FEK is encrypted with FNEK and stored in file header

Bug Description

The file encryption key (FEK) is being encrypted with the file encryption key encryption key (FEKEK) and stored in the file header (correct behavior). The FEK is also being encrypted with the filename encryption key (FNEK) and stored in the file header (incorrect behavior). This results in either the FEKEK or the FNEK being capable of decrypting the FEK and eventually the file contents.

This is a tested patch that applies to 2.6.29-rc8.

Sent upstream in hopes of making 2.6.29: http://thread.gmane.org/gmane.linux.kernel/806318

Tim-

We're absolutely going to want to carry this one for Jaunty.

:-Dustin

http://kernel.ubuntu.com/git?p=ubuntu/ubuntu-jaunty.git;a=commit;h=90efd49eeac18845b856ad33c0b266cf2924cb11

This bug was fixed in the package linux - 2.6.28-10.32

---------------
linux (2.6.28-10.32) jaunty; urgency=low

[ Amit Kucheria ]

* Delete prepare-ppa-source script

[ Andy Isaacson ]

* SAUCE: FSAM7400: select CHECK_SIGNATURE
* SAUCE: LIRC_PVR150: depends on VIDEO_IVTV
- LP: #341477

[ Ayaz Abdulla ]

* SAUCE: forcedeth: msi interrupt fix
- LP: #288281

[ Brad Figg ]

* Updating armel configs to remove PREEMPT

[ Catalin Marinas ]

* Fix the VFP handling on the Feroceon CPU

[ Huaxu Wan ]

* SAUCE: (drop after 2.6.28) [Jaunty] iwlagn: fix iwlagn DMA mapping
direction

[ Ike Panhc ]

* squashfs: correct misspelling
- LP: #322306

[ Theodore Ts'o ]

* SAUCE: (drop after 2.6.28) ext4: add EXT4_IOC_ALLOC_DA_BLKS ioctl
* SAUCE: (drop after 2.6.28) ext4: Automatically allocate delay allocated
blocks on close
* SAUCE: (drop after 2.6.28) ext4: Automatically allocate delay allocated
blocks on rename
- LP: #317781

[ Tyler Hicks ]

* SAUCE: (drop after 2.6.28) eCryptfs: Don't encrypt file key with
filename key
- LP: #342128

[ Upstream Kernel Changes ]

* ALS: hda - Add support of iMac 24 Aluminium
* USB: fix broken OTG makefile reference
* ALSA: hda - add another MacBook Pro 3,1 SSID
* ALSA: hda - Add model entry for HP dv4
* x86-64: fix int 0ドルx80 -ENOSYS return
- LP: #339743

-- Tim Gardner <email address hidden> 2009年3月12日 19:16:07 -0600

Thanks kernel team.

Tyler-

Would you please close the ecryptfs task when this patch makes it into Linus' git tree upstream?

Thanks,
:-Dustn

Linus pulled this into mainline: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=84814d642a4f1f294bd675ab11aae1ca54c6cedb