linux/fs/ecryptfs/Kconfig

config ECRYPT_FS
	tristate "eCrypt filesystem layer support"
	depends on KEYS && CRYPTO && (ENCRYPTED_KEYS || ENCRYPTED_KEYS=n)
	select CRYPTO_ECB
	select CRYPTO_CBC
	select CRYPTO_MD5
	help
	  Encrypted filesystem that operates on the VFS layer.  See
	  <file:Documentation/filesystems/ecryptfs.txt> to learn more about
	  eCryptfs.  Userspace components are required and can be
	  obtained from <http://ecryptfs.sf.net>.

	  To compile this file system support as a module, choose M here: the
	  module will be called ecryptfs.

config ECRYPT_FS_MESSAGING
	bool "Enable notifications for userspace key wrap/unwrap"
	depends on ECRYPT_FS
	help
	  Enables the /dev/ecryptfs entry for use by ecryptfsd. This allows
	  for userspace to wrap/unwrap file encryption keys by other
	  backends, like OpenSSL.
fs/Kconfig: move ecryptfs out Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> 2009-01-22 10:50:50 +03:00			`config ECRYPT_FS`
fs/ecryptfs: remove depends on CONFIG_EXPERIMENTAL The CONFIG_EXPERIMENTAL config item has not carried much meaning for a while now and is almost always enabled by default. As agreed during the Linux kernel summit, remove it from any "depends on" lines in Kconfigs. CC: Tyler Hicks <tyhicks@canonical.com> CC: Dustin Kirkland <dustin.kirkland@gazzang.com> Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Tyler Hicks <tyhicks@canonical.com> 2012-10-02 22:19:20 +04:00			`tristate "eCrypt filesystem layer support"`
			`depends on KEYS && CRYPTO && (ENCRYPTED_KEYS \|\| ENCRYPTED_KEYS=n)`
ecryptfs: improved dependency checking and reporting So, I compiled a 2.6.31-rc5 kernel with ecryptfs and loaded its module. When it came time to mount my filesystem, I got this in dmesg, and it refused to mount: [93577.776637] Unable to allocate crypto cipher with name [aes]; rc = [-2] [93577.783280] Error attempting to initialize key TFM cipher with name = [aes]; rc = [-2] [93577.791183] Error attempting to initialize cipher with name = [aes] and key size = [32]; rc = [-2] [93577.800113] Error parsing options; rc = [-22] I figured from the error message that I'd either forgotten to load "aes" or that my key size was bogus. Neither one of those was the case. In fact, I was missing the CRYPTO_ECB config option and the 'ecb' module. Unfortunately, there's no trace of 'ecb' in that error message. I've done two things to fix this. First, I've modified ecryptfs's Kconfig entry to select CRYPTO_ECB and CRYPTO_CBC. I also took CRYPTO out of the dependencies since the 'select' will take care of it for us. I've also modified the error messages to print a string that should contain both 'ecb' and 'aes' in my error case. That will give any future users a chance of finding the right modules and Kconfig options. I also wonder if we should: select CRYPTO_AES if !EMBEDDED since I think most ecryptfs users are using AES like me. Cc: ecryptfs-devel@lists.launchpad.net Cc: linux-fsdevel@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: Dustin Kirkland <kirkland@canonical.com> Signed-off-by: Dave Hansen <dave@linux.vnet.ibm.com> [tyhicks@linux.vnet.ibm.com: Removed extra newline, 80-char violation] Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com> 2009-08-27 20:47:07 +04:00			`select CRYPTO_ECB`
			`select CRYPTO_CBC`
eCryptfs: Remove Kconfig NET dependency and select MD5 eCryptfs no longer uses a netlink interface to communicate with ecryptfsd, so NET is not a valid dependency anymore. MD5 is required and must be built for eCryptfs to be of any use. Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com> 2009-09-29 11:33:59 +04:00			`select CRYPTO_MD5`
fs/Kconfig: move ecryptfs out Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> 2009-01-22 10:50:50 +03:00			`help`
			`Encrypted filesystem that operates on the VFS layer. See`
			`<file:Documentation/filesystems/ecryptfs.txt> to learn more about`
			`eCryptfs. Userspace components are required and can be`
			`obtained from <http://ecryptfs.sf.net>.`

			`To compile this file system support as a module, choose M here: the`
			`module will be called ecryptfs.`
eCryptfs: allow userspace messaging to be disabled When the userspace messaging (for the less common case of userspace key wrap/unwrap via ecryptfsd) is not needed, allow eCryptfs to build with it removed. This saves on kernel code size and reduces potential attack surface by removing the /dev/ecryptfs node. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Tyler Hicks <tyhicks@canonical.com> 2013-02-28 12:39:37 +04:00
			`config ECRYPT_FS_MESSAGING`
			`bool "Enable notifications for userspace key wrap/unwrap"`
			`depends on ECRYPT_FS`
			`help`
			`Enables the /dev/ecryptfs entry for use by ecryptfsd. This allows`
			`for userspace to wrap/unwrap file encryption keys by other`
			`backends, like OpenSSL.`