The kernel patches for metadata encryption are at: https://lore.kernel.org/linux-fscrypt/20201217150435.1505269-1-sat...@google.com/
This patch series implements the userspace changes required for metadata encryption support as implemented in the kernel changes above. All blocks in the filesystem are encrypted with the user provided metadata encryption key except for the superblock (and its redundant copy). The DUN for a block is its offset from the start of the filesystem. Patch 1 introduces two new options for mkfs.f2fs: '-A' to specify the encryption algorithm, and '-M' to specify the encryption key. mkfs.f2fs will store the encryption algorithm and the key identifier of the key used for metadata encryption in the superblock itself. The rest of the tools will obtain the encryption algorithm and the key identifier from the superblock of the FS, and don't need any new options. Patch 2 is an attempt at getting metadata encryption to work with sparse mode. It is currently untested because I haven't yet figured out how to set up the environment to compile and test sparse mode, but I've included it here in case there are already objections to the approach. Limitations: This patch requires the metadata encryption key to be readable from userspace, and does not ensure that it is zeroed before the program exits for any reason. Changes v1 => v2: - update userspace tools to work with the kernel changes for v2 - mkfs.f2fs stores the metadata crypt key identifier in the superblock, and the remaining tools use it to obtain the metadata encryption key. As such, only mkfs.f2fs requires new options. - use libkcapi for all encryption tasks. - updated man pages - cleanups and improved docs/error messages - added an attempt to make metadata encryption work with sparse mode Satya Tangirala (2): f2fs-tools: Introduce metadata encryption support libf2fs_io: Make metadata encryption work with sparse mode README | 2 + configure.ac | 2 + fsck/main.c | 2 + fsck/mount.c | 27 +++- include/f2fs_fs.h | 21 ++- include/f2fs_metadata_crypt.h | 33 ++++ lib/Makefile.am | 4 +- lib/f2fs_metadata_crypt.c | 284 ++++++++++++++++++++++++++++++++++ lib/libf2fs.c | 3 - lib/libf2fs_io.c | 189 +++++++++++++++++++--- man/fsck.f2fs.8 | 5 +- man/mkfs.f2fs.8 | 44 ++++++ mkfs/f2fs_format.c | 8 +- mkfs/f2fs_format_main.c | 35 ++++- 14 files changed, 624 insertions(+), 35 deletions(-) create mode 100644 include/f2fs_metadata_crypt.h create mode 100644 lib/f2fs_metadata_crypt.c -- 2.29.2.729.g45daf8777d-goog _______________________________________________ Linux-f2fs-devel mailing list Linux-f2fs-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
