889 lines · c
1// SPDX-License-Identifier: GPL-2.0-or-later2/*3 * eCryptfs: Linux filesystem encryption layer4 *5 * Copyright (C) 1997-2003 Erez Zadok6 * Copyright (C) 2001-2003 Stony Brook University7 * Copyright (C) 2004-2007 International Business Machines Corp.8 * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>9 * Michael C. Thompson <mcthomps@us.ibm.com>10 * Tyler Hicks <code@tyhicks.com>11 */12 13#include <linux/dcache.h>14#include <linux/file.h>15#include <linux/module.h>16#include <linux/namei.h>17#include <linux/skbuff.h>18#include <linux/mount.h>19#include <linux/pagemap.h>20#include <linux/key.h>21#include <linux/parser.h>22#include <linux/fs_stack.h>23#include <linux/slab.h>24#include <linux/magic.h>25#include "ecryptfs_kernel.h"26 27/*28 * Module parameter that defines the ecryptfs_verbosity level.29 */30int ecryptfs_verbosity = 0;31 32module_param(ecryptfs_verbosity, int, 0);33MODULE_PARM_DESC(ecryptfs_verbosity,34 "Initial verbosity level (0 or 1; defaults to "35 "0, which is Quiet)");36 37/*38 * Module parameter that defines the number of message buffer elements39 */40unsigned int ecryptfs_message_buf_len = ECRYPTFS_DEFAULT_MSG_CTX_ELEMS;41 42module_param(ecryptfs_message_buf_len, uint, 0);43MODULE_PARM_DESC(ecryptfs_message_buf_len,44 "Number of message buffer elements");45 46/*47 * Module parameter that defines the maximum guaranteed amount of time to wait48 * for a response from ecryptfsd. The actual sleep time will be, more than49 * likely, a small amount greater than this specified value, but only less if50 * the message successfully arrives.51 */52signed long ecryptfs_message_wait_timeout = ECRYPTFS_MAX_MSG_CTX_TTL / HZ;53 54module_param(ecryptfs_message_wait_timeout, long, 0);55MODULE_PARM_DESC(ecryptfs_message_wait_timeout,56 "Maximum number of seconds that an operation will "57 "sleep while waiting for a message response from "58 "userspace");59 60/*61 * Module parameter that is an estimate of the maximum number of users62 * that will be concurrently using eCryptfs. Set this to the right63 * value to balance performance and memory use.64 */65unsigned int ecryptfs_number_of_users = ECRYPTFS_DEFAULT_NUM_USERS;66 67module_param(ecryptfs_number_of_users, uint, 0);68MODULE_PARM_DESC(ecryptfs_number_of_users, "An estimate of the number of "69 "concurrent users of eCryptfs");70 71void __ecryptfs_printk(const char *fmt, ...)72{73 va_list args;74 va_start(args, fmt);75 if (fmt[1] == '7') { /* KERN_DEBUG */76 if (ecryptfs_verbosity >= 1)77 vprintk(fmt, args);78 } else79 vprintk(fmt, args);80 va_end(args);81}82 83/*84 * ecryptfs_init_lower_file85 * @ecryptfs_dentry: Fully initialized eCryptfs dentry object, with86 * the lower dentry and the lower mount set87 *88 * eCryptfs only ever keeps a single open file for every lower89 * inode. All I/O operations to the lower inode occur through that90 * file. When the first eCryptfs dentry that interposes with the first91 * lower dentry for that inode is created, this function creates the92 * lower file struct and associates it with the eCryptfs93 * inode. When all eCryptfs files associated with the inode are released, the94 * file is closed.95 *96 * The lower file will be opened with read/write permissions, if97 * possible. Otherwise, it is opened read-only.98 *99 * This function does nothing if a lower file is already100 * associated with the eCryptfs inode.101 *102 * Returns zero on success; non-zero otherwise103 */104static int ecryptfs_init_lower_file(struct dentry *dentry,105 struct file **lower_file)106{107 const struct cred *cred = current_cred();108 const struct path *path = ecryptfs_dentry_to_lower_path(dentry);109 int rc;110 111 rc = ecryptfs_privileged_open(lower_file, path->dentry, path->mnt,112 cred);113 if (rc) {114 printk(KERN_ERR "Error opening lower file "115 "for lower_dentry [0x%p] and lower_mnt [0x%p]; "116 "rc = [%d]\n", path->dentry, path->mnt, rc);117 (*lower_file) = NULL;118 }119 return rc;120}121 122int ecryptfs_get_lower_file(struct dentry *dentry, struct inode *inode)123{124 struct ecryptfs_inode_info *inode_info;125 int count, rc = 0;126 127 inode_info = ecryptfs_inode_to_private(inode);128 mutex_lock(&inode_info->lower_file_mutex);129 count = atomic_inc_return(&inode_info->lower_file_count);130 if (WARN_ON_ONCE(count < 1))131 rc = -EINVAL;132 else if (count == 1) {133 rc = ecryptfs_init_lower_file(dentry,134 &inode_info->lower_file);135 if (rc)136 atomic_set(&inode_info->lower_file_count, 0);137 }138 mutex_unlock(&inode_info->lower_file_mutex);139 return rc;140}141 142void ecryptfs_put_lower_file(struct inode *inode)143{144 struct ecryptfs_inode_info *inode_info;145 146 inode_info = ecryptfs_inode_to_private(inode);147 if (atomic_dec_and_mutex_lock(&inode_info->lower_file_count,148 &inode_info->lower_file_mutex)) {149 filemap_write_and_wait(inode->i_mapping);150 fput(inode_info->lower_file);151 inode_info->lower_file = NULL;152 mutex_unlock(&inode_info->lower_file_mutex);153 }154}155 156enum { ecryptfs_opt_sig, ecryptfs_opt_ecryptfs_sig,157 ecryptfs_opt_cipher, ecryptfs_opt_ecryptfs_cipher,158 ecryptfs_opt_ecryptfs_key_bytes,159 ecryptfs_opt_passthrough, ecryptfs_opt_xattr_metadata,160 ecryptfs_opt_encrypted_view, ecryptfs_opt_fnek_sig,161 ecryptfs_opt_fn_cipher, ecryptfs_opt_fn_cipher_key_bytes,162 ecryptfs_opt_unlink_sigs, ecryptfs_opt_mount_auth_tok_only,163 ecryptfs_opt_check_dev_ruid,164 ecryptfs_opt_err };165 166static const match_table_t tokens = {167 {ecryptfs_opt_sig, "sig=%s"},168 {ecryptfs_opt_ecryptfs_sig, "ecryptfs_sig=%s"},169 {ecryptfs_opt_cipher, "cipher=%s"},170 {ecryptfs_opt_ecryptfs_cipher, "ecryptfs_cipher=%s"},171 {ecryptfs_opt_ecryptfs_key_bytes, "ecryptfs_key_bytes=%u"},172 {ecryptfs_opt_passthrough, "ecryptfs_passthrough"},173 {ecryptfs_opt_xattr_metadata, "ecryptfs_xattr_metadata"},174 {ecryptfs_opt_encrypted_view, "ecryptfs_encrypted_view"},175 {ecryptfs_opt_fnek_sig, "ecryptfs_fnek_sig=%s"},176 {ecryptfs_opt_fn_cipher, "ecryptfs_fn_cipher=%s"},177 {ecryptfs_opt_fn_cipher_key_bytes, "ecryptfs_fn_key_bytes=%u"},178 {ecryptfs_opt_unlink_sigs, "ecryptfs_unlink_sigs"},179 {ecryptfs_opt_mount_auth_tok_only, "ecryptfs_mount_auth_tok_only"},180 {ecryptfs_opt_check_dev_ruid, "ecryptfs_check_dev_ruid"},181 {ecryptfs_opt_err, NULL}182};183 184static int ecryptfs_init_global_auth_toks(185 struct ecryptfs_mount_crypt_stat *mount_crypt_stat)186{187 struct ecryptfs_global_auth_tok *global_auth_tok;188 struct ecryptfs_auth_tok *auth_tok;189 int rc = 0;190 191 list_for_each_entry(global_auth_tok,192 &mount_crypt_stat->global_auth_tok_list,193 mount_crypt_stat_list) {194 rc = ecryptfs_keyring_auth_tok_for_sig(195 &global_auth_tok->global_auth_tok_key, &auth_tok,196 global_auth_tok->sig);197 if (rc) {198 printk(KERN_ERR "Could not find valid key in user "199 "session keyring for sig specified in mount "200 "option: [%s]\n", global_auth_tok->sig);201 global_auth_tok->flags |= ECRYPTFS_AUTH_TOK_INVALID;202 goto out;203 } else {204 global_auth_tok->flags &= ~ECRYPTFS_AUTH_TOK_INVALID;205 up_write(&(global_auth_tok->global_auth_tok_key)->sem);206 }207 }208out:209 return rc;210}211 212static void ecryptfs_init_mount_crypt_stat(213 struct ecryptfs_mount_crypt_stat *mount_crypt_stat)214{215 memset((void *)mount_crypt_stat, 0,216 sizeof(struct ecryptfs_mount_crypt_stat));217 INIT_LIST_HEAD(&mount_crypt_stat->global_auth_tok_list);218 mutex_init(&mount_crypt_stat->global_auth_tok_list_mutex);219 mount_crypt_stat->flags |= ECRYPTFS_MOUNT_CRYPT_STAT_INITIALIZED;220}221 222/**223 * ecryptfs_parse_options224 * @sbi: The ecryptfs super block225 * @options: The options passed to the kernel226 * @check_ruid: set to 1 if device uid should be checked against the ruid227 *228 * Parse mount options:229 * debug=N - ecryptfs_verbosity level for debug output230 * sig=XXX - description(signature) of the key to use231 *232 * Returns the dentry object of the lower-level (lower/interposed)233 * directory; We want to mount our stackable file system on top of234 * that lower directory.235 *236 * The signature of the key to use must be the description of a key237 * already in the keyring. Mounting will fail if the key can not be238 * found.239 *240 * Returns zero on success; non-zero on error241 */242static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options,243 uid_t *check_ruid)244{245 char *p;246 int rc = 0;247 int sig_set = 0;248 int cipher_name_set = 0;249 int fn_cipher_name_set = 0;250 int cipher_key_bytes;251 int cipher_key_bytes_set = 0;252 int fn_cipher_key_bytes;253 int fn_cipher_key_bytes_set = 0;254 struct ecryptfs_mount_crypt_stat *mount_crypt_stat =255 &sbi->mount_crypt_stat;256 substring_t args[MAX_OPT_ARGS];257 int token;258 char *sig_src;259 char *cipher_name_src;260 char *fn_cipher_name_src;261 char *fnek_src;262 char *cipher_key_bytes_src;263 char *fn_cipher_key_bytes_src;264 u8 cipher_code;265 266 *check_ruid = 0;267 268 if (!options) {269 rc = -EINVAL;270 goto out;271 }272 ecryptfs_init_mount_crypt_stat(mount_crypt_stat);273 while ((p = strsep(&options, ",")) != NULL) {274 if (!*p)275 continue;276 token = match_token(p, tokens, args);277 switch (token) {278 case ecryptfs_opt_sig:279 case ecryptfs_opt_ecryptfs_sig:280 sig_src = args[0].from;281 rc = ecryptfs_add_global_auth_tok(mount_crypt_stat,282 sig_src, 0);283 if (rc) {284 printk(KERN_ERR "Error attempting to register "285 "global sig; rc = [%d]\n", rc);286 goto out;287 }288 sig_set = 1;289 break;290 case ecryptfs_opt_cipher:291 case ecryptfs_opt_ecryptfs_cipher:292 cipher_name_src = args[0].from;293 strscpy(mount_crypt_stat->global_default_cipher_name,294 cipher_name_src);295 cipher_name_set = 1;296 break;297 case ecryptfs_opt_ecryptfs_key_bytes:298 cipher_key_bytes_src = args[0].from;299 cipher_key_bytes =300 (int)simple_strtol(cipher_key_bytes_src,301 &cipher_key_bytes_src, 0);302 mount_crypt_stat->global_default_cipher_key_size =303 cipher_key_bytes;304 cipher_key_bytes_set = 1;305 break;306 case ecryptfs_opt_passthrough:307 mount_crypt_stat->flags |=308 ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED;309 break;310 case ecryptfs_opt_xattr_metadata:311 mount_crypt_stat->flags |=312 ECRYPTFS_XATTR_METADATA_ENABLED;313 break;314 case ecryptfs_opt_encrypted_view:315 mount_crypt_stat->flags |=316 ECRYPTFS_XATTR_METADATA_ENABLED;317 mount_crypt_stat->flags |=318 ECRYPTFS_ENCRYPTED_VIEW_ENABLED;319 break;320 case ecryptfs_opt_fnek_sig:321 fnek_src = args[0].from;322 strscpy(mount_crypt_stat->global_default_fnek_sig,323 fnek_src);324 rc = ecryptfs_add_global_auth_tok(325 mount_crypt_stat,326 mount_crypt_stat->global_default_fnek_sig,327 ECRYPTFS_AUTH_TOK_FNEK);328 if (rc) {329 printk(KERN_ERR "Error attempting to register "330 "global fnek sig [%s]; rc = [%d]\n",331 mount_crypt_stat->global_default_fnek_sig,332 rc);333 goto out;334 }335 mount_crypt_stat->flags |=336 (ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES337 | ECRYPTFS_GLOBAL_ENCFN_USE_MOUNT_FNEK);338 break;339 case ecryptfs_opt_fn_cipher:340 fn_cipher_name_src = args[0].from;341 strscpy(mount_crypt_stat->global_default_fn_cipher_name,342 fn_cipher_name_src);343 fn_cipher_name_set = 1;344 break;345 case ecryptfs_opt_fn_cipher_key_bytes:346 fn_cipher_key_bytes_src = args[0].from;347 fn_cipher_key_bytes =348 (int)simple_strtol(fn_cipher_key_bytes_src,349 &fn_cipher_key_bytes_src, 0);350 mount_crypt_stat->global_default_fn_cipher_key_bytes =351 fn_cipher_key_bytes;352 fn_cipher_key_bytes_set = 1;353 break;354 case ecryptfs_opt_unlink_sigs:355 mount_crypt_stat->flags |= ECRYPTFS_UNLINK_SIGS;356 break;357 case ecryptfs_opt_mount_auth_tok_only:358 mount_crypt_stat->flags |=359 ECRYPTFS_GLOBAL_MOUNT_AUTH_TOK_ONLY;360 break;361 case ecryptfs_opt_check_dev_ruid:362 *check_ruid = 1;363 break;364 case ecryptfs_opt_err:365 default:366 printk(KERN_WARNING367 "%s: eCryptfs: unrecognized option [%s]\n",368 __func__, p);369 }370 }371 if (!sig_set) {372 rc = -EINVAL;373 ecryptfs_printk(KERN_ERR, "You must supply at least one valid "374 "auth tok signature as a mount "375 "parameter; see the eCryptfs README\n");376 goto out;377 }378 if (!cipher_name_set) {379 int cipher_name_len = strlen(ECRYPTFS_DEFAULT_CIPHER);380 381 BUG_ON(cipher_name_len > ECRYPTFS_MAX_CIPHER_NAME_SIZE);382 strcpy(mount_crypt_stat->global_default_cipher_name,383 ECRYPTFS_DEFAULT_CIPHER);384 }385 if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)386 && !fn_cipher_name_set)387 strcpy(mount_crypt_stat->global_default_fn_cipher_name,388 mount_crypt_stat->global_default_cipher_name);389 if (!cipher_key_bytes_set)390 mount_crypt_stat->global_default_cipher_key_size = 0;391 if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)392 && !fn_cipher_key_bytes_set)393 mount_crypt_stat->global_default_fn_cipher_key_bytes =394 mount_crypt_stat->global_default_cipher_key_size;395 396 cipher_code = ecryptfs_code_for_cipher_string(397 mount_crypt_stat->global_default_cipher_name,398 mount_crypt_stat->global_default_cipher_key_size);399 if (!cipher_code) {400 ecryptfs_printk(KERN_ERR,401 "eCryptfs doesn't support cipher: %s\n",402 mount_crypt_stat->global_default_cipher_name);403 rc = -EINVAL;404 goto out;405 }406 407 mutex_lock(&key_tfm_list_mutex);408 if (!ecryptfs_tfm_exists(mount_crypt_stat->global_default_cipher_name,409 NULL)) {410 rc = ecryptfs_add_new_key_tfm(411 NULL, mount_crypt_stat->global_default_cipher_name,412 mount_crypt_stat->global_default_cipher_key_size);413 if (rc) {414 printk(KERN_ERR "Error attempting to initialize "415 "cipher with name = [%s] and key size = [%td]; "416 "rc = [%d]\n",417 mount_crypt_stat->global_default_cipher_name,418 mount_crypt_stat->global_default_cipher_key_size,419 rc);420 rc = -EINVAL;421 mutex_unlock(&key_tfm_list_mutex);422 goto out;423 }424 }425 if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)426 && !ecryptfs_tfm_exists(427 mount_crypt_stat->global_default_fn_cipher_name, NULL)) {428 rc = ecryptfs_add_new_key_tfm(429 NULL, mount_crypt_stat->global_default_fn_cipher_name,430 mount_crypt_stat->global_default_fn_cipher_key_bytes);431 if (rc) {432 printk(KERN_ERR "Error attempting to initialize "433 "cipher with name = [%s] and key size = [%td]; "434 "rc = [%d]\n",435 mount_crypt_stat->global_default_fn_cipher_name,436 mount_crypt_stat->global_default_fn_cipher_key_bytes,437 rc);438 rc = -EINVAL;439 mutex_unlock(&key_tfm_list_mutex);440 goto out;441 }442 }443 mutex_unlock(&key_tfm_list_mutex);444 rc = ecryptfs_init_global_auth_toks(mount_crypt_stat);445 if (rc)446 printk(KERN_WARNING "One or more global auth toks could not "447 "properly register; rc = [%d]\n", rc);448out:449 return rc;450}451 452struct kmem_cache *ecryptfs_sb_info_cache;453static struct file_system_type ecryptfs_fs_type;454 455/*456 * ecryptfs_mount457 * @fs_type: The filesystem type that the superblock should belong to458 * @flags: The flags associated with the mount459 * @dev_name: The path to mount over460 * @raw_data: The options passed into the kernel461 */462static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags,463 const char *dev_name, void *raw_data)464{465 struct super_block *s;466 struct ecryptfs_sb_info *sbi;467 struct ecryptfs_mount_crypt_stat *mount_crypt_stat;468 struct ecryptfs_dentry_info *root_info;469 const char *err = "Getting sb failed";470 struct inode *inode;471 struct path path;472 uid_t check_ruid;473 int rc;474 475 sbi = kmem_cache_zalloc(ecryptfs_sb_info_cache, GFP_KERNEL);476 if (!sbi) {477 rc = -ENOMEM;478 goto out;479 }480 481 if (!dev_name) {482 rc = -EINVAL;483 err = "Device name cannot be null";484 goto out;485 }486 487 rc = ecryptfs_parse_options(sbi, raw_data, &check_ruid);488 if (rc) {489 err = "Error parsing options";490 goto out;491 }492 mount_crypt_stat = &sbi->mount_crypt_stat;493 494 s = sget(fs_type, NULL, set_anon_super, flags, NULL);495 if (IS_ERR(s)) {496 rc = PTR_ERR(s);497 goto out;498 }499 500 rc = super_setup_bdi(s);501 if (rc)502 goto out1;503 504 ecryptfs_set_superblock_private(s, sbi);505 506 /* ->kill_sb() will take care of sbi after that point */507 sbi = NULL;508 s->s_op = &ecryptfs_sops;509 s->s_xattr = ecryptfs_xattr_handlers;510 s->s_d_op = &ecryptfs_dops;511 512 err = "Reading sb failed";513 rc = kern_path(dev_name, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &path);514 if (rc) {515 ecryptfs_printk(KERN_WARNING, "kern_path() failed\n");516 goto out1;517 }518 if (path.dentry->d_sb->s_type == &ecryptfs_fs_type) {519 rc = -EINVAL;520 printk(KERN_ERR "Mount on filesystem of type "521 "eCryptfs explicitly disallowed due to "522 "known incompatibilities\n");523 goto out_free;524 }525 526 if (is_idmapped_mnt(path.mnt)) {527 rc = -EINVAL;528 printk(KERN_ERR "Mounting on idmapped mounts currently disallowed\n");529 goto out_free;530 }531 532 if (check_ruid && !uid_eq(d_inode(path.dentry)->i_uid, current_uid())) {533 rc = -EPERM;534 printk(KERN_ERR "Mount of device (uid: %d) not owned by "535 "requested user (uid: %d)\n",536 i_uid_read(d_inode(path.dentry)),537 from_kuid(&init_user_ns, current_uid()));538 goto out_free;539 }540 541 ecryptfs_set_superblock_lower(s, path.dentry->d_sb);542 543 /**544 * Set the POSIX ACL flag based on whether they're enabled in the lower545 * mount.546 */547 s->s_flags = flags & ~SB_POSIXACL;548 s->s_flags |= path.dentry->d_sb->s_flags & SB_POSIXACL;549 550 /**551 * Force a read-only eCryptfs mount when:552 * 1) The lower mount is ro553 * 2) The ecryptfs_encrypted_view mount option is specified554 */555 if (sb_rdonly(path.dentry->d_sb) || mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)556 s->s_flags |= SB_RDONLY;557 558 s->s_maxbytes = path.dentry->d_sb->s_maxbytes;559 s->s_blocksize = path.dentry->d_sb->s_blocksize;560 s->s_magic = ECRYPTFS_SUPER_MAGIC;561 s->s_stack_depth = path.dentry->d_sb->s_stack_depth + 1;562 563 rc = -EINVAL;564 if (s->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {565 pr_err("eCryptfs: maximum fs stacking depth exceeded\n");566 goto out_free;567 }568 569 inode = ecryptfs_get_inode(d_inode(path.dentry), s);570 rc = PTR_ERR(inode);571 if (IS_ERR(inode))572 goto out_free;573 574 s->s_root = d_make_root(inode);575 if (!s->s_root) {576 rc = -ENOMEM;577 goto out_free;578 }579 580 rc = -ENOMEM;581 root_info = kmem_cache_zalloc(ecryptfs_dentry_info_cache, GFP_KERNEL);582 if (!root_info)583 goto out_free;584 585 /* ->kill_sb() will take care of root_info */586 ecryptfs_set_dentry_private(s->s_root, root_info);587 root_info->lower_path = path;588 589 s->s_flags |= SB_ACTIVE;590 return dget(s->s_root);591 592out_free:593 path_put(&path);594out1:595 deactivate_locked_super(s);596out:597 if (sbi) {598 ecryptfs_destroy_mount_crypt_stat(&sbi->mount_crypt_stat);599 kmem_cache_free(ecryptfs_sb_info_cache, sbi);600 }601 printk(KERN_ERR "%s; rc = [%d]\n", err, rc);602 return ERR_PTR(rc);603}604 605/**606 * ecryptfs_kill_block_super607 * @sb: The ecryptfs super block608 *609 * Used to bring the superblock down and free the private data.610 */611static void ecryptfs_kill_block_super(struct super_block *sb)612{613 struct ecryptfs_sb_info *sb_info = ecryptfs_superblock_to_private(sb);614 kill_anon_super(sb);615 if (!sb_info)616 return;617 ecryptfs_destroy_mount_crypt_stat(&sb_info->mount_crypt_stat);618 kmem_cache_free(ecryptfs_sb_info_cache, sb_info);619}620 