Back to home page

OSCL-LXR
 
 

     

0001 // SPDX-License-Identifier: GPL-2.0-or-later
0002 /*
0003  * eCryptfs: Linux filesystem encryption layer
0004  *
0005  * Copyright (C) 1997-2004 Erez Zadok
0006  * Copyright (C) 2001-2004 Stony Brook University
0007  * Copyright (C) 2004-2007 International Business Machines Corp.
0008  *   Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>
0009  *              Michael C. Thompsion <mcthomps@us.ibm.com>
0010  */
0011 
0012 #include <linux/file.h>
0013 #include <linux/vmalloc.h>
0014 #include <linux/pagemap.h>
0015 #include <linux/dcache.h>
0016 #include <linux/namei.h>
0017 #include <linux/mount.h>
0018 #include <linux/fs_stack.h>
0019 #include <linux/slab.h>
0020 #include <linux/xattr.h>
0021 #include <linux/fileattr.h>
0022 #include <asm/unaligned.h>
0023 #include "ecryptfs_kernel.h"
0024 
0025 static int lock_parent(struct dentry *dentry,
0026                struct dentry **lower_dentry,
0027                struct inode **lower_dir)
0028 {
0029     struct dentry *lower_dir_dentry;
0030 
0031     lower_dir_dentry = ecryptfs_dentry_to_lower(dentry->d_parent);
0032     *lower_dir = d_inode(lower_dir_dentry);
0033     *lower_dentry = ecryptfs_dentry_to_lower(dentry);
0034 
0035     inode_lock_nested(*lower_dir, I_MUTEX_PARENT);
0036     return (*lower_dentry)->d_parent == lower_dir_dentry ? 0 : -EINVAL;
0037 }
0038 
0039 static int ecryptfs_inode_test(struct inode *inode, void *lower_inode)
0040 {
0041     return ecryptfs_inode_to_lower(inode) == lower_inode;
0042 }
0043 
0044 static int ecryptfs_inode_set(struct inode *inode, void *opaque)
0045 {
0046     struct inode *lower_inode = opaque;
0047 
0048     ecryptfs_set_inode_lower(inode, lower_inode);
0049     fsstack_copy_attr_all(inode, lower_inode);
0050     /* i_size will be overwritten for encrypted regular files */
0051     fsstack_copy_inode_size(inode, lower_inode);
0052     inode->i_ino = lower_inode->i_ino;
0053     inode->i_mapping->a_ops = &ecryptfs_aops;
0054 
0055     if (S_ISLNK(inode->i_mode))
0056         inode->i_op = &ecryptfs_symlink_iops;
0057     else if (S_ISDIR(inode->i_mode))
0058         inode->i_op = &ecryptfs_dir_iops;
0059     else
0060         inode->i_op = &ecryptfs_main_iops;
0061 
0062     if (S_ISDIR(inode->i_mode))
0063         inode->i_fop = &ecryptfs_dir_fops;
0064     else if (special_file(inode->i_mode))
0065         init_special_inode(inode, inode->i_mode, inode->i_rdev);
0066     else
0067         inode->i_fop = &ecryptfs_main_fops;
0068 
0069     return 0;
0070 }
0071 
0072 static struct inode *__ecryptfs_get_inode(struct inode *lower_inode,
0073                       struct super_block *sb)
0074 {
0075     struct inode *inode;
0076 
0077     if (lower_inode->i_sb != ecryptfs_superblock_to_lower(sb))
0078         return ERR_PTR(-EXDEV);
0079     if (!igrab(lower_inode))
0080         return ERR_PTR(-ESTALE);
0081     inode = iget5_locked(sb, (unsigned long)lower_inode,
0082                  ecryptfs_inode_test, ecryptfs_inode_set,
0083                  lower_inode);
0084     if (!inode) {
0085         iput(lower_inode);
0086         return ERR_PTR(-EACCES);
0087     }
0088     if (!(inode->i_state & I_NEW))
0089         iput(lower_inode);
0090 
0091     return inode;
0092 }
0093 
0094 struct inode *ecryptfs_get_inode(struct inode *lower_inode,
0095                  struct super_block *sb)
0096 {
0097     struct inode *inode = __ecryptfs_get_inode(lower_inode, sb);
0098 
0099     if (!IS_ERR(inode) && (inode->i_state & I_NEW))
0100         unlock_new_inode(inode);
0101 
0102     return inode;
0103 }
0104 
0105 /**
0106  * ecryptfs_interpose
0107  * @lower_dentry: Existing dentry in the lower filesystem
0108  * @dentry: ecryptfs' dentry
0109  * @sb: ecryptfs's super_block
0110  *
0111  * Interposes upper and lower dentries.
0112  *
0113  * Returns zero on success; non-zero otherwise
0114  */
0115 static int ecryptfs_interpose(struct dentry *lower_dentry,
0116                   struct dentry *dentry, struct super_block *sb)
0117 {
0118     struct inode *inode = ecryptfs_get_inode(d_inode(lower_dentry), sb);
0119 
0120     if (IS_ERR(inode))
0121         return PTR_ERR(inode);
0122     d_instantiate(dentry, inode);
0123 
0124     return 0;
0125 }
0126 
0127 static int ecryptfs_do_unlink(struct inode *dir, struct dentry *dentry,
0128                   struct inode *inode)
0129 {
0130     struct dentry *lower_dentry;
0131     struct inode *lower_dir;
0132     int rc;
0133 
0134     rc = lock_parent(dentry, &lower_dentry, &lower_dir);
0135     dget(lower_dentry); // don't even try to make the lower negative
0136     if (!rc) {
0137         if (d_unhashed(lower_dentry))
0138             rc = -EINVAL;
0139         else
0140             rc = vfs_unlink(&init_user_ns, lower_dir, lower_dentry,
0141                     NULL);
0142     }
0143     if (rc) {
0144         printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
0145         goto out_unlock;
0146     }
0147     fsstack_copy_attr_times(dir, lower_dir);
0148     set_nlink(inode, ecryptfs_inode_to_lower(inode)->i_nlink);
0149     inode->i_ctime = dir->i_ctime;
0150 out_unlock:
0151     dput(lower_dentry);
0152     inode_unlock(lower_dir);
0153     if (!rc)
0154         d_drop(dentry);
0155     return rc;
0156 }
0157 
0158 /**
0159  * ecryptfs_do_create
0160  * @directory_inode: inode of the new file's dentry's parent in ecryptfs
0161  * @ecryptfs_dentry: New file's dentry in ecryptfs
0162  * @mode: The mode of the new file
0163  *
0164  * Creates the underlying file and the eCryptfs inode which will link to
0165  * it. It will also update the eCryptfs directory inode to mimic the
0166  * stat of the lower directory inode.
0167  *
0168  * Returns the new eCryptfs inode on success; an ERR_PTR on error condition
0169  */
0170 static struct inode *
0171 ecryptfs_do_create(struct inode *directory_inode,
0172            struct dentry *ecryptfs_dentry, umode_t mode)
0173 {
0174     int rc;
0175     struct dentry *lower_dentry;
0176     struct inode *lower_dir;
0177     struct inode *inode;
0178 
0179     rc = lock_parent(ecryptfs_dentry, &lower_dentry, &lower_dir);
0180     if (!rc)
0181         rc = vfs_create(&init_user_ns, lower_dir,
0182                 lower_dentry, mode, true);
0183     if (rc) {
0184         printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
0185                "rc = [%d]\n", __func__, rc);
0186         inode = ERR_PTR(rc);
0187         goto out_lock;
0188     }
0189     inode = __ecryptfs_get_inode(d_inode(lower_dentry),
0190                      directory_inode->i_sb);
0191     if (IS_ERR(inode)) {
0192         vfs_unlink(&init_user_ns, lower_dir, lower_dentry, NULL);
0193         goto out_lock;
0194     }
0195     fsstack_copy_attr_times(directory_inode, lower_dir);
0196     fsstack_copy_inode_size(directory_inode, lower_dir);
0197 out_lock:
0198     inode_unlock(lower_dir);
0199     return inode;
0200 }
0201 
0202 /*
0203  * ecryptfs_initialize_file
0204  *
0205  * Cause the file to be changed from a basic empty file to an ecryptfs
0206  * file with a header and first data page.
0207  *
0208  * Returns zero on success
0209  */
0210 int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry,
0211                  struct inode *ecryptfs_inode)
0212 {
0213     struct ecryptfs_crypt_stat *crypt_stat =
0214         &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
0215     int rc = 0;
0216 
0217     if (S_ISDIR(ecryptfs_inode->i_mode)) {
0218         ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
0219         crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
0220         goto out;
0221     }
0222     ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n");
0223     rc = ecryptfs_new_file_context(ecryptfs_inode);
0224     if (rc) {
0225         ecryptfs_printk(KERN_ERR, "Error creating new file "
0226                 "context; rc = [%d]\n", rc);
0227         goto out;
0228     }
0229     rc = ecryptfs_get_lower_file(ecryptfs_dentry, ecryptfs_inode);
0230     if (rc) {
0231         printk(KERN_ERR "%s: Error attempting to initialize "
0232             "the lower file for the dentry with name "
0233             "[%pd]; rc = [%d]\n", __func__,
0234             ecryptfs_dentry, rc);
0235         goto out;
0236     }
0237     rc = ecryptfs_write_metadata(ecryptfs_dentry, ecryptfs_inode);
0238     if (rc)
0239         printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
0240     ecryptfs_put_lower_file(ecryptfs_inode);
0241 out:
0242     return rc;
0243 }
0244 
0245 /*
0246  * ecryptfs_create
0247  * @mode: The mode of the new file.
0248  *
0249  * Creates a new file.
0250  *
0251  * Returns zero on success; non-zero on error condition
0252  */
0253 static int
0254 ecryptfs_create(struct user_namespace *mnt_userns,
0255         struct inode *directory_inode, struct dentry *ecryptfs_dentry,
0256         umode_t mode, bool excl)
0257 {
0258     struct inode *ecryptfs_inode;
0259     int rc;
0260 
0261     ecryptfs_inode = ecryptfs_do_create(directory_inode, ecryptfs_dentry,
0262                         mode);
0263     if (IS_ERR(ecryptfs_inode)) {
0264         ecryptfs_printk(KERN_WARNING, "Failed to create file in"
0265                 "lower filesystem\n");
0266         rc = PTR_ERR(ecryptfs_inode);
0267         goto out;
0268     }
0269     /* At this point, a file exists on "disk"; we need to make sure
0270      * that this on disk file is prepared to be an ecryptfs file */
0271     rc = ecryptfs_initialize_file(ecryptfs_dentry, ecryptfs_inode);
0272     if (rc) {
0273         ecryptfs_do_unlink(directory_inode, ecryptfs_dentry,
0274                    ecryptfs_inode);
0275         iget_failed(ecryptfs_inode);
0276         goto out;
0277     }
0278     d_instantiate_new(ecryptfs_dentry, ecryptfs_inode);
0279 out:
0280     return rc;
0281 }
0282 
0283 static int ecryptfs_i_size_read(struct dentry *dentry, struct inode *inode)
0284 {
0285     struct ecryptfs_crypt_stat *crypt_stat;
0286     int rc;
0287 
0288     rc = ecryptfs_get_lower_file(dentry, inode);
0289     if (rc) {
0290         printk(KERN_ERR "%s: Error attempting to initialize "
0291             "the lower file for the dentry with name "
0292             "[%pd]; rc = [%d]\n", __func__,
0293             dentry, rc);
0294         return rc;
0295     }
0296 
0297     crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
0298     /* TODO: lock for crypt_stat comparison */
0299     if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
0300         ecryptfs_set_default_sizes(crypt_stat);
0301 
0302     rc = ecryptfs_read_and_validate_header_region(inode);
0303     ecryptfs_put_lower_file(inode);
0304     if (rc) {
0305         rc = ecryptfs_read_and_validate_xattr_region(dentry, inode);
0306         if (!rc)
0307             crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
0308     }
0309 
0310     /* Must return 0 to allow non-eCryptfs files to be looked up, too */
0311     return 0;
0312 }
0313 
0314 /*
0315  * ecryptfs_lookup_interpose - Dentry interposition for a lookup
0316  */
0317 static struct dentry *ecryptfs_lookup_interpose(struct dentry *dentry,
0318                      struct dentry *lower_dentry)
0319 {
0320     struct path *path = ecryptfs_dentry_to_lower_path(dentry->d_parent);
0321     struct inode *inode, *lower_inode;
0322     struct ecryptfs_dentry_info *dentry_info;
0323     int rc = 0;
0324 
0325     dentry_info = kmem_cache_alloc(ecryptfs_dentry_info_cache, GFP_KERNEL);
0326     if (!dentry_info) {
0327         dput(lower_dentry);
0328         return ERR_PTR(-ENOMEM);
0329     }
0330 
0331     fsstack_copy_attr_atime(d_inode(dentry->d_parent),
0332                 d_inode(path->dentry));
0333     BUG_ON(!d_count(lower_dentry));
0334 
0335     ecryptfs_set_dentry_private(dentry, dentry_info);
0336     dentry_info->lower_path.mnt = mntget(path->mnt);
0337     dentry_info->lower_path.dentry = lower_dentry;
0338 
0339     /*
0340      * negative dentry can go positive under us here - its parent is not
0341      * locked.  That's OK and that could happen just as we return from
0342      * ecryptfs_lookup() anyway.  Just need to be careful and fetch
0343      * ->d_inode only once - it's not stable here.
0344      */
0345     lower_inode = READ_ONCE(lower_dentry->d_inode);
0346 
0347     if (!lower_inode) {
0348         /* We want to add because we couldn't find in lower */
0349         d_add(dentry, NULL);
0350         return NULL;
0351     }
0352     inode = __ecryptfs_get_inode(lower_inode, dentry->d_sb);
0353     if (IS_ERR(inode)) {
0354         printk(KERN_ERR "%s: Error interposing; rc = [%ld]\n",
0355                __func__, PTR_ERR(inode));
0356         return ERR_CAST(inode);
0357     }
0358     if (S_ISREG(inode->i_mode)) {
0359         rc = ecryptfs_i_size_read(dentry, inode);
0360         if (rc) {
0361             make_bad_inode(inode);
0362             return ERR_PTR(rc);
0363         }
0364     }
0365 
0366     if (inode->i_state & I_NEW)
0367         unlock_new_inode(inode);
0368     return d_splice_alias(inode, dentry);
0369 }
0370 
0371 /**
0372  * ecryptfs_lookup
0373  * @ecryptfs_dir_inode: The eCryptfs directory inode
0374  * @ecryptfs_dentry: The eCryptfs dentry that we are looking up
0375  * @flags: lookup flags
0376  *
0377  * Find a file on disk. If the file does not exist, then we'll add it to the
0378  * dentry cache and continue on to read it from the disk.
0379  */
0380 static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
0381                       struct dentry *ecryptfs_dentry,
0382                       unsigned int flags)
0383 {
0384     char *encrypted_and_encoded_name = NULL;
0385     struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
0386     struct dentry *lower_dir_dentry, *lower_dentry;
0387     const char *name = ecryptfs_dentry->d_name.name;
0388     size_t len = ecryptfs_dentry->d_name.len;
0389     struct dentry *res;
0390     int rc = 0;
0391 
0392     lower_dir_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry->d_parent);
0393 
0394     mount_crypt_stat = &ecryptfs_superblock_to_private(
0395                 ecryptfs_dentry->d_sb)->mount_crypt_stat;
0396     if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
0397         rc = ecryptfs_encrypt_and_encode_filename(
0398             &encrypted_and_encoded_name, &len,
0399             mount_crypt_stat, name, len);
0400         if (rc) {
0401             printk(KERN_ERR "%s: Error attempting to encrypt and encode "
0402                    "filename; rc = [%d]\n", __func__, rc);
0403             return ERR_PTR(rc);
0404         }
0405         name = encrypted_and_encoded_name;
0406     }
0407 
0408     lower_dentry = lookup_one_len_unlocked(name, lower_dir_dentry, len);
0409     if (IS_ERR(lower_dentry)) {
0410         ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned "
0411                 "[%ld] on lower_dentry = [%s]\n", __func__,
0412                 PTR_ERR(lower_dentry),
0413                 name);
0414         res = ERR_CAST(lower_dentry);
0415     } else {
0416         res = ecryptfs_lookup_interpose(ecryptfs_dentry, lower_dentry);
0417     }
0418     kfree(encrypted_and_encoded_name);
0419     return res;
0420 }
0421 
0422 static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir,
0423              struct dentry *new_dentry)
0424 {
0425     struct dentry *lower_old_dentry;
0426     struct dentry *lower_new_dentry;
0427     struct inode *lower_dir;
0428     u64 file_size_save;
0429     int rc;
0430 
0431     file_size_save = i_size_read(d_inode(old_dentry));
0432     lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
0433     rc = lock_parent(new_dentry, &lower_new_dentry, &lower_dir);
0434     if (!rc)
0435         rc = vfs_link(lower_old_dentry, &init_user_ns, lower_dir,
0436                   lower_new_dentry, NULL);
0437     if (rc || d_really_is_negative(lower_new_dentry))
0438         goto out_lock;
0439     rc = ecryptfs_interpose(lower_new_dentry, new_dentry, dir->i_sb);
0440     if (rc)
0441         goto out_lock;
0442     fsstack_copy_attr_times(dir, lower_dir);
0443     fsstack_copy_inode_size(dir, lower_dir);
0444     set_nlink(d_inode(old_dentry),
0445           ecryptfs_inode_to_lower(d_inode(old_dentry))->i_nlink);
0446     i_size_write(d_inode(new_dentry), file_size_save);
0447 out_lock:
0448     inode_unlock(lower_dir);
0449     return rc;
0450 }
0451 
0452 static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
0453 {
0454     return ecryptfs_do_unlink(dir, dentry, d_inode(dentry));
0455 }
0456 
0457 static int ecryptfs_symlink(struct user_namespace *mnt_userns,
0458                 struct inode *dir, struct dentry *dentry,
0459                 const char *symname)
0460 {
0461     int rc;
0462     struct dentry *lower_dentry;
0463     struct inode *lower_dir;
0464     char *encoded_symname;
0465     size_t encoded_symlen;
0466     struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
0467 
0468     rc = lock_parent(dentry, &lower_dentry, &lower_dir);
0469     if (rc)
0470         goto out_lock;
0471     mount_crypt_stat = &ecryptfs_superblock_to_private(
0472         dir->i_sb)->mount_crypt_stat;
0473     rc = ecryptfs_encrypt_and_encode_filename(&encoded_symname,
0474                           &encoded_symlen,
0475                           mount_crypt_stat, symname,
0476                           strlen(symname));
0477     if (rc)
0478         goto out_lock;
0479     rc = vfs_symlink(&init_user_ns, lower_dir, lower_dentry,
0480              encoded_symname);
0481     kfree(encoded_symname);
0482     if (rc || d_really_is_negative(lower_dentry))
0483         goto out_lock;
0484     rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
0485     if (rc)
0486         goto out_lock;
0487     fsstack_copy_attr_times(dir, lower_dir);
0488     fsstack_copy_inode_size(dir, lower_dir);
0489 out_lock:
0490     inode_unlock(lower_dir);
0491     if (d_really_is_negative(dentry))
0492         d_drop(dentry);
0493     return rc;
0494 }
0495 
0496 static int ecryptfs_mkdir(struct user_namespace *mnt_userns, struct inode *dir,
0497               struct dentry *dentry, umode_t mode)
0498 {
0499     int rc;
0500     struct dentry *lower_dentry;
0501     struct inode *lower_dir;
0502 
0503     rc = lock_parent(dentry, &lower_dentry, &lower_dir);
0504     if (!rc)
0505         rc = vfs_mkdir(&init_user_ns, lower_dir,
0506                    lower_dentry, mode);
0507     if (rc || d_really_is_negative(lower_dentry))
0508         goto out;
0509     rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
0510     if (rc)
0511         goto out;
0512     fsstack_copy_attr_times(dir, lower_dir);
0513     fsstack_copy_inode_size(dir, lower_dir);
0514     set_nlink(dir, lower_dir->i_nlink);
0515 out:
0516     inode_unlock(lower_dir);
0517     if (d_really_is_negative(dentry))
0518         d_drop(dentry);
0519     return rc;
0520 }
0521 
0522 static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry)
0523 {
0524     struct dentry *lower_dentry;
0525     struct inode *lower_dir;
0526     int rc;
0527 
0528     rc = lock_parent(dentry, &lower_dentry, &lower_dir);
0529     dget(lower_dentry); // don't even try to make the lower negative
0530     if (!rc) {
0531         if (d_unhashed(lower_dentry))
0532             rc = -EINVAL;
0533         else
0534             rc = vfs_rmdir(&init_user_ns, lower_dir, lower_dentry);
0535     }
0536     if (!rc) {
0537         clear_nlink(d_inode(dentry));
0538         fsstack_copy_attr_times(dir, lower_dir);
0539         set_nlink(dir, lower_dir->i_nlink);
0540     }
0541     dput(lower_dentry);
0542     inode_unlock(lower_dir);
0543     if (!rc)
0544         d_drop(dentry);
0545     return rc;
0546 }
0547 
0548 static int
0549 ecryptfs_mknod(struct user_namespace *mnt_userns, struct inode *dir,
0550            struct dentry *dentry, umode_t mode, dev_t dev)
0551 {
0552     int rc;
0553     struct dentry *lower_dentry;
0554     struct inode *lower_dir;
0555 
0556     rc = lock_parent(dentry, &lower_dentry, &lower_dir);
0557     if (!rc)
0558         rc = vfs_mknod(&init_user_ns, lower_dir,
0559                    lower_dentry, mode, dev);
0560     if (rc || d_really_is_negative(lower_dentry))
0561         goto out;
0562     rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
0563     if (rc)
0564         goto out;
0565     fsstack_copy_attr_times(dir, lower_dir);
0566     fsstack_copy_inode_size(dir, lower_dir);
0567 out:
0568     inode_unlock(lower_dir);
0569     if (d_really_is_negative(dentry))
0570         d_drop(dentry);
0571     return rc;
0572 }
0573 
0574 static int
0575 ecryptfs_rename(struct user_namespace *mnt_userns, struct inode *old_dir,
0576         struct dentry *old_dentry, struct inode *new_dir,
0577         struct dentry *new_dentry, unsigned int flags)
0578 {
0579     int rc;
0580     struct dentry *lower_old_dentry;
0581     struct dentry *lower_new_dentry;
0582     struct dentry *lower_old_dir_dentry;
0583     struct dentry *lower_new_dir_dentry;
0584     struct dentry *trap;
0585     struct inode *target_inode;
0586     struct renamedata rd = {};
0587 
0588     if (flags)
0589         return -EINVAL;
0590 
0591     lower_old_dir_dentry = ecryptfs_dentry_to_lower(old_dentry->d_parent);
0592     lower_new_dir_dentry = ecryptfs_dentry_to_lower(new_dentry->d_parent);
0593 
0594     lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
0595     lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
0596 
0597     target_inode = d_inode(new_dentry);
0598 
0599     trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
0600     dget(lower_new_dentry);
0601     rc = -EINVAL;
0602     if (lower_old_dentry->d_parent != lower_old_dir_dentry)
0603         goto out_lock;
0604     if (lower_new_dentry->d_parent != lower_new_dir_dentry)
0605         goto out_lock;
0606     if (d_unhashed(lower_old_dentry) || d_unhashed(lower_new_dentry))
0607         goto out_lock;
0608     /* source should not be ancestor of target */
0609     if (trap == lower_old_dentry)
0610         goto out_lock;
0611     /* target should not be ancestor of source */
0612     if (trap == lower_new_dentry) {
0613         rc = -ENOTEMPTY;
0614         goto out_lock;
0615     }
0616 
0617     rd.old_mnt_userns   = &init_user_ns;
0618     rd.old_dir      = d_inode(lower_old_dir_dentry);
0619     rd.old_dentry       = lower_old_dentry;
0620     rd.new_mnt_userns   = &init_user_ns;
0621     rd.new_dir      = d_inode(lower_new_dir_dentry);
0622     rd.new_dentry       = lower_new_dentry;
0623     rc = vfs_rename(&rd);
0624     if (rc)
0625         goto out_lock;
0626     if (target_inode)
0627         fsstack_copy_attr_all(target_inode,
0628                       ecryptfs_inode_to_lower(target_inode));
0629     fsstack_copy_attr_all(new_dir, d_inode(lower_new_dir_dentry));
0630     if (new_dir != old_dir)
0631         fsstack_copy_attr_all(old_dir, d_inode(lower_old_dir_dentry));
0632 out_lock:
0633     dput(lower_new_dentry);
0634     unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
0635     return rc;
0636 }
0637 
0638 static char *ecryptfs_readlink_lower(struct dentry *dentry, size_t *bufsiz)
0639 {
0640     DEFINE_DELAYED_CALL(done);
0641     struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
0642     const char *link;
0643     char *buf;
0644     int rc;
0645 
0646     link = vfs_get_link(lower_dentry, &done);
0647     if (IS_ERR(link))
0648         return ERR_CAST(link);
0649 
0650     rc = ecryptfs_decode_and_decrypt_filename(&buf, bufsiz, dentry->d_sb,
0651                           link, strlen(link));
0652     do_delayed_call(&done);
0653     if (rc)
0654         return ERR_PTR(rc);
0655 
0656     return buf;
0657 }
0658 
0659 static const char *ecryptfs_get_link(struct dentry *dentry,
0660                      struct inode *inode,
0661                      struct delayed_call *done)
0662 {
0663     size_t len;
0664     char *buf;
0665 
0666     if (!dentry)
0667         return ERR_PTR(-ECHILD);
0668 
0669     buf = ecryptfs_readlink_lower(dentry, &len);
0670     if (IS_ERR(buf))
0671         return buf;
0672     fsstack_copy_attr_atime(d_inode(dentry),
0673                 d_inode(ecryptfs_dentry_to_lower(dentry)));
0674     buf[len] = '\0';
0675     set_delayed_call(done, kfree_link, buf);
0676     return buf;
0677 }
0678 
0679 /**
0680  * upper_size_to_lower_size
0681  * @crypt_stat: Crypt_stat associated with file
0682  * @upper_size: Size of the upper file
0683  *
0684  * Calculate the required size of the lower file based on the
0685  * specified size of the upper file. This calculation is based on the
0686  * number of headers in the underlying file and the extent size.
0687  *
0688  * Returns Calculated size of the lower file.
0689  */
0690 static loff_t
0691 upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat,
0692              loff_t upper_size)
0693 {
0694     loff_t lower_size;
0695 
0696     lower_size = ecryptfs_lower_header_size(crypt_stat);
0697     if (upper_size != 0) {
0698         loff_t num_extents;
0699 
0700         num_extents = upper_size >> crypt_stat->extent_shift;
0701         if (upper_size & ~crypt_stat->extent_mask)
0702             num_extents++;
0703         lower_size += (num_extents * crypt_stat->extent_size);
0704     }
0705     return lower_size;
0706 }
0707 
0708 /**
0709  * truncate_upper
0710  * @dentry: The ecryptfs layer dentry
0711  * @ia: Address of the ecryptfs inode's attributes
0712  * @lower_ia: Address of the lower inode's attributes
0713  *
0714  * Function to handle truncations modifying the size of the file. Note
0715  * that the file sizes are interpolated. When expanding, we are simply
0716  * writing strings of 0's out. When truncating, we truncate the upper
0717  * inode and update the lower_ia according to the page index
0718  * interpolations. If ATTR_SIZE is set in lower_ia->ia_valid upon return,
0719  * the caller must use lower_ia in a call to notify_change() to perform
0720  * the truncation of the lower inode.
