• Eric Biggers's avatar
    fscrypt: add FS_IOC_GET_ENCRYPTION_NONCE ioctl · e98ad464
    Eric Biggers authored
    Add an ioctl FS_IOC_GET_ENCRYPTION_NONCE which retrieves the nonce from
    an encrypted file or directory.  The nonce is the 16-byte random value
    stored in the inode's encryption xattr.  It is normally used together
    with the master key to derive the inode's actual encryption key.
    
    The nonces are needed by automated tests that verify the correctness of
    the ciphertext on-disk.  Except for the IV_INO_LBLK_64 case, there's no
    way to replicate a file's ciphertext without knowing that file's nonce.
    
    The nonces aren't secret, and the existing ciphertext verification tests
    in xfstests retrieve them from disk using debugfs or dump.f2fs.  But in
    environments that lack these debugging tools, getting the nonces by
    manually parsing the filesystem structure would be very hard.
    
    To make this important type of testing much easier, let's just add an
    ioctl that retrieves the nonce.
    
    Link: https://lore.kernel.org/r/20200314205052.93294-2-ebiggers@kernel.orgReviewed-by: default avatarTheodore Ts'o <tytso@mit.edu>
    Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
    e98ad464
keysetup.c 15.2 KB