mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-10-31 05:15:34 +00:00
1ebd4a3c09
Until this point, the kernel can use hardware-wrapped keys to do encryption if userspace provides one -- specifically a key in ephemerally-wrapped form. However, no generic way has been provided for userspace to get such a key in the first place. Getting such a key is a two-step process. First, the key needs to be imported from a raw key or generated by the hardware, producing a key in long-term wrapped form. This happens once in the whole lifetime of the key. Second, the long-term wrapped key needs to be converted into ephemerally-wrapped form. This happens each time the key is "unlocked". In Android, these operations are supported in a generic way through KeyMint, a userspace abstraction layer. However, that method is Android-specific and can't be used on other Linux systems, may rely on proprietary libraries, and also misleads people into supporting KeyMint features like rollback resistance that make sense for other KeyMint keys but don't make sense for hardware-wrapped inline encryption keys. Therefore, this patch provides a generic kernel interface for these operations by introducing new block device ioctls: - BLKCRYPTOIMPORTKEY: convert a raw key to long-term wrapped form. - BLKCRYPTOGENERATEKEY: have the hardware generate a new key, then return it in long-term wrapped form. - BLKCRYPTOPREPAREKEY: convert a key from long-term wrapped form to ephemerally-wrapped form. These ioctls are implemented using new operations in blk_crypto_ll_ops. Signed-off-by: Eric Biggers <ebiggers@google.com> Tested-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> # sm8650 Link: https://lore.kernel.org/r/20250204060041.409950-4-ebiggers@kernel.org Signed-off-by: Jens Axboe <axboe@kernel.dk> |
History
|
|
|---|---|---|
| .. | ||
| accelerators | ||
| ebpf | ||
| gpio | ||
| ioctl | ||
| media | ||
| netlink | ||
| check_exec.rst | ||
| dcdbas.rst | ||
| dma-buf-alloc-exchange.rst | ||
| ELF.rst | ||
| futex2.rst | ||
| index.rst | ||
| iommufd.rst | ||
| isapnp.rst | ||
| landlock.rst | ||
| lsm.rst | ||
| mfd_noexec.rst | ||
| mseal.rst | ||
| no_new_privs.rst | ||
| ntsync.rst | ||
| perf_ring_buffer.rst | ||
| seccomp_filter.rst | ||
| spec_ctrl.rst | ||
| sysfs-platform_profile.rst | ||
| tee.rst | ||
| unshare.rst | ||
| vduse.rst | ||