0721  *
0722  * Returns zero on success; non-zero otherwise
0723  */
0724 static int truncate_upper(struct dentry *dentry, struct iattr *ia,
0725               struct iattr *lower_ia)
0726 {
0727     int rc = 0;
0728     struct inode *inode = d_inode(dentry);
0729     struct ecryptfs_crypt_stat *crypt_stat;
0730     loff_t i_size = i_size_read(inode);
0731     loff_t lower_size_before_truncate;
0732     loff_t lower_size_after_truncate;
0733 
0734     if (unlikely((ia->ia_size == i_size))) {
0735         lower_ia->ia_valid &= ~ATTR_SIZE;
0736         return 0;
0737     }
0738     rc = ecryptfs_get_lower_file(dentry, inode);
0739     if (rc)
0740         return rc;
0741     crypt_stat = &ecryptfs_inode_to_private(d_inode(dentry))->crypt_stat;
0742     /* Switch on growing or shrinking file */
0743     if (ia->ia_size > i_size) {
0744         char zero[] = { 0x00 };
0745 
0746         lower_ia->ia_valid &= ~ATTR_SIZE;
0747         /* Write a single 0 at the last position of the file;
0748          * this triggers code that will fill in 0's throughout
0749          * the intermediate portion of the previous end of the
0750          * file and the new and of the file */
0751         rc = ecryptfs_write(inode, zero,
0752                     (ia->ia_size - 1), 1);
0753     } else { /* ia->ia_size < i_size_read(inode) */
0754         /* We're chopping off all the pages down to the page
0755          * in which ia->ia_size is located. Fill in the end of
0756          * that page from (ia->ia_size & ~PAGE_MASK) to
0757          * PAGE_SIZE with zeros. */
0758         size_t num_zeros = (PAGE_SIZE
0759                     - (ia->ia_size & ~PAGE_MASK));
0760 
0761         if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
0762             truncate_setsize(inode, ia->ia_size);
0763             lower_ia->ia_size = ia->ia_size;
0764             lower_ia->ia_valid |= ATTR_SIZE;
0765             goto out;
0766         }
0767         if (num_zeros) {
0768             char *zeros_virt;
0769 
0770             zeros_virt = kzalloc(num_zeros, GFP_KERNEL);
0771             if (!zeros_virt) {
0772                 rc = -ENOMEM;
0773                 goto out;
0774             }
0775             rc = ecryptfs_write(inode, zeros_virt,
0776                         ia->ia_size, num_zeros);
0777             kfree(zeros_virt);
0778             if (rc) {
0779                 printk(KERN_ERR "Error attempting to zero out "
0780                        "the remainder of the end page on "
0781                        "reducing truncate; rc = [%d]\n", rc);
0782                 goto out;
0783             }
0784         }
0785         truncate_setsize(inode, ia->ia_size);
0786         rc = ecryptfs_write_inode_size_to_metadata(inode);
0787         if (rc) {
0788             printk(KERN_ERR "Problem with "
0789                    "ecryptfs_write_inode_size_to_metadata; "
0790                    "rc = [%d]\n", rc);
0791             goto out;
0792         }
0793         /* We are reducing the size of the ecryptfs file, and need to
0794          * know if we need to reduce the size of the lower file. */
0795         lower_size_before_truncate =
0796             upper_size_to_lower_size(crypt_stat, i_size);
0797         lower_size_after_truncate =
0798             upper_size_to_lower_size(crypt_stat, ia->ia_size);
0799         if (lower_size_after_truncate < lower_size_before_truncate) {
0800             lower_ia->ia_size = lower_size_after_truncate;
0801             lower_ia->ia_valid |= ATTR_SIZE;
0802         } else
0803             lower_ia->ia_valid &= ~ATTR_SIZE;
0804     }
0805 out:
0806     ecryptfs_put_lower_file(inode);
0807     return rc;
0808 }
0809 
0810 static int ecryptfs_inode_newsize_ok(struct inode *inode, loff_t offset)
0811 {
0812     struct ecryptfs_crypt_stat *crypt_stat;
0813     loff_t lower_oldsize, lower_newsize;
0814 
0815     crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
0816     lower_oldsize = upper_size_to_lower_size(crypt_stat,
0817                          i_size_read(inode));
0818     lower_newsize = upper_size_to_lower_size(crypt_stat, offset);
0819     if (lower_newsize > lower_oldsize) {
0820         /*
0821          * The eCryptfs inode and the new *lower* size are mixed here
0822          * because we may not have the lower i_mutex held and/or it may
0823          * not be appropriate to call inode_newsize_ok() with inodes
0824          * from other filesystems.
0825          */
0826         return inode_newsize_ok(inode, lower_newsize);
0827     }
0828 
0829     return 0;
0830 }
0831 
0832 /**
0833  * ecryptfs_truncate
0834  * @dentry: The ecryptfs layer dentry
0835  * @new_length: The length to expand the file to
0836  *
0837  * Simple function that handles the truncation of an eCryptfs inode and
0838  * its corresponding lower inode.
0839  *
0840  * Returns zero on success; non-zero otherwise
0841  */
0842 int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
0843 {
0844     struct iattr ia = { .ia_valid = ATTR_SIZE, .ia_size = new_length };
0845     struct iattr lower_ia = { .ia_valid = 0 };
0846     int rc;
0847 
0848     rc = ecryptfs_inode_newsize_ok(d_inode(dentry), new_length);
0849     if (rc)
0850         return rc;
0851 
0852     rc = truncate_upper(dentry, &ia, &lower_ia);
0853     if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
0854         struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
0855 
0856         inode_lock(d_inode(lower_dentry));
0857         rc = notify_change(&init_user_ns, lower_dentry,
0858                    &lower_ia, NULL);
0859         inode_unlock(d_inode(lower_dentry));
0860     }
0861     return rc;
0862 }
0863 
0864 static int
0865 ecryptfs_permission(struct user_namespace *mnt_userns, struct inode *inode,
0866             int mask)
0867 {
0868     return inode_permission(&init_user_ns,
0869                 ecryptfs_inode_to_lower(inode), mask);
0870 }
0871 
0872 /**
0873  * ecryptfs_setattr
0874  * @mnt_userns: user namespace of the target mount
0875  * @dentry: dentry handle to the inode to modify
0876  * @ia: Structure with flags of what to change and values
0877  *
0878  * Updates the metadata of an inode. If the update is to the size
0879  * i.e. truncation, then ecryptfs_truncate will handle the size modification
0880  * of both the ecryptfs inode and the lower inode.
0881  *
0882  * All other metadata changes will be passed right to the lower filesystem,
0883  * and we will just update our inode to look like the lower.
