r
= mount_nofollow_verbose(LOG_ERR
, NULL
, HOME_RUNTIME_WORK_DIR
, NULL
, MS_BIND
|MS_REMOUNT
|user_record_mount_flags(h
), NULL
);
389 safe_close(setup
->root_fd
);
390 setup
->root_fd
= open(HOME_RUNTIME_WORK_DIR
, O_RDONLY
|O_CLOEXEC
|O_DIRECTORY
|O_NOFOLLOW
);
391 if (setup
->root_fd
< 0)
392 return log_error_errno(errno
, "Failed to open home directory: %m");
397 static int fscrypt_slot_set(
399 const void *volume_key
,
400 size_t volume_key_size
,
401 const char *password
,
404 _cleanup_free_
char *salt_base64
= NULL
, *encrypted_base64
= NULL
, *joined
= NULL
;
405 char label
[STRLEN("trusted.fscrypt_slot") + DECIMAL_STR_MAX(nr
) + 1];
406 _cleanup_(EVP_CIPHER_CTX_freep
) EVP_CIPHER_CTX
*context
= NULL
;
407 int r
, encrypted_size_out1
, encrypted_size_out2
;
408 uint8_t salt
[64], derived
[512 / 8] = {};
409 _cleanup_free_
void *encrypted
= NULL
;
410 const EVP_CIPHER
*cc
;
411 size_t encrypted_size
;
413 r
= genuine_random_bytes(salt
, sizeof(salt
), RANDOM_BLOCK
);
415 return log_error_errno(r
, "Failed to generate salt: %m");
417 if (PKCS5_PBKDF2_HMAC(
418 password
, strlen(password
),
420 0xFFFF, EVP_sha512(),
421 sizeof(derived
), derived
) != 1) {
422 r
= log_error_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE
), "PBKDF2 failed");
426 context
= EVP_CIPHER_CTX_new();
432 /* We use AES256 in counter mode */
433 cc
= EVP_aes_256_ctr();
435 /* We only use the first half of the derived key */
436 assert(sizeof(derived
) >= (size_t) EVP_CIPHER_key_length(cc
));
438 if (EVP_EncryptInit_ex(context
, cc
, NULL
, derived
, NULL
) != 1) {
439 r
= log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Failed to initialize encryption context.");
443 /* Flush out the derived key now, we don't need it anymore */
444 explicit_bzero_safe(derived
, sizeof(derived
));
446 encrypted_size
= volume_key_size
+ EVP_CIPHER_key_length(cc
) * 2;
447 encrypted
= malloc(encrypted_size
);
451 if (EVP_EncryptUpdate(context
, (uint8_t*) encrypted
, &encrypted_size_out1
, volume_key
, volume_key_size
) != 1)
452 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Failed to encrypt volume key.");
454 assert((size_t) encrypted_size_out1
<= encrypted_size
);
456 if (EVP_EncryptFinal_ex(context
, (uint8_t*) encrypted_size
+ encrypted_size_out1
, &encrypted_size_out2
) != 1)
457 return log_error_errno(SYNTHETIC_ERRNO(EINVAL
), "Failed to finish encryption of volume key.");
459 assert((size_t) encrypted_size_out1
+ (size_t) encrypted_size_out2
< encrypted_size
);
460 encrypted_size
= (size_t) encrypted_size_out1
+ (size_t) encrypted_size_out2
;
462 r
= base64mem(salt
, sizeof(salt
), &salt_base64
);
466 r
= base64mem(encrypted
, encrypted_size
, &encrypted_base64
);
470 joined
= strjoin(salt_base64
, ":", encrypted_base64
);
474 xsprintf(label
, "trusted.fscrypt_slot%" PRIu32
, nr
);
475 if (fsetxattr(root_fd
, label
, joined
, strlen(joined
), 0) < 0)
476 return log_error_errno(errno
, "Failed to write xattr %s: %m", label
);
478 log_info("Written key slot %s.", label
);
483 explicit_bzero_safe(derived
, sizeof(derived
));
487 int home_create_fscrypt(
490 char **effective_passwords
,
491 UserRecord
**ret_home
) {
493 _cleanup_(rm_rf_physical_and_freep
) char *temporary
= NULL
;
494 _cleanup_(user_record_unrefp
) UserRecord
*new_home
= NULL
;
495 _cleanup_(erase_and_freep
) void *volume_key
= NULL
;
496 _cleanup_close_
int mount_fd
= -1;
497 struct fscrypt_policy policy
= {};
498 size_t volume_key_size
= 512 / 8;
499 _cleanup_free_
char *d
= NULL
;
506 assert(user_record_storage(h
) == USER_FSCRYPT
);
510 assert_se(ip
= user_record_image_path(h
));
512 r
= tempfn_random(ip
, "homework", &d
);
514 return log_error_errno(r
, "Failed to allocate temporary directory: %m");
516 (void) mkdir_parents(d
, 0755);
518 if (mkdir(d
, 0700) < 0)
519 return log_error_errno(errno
, "Failed to create temporary home directory %s: %m", d
);
521 temporary
= TAKE_PTR(d
); /* Needs to be destroyed now */
523 r
= home_unshare_and_mkdir();
527 setup
->root_fd
= open(temporary
, O_RDONLY
|O_CLOEXEC
|O_DIRECTORY
|O_NOFOLLOW
);
528 if (setup
->root_fd
< 0)
529 return log_error_errno(errno
, "Failed to open temporary home directory: %m");
531 if (ioctl(setup
->root_fd
, FS_IOC_GET_ENCRYPTION_POLICY
, &policy
) < 0) {
532 if (ERRNO_IS_NOT_SUPPORTED(errno
)) {
533 log_error_errno(errno
, "File system does not support fscrypt: %m");
534 return -ENOLINK
; /* make recognizable */
536 if (errno
!= ENODATA
)
537 return log_error_errno(errno
, "Failed to get fscrypt policy of directory: %m");
539 return log_error_errno(SYNTHETIC_ERRNO(EBUSY
), "Parent of %s already encrypted, refusing.", d
);
541 volume_key
= malloc(volume_key_size
);
545 r
= genuine_random_bytes(volume_key
, volume_key_size
, RANDOM_BLOCK
);
547 return log_error_errno(r
, "Failed to acquire volume key: %m");
549 log_info("Generated volume key of size %zu.", volume_key_size
);
551 policy
= (struct fscrypt_policy
) {
552 .contents_encryption_mode
= FS_ENCRYPTION_MODE_AES_256_XTS
,
553 .filenames_encryption_mode
= FS_ENCRYPTION_MODE_AES_256_CTS
,
554 .flags
= FS_POLICY_FLAGS_PAD_32
,
557 calculate_key_descriptor(volume_key
, volume_key_size
, policy
.master_key_descriptor
);
559 r
= fscrypt_upload_volume_key(policy
.master_key_descriptor
, volume_key
, volume_key_size
, KEY_SPEC_THREAD_KEYRING
);
563 log_info("Uploaded volume key to kernel.");
565 if (ioctl(setup
->root_fd
, FS_IOC_SET_ENCRYPTION_POLICY
, &policy
) < 0)
566 return log_error_errno(errno
, "Failed to set fscrypt policy on directory: %m");
568 log_info("Encryption policy set.");
570 STRV_FOREACH(i
, effective_passwords
) {
571 r
= fscrypt_slot_set(setup
->root_fd
, volume_key
, volume_key_size
, *i
, nr
);
578 (void) home_update_quota_classic(h
, temporary
);
580 r
= home_shift_uid(setup
->root_fd
, HOME_RUNTIME_WORK_DIR
, h
->uid
, h
->uid
, &mount_fd
);
582 setup
->undo_mount
= true; /* If uidmaps worked we have a mount to undo again */
585 /* If we have established a new mount, then we can use that as new root fd to our home directory. */
586 safe_close(setup
->root_fd
);
588 setup
->root_fd
= fd_reopen(mount_fd
, O_RDONLY
|O_CLOEXEC
|O_DIRECTORY
);
589 if (setup
->root_fd
< 0)
590 return log_error_errno(setup
->root_fd
, "Unable to convert mount fd into proper directory fd: %m");
592 mount_fd
= safe_close(mount_fd
);
595 r
= home_populate(h
, setup
->root_fd
);
599 r
= home_sync_and_statfs(setup
->root_fd
, NULL
);
603 r
= user_record_clone(h
, USER_RECORD_LOAD_MASK_SECRET
|USER_RECORD_PERMISSIVE
, &new_home
);
605 return log_error_errno(r
, "Failed to clone record: %m");
607 r
= user_record_add_binding(
622 return log_error_errno(r
, "Failed to add binding to record: %m");
624 setup
->root_fd
= safe_close(setup
->root_fd
);
626 r
= home_setup_undo_mount(setup
, LOG_ERR
);
630 if (rename(temporary
, ip
) < 0)
631 return log_error_errno(errno
, "Failed to rename %s to %s: %m", temporary
, ip
);
633 temporary
= mfree(temporary
);
635 log_info("Everything completed.");
637 *ret_home
= TAKE_PTR(new_home
);
641 int home_passwd_fscrypt(
644 const PasswordCache
*cache
, /* the passwords acquired via PKCS#11/FIDO2 security tokens */
645 char **effective_passwords
/* new passwords */) {
647 _cleanup_(erase_and_freep
) void *volume_key
= NULL
;
648 _cleanup_free_
char *xattr_buf
= NULL
;
649 size_t volume_key_size
= 0;
656 assert(user_record_storage(h
) == USER_FSCRYPT
);
668 STRV_FOREACH(p
, effective_passwords
) {
669 r
= fscrypt_slot_set(setup
->root_fd
, volume_key
, volume_key_size
, *p
, slot
);
676 r
= flistxattr_malloc(setup
->root_fd
, &xattr_buf
);
678 return log_error_errno(errno
, "Failed to retrieve xattr list: %m");
680 NULSTR_FOREACH(xa
, xattr_buf
) {
684 /* Check if this xattr has the format 'trusted.fscrypt_slot<nr>' where '<nr>' is a 32bit unsigned integer */
685 nr
= startswith(xa
, "trusted.fscrypt_slot");
688 if (safe_atou32(nr
, &z
) < 0)
694 if (fremovexattr(setup
->root_fd
, xa
) < 0)
695 if (errno
!= ENODATA
)
696 log_warning_errno(errno
, "Failed to remove xattr %s: %m", xa
);