1 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ 2 /* 3 * fscrypt user API 4 * 5 * These ioctls can be used on filesystems that support fscrypt. See the 6 * "User API" section of Documentation/filesystems/fscrypt.rst. 7 */ 8 #ifndef _UAPI_LINUX_FSCRYPT_H 9 #define _UAPI_LINUX_FSCRYPT_H 10 11 #include <linux/types.h> 12 13 #define FSCRYPT_KEY_DESCRIPTOR_SIZE 8 14 15 /* Encryption policy flags */ 16 #define FSCRYPT_POLICY_FLAGS_PAD_4 0x00 17 #define FSCRYPT_POLICY_FLAGS_PAD_8 0x01 18 #define FSCRYPT_POLICY_FLAGS_PAD_16 0x02 19 #define FSCRYPT_POLICY_FLAGS_PAD_32 0x03 20 #define FSCRYPT_POLICY_FLAGS_PAD_MASK 0x03 21 #define FSCRYPT_POLICY_FLAG_DIRECT_KEY 0x04 /* use master key directly */ 22 #define FSCRYPT_POLICY_FLAGS_VALID 0x07 23 24 /* Encryption algorithms */ 25 #define FSCRYPT_MODE_AES_256_XTS 1 26 #define FSCRYPT_MODE_AES_256_CTS 4 27 #define FSCRYPT_MODE_AES_128_CBC 5 28 #define FSCRYPT_MODE_AES_128_CTS 6 29 #define FSCRYPT_MODE_ADIANTUM 9 30 31 struct fscrypt_policy { 32 __u8 version; 33 __u8 contents_encryption_mode; 34 __u8 filenames_encryption_mode; 35 __u8 flags; 36 __u8 master_key_descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE]; 37 }; 38 39 /* 40 * Process-subscribed "logon" key description prefix and payload format. 41 * Deprecated; prefer FS_IOC_ADD_ENCRYPTION_KEY instead. 42 */ 43 #define FSCRYPT_KEY_DESC_PREFIX "fscrypt:" 44 #define FSCRYPT_KEY_DESC_PREFIX_SIZE 8 45 #define FSCRYPT_MAX_KEY_SIZE 64 46 struct fscrypt_key { 47 __u32 mode; 48 __u8 raw[FSCRYPT_MAX_KEY_SIZE]; 49 __u32 size; 50 }; 51 52 /* 53 * Keys are specified by an arbitrary 8-byte key "descriptor", 54 * matching fscrypt_policy::master_key_descriptor. 55 */ 56 #define FSCRYPT_KEY_SPEC_TYPE_DESCRIPTOR 1 57 58 /* 59 * Specifies a key. This doesn't contain the actual key itself; this is just 60 * the "name" of the key. 61 */ 62 struct fscrypt_key_specifier { 63 __u32 type; /* one of FSCRYPT_KEY_SPEC_TYPE_* */ 64 __u32 __reserved; 65 union { 66 __u8 __reserved[32]; /* reserve some extra space */ 67 __u8 descriptor[FSCRYPT_KEY_DESCRIPTOR_SIZE]; 68 } u; 69 }; 70 71 /* Struct passed to FS_IOC_ADD_ENCRYPTION_KEY */ 72 struct fscrypt_add_key_arg { 73 struct fscrypt_key_specifier key_spec; 74 __u32 raw_size; 75 __u32 __reserved[9]; 76 __u8 raw[]; 77 }; 78 79 /* Struct passed to FS_IOC_REMOVE_ENCRYPTION_KEY */ 80 struct fscrypt_remove_key_arg { 81 struct fscrypt_key_specifier key_spec; 82 #define FSCRYPT_KEY_REMOVAL_STATUS_FLAG_FILES_BUSY 0x00000001 83 __u32 removal_status_flags; /* output */ 84 __u32 __reserved[5]; 85 }; 86 87 /* Struct passed to FS_IOC_GET_ENCRYPTION_KEY_STATUS */ 88 struct fscrypt_get_key_status_arg { 89 /* input */ 90 struct fscrypt_key_specifier key_spec; 91 __u32 __reserved[6]; 92 93 /* output */ 94 #define FSCRYPT_KEY_STATUS_ABSENT 1 95 #define FSCRYPT_KEY_STATUS_PRESENT 2 96 #define FSCRYPT_KEY_STATUS_INCOMPLETELY_REMOVED 3 97 __u32 status; 98 __u32 __out_reserved[15]; 99 }; 100 101 #define FS_IOC_SET_ENCRYPTION_POLICY _IOR('f', 19, struct fscrypt_policy) 102 #define FS_IOC_GET_ENCRYPTION_PWSALT _IOW('f', 20, __u8[16]) 103 #define FS_IOC_GET_ENCRYPTION_POLICY _IOW('f', 21, struct fscrypt_policy) 104 #define FS_IOC_ADD_ENCRYPTION_KEY _IOWR('f', 23, struct fscrypt_add_key_arg) 105 #define FS_IOC_REMOVE_ENCRYPTION_KEY _IOWR('f', 24, struct fscrypt_remove_key_arg) 106 #define FS_IOC_GET_ENCRYPTION_KEY_STATUS _IOWR('f', 26, struct fscrypt_get_key_status_arg) 107 108 /**********************************************************************/ 109 110 /* old names; don't add anything new here! */ 111 #ifndef __KERNEL__ 112 #define FS_KEY_DESCRIPTOR_SIZE FSCRYPT_KEY_DESCRIPTOR_SIZE 113 #define FS_POLICY_FLAGS_PAD_4 FSCRYPT_POLICY_FLAGS_PAD_4 114 #define FS_POLICY_FLAGS_PAD_8 FSCRYPT_POLICY_FLAGS_PAD_8 115 #define FS_POLICY_FLAGS_PAD_16 FSCRYPT_POLICY_FLAGS_PAD_16 116 #define FS_POLICY_FLAGS_PAD_32 FSCRYPT_POLICY_FLAGS_PAD_32 117 #define FS_POLICY_FLAGS_PAD_MASK FSCRYPT_POLICY_FLAGS_PAD_MASK 118 #define FS_POLICY_FLAG_DIRECT_KEY FSCRYPT_POLICY_FLAG_DIRECT_KEY 119 #define FS_POLICY_FLAGS_VALID FSCRYPT_POLICY_FLAGS_VALID 120 #define FS_ENCRYPTION_MODE_INVALID 0 /* never used */ 121 #define FS_ENCRYPTION_MODE_AES_256_XTS FSCRYPT_MODE_AES_256_XTS 122 #define FS_ENCRYPTION_MODE_AES_256_GCM 2 /* never used */ 123 #define FS_ENCRYPTION_MODE_AES_256_CBC 3 /* never used */ 124 #define FS_ENCRYPTION_MODE_AES_256_CTS FSCRYPT_MODE_AES_256_CTS 125 #define FS_ENCRYPTION_MODE_AES_128_CBC FSCRYPT_MODE_AES_128_CBC 126 #define FS_ENCRYPTION_MODE_AES_128_CTS FSCRYPT_MODE_AES_128_CTS 127 #define FS_ENCRYPTION_MODE_SPECK128_256_XTS 7 /* removed */ 128 #define FS_ENCRYPTION_MODE_SPECK128_256_CTS 8 /* removed */ 129 #define FS_ENCRYPTION_MODE_ADIANTUM FSCRYPT_MODE_ADIANTUM 130 #define FS_KEY_DESC_PREFIX FSCRYPT_KEY_DESC_PREFIX 131 #define FS_KEY_DESC_PREFIX_SIZE FSCRYPT_KEY_DESC_PREFIX_SIZE 132 #define FS_MAX_KEY_SIZE FSCRYPT_MAX_KEY_SIZE 133 #endif /* !__KERNEL__ */ 134 135 #endif /* _UAPI_LINUX_FSCRYPT_H */ 136