5ab7189a31
By looking up the master keys in a filesystem-level keyring rather than in the calling processes' key hierarchy, it becomes possible for a user to set an encryption policy which refers to some key they don't actually know, then encrypt their files using that key. Cryptographically this isn't much of a problem, but the semantics of this would be a bit weird. Thus, enforce that a v2 encryption policy can only be set if the user has previously added the key, or has capable(CAP_FOWNER). We tolerate that this problem will continue to exist for v1 encryption policies, however; there is no way around that. Reviewed-by: Theodore Ts'o <tytso@mit.edu> Signed-off-by: Eric Biggers <ebiggers@google.com> |
||
|---|---|---|
| .. | ||
| bio.c | ||
| crypto.c | ||
| fname.c | ||
| fscrypt_private.h | ||
| hkdf.c | ||
| hooks.c | ||
| Kconfig | ||
| keyring.c | ||
| keysetup_v1.c | ||
| keysetup.c | ||
| Makefile | ||
| policy.c | ||