arm64 linux上实现文件级加密

一、原理简介

linux内核支持实现文件级加解密系统，因此如果不考虑密钥的安全存储，只需要开启相关内核配置，并集成fscrypt用户空间工具，即可实现文件级加解密。

fscrypt通过hook文件系统的方式实现文件级加密，加解密逻辑直接嵌入文件操作过程。

二、用户空间工具

2.1. C语言简易版

fscryptctl是一个精简的fscrypt用户空间工具，适合用来实现实验性质的文件系统加解密系统，开放源代码地址为：https://github.com/google/fscryptctl。

2.2. go语言完整版

fscrypt go语言完整版包含了复杂的fscrypt工具和命令，适合在功能强大的PC中集成，开放源代码地址为：https://github.com/google/fscrypt。

三、内核配置

打开内核配置选项CONFIG_FS_ENCRYPTION：

CONFIG_FS_ENCRYPTION=y

四、编译方式

在Makefile中配置以arm64为目标平台的gcc和ld，如下所示：

CC := aarch64-linux-gnu-gcc LD := aarch64-linux-gnu-ld

五、验证

5.1. 实现加密分区

1. 选择log分区为fscrypt作用分区，确认块设备编号

root@emulator:/userdata# mount | grep log /dev/block/platform/by-name/log on /log type ext4 (rw,seclabel,noatime,discard) root@emulator:/dev/block/platform/by-name# ls -l | grep log lrwxrwxrwx    1 root     root            15 Jan  1 08:00 log -> /dev/mmcblk0p30

2. 将log分区文件系统设为可加密类型

root@emulator:/dev/block/platform/by-name# tune2fs -O encrypt /dev/mmcblk0p30 tune2fs 1.45.3 (14-Jul-2019)

3. 生成随机密钥

dd if=/dev/urandom of=/tmp/key bs=1 count=64 64+0 records in 64+0 records out

4. 为文件系统关联密钥

root@emulator:/userdata# ./fscryptctl add_key /log < /tmp/key a290ce05e9566ad81acda348a2b906ab

5. 查看密钥状态

root@emulator:/userdata# ./fscryptctl key_status a290ce05e9566ad81acda348a2b906ab /log Present (user_count=1, added_by_self)

6. 设置加密策略

./fscryptctl set_policy a290ce05e9566ad81acda348a2b906ab /log/enc

7. 查看加密策略

root@emulator:/userdata# ./fscryptctl get_policy /log/enc Encryption policy for /log/enc:         Policy version: 2         Master key identifier: a290ce05e9566ad81acda348a2b906ab         Contents encryption mode: AES-256-XTS         Filenames encryption mode: AES-256-CTS         Flags: PAD_32

8. 构造文件和目录

root@emulator:/userdata# echo This is the message! > /log/enc/message root@emulator:/userdata# mkdir /log/enc/testdir root@emulator:/userdata# cat /log/enc/message This is the message! root@emulator:/userdata# ls /log/enc message  testdir

5.2. 测试加密效果

1. 删除密钥，测试文件的加密效果

# 删除密钥 root@emulator:/userdata# ./fscryptctl remove_key a290ce05e9566ad81acda348a2b906ab /log warning: some files using this key are still in-use   # 查看密钥状态 root@emulator:/userdata# ./fscryptctl key_status a290ce05e9566ad81acda348a2b906ab /log Incompletely removed # 读取文件内容 root@emulator:/userdata# cat /log/enc/message cat: can't open '/log/enc/message': Required key not available # 查看目录内容 root@emulator:/userdata# ls /log/enc message  testdir # 创建新目录 root@emulator:/userdata# mkdir /log/enc/test mkdir: can't create directory '/log/enc/test': Required key not available

2. 提取块设备重新挂载，测试加密效果

# 提取log分区 root@emulator:/userdata# dd if=/dev/mmcblk0p36 of=/ota/logdev 8388608+0 records in 8388608+0 records out # ubuntu上重新挂载 dev@dev-bluesky:~/sambashare$ sudo mount logdev log [sudo] password for dev: dev@dev-bluesky:~/sambashare$ cd log dev@dev-bluesky:~/sambashare/log$ cd enc # 文件名、目录名均为密文状态 dev@dev-bluesky:~/sambashare/log/enc$ ls qTheaAXRLsb6DbHDVfXjgFj64qvDXbBehm6d9DQjFNb1DYQdtfUG0B  wqQqMnICWHOGFmyU1jnUkYWvNQgh2xp98yKUBmdu1D,mRECmxlMqAD # 无法查看文件内容 dev@dev-bluesky:~/sambashare/log/enc$ cat qTheaAXRLsb6DbHDVfXjgFj64qvDXbBehm6d9DQjFNb1DYQdtfUG0B cat: qTheaAXRLsb6DbHDVfXjgFj64qvDXbBehm6d9DQjFNb1DYQdtfUG0B: Required key not available dev@dev-lixiang:~/sambashare/log/enc$ ls wqQqMnICWHOGFmyU1jnUkYWvNQgh2xp98yKUBmdu1D,mRECmxlMqAD