Fscrypt Versions Save

The release notes can now be found in the NEWS file.

This release contains fixes for three security vulnerabilities and related security hardening:

• Correctly handle malicious mountpoint paths in the fscrypt bash completion script (CVE-2022-25328, command injection).
• Validate the size, type, and owner (for login protectors) of policy and protector files (CVE-2022-25327, denial of service).
• Make the fscrypt metadata directories non-world-writable by default (CVE-2022-25326, denial of service).
• When running as a non-root user, ignore policy and protector files that aren't owned by the user or by root.
• Also require that the metadata directories themselves and the mountpoint root directory be owned by the user or by root.
• Make policy and protector files mode 0600 rather than 0644.
• Make all relevant files owned by the user when root encrypts a directory with a user's login protector, not just the the login protector itself.
• Make pam_fscrypt ignore system users completely.

Thanks to Matthias Gerstner (SUSE) for reporting the above vulnerabilities and suggesting additional hardening.

Note: none of these vulnerabilities or changes are related to the cryptography used. The main issue was that it wasn't fully considered how fscrypt's metadata storage method could lead to denial-of-service attacks if a local user is malicious.

Although upgrading to v0.3.3 shouldn't break existing users, there may be some edge cases where users were relying on functionality in ways we didn't anticipate. If you encounter any issues, please report them as soon as possible so that we can find a solution for you.

This release includes the following improvements:

• Made linked protectors (e.g., login protectors used on a non-root filesystem) more reliable when a filesystem UUID changes.
• Made login protectors be owned by the user when they are created as root, so that the user has permission to update them later.
• Made fscrypt work when the root directory is a btrfs filesystem.
• Made pam_fscrypt start warning when a user's login protector is getting de-synced due to their password being changed by root.
• Support reading the key for raw key protectors from standard input.
• Made fscrypt metadata remove-protector-from-policy work even if the protector is no longer accessible.
• Made fscrypt stop trying to access irrelevant filesystems.
• Improved the documentation.

This release includes the following improvements:

• Slightly decreased the amount of memory that fscrypt uses for password hashing, to avoid out-of-memory situations
• Made recovery passphrase generation happen without a prompt by default, and improved the explanation given
• Made many improvements to the README file
• Various other minor fixes

While this release includes some potentially breaking changes, we don't expect this to break users in practice.

Potentially breaking changes to pam_fscrypt module:

• #281: Remove the drop_caches and lock_policies options. The lock_policies behavior is now unconditional, while the correct drop_caches setting is now auto-detected. Existing PAM files that specify these options will continue to work, but these options will now be ignored.
• #278: Prioritize over other session modules. The pam_fscrypt session hook is now inserted into the correct place in the PAM stack when pam_fscrypt is configured using Debian's / Ubuntu's PAM configuration framework.

Non-breaking changes:

• #261: Add Bash completions for fscrypt
• #275: Fix an error message
• #263: Correctly detect "incompletely locked" v1-encrypted directories on kernel versions 5.10 and later

Other:

• #244: Improve Ubuntu installation instructions
• #264, #269: Minor README updates
• #256, #257, #267, #277, #283: CI updates, including switching from Travis CI to GitHub Actions

This release includes:

• Fix 32-bit build (https://github.com/google/fscrypt/pull/235). This was supposed to be fixed in v0.2.8, but another breakage was added in the same release.
• Clarify output of fscrypt status DIR on v1-encrypted directories in some cases (https://github.com/google/fscrypt/pull/237).
• [Developers]
  • Add 32-bit build to presubmit checks (https://github.com/google/fscrypt/pull/235).
  • Fix cli-tests/t_v1_policy to not be flaky (https://github.com/google/fscrypt/pull/237).

This release includes:

• Build fixes
  • Fix build on 32-bit platforms (https://github.com/google/fscrypt/pull/221)
  • Fix build with gcc 10 (https://github.com/google/fscrypt/pull/224)
• Allow fscrypt to work in containers (https://github.com/google/fscrypt/pull/213)
• Usability improvements
  • Improve many error messages and suggestions (https://github.com/google/fscrypt/pull/219). For example, if the encrypt feature flag needs to be enabled on an ext4 filesystem, fscrypt will now show the tune2fs command to run.
  • Document how to securely use login protectors (https://github.com/google/fscrypt/pull/223), and link to that documentation when creating a new login protector (https://github.com/google/fscrypt/pull/225).
  • Try to detect incomplete locking of v1-encrypted directory (https://github.com/google/fscrypt/pull/217)
  • Several other small improvements.
• [Developers] Added command-line interface tests (https://github.com/google/fscrypt/pull/218)

The main addition in this release is that we now automatically detect support for V2 policies when running fscrypt setup and configure /etc/fscrypt.conf appropriately (#205). This allows uses on newer kernels to automatically start using V2 policies without manually changing /etc/fscrypt.conf. To use these new policies, simply run sudo fscrypt setup and your /etc/fscrypt.conf will be automatically updated.

We also made changes to make the build of fscrypt reproducible:

• Simplify fscrypt --version output (#207)
• Use -trimpath (#208)

Finally, we added improved documentation (#201, #204, #205) and fixed up the Makefile (#200)

The big feature in this release is #148, support for v2 kernel encryption policies. With the release of Linux 5.4, the kernel added a new type of policy that makes fscrypt much easier to use. For directories using these new policies:

• fscrypt unlock makes the plaintext version of the directory visible to all users (if they have permission). This makes sharing encrypted folders between users (or a user and root) much easier.
• fscrypt lock (also new in this release) can be run as a non-root user.
• The policies are no longer tied to the buggy kernel keyring API.
  • This removes the need for users to run keyctl link or to reconfigure pam_keyinit.
  • Some systemd related bugs will no longer be an issue.
• Denial-of-Service attacks possible with the v1 API can no longer be used.

To use this new functionality, make sure you are on Linux 5.4 or later. Then, add "policy_version": "2" to "options" in /etc/fscrypt.conf. After this, all new directories will encrypted with v2 polices. See the README.md for more information, including how to use some of the new kernel features with existing directories.

Many thanks to @ebiggers for the herculean effort to get this code (and the kernel code) tested and merged.

Other new features in this release:

• The .fscrypt directory can now be a symlink. #150
• When an encrypted directory and a protector reside on different filesystems, we now automatically create a recovery password. #167, #193

Bug fixes in this release:

• Bind mounts are now handled correctly #154
• Cleanup polices/protectors on failure #192
• Config file is created with the correct mode #152
• fscrypt setup now properly creates /.fscrypt #149
• Work around strange Go interaction with process keyrings #177
• Misc Optimizations: #159
• Build and CI improvements: #161, #158, #168, #169
• Doc updates: #172, #171, #166, #173, #179, #183

A special thanks to @ebiggers for most of the changes in this release.

With the release of 1.13 recently, the minimum supported version of Go for fscrypt is now 1.12.

With #107, fscrypt now uses go modules (and no longer uses dep).

New Features:

• #119: Adiantum support
• #145: Display encryption options in fscyrpt status DIR

Changes to improve stability of fscrypt:

• #140: Makes sure fscrypt file update are always atomic
• #134: Use sane defaults for newly encrypted directories
• #122: Install PAM modules/configs correctly

The remaining changes include numerous fixes to the Documentation and CI.