Commit 09f5412c authored by Kees Cook's avatar Kees Cook Committed by Jonathan Corbet

doc: ReSTify keys-ecryptfs.txt

Adjusts for ReST markup and moves under keys security devel index.

Cc: David Howells <dhowells@redhat.com>
Cc: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarJonathan Corbet <corbet@lwn.net>
parent b68101a1
00-INDEX 00-INDEX
- this file. - this file.
keys-ecryptfs.txt
- description of the encryption keys for the ecryptfs filesystem.
keys-request-key.txt keys-request-key.txt
- description of the kernel key request service. - description of the kernel key request service.
keys-trusted-encrypted.txt keys-trusted-encrypted.txt
......
Encrypted keys for the eCryptfs filesystem ==========================================
Encrypted keys for the eCryptfs filesystem
==========================================
ECryptfs is a stacked filesystem which transparently encrypts and decrypts each ECryptfs is a stacked filesystem which transparently encrypts and decrypts each
file using a randomly generated File Encryption Key (FEK). file using a randomly generated File Encryption Key (FEK).
...@@ -35,20 +37,23 @@ controlled environment. Another advantage is that the key is not exposed to ...@@ -35,20 +37,23 @@ controlled environment. Another advantage is that the key is not exposed to
threats of malicious software, because it is available in clear form only at threats of malicious software, because it is available in clear form only at
kernel level. kernel level.
Usage: Usage::
keyctl add encrypted name "new ecryptfs key-type:master-key-name keylen" ring keyctl add encrypted name "new ecryptfs key-type:master-key-name keylen" ring
keyctl add encrypted name "load hex_blob" ring keyctl add encrypted name "load hex_blob" ring
keyctl update keyid "update key-type:master-key-name" keyctl update keyid "update key-type:master-key-name"
name:= '<16 hexadecimal characters>' Where::
key-type:= 'trusted' | 'user'
keylen:= 64 name:= '<16 hexadecimal characters>'
key-type:= 'trusted' | 'user'
keylen:= 64
Example of encrypted key usage with the eCryptfs filesystem: Example of encrypted key usage with the eCryptfs filesystem:
Create an encrypted key "1000100010001000" of length 64 bytes with format Create an encrypted key "1000100010001000" of length 64 bytes with format
'ecryptfs' and save it using a previously loaded user key "test": 'ecryptfs' and save it using a previously loaded user key "test"::
$ keyctl add encrypted 1000100010001000 "new ecryptfs user:test 64" @u $ keyctl add encrypted 1000100010001000 "new ecryptfs user:test 64" @u
19184530 19184530
...@@ -62,7 +67,7 @@ Create an encrypted key "1000100010001000" of length 64 bytes with format ...@@ -62,7 +67,7 @@ Create an encrypted key "1000100010001000" of length 64 bytes with format
$ keyctl pipe 19184530 > ecryptfs.blob $ keyctl pipe 19184530 > ecryptfs.blob
Mount an eCryptfs filesystem using the created encrypted key "1000100010001000" Mount an eCryptfs filesystem using the created encrypted key "1000100010001000"
into the '/secret' directory: into the '/secret' directory::
$ mount -i -t ecryptfs -oecryptfs_sig=1000100010001000,\ $ mount -i -t ecryptfs -oecryptfs_sig=1000100010001000,\
ecryptfs_cipher=aes,ecryptfs_key_bytes=32 /secret /secret ecryptfs_cipher=aes,ecryptfs_key_bytes=32 /secret /secret
...@@ -6,3 +6,4 @@ Kernel Keys ...@@ -6,3 +6,4 @@ Kernel Keys
:maxdepth: 1 :maxdepth: 1
core core
ecryptfs
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment