1235 lines · c
1// SPDX-License-Identifier: GPL-2.0-or-later2/*3 * eCryptfs: Linux filesystem encryption layer4 *5 * Copyright (C) 1997-2004 Erez Zadok6 * Copyright (C) 2001-2004 Stony Brook University7 * Copyright (C) 2004-2007 International Business Machines Corp.8 * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>9 * Michael C. Thompsion <mcthomps@us.ibm.com>10 */11 12#include <linux/file.h>13#include <linux/vmalloc.h>14#include <linux/pagemap.h>15#include <linux/dcache.h>16#include <linux/namei.h>17#include <linux/mount.h>18#include <linux/fs_stack.h>19#include <linux/slab.h>20#include <linux/xattr.h>21#include <linux/posix_acl.h>22#include <linux/posix_acl_xattr.h>23#include <linux/fileattr.h>24#include <linux/unaligned.h>25#include "ecryptfs_kernel.h"26 27static int lock_parent(struct dentry *dentry,28 struct dentry **lower_dentry,29 struct inode **lower_dir)30{31 struct dentry *lower_dir_dentry;32 33 lower_dir_dentry = ecryptfs_dentry_to_lower(dentry->d_parent);34 *lower_dir = d_inode(lower_dir_dentry);35 *lower_dentry = ecryptfs_dentry_to_lower(dentry);36 37 inode_lock_nested(*lower_dir, I_MUTEX_PARENT);38 return (*lower_dentry)->d_parent == lower_dir_dentry ? 0 : -EINVAL;39}40 41static int ecryptfs_inode_test(struct inode *inode, void *lower_inode)42{43 return ecryptfs_inode_to_lower(inode) == lower_inode;44}45 46static int ecryptfs_inode_set(struct inode *inode, void *opaque)47{48 struct inode *lower_inode = opaque;49 50 ecryptfs_set_inode_lower(inode, lower_inode);51 fsstack_copy_attr_all(inode, lower_inode);52 /* i_size will be overwritten for encrypted regular files */53 fsstack_copy_inode_size(inode, lower_inode);54 inode->i_ino = lower_inode->i_ino;55 inode->i_mapping->a_ops = &ecryptfs_aops;56 57 if (S_ISLNK(inode->i_mode))58 inode->i_op = &ecryptfs_symlink_iops;59 else if (S_ISDIR(inode->i_mode))60 inode->i_op = &ecryptfs_dir_iops;61 else62 inode->i_op = &ecryptfs_main_iops;63 64 if (S_ISDIR(inode->i_mode))65 inode->i_fop = &ecryptfs_dir_fops;66 else if (special_file(inode->i_mode))67 init_special_inode(inode, inode->i_mode, inode->i_rdev);68 else69 inode->i_fop = &ecryptfs_main_fops;70 71 return 0;72}73 74static struct inode *__ecryptfs_get_inode(struct inode *lower_inode,75 struct super_block *sb)76{77 struct inode *inode;78 79 if (lower_inode->i_sb != ecryptfs_superblock_to_lower(sb))80 return ERR_PTR(-EXDEV);81 82 /* Reject dealing with casefold directories. */83 if (IS_CASEFOLDED(lower_inode)) {84 pr_err_ratelimited("%s: Can't handle casefolded directory.\n",85 __func__);86 return ERR_PTR(-EREMOTE);87 }88 89 if (!igrab(lower_inode))90 return ERR_PTR(-ESTALE);91 inode = iget5_locked(sb, (unsigned long)lower_inode,92 ecryptfs_inode_test, ecryptfs_inode_set,93 lower_inode);94 if (!inode) {95 iput(lower_inode);96 return ERR_PTR(-EACCES);97 }98 if (!(inode->i_state & I_NEW))99 iput(lower_inode);100 101 return inode;102}103 104struct inode *ecryptfs_get_inode(struct inode *lower_inode,105 struct super_block *sb)106{107 struct inode *inode = __ecryptfs_get_inode(lower_inode, sb);108 109 if (!IS_ERR(inode) && (inode->i_state & I_NEW))110 unlock_new_inode(inode);111 112 return inode;113}114 115/**116 * ecryptfs_interpose117 * @lower_dentry: Existing dentry in the lower filesystem118 * @dentry: ecryptfs' dentry119 * @sb: ecryptfs's super_block120 *121 * Interposes upper and lower dentries.122 *123 * Returns zero on success; non-zero otherwise124 */125static int ecryptfs_interpose(struct dentry *lower_dentry,126 struct dentry *dentry, struct super_block *sb)127{128 struct inode *inode = ecryptfs_get_inode(d_inode(lower_dentry), sb);129 130 if (IS_ERR(inode))131 return PTR_ERR(inode);132 d_instantiate(dentry, inode);133 134 return 0;135}136 137static int ecryptfs_do_unlink(struct inode *dir, struct dentry *dentry,138 struct inode *inode)139{140 struct dentry *lower_dentry;141 struct inode *lower_dir;142 int rc;143 144 rc = lock_parent(dentry, &lower_dentry, &lower_dir);145 dget(lower_dentry); // don't even try to make the lower negative146 if (!rc) {147 if (d_unhashed(lower_dentry))148 rc = -EINVAL;149 else150 rc = vfs_unlink(&nop_mnt_idmap, lower_dir, lower_dentry,151 NULL);152 }153 if (rc) {154 printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);155 goto out_unlock;156 }157 fsstack_copy_attr_times(dir, lower_dir);158 set_nlink(inode, ecryptfs_inode_to_lower(inode)->i_nlink);159 inode_set_ctime_to_ts(inode, inode_get_ctime(dir));160out_unlock:161 dput(lower_dentry);162 inode_unlock(lower_dir);163 if (!rc)164 d_drop(dentry);165 return rc;166}167 168/**169 * ecryptfs_do_create170 * @directory_inode: inode of the new file's dentry's parent in ecryptfs171 * @ecryptfs_dentry: New file's dentry in ecryptfs172 * @mode: The mode of the new file173 *174 * Creates the underlying file and the eCryptfs inode which will link to175 * it. It will also update the eCryptfs directory inode to mimic the176 * stat of the lower directory inode.177 *178 * Returns the new eCryptfs inode on success; an ERR_PTR on error condition179 */180static struct inode *181ecryptfs_do_create(struct inode *directory_inode,182 struct dentry *ecryptfs_dentry, umode_t mode)183{184 int rc;185 struct dentry *lower_dentry;186 struct inode *lower_dir;187 struct inode *inode;188 189 rc = lock_parent(ecryptfs_dentry, &lower_dentry, &lower_dir);190 if (!rc)191 rc = vfs_create(&nop_mnt_idmap, lower_dir,192 lower_dentry, mode, true);193 if (rc) {194 printk(KERN_ERR "%s: Failure to create dentry in lower fs; "195 "rc = [%d]\n", __func__, rc);196 inode = ERR_PTR(rc);197 goto out_lock;198 }199 inode = __ecryptfs_get_inode(d_inode(lower_dentry),200 directory_inode->i_sb);201 if (IS_ERR(inode)) {202 vfs_unlink(&nop_mnt_idmap, lower_dir, lower_dentry, NULL);203 goto out_lock;204 }205 fsstack_copy_attr_times(directory_inode, lower_dir);206 fsstack_copy_inode_size(directory_inode, lower_dir);207out_lock:208 inode_unlock(lower_dir);209 return inode;210}211 212/*213 * ecryptfs_initialize_file214 *215 * Cause the file to be changed from a basic empty file to an ecryptfs216 * file with a header and first data page.217 *218 * Returns zero on success219 */220int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry,221 struct inode *ecryptfs_inode)222{223 struct ecryptfs_crypt_stat *crypt_stat =224 &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;225 int rc = 0;226 227 if (S_ISDIR(ecryptfs_inode->i_mode)) {228 ecryptfs_printk(KERN_DEBUG, "This is a directory\n");229 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);230 goto out;231 }232 ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n");233 rc = ecryptfs_new_file_context(ecryptfs_inode);234 if (rc) {235 ecryptfs_printk(KERN_ERR, "Error creating new file "236 "context; rc = [%d]\n", rc);237 goto out;238 }239 rc = ecryptfs_get_lower_file(ecryptfs_dentry, ecryptfs_inode);240 if (rc) {241 printk(KERN_ERR "%s: Error attempting to initialize "242 "the lower file for the dentry with name "243 "[%pd]; rc = [%d]\n", __func__,244 ecryptfs_dentry, rc);245 goto out;246 }247 rc = ecryptfs_write_metadata(ecryptfs_dentry, ecryptfs_inode);248 if (rc)249 printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);250 ecryptfs_put_lower_file(ecryptfs_inode);251out:252 return rc;253}254 255/*256 * ecryptfs_create257 * @mode: The mode of the new file.258 *259 * Creates a new file.260 *261 * Returns zero on success; non-zero on error condition262 */263static int264ecryptfs_create(struct mnt_idmap *idmap,265 struct inode *directory_inode, struct dentry *ecryptfs_dentry,266 umode_t mode, bool excl)267{268 struct inode *ecryptfs_inode;269 int rc;270 271 ecryptfs_inode = ecryptfs_do_create(directory_inode, ecryptfs_dentry,272 mode);273 if (IS_ERR(ecryptfs_inode)) {274 ecryptfs_printk(KERN_WARNING, "Failed to create file in"275 "lower filesystem\n");276 rc = PTR_ERR(ecryptfs_inode);277 goto out;278 }279 /* At this point, a file exists on "disk"; we need to make sure280 * that this on disk file is prepared to be an ecryptfs file */281 rc = ecryptfs_initialize_file(ecryptfs_dentry, ecryptfs_inode);282 if (rc) {283 ecryptfs_do_unlink(directory_inode, ecryptfs_dentry,284 ecryptfs_inode);285 iget_failed(ecryptfs_inode);286 goto out;287 }288 d_instantiate_new(ecryptfs_dentry, ecryptfs_inode);289out:290 return rc;291}292 293static int ecryptfs_i_size_read(struct dentry *dentry, struct inode *inode)294{295 struct ecryptfs_crypt_stat *crypt_stat;296 int rc;297 298 rc = ecryptfs_get_lower_file(dentry, inode);299 if (rc) {300 printk(KERN_ERR "%s: Error attempting to initialize "301 "the lower file for the dentry with name "302 "[%pd]; rc = [%d]\n", __func__,303 dentry, rc);304 return rc;305 }306 307 crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;308 /* TODO: lock for crypt_stat comparison */309 if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))310 ecryptfs_set_default_sizes(crypt_stat);311 312 rc = ecryptfs_read_and_validate_header_region(inode);313 ecryptfs_put_lower_file(inode);314 if (rc) {315 rc = ecryptfs_read_and_validate_xattr_region(dentry, inode);316 if (!rc)317 crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;318 }319 320 /* Must return 0 to allow non-eCryptfs files to be looked up, too */321 return 0;322}323 324/*325 * ecryptfs_lookup_interpose - Dentry interposition for a lookup326 */327static struct dentry *ecryptfs_lookup_interpose(struct dentry *dentry,328 struct dentry *lower_dentry)329{330 const struct path *path = ecryptfs_dentry_to_lower_path(dentry->d_parent);331 struct inode *inode, *lower_inode;332 struct ecryptfs_dentry_info *dentry_info;333 int rc = 0;334 335 dentry_info = kmem_cache_alloc(ecryptfs_dentry_info_cache, GFP_KERNEL);336 if (!dentry_info) {337 dput(lower_dentry);338 return ERR_PTR(-ENOMEM);339 }340 341 fsstack_copy_attr_atime(d_inode(dentry->d_parent),342 d_inode(path->dentry));343 BUG_ON(!d_count(lower_dentry));344 345 ecryptfs_set_dentry_private(dentry, dentry_info);346 dentry_info->lower_path.mnt = mntget(path->mnt);347 dentry_info->lower_path.dentry = lower_dentry;348 349 /*350 * negative dentry can go positive under us here - its parent is not351 * locked. That's OK and that could happen just as we return from352 * ecryptfs_lookup() anyway. Just need to be careful and fetch353 * ->d_inode only once - it's not stable here.354 */355 lower_inode = READ_ONCE(lower_dentry->d_inode);356 357 if (!lower_inode) {358 /* We want to add because we couldn't find in lower */359 d_add(dentry, NULL);360 return NULL;361 }362 inode = __ecryptfs_get_inode(lower_inode, dentry->d_sb);363 if (IS_ERR(inode)) {364 printk(KERN_ERR "%s: Error interposing; rc = [%ld]\n",365 __func__, PTR_ERR(inode));366 return ERR_CAST(inode);367 }368 if (S_ISREG(inode->i_mode)) {369 rc = ecryptfs_i_size_read(dentry, inode);370 if (rc) {371 make_bad_inode(inode);372 return ERR_PTR(rc);373 }374 }375 376 if (inode->i_state & I_NEW)377 unlock_new_inode(inode);378 return d_splice_alias(inode, dentry);379}380 381/**382 * ecryptfs_lookup383 * @ecryptfs_dir_inode: The eCryptfs directory inode384 * @ecryptfs_dentry: The eCryptfs dentry that we are looking up385 * @flags: lookup flags386 *387 * Find a file on disk. If the file does not exist, then we'll add it to the388 * dentry cache and continue on to read it from the disk.389 */390static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,391 struct dentry *ecryptfs_dentry,392 unsigned int flags)393{394 char *encrypted_and_encoded_name = NULL;395 struct ecryptfs_mount_crypt_stat *mount_crypt_stat;396 struct dentry *lower_dir_dentry, *lower_dentry;397 const char *name = ecryptfs_dentry->d_name.name;398 size_t len = ecryptfs_dentry->d_name.len;399 struct dentry *res;400 int rc = 0;401 402 lower_dir_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry->d_parent);403 404 mount_crypt_stat = &ecryptfs_superblock_to_private(405 ecryptfs_dentry->d_sb)->mount_crypt_stat;406 if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {407 rc = ecryptfs_encrypt_and_encode_filename(408 &encrypted_and_encoded_name, &len,409 mount_crypt_stat, name, len);410 if (rc) {411 printk(KERN_ERR "%s: Error attempting to encrypt and encode "412 "filename; rc = [%d]\n", __func__, rc);413 return ERR_PTR(rc);414 }415 name = encrypted_and_encoded_name;416 }417 418 lower_dentry = lookup_one_len_unlocked(name, lower_dir_dentry, len);419 if (IS_ERR(lower_dentry)) {420 ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned "421 "[%ld] on lower_dentry = [%s]\n", __func__,422 PTR_ERR(lower_dentry),423 name);424 res = ERR_CAST(lower_dentry);425 } else {426 res = ecryptfs_lookup_interpose(ecryptfs_dentry, lower_dentry);427 }428 kfree(encrypted_and_encoded_name);429 return res;430}431 432static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir,433 struct dentry *new_dentry)434{435 struct dentry *lower_old_dentry;436 struct dentry *lower_new_dentry;437 struct inode *lower_dir;438 u64 file_size_save;439 int rc;440 441 file_size_save = i_size_read(d_inode(old_dentry));442 lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);443 rc = lock_parent(new_dentry, &lower_new_dentry, &lower_dir);444 if (!rc)445 rc = vfs_link(lower_old_dentry, &nop_mnt_idmap, lower_dir,446 lower_new_dentry, NULL);447 if (rc || d_really_is_negative(lower_new_dentry))448 goto out_lock;449 rc = ecryptfs_interpose(lower_new_dentry, new_dentry, dir->i_sb);450 if (rc)451 goto out_lock;452 fsstack_copy_attr_times(dir, lower_dir);453 fsstack_copy_inode_size(dir, lower_dir);454 set_nlink(d_inode(old_dentry),455 ecryptfs_inode_to_lower(d_inode(old_dentry))->i_nlink);456 i_size_write(d_inode(new_dentry), file_size_save);457out_lock:458 inode_unlock(lower_dir);459 return rc;460}461 462static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)463{464 return ecryptfs_do_unlink(dir, dentry, d_inode(dentry));465}466 