@@ -8,6 +8,7 @@ config FS_ENCRYPTION
select KEYS
imply EXT4_FS_ENCRYPTION
imply F2FS_FS_ENCRYPTION
+ imply UBIFS_FS_ENCRYPTION
help
Enable encryption of files and directories. This
feature is similar to ecryptfs, but it is more memory
@@ -11,8 +11,6 @@ config UBIFS_FS
select CRYPTO_DEFLATE if UBIFS_FS_ZLIB
select CRYPTO_ZSTD if UBIFS_FS_ZSTD
select CRYPTO_HASH_INFO
- select UBIFS_FS_XATTR if FS_ENCRYPTION
- select FS_ENCRYPTION_ALGS if FS_ENCRYPTION
depends on MTD_UBI
help
UBIFS is a file system for flash devices which works on top of UBI.
@@ -98,4 +96,16 @@ config UBIFS_FS_AUTHENTICATION
sha256, these are not selected automatically since there are many
different options.
+config UBIFS_FS_ENCRYPTION
+ bool "UBIFS with support for filesystem encryption"
+ depends on FS_ENCRYPTION
+ select UBIFS_FS_XATTR
+ select FS_ENCRYPTION_ALGS if FS_ENCRYPTION
+ help
+ Enable encryption of files and directories. This feature is similar
+ to ecryptfs, but it is more memory efficient since it avoids caching
+ the encrypted and decrypted pages in the page cache.
+
+ If unsure, say N.
+
endif # UBIFS_FS
@@ -6,6 +6,6 @@ ubifs-y += tnc.o master.o scan.o replay.o log.o commit.o gc.o orphan.o
ubifs-y += budget.o find.o tnc_commit.o compress.o lpt.o lprops.o
ubifs-y += recovery.o ioctl.o lpt_commit.o tnc_misc.o debug.o
ubifs-y += misc.o sysfs.o
-ubifs-$(CONFIG_FS_ENCRYPTION) += crypto.o
+ubifs-$(CONFIG_UBIFS_FS_ENCRYPTION) += crypto.o
ubifs-$(CONFIG_UBIFS_FS_XATTR) += xattr.o
ubifs-$(CONFIG_UBIFS_FS_AUTHENTICATION) += auth.o
@@ -746,7 +746,7 @@ int ubifs_read_superblock(struct ubifs_info *c)
goto out;
}
- if (!IS_ENABLED(CONFIG_FS_ENCRYPTION) && c->encrypted) {
+ if (!IS_ENABLED(CONFIG_UBIFS_FS_ENCRYPTION) && c->encrypted) {
ubifs_err(c, "file system contains encrypted files but UBIFS"
" was built without crypto support.");
err = -EINVAL;
@@ -932,7 +932,7 @@ int ubifs_enable_encryption(struct ubifs_info *c)
int err;
struct ubifs_sb_node *sup = c->sup_node;
- if (!IS_ENABLED(CONFIG_FS_ENCRYPTION))
+ if (!IS_ENABLED(CONFIG_UBIFS_FS_ENCRYPTION))
return -EOPNOTSUPP;
if (c->encrypted)
@@ -33,7 +33,7 @@
#include <crypto/hash.h>
#include <crypto/algapi.h>
-#ifdef CONFIG_FS_ENCRYPTION
+#ifdef CONFIG_UBIFS_FS_ENCRYPTION
#define USE_FS_ENCRYPTION
#endif
#include <linux/fscrypt.h>
@@ -134,7 +134,7 @@
*/
#define WORST_COMPR_FACTOR 2
-#ifdef CONFIG_FS_ENCRYPTION
+#ifdef CONFIG_UBIFS_FS_ENCRYPTION
#define UBIFS_CIPHER_BLOCK_SIZE FSCRYPT_CONTENTS_ALIGNMENT
#else
#define UBIFS_CIPHER_BLOCK_SIZE 0
@@ -2114,7 +2114,7 @@ void ubifs_sysfs_unregister(struct ubifs_info *c);
#include "misc.h"
#include "key.h"
-#ifndef CONFIG_FS_ENCRYPTION
+#ifndef CONFIG_UBIFS_FS_ENCRYPTION
static inline int ubifs_encrypt(const struct inode *inode,
struct ubifs_data_node *dn,
unsigned int in_len, unsigned int *out_len,
Add CONFIG_UBIFS_FS_ENCRYPTION as a config option, which depends on the global CONFIG_FS_ENCRYPTION setting. This makes it possible to opt-out of fscrypt for UBIFS, while enabling it for others. Signed-off-by: Niels de Vos <ndevos@redhat.com> --- fs/crypto/Kconfig | 1 + fs/ubifs/Kconfig | 14 ++++++++++++-- fs/ubifs/Makefile | 2 +- fs/ubifs/sb.c | 4 ++-- fs/ubifs/ubifs.h | 6 +++--- 5 files changed, 19 insertions(+), 8 deletions(-)