mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-09-18 22:59:29 +02:00
Eric Biggers
5acc6f649a
For encrypting and decrypting file contents on block-based filesystems (i.e., ext4 and f2fs, but not ceph and ubifs), always use blk-crypto instead of fs-layer crypto (direct use of crypto_skcipher). Since the blk-crypto API provides a fallback to CPU-based encryption, it's all that's needed on block-based filesystems. The support for two alternative block-based file contents encryption implementations, fs-layer and blk-crypto, existed mainly for historical reasons, as the fs-layer path came first. Some of it is also still needed for the non-block-based filesystems, but a lot of it isn't. Removing the duplicate fs-layer code paths greatly simplifies the code, most of which is done in later commits. Specific implementation details: - SB_INLINECRYPT now controls whether blk_crypto_config::allow_hw is set to true, instead of whether blk-crypto is used at all. The effect is that the semantics are preserved: the inlinecrypt mount option selects the use of inline encryption hardware instead of the CPU. - Set up a blk_crypto_key iff the file is a regular file on a block-based filesystem. To determine whether the filesystem is block-based, add a bit fscrypt_operations::is_block_based. - Remove fscrypt_select_encryption_impl(). Move the logging logic that was previously there into fscrypt_prepare_inline_crypt_key(). Note that blk_crypto_config_supported() is no longer needed. Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/20260713023708.9245-6-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
41 lines
1.5 KiB
Plaintext
41 lines
1.5 KiB
Plaintext
# SPDX-License-Identifier: GPL-2.0-only
|
|
config FS_ENCRYPTION
|
|
bool "FS Encryption (Per-file encryption)"
|
|
select BLK_INLINE_ENCRYPTION if BLOCK
|
|
select BLK_INLINE_ENCRYPTION_FALLBACK if BLOCK
|
|
select CRYPTO
|
|
select CRYPTO_SKCIPHER
|
|
select CRYPTO_LIB_AES
|
|
select CRYPTO_LIB_SHA256
|
|
select CRYPTO_LIB_SHA512
|
|
select KEYS
|
|
help
|
|
Enable encryption of files and directories. This
|
|
feature is similar to ecryptfs, but it is more memory
|
|
efficient since it avoids caching the encrypted and
|
|
decrypted pages in the page cache. Currently Ext4,
|
|
F2FS, UBIFS, and CephFS make use of this feature.
|
|
|
|
# Filesystems supporting encryption must select this if FS_ENCRYPTION. This
|
|
# allows the algorithms to be built as modules when all the filesystems are,
|
|
# whereas selecting them from FS_ENCRYPTION would force them to be built-in.
|
|
#
|
|
# Note: this option only pulls in the algorithms that filesystem encryption
|
|
# needs "by default". If userspace will use "non-default" encryption modes such
|
|
# as Adiantum encryption, then those other modes need to be explicitly enabled
|
|
# in the crypto API; see Documentation/filesystems/fscrypt.rst for details.
|
|
#
|
|
# Also note that this option only pulls in the generic implementations of the
|
|
# algorithms, not any per-architecture optimized implementations. It is
|
|
# strongly recommended to enable optimized implementations too.
|
|
config FS_ENCRYPTION_ALGS
|
|
tristate
|
|
select CRYPTO_AES
|
|
select CRYPTO_CBC
|
|
select CRYPTO_CTS
|
|
select CRYPTO_XTS
|
|
|
|
config FS_ENCRYPTION_INLINE_CRYPT
|
|
bool
|
|
default y if FS_ENCRYPTION && BLOCK
|