[f2fs-dev] [PATCH v2 0/2] userspace support for metadata encryption.

[Satya Tangirala via Linux-f2fs-devel <linux-f2fs-devel@lists.sourceforge.net>]

The kernel patches for metadata encryption are at:
https://lore.kernel.org/linux-fscrypt/20201217150435.1505269-1-satyat@google.com/

This patch series implements the userspace changes required for metadata
encryption support as implemented in the kernel changes above. All blocks
in the filesystem are encrypted with the user provided metadata encryption
key except for the superblock (and its redundant copy). The DUN for a block
is its offset from the start of the filesystem.

Patch 1 introduces two new options for mkfs.f2fs: '-A' to specify the
encryption algorithm, and '-M' to specify the encryption key.
mkfs.f2fs will store the encryption algorithm and the key identifier of the
key used for metadata encryption in the superblock itself. The rest of the
tools will obtain the encryption algorithm and the key identifier from the
superblock of the FS, and don't need any new options.

Patch 2 is an attempt at getting metadata encryption to work with sparse
mode. It is currently untested because I haven't yet figured out how to set
up the environment to compile and test sparse mode, but I've included it
here in case there are already objections to the approach.

Limitations: 
This patch requires the metadata encryption key to be readable from
userspace, and does not ensure that it is zeroed before the program exits
for any reason.

Changes v1 => v2:
 - update userspace tools to work with the kernel changes for v2
 - mkfs.f2fs stores the metadata crypt key identifier in the superblock,
   and the remaining tools use it to obtain the metadata encryption key.
   As such, only mkfs.f2fs requires new options.
 - use libkcapi for all encryption tasks.
 - updated man pages
 - cleanups and improved docs/error messages
 - added an attempt to make metadata encryption work with sparse mode


Satya Tangirala (2):
  f2fs-tools: Introduce metadata encryption support
  libf2fs_io: Make metadata encryption work with sparse mode

 README                        |   2 +
 configure.ac                  |   2 +
 fsck/main.c                   |   2 +
 fsck/mount.c                  |  27 +++-
 include/f2fs_fs.h             |  21 ++-
 include/f2fs_metadata_crypt.h |  33 ++++
 lib/Makefile.am               |   4 +-
 lib/f2fs_metadata_crypt.c     | 284 ++++++++++++++++++++++++++++++++++
 lib/libf2fs.c                 |   3 -
 lib/libf2fs_io.c              | 189 +++++++++++++++++++---
 man/fsck.f2fs.8               |   5 +-
 man/mkfs.f2fs.8               |  44 ++++++
 mkfs/f2fs_format.c            |   8 +-
 mkfs/f2fs_format_main.c       |  35 ++++-
 14 files changed, 624 insertions(+), 35 deletions(-)
 create mode 100644 include/f2fs_metadata_crypt.h
 create mode 100644 lib/f2fs_metadata_crypt.c

-- 
2.29.2.729.g45daf8777d-goog



_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel