Encryption

You can encrypt all or parts of a Power-Safe filesystem in order to protect its contents.

You might need to encrypt different parts of the filesystem with different keys, and you might not need to encrypt some parts, so the Power-Safe filesystem lets you create multiple encryption domains, which you can lock or unlock as needed.

A domain can contain any number of files or directories, but a file or directory can belong to at most one domain. If you assign a domain to a directory, all files subsequently created in that directory are encrypted and inherit that domain. Assigning a domain to a directory doesn't introduce encryption to any files or directories that are already in it.

You can simply assign a domain to a directory or an empty file; the filesystem treats them in the same way because they don't have any content to encrypt. If you want to encrypt a file that isn't empty, you must make it migrate to a domain because the filesystem needs to decrypt the file, assign the new domain to it, and then encrypt the file again.

During operation, files that are assigned to a domain are encrypted, and the files' contents are available only when the associated domain is unlocked. When a domain is unlocked, all the files and directories under that domain—regardless of their locations in the volume—are unlocked as well, and are therefore accessible (as per basic file permissions). When a domain is locked, any access to file content belonging to that domain is denied.

Domain 0 (FS_CRYPTO_UNASSIGNED_DOMAIN) is always unlocked, and its contents are unencrypted; you can design your system to use any other domains. Valid domain numbers are 0–119.

To use encryption, you must set the crypto= option for fs-qnx6.so. You can then use fsencrypt to manage the encryption. The chkqnx6fs utility automatically identifies the encryption format and verifies the integrity of the encryption data. It's also possible for you to use fsencrypt to enable encryption after you've formatted the volume and added content, but you must have set the crypto= option when you started fs-qnx6.so.

Key types

Encryption types

The Power-Safe filesystem supports the following types of encryption:

Interface usage

To manage encryption from the command line, use fsencrypt; its -c option lets you specify the command to run. From your code, use the fscrypto library. You need to include both the <fs_crypto_api.h> and <sys/fs_crypto.h> header files. Many of the APIs return EOK on success and have a reply argument that provides more information.

The library also includes some functions that you can use to move existing files and directories into an encryption domain. To do this, you unlock the source and destination domains, tag the files and directories that you want to move, and then start the migration, which the filesystem does in the background. These functions include:

Examples

Here are some examples of the way you can use fsencrypt to manage filesystem encryption:

• Determine if encryption is supported or enabled:

  $ fsencrypt -vc check -p /
  ENCRYPTION_CHECK(Path:'/') FAILED: (18) - 'No support'
  

• Enable encryption on an existing filesystem:

  $ fsencrypt -vc enable -p / 
  ENCRYPTION_CHECK(Path:'/') SUCCESS
  $ fsencrypt -vc check -p /
  ENCRYPTION_CHECK(Path:'/') NOTICE: Encryption is SUPPORTED)
  

  Note:

  This change is irreversible and forces two consecutive disk transactions to rewrite some data in the superblocks.
• Determine if a file is encrypted. Files with the domain number of 0 aren't encrypted. A nonzero value means the file is assigned to a domain. Access to the file's original contents is determined by the status of the domain. The example below shows that the named file is assigned to domain 10:

  $ fsencrypt -vcget -p /accounts/1000/secure/testfile
  GET_DOMAIN(Path:'/accounts/1000/secure/testfile') = 10 SUCCESS
  

• Determine if a domain is locked. If a domain is locked, reading the files within that domain yields encrypted data; unlocked domains yield the original file contents. Unused domains are ones that haven't yet been created. In the example below, domain 11 hasn't yet been created, and domain 10 is currently unlocked:

  $ fsencrypt -vc query -p/ -d11
  QUERY_DOMAIN(Path:'/', Domain:11) NOTICE: Domain is UNUSED
  $ fsencrypt -vc query -p/ -d10
  QUERY_DOMAIN(Path:'/', Domain:10) NOTICE: Domain is UNLOCKED