467static int ecryptfs_symlink(struct mnt_idmap *idmap,468 struct inode *dir, struct dentry *dentry,469 const char *symname)470{471 int rc;472 struct dentry *lower_dentry;473 struct inode *lower_dir;474 char *encoded_symname;475 size_t encoded_symlen;476 struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;477 478 rc = lock_parent(dentry, &lower_dentry, &lower_dir);479 if (rc)480 goto out_lock;481 mount_crypt_stat = &ecryptfs_superblock_to_private(482 dir->i_sb)->mount_crypt_stat;483 rc = ecryptfs_encrypt_and_encode_filename(&encoded_symname,484 &encoded_symlen,485 mount_crypt_stat, symname,486 strlen(symname));487 if (rc)488 goto out_lock;489 rc = vfs_symlink(&nop_mnt_idmap, lower_dir, lower_dentry,490 encoded_symname);491 kfree(encoded_symname);492 if (rc || d_really_is_negative(lower_dentry))493 goto out_lock;494 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);495 if (rc)496 goto out_lock;497 fsstack_copy_attr_times(dir, lower_dir);498 fsstack_copy_inode_size(dir, lower_dir);499out_lock:500 inode_unlock(lower_dir);501 if (d_really_is_negative(dentry))502 d_drop(dentry);503 return rc;504}505 506static int ecryptfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,507 struct dentry *dentry, umode_t mode)508{509 int rc;510 struct dentry *lower_dentry;511 struct inode *lower_dir;512 513 rc = lock_parent(dentry, &lower_dentry, &lower_dir);514 if (!rc)515 rc = vfs_mkdir(&nop_mnt_idmap, lower_dir,516 lower_dentry, mode);517 if (rc || d_really_is_negative(lower_dentry))518 goto out;519 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);520 if (rc)521 goto out;522 fsstack_copy_attr_times(dir, lower_dir);523 fsstack_copy_inode_size(dir, lower_dir);524 set_nlink(dir, lower_dir->i_nlink);525out:526 inode_unlock(lower_dir);527 if (d_really_is_negative(dentry))528 d_drop(dentry);529 return rc;530}531 532static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry)533{534 struct dentry *lower_dentry;535 struct inode *lower_dir;536 int rc;537 538 rc = lock_parent(dentry, &lower_dentry, &lower_dir);539 dget(lower_dentry); // don't even try to make the lower negative540 if (!rc) {541 if (d_unhashed(lower_dentry))542 rc = -EINVAL;543 else544 rc = vfs_rmdir(&nop_mnt_idmap, lower_dir, lower_dentry);545 }546 if (!rc) {547 clear_nlink(d_inode(dentry));548 fsstack_copy_attr_times(dir, lower_dir);549 set_nlink(dir, lower_dir->i_nlink);550 }551 dput(lower_dentry);552 inode_unlock(lower_dir);553 if (!rc)554 d_drop(dentry);555 return rc;556}557 558static int559ecryptfs_mknod(struct mnt_idmap *idmap, struct inode *dir,560 struct dentry *dentry, umode_t mode, dev_t dev)561{562 int rc;563 struct dentry *lower_dentry;564 struct inode *lower_dir;565 566 rc = lock_parent(dentry, &lower_dentry, &lower_dir);567 if (!rc)568 rc = vfs_mknod(&nop_mnt_idmap, lower_dir,569 lower_dentry, mode, dev);570 if (rc || d_really_is_negative(lower_dentry))571 goto out;572 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);573 if (rc)574 goto out;575 fsstack_copy_attr_times(dir, lower_dir);576 fsstack_copy_inode_size(dir, lower_dir);577out:578 inode_unlock(lower_dir);579 if (d_really_is_negative(dentry))580 d_drop(dentry);581 return rc;582}583 584static int585ecryptfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,586 struct dentry *old_dentry, struct inode *new_dir,587 struct dentry *new_dentry, unsigned int flags)588{589 int rc;590 struct dentry *lower_old_dentry;591 struct dentry *lower_new_dentry;592 struct dentry *lower_old_dir_dentry;593 struct dentry *lower_new_dir_dentry;594 struct dentry *trap;595 struct inode *target_inode;596 struct renamedata rd = {};597 598 if (flags)599 return -EINVAL;600 601 lower_old_dir_dentry = ecryptfs_dentry_to_lower(old_dentry->d_parent);602 lower_new_dir_dentry = ecryptfs_dentry_to_lower(new_dentry->d_parent);603 604 lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);605 lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);606 607 target_inode = d_inode(new_dentry);608 609 trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);610 if (IS_ERR(trap))611 return PTR_ERR(trap);612 dget(lower_new_dentry);613 rc = -EINVAL;614 if (lower_old_dentry->d_parent != lower_old_dir_dentry)615 goto out_lock;616 if (lower_new_dentry->d_parent != lower_new_dir_dentry)617 goto out_lock;618 if (d_unhashed(lower_old_dentry) || d_unhashed(lower_new_dentry))619 goto out_lock;620 /* source should not be ancestor of target */621 if (trap == lower_old_dentry)622 goto out_lock;623 /* target should not be ancestor of source */624 if (trap == lower_new_dentry) {625 rc = -ENOTEMPTY;626 goto out_lock;627 }628 629 rd.old_mnt_idmap = &nop_mnt_idmap;630 rd.old_dir = d_inode(lower_old_dir_dentry);631 rd.old_dentry = lower_old_dentry;632 rd.new_mnt_idmap = &nop_mnt_idmap;633 rd.new_dir = d_inode(lower_new_dir_dentry);634 rd.new_dentry = lower_new_dentry;635 rc = vfs_rename(&rd);636 if (rc)637 goto out_lock;638 if (target_inode)639 fsstack_copy_attr_all(target_inode,640 ecryptfs_inode_to_lower(target_inode));641 fsstack_copy_attr_all(new_dir, d_inode(lower_new_dir_dentry));642 if (new_dir != old_dir)643 fsstack_copy_attr_all(old_dir, d_inode(lower_old_dir_dentry));644out_lock:645 dput(lower_new_dentry);646 unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry);647 return rc;648}649 650static char *ecryptfs_readlink_lower(struct dentry *dentry, size_t *bufsiz)651{652 DEFINE_DELAYED_CALL(done);653 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);654 const char *link;655 char *buf;656 int rc;657 658 link = vfs_get_link(lower_dentry, &done);659 if (IS_ERR(link))660 return ERR_CAST(link);661 662 rc = ecryptfs_decode_and_decrypt_filename(&buf, bufsiz, dentry->d_sb,663 link, strlen(link));664 do_delayed_call(&done);665 if (rc)666 return ERR_PTR(rc);667 668 return buf;669}670 671static const char *ecryptfs_get_link(struct dentry *dentry,672 struct inode *inode,673 struct delayed_call *done)674{675 size_t len;676 char *buf;677 678 if (!dentry)679 return ERR_PTR(-ECHILD);680 681 buf = ecryptfs_readlink_lower(dentry, &len);682 if (IS_ERR(buf))683 return buf;684 fsstack_copy_attr_atime(d_inode(dentry),685 d_inode(ecryptfs_dentry_to_lower(dentry)));686 buf[len] = '\0';687 set_delayed_call(done, kfree_link, buf);688 return buf;689}690 691/**692 * upper_size_to_lower_size693 * @crypt_stat: Crypt_stat associated with file694 * @upper_size: Size of the upper file695 *696 * Calculate the required size of the lower file based on the697 * specified size of the upper file. This calculation is based on the698 * number of headers in the underlying file and the extent size.699 *700 * Returns Calculated size of the lower file.701 */702static loff_t703upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat,704 loff_t upper_size)705{706 loff_t lower_size;707 708 lower_size = ecryptfs_lower_header_size(crypt_stat);709 if (upper_size != 0) {710 loff_t num_extents;711 712 num_extents = upper_size >> crypt_stat->extent_shift;713 if (upper_size & ~crypt_stat->extent_mask)714 num_extents++;715 lower_size += (num_extents * crypt_stat->extent_size);716 }717 return lower_size;718}719 720/**721 * truncate_upper722 * @dentry: The ecryptfs layer dentry723 * @ia: Address of the ecryptfs inode's attributes724 * @lower_ia: Address of the lower inode's attributes725 *726 * Function to handle truncations modifying the size of the file. Note727 * that the file sizes are interpolated. When expanding, we are simply728 * writing strings of 0's out. When truncating, we truncate the upper729 * inode and update the lower_ia according to the page index730 * interpolations. If ATTR_SIZE is set in lower_ia->ia_valid upon return,731 * the caller must use lower_ia in a call to notify_change() to perform732 * the truncation of the lower inode.733 *734 * Returns zero on success; non-zero otherwise735 */736static int truncate_upper(struct dentry *dentry, struct iattr *ia,737 struct iattr *lower_ia)738{739 int rc = 0;740 struct inode *inode = d_inode(dentry);741 struct ecryptfs_crypt_stat *crypt_stat;742 loff_t i_size = i_size_read(inode);743 loff_t lower_size_before_truncate;744 loff_t lower_size_after_truncate;745 746 if (unlikely((ia->ia_size == i_size))) {747 lower_ia->ia_valid &= ~ATTR_SIZE;748 return 0;749 }750 rc = ecryptfs_get_lower_file(dentry, inode);751 if (rc)752 return rc;753 crypt_stat = &ecryptfs_inode_to_private(d_inode(dentry))->crypt_stat;754 /* Switch on growing or shrinking file */755 if (ia->ia_size > i_size) {756 char zero[] = { 0x00 };757 758 lower_ia->ia_valid &= ~ATTR_SIZE;759 /* Write a single 0 at the last position of the file;760 * this triggers code that will fill in 0's throughout761 * the intermediate portion of the previous end of the762 * file and the new and of the file */763 rc = ecryptfs_write(inode, zero,764 (ia->ia_size - 1), 1);765 } else { /* ia->ia_size < i_size_read(inode) */766 /* We're chopping off all the pages down to the page767 * in which ia->ia_size is located. Fill in the end of768 * that page from (ia->ia_size & ~PAGE_MASK) to769 * PAGE_SIZE with zeros. */770 size_t num_zeros = (PAGE_SIZE771 - (ia->ia_size & ~PAGE_MASK));772 773 if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {774 truncate_setsize(inode, ia->ia_size);775 lower_ia->ia_size = ia->ia_size;776 lower_ia->ia_valid |= ATTR_SIZE;777 goto out;778 }779 if (num_zeros) {780 char *zeros_virt;781 782 zeros_virt = kzalloc(num_zeros, GFP_KERNEL);783 if (!zeros_virt) {784 rc = -ENOMEM;785 goto out;786 }787 rc = ecryptfs_write(inode, zeros_virt,788 ia->ia_size, num_zeros);789 kfree(zeros_virt);790 if (rc) {791 printk(KERN_ERR "Error attempting to zero out "792 "the remainder of the end page on "793 "reducing truncate; rc = [%d]\n", rc);794 goto out;795 }796 }797 truncate_setsize(inode, ia->ia_size);798 rc = ecryptfs_write_inode_size_to_metadata(inode);799 if (rc) {800 printk(KERN_ERR "Problem with "801 "ecryptfs_write_inode_size_to_metadata; "802 "rc = [%d]\n", rc);803 goto out;804 }805 /* We are reducing the size of the ecryptfs file, and need to806 * know if we need to reduce the size of the lower file. */807 lower_size_before_truncate =808 upper_size_to_lower_size(crypt_stat, i_size);809 lower_size_after_truncate =810 upper_size_to_lower_size(crypt_stat, ia->ia_size);811 if (lower_size_after_truncate < lower_size_before_truncate) {812 lower_ia->ia_size = lower_size_after_truncate;813 lower_ia->ia_valid |= ATTR_SIZE;814 } else815 lower_ia->ia_valid &= ~ATTR_SIZE;816 }817out:818 ecryptfs_put_lower_file(inode);819 return rc;820}821 822static int ecryptfs_inode_newsize_ok(struct inode *inode, loff_t offset)823{824 struct ecryptfs_crypt_stat *crypt_stat;825 loff_t lower_oldsize, lower_newsize;826 827 crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;828 lower_oldsize = upper_size_to_lower_size(crypt_stat,829 i_size_read(inode));830 lower_newsize = upper_size_to_lower_size(crypt_stat, offset);831 if (lower_newsize > lower_oldsize) {832 /*833 * The eCryptfs inode and the new *lower* size are mixed here834 * because we may not have the lower i_mutex held and/or it may835 * not be appropriate to call inode_newsize_ok() with inodes836 * from other filesystems.837 */838 return inode_newsize_ok(inode, lower_newsize);839 }840 841 return 0;842}843 844/**845 * ecryptfs_truncate846 * @dentry: The ecryptfs layer dentry847 * @new_length: The length to expand the file to848 *849 * Simple function that handles the truncation of an eCryptfs inode and850 * its corresponding lower inode.851 *852 * Returns zero on success; non-zero otherwise853 */854int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)855{856 struct iattr ia = { .ia_valid = ATTR_SIZE, .ia_size = new_length };857 struct iattr lower_ia = { .ia_valid = 0 };858 int rc;859 860 rc = ecryptfs_inode_newsize_ok(d_inode(dentry), new_length);861 if (rc)862 return rc;863 864 rc = truncate_upper(dentry, &ia, &lower_ia);865 if (!rc && lower_ia.ia_valid & ATTR_SIZE) {866 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);867 868 inode_lock(d_inode(lower_dentry));869 rc = notify_change(&nop_mnt_idmap, lower_dentry,870 &lower_ia, NULL);871 inode_unlock(d_inode(lower_dentry));872 }873 return rc;874}875 876static int877ecryptfs_permission(struct mnt_idmap *idmap, struct inode *inode,878 int mask)879{880 return inode_permission(&nop_mnt_idmap,881 ecryptfs_inode_to_lower(inode), mask);882}883 884/**885 * ecryptfs_setattr886 * @idmap: idmap of the target mount887 * @dentry: dentry handle to the inode to modify888 * @ia: Structure with flags of what to change and values889 *890 * Updates the metadata of an inode. If the update is to the size891 * i.e. truncation, then ecryptfs_truncate will handle the size modification892 * of both the ecryptfs inode and the lower inode.893 *894 * All other metadata changes will be passed right to the lower filesystem,895 * and we will just update our inode to look like the lower.896 */897static int ecryptfs_setattr(struct mnt_idmap *idmap,898 struct dentry *dentry, struct iattr *ia)899{900 int rc = 0;901 struct dentry *lower_dentry;902 struct iattr lower_ia;903 struct inode *inode;904 struct inode *lower_inode;905 struct ecryptfs_crypt_stat *crypt_stat;906 907 crypt_stat = &ecryptfs_inode_to_private(d_inode(dentry))->crypt_stat;908 if (!(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)) {909 rc = ecryptfs_init_crypt_stat(crypt_stat);910 if (rc)911 return rc;912 }913 inode = d_inode(dentry);914 lower_inode = ecryptfs_inode_to_lower(inode);915 lower_dentry = ecryptfs_dentry_to_lower(dentry);916 mutex_lock(&crypt_stat->cs_mutex);917 if (d_is_dir(dentry))918 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);919 else if (d_is_reg(dentry)920 && (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)921 || !