0884  */
0885 static int ecryptfs_setattr(struct user_namespace *mnt_userns,
0886                 struct dentry *dentry, struct iattr *ia)
0887 {
0888     int rc = 0;
0889     struct dentry *lower_dentry;
0890     struct iattr lower_ia;
0891     struct inode *inode;
0892     struct inode *lower_inode;
0893     struct ecryptfs_crypt_stat *crypt_stat;
0894 
0895     crypt_stat = &ecryptfs_inode_to_private(d_inode(dentry))->crypt_stat;
0896     if (!(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)) {
0897         rc = ecryptfs_init_crypt_stat(crypt_stat);
0898         if (rc)
0899             return rc;
0900     }
0901     inode = d_inode(dentry);
0902     lower_inode = ecryptfs_inode_to_lower(inode);
0903     lower_dentry = ecryptfs_dentry_to_lower(dentry);
0904     mutex_lock(&crypt_stat->cs_mutex);
0905     if (d_is_dir(dentry))
0906         crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
0907     else if (d_is_reg(dentry)
0908          && (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)
0909              || !(crypt_stat->flags & ECRYPTFS_KEY_VALID))) {
0910         struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
0911 
0912         mount_crypt_stat = &ecryptfs_superblock_to_private(
0913             dentry->d_sb)->mount_crypt_stat;
0914         rc = ecryptfs_get_lower_file(dentry, inode);
0915         if (rc) {
0916             mutex_unlock(&crypt_stat->cs_mutex);
0917             goto out;
0918         }
0919         rc = ecryptfs_read_metadata(dentry);
0920         ecryptfs_put_lower_file(inode);
0921         if (rc) {
0922             if (!(mount_crypt_stat->flags
0923                   & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
0924                 rc = -EIO;
0925                 printk(KERN_WARNING "Either the lower file "
0926                        "is not in a valid eCryptfs format, "
0927                        "or the key could not be retrieved. "
0928                        "Plaintext passthrough mode is not "
0929                        "enabled; returning -EIO\n");
0930                 mutex_unlock(&crypt_stat->cs_mutex);
0931                 goto out;
0932             }
0933             rc = 0;
0934             crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
0935                            | ECRYPTFS_ENCRYPTED);
0936         }
0937     }
0938     mutex_unlock(&crypt_stat->cs_mutex);
0939 
0940     rc = setattr_prepare(&init_user_ns, dentry, ia);
0941     if (rc)
0942         goto out;
0943     if (ia->ia_valid & ATTR_SIZE) {
0944         rc = ecryptfs_inode_newsize_ok(inode, ia->ia_size);
0945         if (rc)
0946             goto out;
0947     }
0948 
0949     memcpy(&lower_ia, ia, sizeof(lower_ia));
0950     if (ia->ia_valid & ATTR_FILE)
0951         lower_ia.ia_file = ecryptfs_file_to_lower(ia->ia_file);
0952     if (ia->ia_valid & ATTR_SIZE) {
0953         rc = truncate_upper(dentry, ia, &lower_ia);
0954         if (rc < 0)
0955             goto out;
0956     }
0957 
0958     /*
0959      * mode change is for clearing setuid/setgid bits. Allow lower fs
0960      * to interpret this in its own way.
0961      */
0962     if (lower_ia.ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
0963         lower_ia.ia_valid &= ~ATTR_MODE;
0964 
0965     inode_lock(d_inode(lower_dentry));
0966     rc = notify_change(&init_user_ns, lower_dentry, &lower_ia, NULL);
0967     inode_unlock(d_inode(lower_dentry));
0968 out:
0969     fsstack_copy_attr_all(inode, lower_inode);
0970     return rc;
0971 }
0972 
0973 static int ecryptfs_getattr_link(struct user_namespace *mnt_userns,
0974                  const struct path *path, struct kstat *stat,
0975                  u32 request_mask, unsigned int flags)
0976 {
0977     struct dentry *dentry = path->dentry;
0978     struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
0979     int rc = 0;
0980 
0981     mount_crypt_stat = &ecryptfs_superblock_to_private(
0982                         dentry->d_sb)->mount_crypt_stat;
0983     generic_fillattr(&init_user_ns, d_inode(dentry), stat);
0984     if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
0985         char *target;
0986         size_t targetsiz;
0987 
0988         target = ecryptfs_readlink_lower(dentry, &targetsiz);
0989         if (!IS_ERR(target)) {
0990             kfree(target);
0991             stat->size = targetsiz;
0992         } else {
0993             rc = PTR_ERR(target);
0994         }
0995     }
0996     return rc;
0997 }
0998 
0999 static int ecryptfs_getattr(struct user_namespace *mnt_userns,
1000                 const struct path *path, struct kstat *stat,
1001                 u32 request_mask, unsigned int flags)
1002 {
1003     struct dentry *dentry = path->dentry;
1004     struct kstat lower_stat;
1005     int rc;
1006 
1007     rc = vfs_getattr(ecryptfs_dentry_to_lower_path(dentry), &lower_stat,
1008              request_mask, flags);
1009     if (!rc) {
1010         fsstack_copy_attr_all(d_inode(dentry),
1011                       ecryptfs_inode_to_lower(d_inode(dentry)));
1012         generic_fillattr(&init_user_ns, d_inode(dentry), stat);
1013         stat->blocks = lower_stat.blocks;
1014     }
1015     return rc;
1016 }
1017 
1018 int
1019 ecryptfs_setxattr(struct dentry *dentry, struct inode *inode,
1020           const char *name, const void *value,
1021           size_t size, int flags)
1022 {
1023     int rc;
1024     struct dentry *lower_dentry;
1025     struct inode *lower_inode;
1026 
1027     lower_dentry = ecryptfs_dentry_to_lower(dentry);
1028     lower_inode = d_inode(lower_dentry);
