mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/herbert/cryptodev-2.6.git
synced 2026-04-18 03:23:53 -04:00
75eb8b9410
This mostly reverts commit a0fc20333e.
Keep the relevant parts of the comment added by that commit.
The problem with that commit is that it allowed people to create broken
configurations that enabled FS_ENCRYPTION but not the mandatory
algorithms. An example of this can be found here:
https://lore.kernel.org/r/1207325.1737387826@warthog.procyon.org.uk/
The commit did allow people to disable specific generic algorithm
implementations that aren't needed. But that at best allowed saving a
bit of code. In the real world people are unlikely to intentionally and
correctly make such a tweak anyway, as they tend to just be confused by
what all the different crypto kconfig options mean.
Of course we really need the crypto API to enable the correct
implementations automatically, but that's for a later fix.
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Cc: David Howells <dhowells@redhat.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Link: https://lore.kernel.org/r/20250217185314.27345-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
43 lines
1.6 KiB
Plaintext
43 lines
1.6 KiB
Plaintext
# SPDX-License-Identifier: GPL-2.0-only
|
|
config FS_ENCRYPTION
|
|
bool "FS Encryption (Per-file encryption)"
|
|
select CRYPTO
|
|
select CRYPTO_HASH
|
|
select CRYPTO_SKCIPHER
|
|
select CRYPTO_LIB_SHA256
|
|
select KEYS
|
|
help
|
|
Enable encryption of files and directories. This
|
|
feature is similar to ecryptfs, but it is more memory
|
|
efficient since it avoids caching the encrypted and
|
|
decrypted pages in the page cache. Currently Ext4,
|
|
F2FS, UBIFS, and CephFS make use of this feature.
|
|
|
|
# Filesystems supporting encryption must select this if FS_ENCRYPTION. This
|
|
# allows the algorithms to be built as modules when all the filesystems are,
|
|
# whereas selecting them from FS_ENCRYPTION would force them to be built-in.
|
|
#
|
|
# Note: this option only pulls in the algorithms that filesystem encryption
|
|
# needs "by default". If userspace will use "non-default" encryption modes such
|
|
# as Adiantum encryption, then those other modes need to be explicitly enabled
|
|
# in the crypto API; see Documentation/filesystems/fscrypt.rst for details.
|
|
#
|
|
# Also note that this option only pulls in the generic implementations of the
|
|
# algorithms, not any per-architecture optimized implementations. It is
|
|
# strongly recommended to enable optimized implementations too.
|
|
config FS_ENCRYPTION_ALGS
|
|
tristate
|
|
select CRYPTO_AES
|
|
select CRYPTO_CBC
|
|
select CRYPTO_CTS
|
|
select CRYPTO_ECB
|
|
select CRYPTO_HMAC
|
|
select CRYPTO_SHA512
|
|
select CRYPTO_XTS
|
|
|
|
config FS_ENCRYPTION_INLINE_CRYPT
|
|
bool "Enable fscrypt to use inline crypto"
|
|
depends on FS_ENCRYPTION && BLK_INLINE_ENCRYPTION
|
|
help
|
|
Enable fscrypt to use inline encryption hardware if available.
|