Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit df6ad33b authored by Tyler Hicks's avatar Tyler Hicks
Browse files

eCryptfs: Filename encryption only supports password auth tokens 



Returns -ENOTSUPP when attempting to use filename encryption with
something other than a password authentication token, such as a private
token from openssl.  Using filename encryption with a userspace eCryptfs
key module is a future goal.  Until then, this patch handles the
situation a little better than simply using a BUG_ON().

Acked-by: default avatarSerge Hallyn <serue@us.ibm.com>
Cc: ecryptfs-devel@lists.launchpad.net
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarTyler Hicks <tyhicks@linux.vnet.ibm.com>
parent ac22ba23

fs/ecryptfs/crypto.c

+2 −2
Original line number Diff line number Diff line
@@ -1703,7 +1703,7 @@ ecryptfs_encrypt_filename(struct ecryptfs_filename *filename, 
	} else {

		printk(KERN_ERR "%s: No support for requested filename "

		       "encryption method in this release\n", __func__);

		rc = -ENOTSUPP;

		rc = -EOPNOTSUPP;

		goto out;

	}

out:
@@ -2168,7 +2168,7 @@ int ecryptfs_encrypt_and_encode_filename( 
			(*encoded_name)[(*encoded_name_size)] = '\0';

			(*encoded_name_size)++;

		} else {

			rc = -ENOTSUPP;

			rc = -EOPNOTSUPP;

		}

		if (rc) {

			printk(KERN_ERR "%s: Error attempting to encode "

fs/ecryptfs/keystore.c

+12 −2
Original line number Diff line number Diff line
@@ -612,7 +612,12 @@ ecryptfs_write_tag_70_packet(char *dest, size_t *remaining_bytes, 
	}

	/* TODO: Support other key modules than passphrase for

	 * filename encryption */

	BUG_ON(s->auth_tok->token_type != ECRYPTFS_PASSWORD);

	if (s->auth_tok->token_type != ECRYPTFS_PASSWORD) {

		rc = -EOPNOTSUPP;

		printk(KERN_INFO "%s: Filename encryption only supports "

		       "password tokens\n", __func__);

		goto out_free_unlock;

	}

	sg_init_one(

		&s->hash_sg,

		(u8 *)s->auth_tok->token.password.session_key_encryption_key,
@@ -910,7 +915,12 @@ ecryptfs_parse_tag_70_packet(char **filename, size_t *filename_size, 
	}

	/* TODO: Support other key modules than passphrase for

	 * filename encryption */

	BUG_ON(s->auth_tok->token_type != ECRYPTFS_PASSWORD);

	if (s->auth_tok->token_type != ECRYPTFS_PASSWORD) {

		rc = -EOPNOTSUPP;

		printk(KERN_INFO "%s: Filename encryption only supports "

		       "password tokens\n", __func__);

		goto out_free_unlock;

	}

	rc = crypto_blkcipher_setkey(

		s->desc.tfm,

		s->auth_tok->token.password.session_key_encryption_key,