1029     if (!(lower_inode->i_opflags & IOP_XATTR)) {
1030         rc = -EOPNOTSUPP;
1031         goto out;
1032     }
1033     inode_lock(lower_inode);
1034     rc = __vfs_setxattr_locked(&init_user_ns, lower_dentry, name, value, size, flags, NULL);
1035     inode_unlock(lower_inode);
1036     if (!rc && inode)
1037         fsstack_copy_attr_all(inode, lower_inode);
1038 out:
1039     return rc;
1040 }
1041 
1042 ssize_t
1043 ecryptfs_getxattr_lower(struct dentry *lower_dentry, struct inode *lower_inode,
1044             const char *name, void *value, size_t size)
1045 {
1046     int rc;
1047 
1048     if (!(lower_inode->i_opflags & IOP_XATTR)) {
1049         rc = -EOPNOTSUPP;
1050         goto out;
1051     }
1052     inode_lock(lower_inode);
1053     rc = __vfs_getxattr(lower_dentry, lower_inode, name, value, size);
1054     inode_unlock(lower_inode);
1055 out:
1056     return rc;
1057 }
1058 
1059 static ssize_t
1060 ecryptfs_getxattr(struct dentry *dentry, struct inode *inode,
1061           const char *name, void *value, size_t size)
1062 {
1063     return ecryptfs_getxattr_lower(ecryptfs_dentry_to_lower(dentry),
1064                        ecryptfs_inode_to_lower(inode),
1065                        name, value, size);
1066 }
1067 
1068 static ssize_t
1069 ecryptfs_listxattr(struct dentry *dentry, char *list, size_t size)
1070 {
1071     int rc = 0;
1072     struct dentry *lower_dentry;
1073 
1074     lower_dentry = ecryptfs_dentry_to_lower(dentry);
1075     if (!d_inode(lower_dentry)->i_op->listxattr) {
1076         rc = -EOPNOTSUPP;
1077         goto out;
1078     }
1079     inode_lock(d_inode(lower_dentry));
1080     rc = d_inode(lower_dentry)->i_op->listxattr(lower_dentry, list, size);
1081     inode_unlock(d_inode(lower_dentry));
1082 out:
1083     return rc;
1084 }
1085 
1086 static int ecryptfs_removexattr(struct dentry *dentry, struct inode *inode,
1087                 const char *name)
1088 {
1089     int rc;
1090     struct dentry *lower_dentry;
1091     struct inode *lower_inode;
1092 
1093     lower_dentry = ecryptfs_dentry_to_lower(dentry);
1094     lower_inode = ecryptfs_inode_to_lower(inode);
1095     if (!(lower_inode->i_opflags & IOP_XATTR)) {
1096         rc = -EOPNOTSUPP;
1097         goto out;
1098     }
1099     inode_lock(lower_inode);
1100     rc = __vfs_removexattr(&init_user_ns, lower_dentry, name);
1101     inode_unlock(lower_inode);
1102 out:
1103     return rc;
1104 }
1105 
1106 static int ecryptfs_fileattr_get(struct dentry *dentry, struct fileattr *fa)
1107 {
1108     return vfs_fileattr_get(ecryptfs_dentry_to_lower(dentry), fa);
1109 }
1110 
1111 static int ecryptfs_fileattr_set(struct user_namespace *mnt_userns,
1112                  struct dentry *dentry, struct fileattr *fa)
1113 {
1114     struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
1115     int rc;
1116 
1117     rc = vfs_fileattr_set(&init_user_ns, lower_dentry, fa);
1118     fsstack_copy_attr_all(d_inode(dentry), d_inode(lower_dentry));
1119 
1120     return rc;
1121 }
1122 
1123 const struct inode_operations ecryptfs_symlink_iops = {
1124     .get_link = ecryptfs_get_link,
1125     .permission = ecryptfs_permission,
1126     .setattr = ecryptfs_setattr,
1127     .getattr = ecryptfs_getattr_link,
1128     .listxattr = ecryptfs_listxattr,
1129 };
1130 
1131 const struct inode_operations ecryptfs_dir_iops = {
1132     .create = ecryptfs_create,
1133     .lookup = ecryptfs_lookup,
1134     .link = ecryptfs_link,
1135     .unlink = ecryptfs_unlink,
1136     .symlink = ecryptfs_symlink,
1137     .mkdir = ecryptfs_mkdir,
1138     .rmdir = ecryptfs_rmdir,
1139     .mknod = ecryptfs_mknod,
1140     .rename = ecryptfs_rename,
1141     .permission = ecryptfs_permission,
1142     .setattr = ecryptfs_setattr,
1143     .listxattr = ecryptfs_listxattr,
1144     .fileattr_get = ecryptfs_fileattr_get,
1145     .fileattr_set = ecryptfs_fileattr_set,
1146 };
1147 
1148 const struct inode_operations ecryptfs_main_iops = {
1149     .permission = ecryptfs_permission,
1150     .setattr = ecryptfs_setattr,
1151     .getattr = ecryptfs_getattr,
1152     .listxattr = ecryptfs_listxattr,
1153     .fileattr_get = ecryptfs_fileattr_get,
1154     .fileattr_set = ecryptfs_fileattr_set,
1155 };
1156 
1157 static int ecryptfs_xattr_get(const struct xattr_handler *handler,
1158                   struct dentry *dentry, struct inode *inode,
1159                   const char *name, void *buffer, size_t size)
1160 {
1161     return ecryptfs_getxattr(dentry, inode, name, buffer, size);
1162 }
1163 
1164 static int ecryptfs_xattr_set(const struct xattr_handler *handler,
1165                   struct user_namespace *mnt_userns,
1166                   struct dentry *dentry, struct inode *inode,
1167                   const char *name, const void *value, size_t size,
1168                   int flags)
1169 {
1170     if (value)
1171         return ecryptfs_setxattr(dentry, inode, name, value, size, flags);
1172     else {
1173         BUG_ON(flags != XATTR_REPLACE);
1174         return ecryptfs_removexattr(dentry, inode, name);
1175     }
1176 }
1177 
1178 static const struct xattr_handler ecryptfs_xattr_handler = {
1179     .prefix = "",  /* match anything */
1180     .get = ecryptfs_xattr_get,
1181     .set = ecryptfs_xattr_set,
1182 };
1183 
1184 const struct xattr_handler *ecryptfs_xattr_handlers[] = {
1185     &ecryptfs_xattr_handler,
1186     NULL
1187 };
[ Source navigation ] [ Diff markup ] [ Identifier search ] [ general search ]

This page was automatically generated by the 2.1.0 LXR engine.

The LXR team
Valid CSS 2.1! Valid HTML 4.01!