(crypt_stat->flags & ECRYPTFS_KEY_VALID))) {922 struct ecryptfs_mount_crypt_stat *mount_crypt_stat;923 924 mount_crypt_stat = &ecryptfs_superblock_to_private(925 dentry->d_sb)->mount_crypt_stat;926 rc = ecryptfs_get_lower_file(dentry, inode);927 if (rc) {928 mutex_unlock(&crypt_stat->cs_mutex);929 goto out;930 }931 rc = ecryptfs_read_metadata(dentry);932 ecryptfs_put_lower_file(inode);933 if (rc) {934 if (!(mount_crypt_stat->flags935 & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {936 rc = -EIO;937 printk(KERN_WARNING "Either the lower file "938 "is not in a valid eCryptfs format, "939 "or the key could not be retrieved. "940 "Plaintext passthrough mode is not "941 "enabled; returning -EIO\n");942 mutex_unlock(&crypt_stat->cs_mutex);943 goto out;944 }945 rc = 0;946 crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED947 | ECRYPTFS_ENCRYPTED);948 }949 }950 mutex_unlock(&crypt_stat->cs_mutex);951 952 rc = setattr_prepare(&nop_mnt_idmap, dentry, ia);953 if (rc)954 goto out;955 if (ia->ia_valid & ATTR_SIZE) {956 rc = ecryptfs_inode_newsize_ok(inode, ia->ia_size);957 if (rc)958 goto out;959 }960 961 memcpy(&lower_ia, ia, sizeof(lower_ia));962 if (ia->ia_valid & ATTR_FILE)963 lower_ia.ia_file = ecryptfs_file_to_lower(ia->ia_file);964 if (ia->ia_valid & ATTR_SIZE) {965 rc = truncate_upper(dentry, ia, &lower_ia);966 if (rc < 0)967 goto out;968 }969 970 /*971 * mode change is for clearing setuid/setgid bits. Allow lower fs972 * to interpret this in its own way.973 */974 if (lower_ia.ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))975 lower_ia.ia_valid &= ~ATTR_MODE;976 977 inode_lock(d_inode(lower_dentry));978 rc = notify_change(&nop_mnt_idmap, lower_dentry, &lower_ia, NULL);979 inode_unlock(d_inode(lower_dentry));980out:981 fsstack_copy_attr_all(inode, lower_inode);982 return rc;983}984 985static int ecryptfs_getattr_link(struct mnt_idmap *idmap,986 const struct path *path, struct kstat *stat,987 u32 request_mask, unsigned int flags)988{989 struct dentry *dentry = path->dentry;990 struct ecryptfs_mount_crypt_stat *mount_crypt_stat;991 int rc = 0;992 993 mount_crypt_stat = &ecryptfs_superblock_to_private(994 dentry->d_sb)->mount_crypt_stat;995 generic_fillattr(&nop_mnt_idmap, request_mask, d_inode(dentry), stat);996 if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {997 char *target;998 size_t targetsiz;999 1000 target = ecryptfs_readlink_lower(dentry, &targetsiz);1001 if (!IS_ERR(target)) {1002 kfree(target);1003 stat->size = targetsiz;1004 } else {1005 rc = PTR_ERR(target);1006 }1007 }1008 return rc;1009}1010 1011static int ecryptfs_do_getattr(const struct path *path, struct kstat *stat,1012 u32 request_mask, unsigned int flags)1013{1014 if (flags & AT_GETATTR_NOSEC)1015 return vfs_getattr_nosec(path, stat, request_mask, flags);1016 return vfs_getattr(path, stat, request_mask, flags);1017}1018 1019static int ecryptfs_getattr(struct mnt_idmap *idmap,1020 const struct path *path, struct kstat *stat,1021 u32 request_mask, unsigned int flags)1022{1023 struct dentry *dentry = path->dentry;1024 struct kstat lower_stat;1025 int rc;1026 1027 rc = ecryptfs_do_getattr(ecryptfs_dentry_to_lower_path(dentry),1028 &lower_stat, request_mask, flags);1029 if (!rc) {1030 fsstack_copy_attr_all(d_inode(dentry),1031 ecryptfs_inode_to_lower(d_inode(dentry)));1032 generic_fillattr(&nop_mnt_idmap, request_mask,1033 d_inode(dentry), stat);1034 stat->blocks = lower_stat.blocks;1035 }1036 return rc;1037}1038 1039int1040ecryptfs_setxattr(struct dentry *dentry, struct inode *inode,1041 const char *name, const void *value,1042 size_t size, int flags)1043{1044 int rc;1045 struct dentry *lower_dentry;1046 struct inode *lower_inode;1047 1048 lower_dentry = ecryptfs_dentry_to_lower(dentry);1049 lower_inode = d_inode(lower_dentry);1050 if (!(lower_inode->i_opflags & IOP_XATTR)) {1051 rc = -EOPNOTSUPP;1052 goto out;1053 }1054 inode_lock(lower_inode);1055 rc = __vfs_setxattr_locked(&nop_mnt_idmap, lower_dentry, name, value, size, flags, NULL);1056 inode_unlock(lower_inode);1057 if (!rc && inode)1058 fsstack_copy_attr_all(inode, lower_inode);1059out:1060 return rc;1061}1062 1063ssize_t1064ecryptfs_getxattr_lower(struct dentry *lower_dentry, struct inode *lower_inode,1065 const char *name, void *value, size_t size)1066{1067 int rc;1068 1069 if (!(lower_inode->i_opflags & IOP_XATTR)) {1070 rc = -EOPNOTSUPP;1071 goto out;1072 }1073 inode_lock(lower_inode);1074 rc = __vfs_getxattr(lower_dentry, lower_inode, name, value, size);1075 inode_unlock(lower_inode);1076out:1077 return rc;1078}1079 1080static ssize_t1081ecryptfs_getxattr(struct dentry *dentry, struct inode *inode,1082 const char *name, void *value, size_t size)1083{1084 return ecryptfs_getxattr_lower(ecryptfs_dentry_to_lower(dentry),1085 ecryptfs_inode_to_lower(inode),1086 name, value, size);1087}1088 1089static ssize_t1090ecryptfs_listxattr(struct dentry *dentry, char *list, size_t size)1091{1092 int rc = 0;1093 struct dentry *lower_dentry;1094 1095 lower_dentry = ecryptfs_dentry_to_lower(dentry);1096 if (!d_inode(lower_dentry)->i_op->listxattr) {1097 rc = -EOPNOTSUPP;1098 goto out;1099 }1100 inode_lock(d_inode(lower_dentry));1101 rc = d_inode(lower_dentry)->i_op->listxattr(lower_dentry, list, size);1102 inode_unlock(d_inode(lower_dentry));1103out:1104 return rc;1105}1106 1107static int ecryptfs_removexattr(struct dentry *dentry, struct inode *inode,1108 const char *name)1109{1110 int rc;1111 struct dentry *lower_dentry;1112 struct inode *lower_inode;1113 1114 lower_dentry = ecryptfs_dentry_to_lower(dentry);1115 lower_inode = ecryptfs_inode_to_lower(inode);1116 if (!(lower_inode->i_opflags & IOP_XATTR)) {1117 rc = -EOPNOTSUPP;1118 goto out;1119 }1120 inode_lock(lower_inode);1121 rc = __vfs_removexattr(&nop_mnt_idmap, lower_dentry, name);1122 inode_unlock(lower_inode);1123out:1124 return rc;1125}1126 1127static int ecryptfs_fileattr_get(struct dentry *dentry, struct fileattr *fa)1128{1129 return vfs_fileattr_get(ecryptfs_dentry_to_lower(dentry), fa);1130}1131 1132static int ecryptfs_fileattr_set(struct mnt_idmap *idmap,1133 struct dentry *dentry, struct fileattr *fa)1134{1135 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);1136 int rc;1137 1138 rc = vfs_fileattr_set(&nop_mnt_idmap, lower_dentry, fa);1139 fsstack_copy_attr_all(d_inode(dentry), d_inode(lower_dentry));1140 1141 return rc;1142}1143 1144static struct posix_acl *ecryptfs_get_acl(struct mnt_idmap *idmap,1145 struct dentry *dentry, int type)1146{1147 return vfs_get_acl(idmap, ecryptfs_dentry_to_lower(dentry),1148 posix_acl_xattr_name(type));1149}1150 1151static int ecryptfs_set_acl(struct mnt_idmap *idmap,1152 struct dentry *dentry, struct posix_acl *acl,1153 int type)1154{1155 int rc;1156 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);1157 struct inode *lower_inode = d_inode(lower_dentry);1158 1159 rc = vfs_set_acl(&nop_mnt_idmap, lower_dentry,1160 posix_acl_xattr_name(type), acl);1161 if (!rc)1162 fsstack_copy_attr_all(d_inode(dentry), lower_inode);1163 return rc;1164}1165 1166const struct inode_operations ecryptfs_symlink_iops = {1167 .get_link = ecryptfs_get_link,1168 .permission = ecryptfs_permission,1169 .setattr = ecryptfs_setattr,1170 .getattr = ecryptfs_getattr_link,1171 .listxattr = ecryptfs_listxattr,1172};1173 1174const struct inode_operations ecryptfs_dir_iops = {1175 .create = ecryptfs_create,1176 .lookup = ecryptfs_lookup,1177 .link = ecryptfs_link,1178 .unlink = ecryptfs_unlink,1179 .symlink = ecryptfs_symlink,1180 .mkdir = ecryptfs_mkdir,1181 .rmdir = ecryptfs_rmdir,1182 .mknod = ecryptfs_mknod,1183 .rename = ecryptfs_rename,1184 .permission = ecryptfs_permission,1185 .setattr = ecryptfs_setattr,1186 .listxattr = ecryptfs_listxattr,1187 .fileattr_get = ecryptfs_fileattr_get,1188 .fileattr_set = ecryptfs_fileattr_set,1189 .get_acl = ecryptfs_get_acl,1190 .set_acl = ecryptfs_set_acl,1191};1192 1193const struct inode_operations ecryptfs_main_iops = {1194 .permission = ecryptfs_permission,1195 .setattr = ecryptfs_setattr,1196 .getattr = ecryptfs_getattr,1197 .listxattr = ecryptfs_listxattr,1198 .fileattr_get = ecryptfs_fileattr_get,1199 .fileattr_set = ecryptfs_fileattr_set,1200 .get_acl = ecryptfs_get_acl,1201 .set_acl = ecryptfs_set_acl,1202};1203 1204static int ecryptfs_xattr_get(const struct xattr_handler *handler,1205 struct dentry *dentry, struct inode *inode,1206 const char *name, void *buffer, size_t size)1207{1208 return ecryptfs_getxattr(dentry, inode, name, buffer, size);1209}1210 1211static int ecryptfs_xattr_set(const struct xattr_handler *handler,1212 struct mnt_idmap *idmap,1213 struct dentry *dentry, struct inode *inode,1214 const char *name, const void *value, size_t size,1215 int flags)1216{1217 if (value)1218 return ecryptfs_setxattr(dentry, inode, name, value, size, flags);1219 else {1220 BUG_ON(flags != XATTR_REPLACE);1221 return ecryptfs_removexattr(dentry, inode, name);1222 }1223}1224 1225static const struct xattr_handler ecryptfs_xattr_handler = {1226 .prefix = "", /* match anything */1227 .get = ecryptfs_xattr_get,1228 .set = ecryptfs_xattr_set,1229};1230 1231const struct xattr_handler * const ecryptfs_xattr_handlers[] = {1232 &ecryptfs_xattr_handler,1233 NULL1234};1235