621static struct file_system_type ecryptfs_fs_type = {622 .owner = THIS_MODULE,623 .name = "ecryptfs",624 .mount = ecryptfs_mount,625 .kill_sb = ecryptfs_kill_block_super,626 .fs_flags = 0627};628MODULE_ALIAS_FS("ecryptfs");629 630/*631 * inode_info_init_once632 *633 * Initializes the ecryptfs_inode_info_cache when it is created634 */635static void636inode_info_init_once(void *vptr)637{638 struct ecryptfs_inode_info *ei = (struct ecryptfs_inode_info *)vptr;639 640 inode_init_once(&ei->vfs_inode);641}642 643static struct ecryptfs_cache_info {644 struct kmem_cache **cache;645 const char *name;646 size_t size;647 slab_flags_t flags;648 void (*ctor)(void *obj);649} ecryptfs_cache_infos[] = {650 {651 .cache = &ecryptfs_auth_tok_list_item_cache,652 .name = "ecryptfs_auth_tok_list_item",653 .size = sizeof(struct ecryptfs_auth_tok_list_item),654 },655 {656 .cache = &ecryptfs_file_info_cache,657 .name = "ecryptfs_file_cache",658 .size = sizeof(struct ecryptfs_file_info),659 },660 {661 .cache = &ecryptfs_dentry_info_cache,662 .name = "ecryptfs_dentry_info_cache",663 .size = sizeof(struct ecryptfs_dentry_info),664 },665 {666 .cache = &ecryptfs_inode_info_cache,667 .name = "ecryptfs_inode_cache",668 .size = sizeof(struct ecryptfs_inode_info),669 .flags = SLAB_ACCOUNT,670 .ctor = inode_info_init_once,671 },672 {673 .cache = &ecryptfs_sb_info_cache,674 .name = "ecryptfs_sb_cache",675 .size = sizeof(struct ecryptfs_sb_info),676 },677 {678 .cache = &ecryptfs_header_cache,679 .name = "ecryptfs_headers",680 .size = PAGE_SIZE,681 },682 {683 .cache = &ecryptfs_xattr_cache,684 .name = "ecryptfs_xattr_cache",685 .size = PAGE_SIZE,686 },687 {688 .cache = &ecryptfs_key_record_cache,689 .name = "ecryptfs_key_record_cache",690 .size = sizeof(struct ecryptfs_key_record),691 },692 {693 .cache = &ecryptfs_key_sig_cache,694 .name = "ecryptfs_key_sig_cache",695 .size = sizeof(struct ecryptfs_key_sig),696 },697 {698 .cache = &ecryptfs_global_auth_tok_cache,699 .name = "ecryptfs_global_auth_tok_cache",700 .size = sizeof(struct ecryptfs_global_auth_tok),701 },702 {703 .cache = &ecryptfs_key_tfm_cache,704 .name = "ecryptfs_key_tfm_cache",705 .size = sizeof(struct ecryptfs_key_tfm),706 },707};708 709static void ecryptfs_free_kmem_caches(void)710{711 int i;712 713 /*714 * Make sure all delayed rcu free inodes are flushed before we715 * destroy cache.716 */717 rcu_barrier();718 719 for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) {720 struct ecryptfs_cache_info *info;721 722 info = &ecryptfs_cache_infos[i];723 kmem_cache_destroy(*(info->cache));724 }725}726 727/**728 * ecryptfs_init_kmem_caches729 *730 * Returns zero on success; non-zero otherwise731 */732static int ecryptfs_init_kmem_caches(void)733{734 int i;735 736 for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) {737 struct ecryptfs_cache_info *info;738 739 info = &ecryptfs_cache_infos[i];740 *(info->cache) = kmem_cache_create(info->name, info->size, 0,741 SLAB_HWCACHE_ALIGN | info->flags, info->ctor);742 if (!*(info->cache)) {743 ecryptfs_free_kmem_caches();744 ecryptfs_printk(KERN_WARNING, "%s: "745 "kmem_cache_create failed\n",746 info->name);747 return -ENOMEM;748 }749 }750 return 0;751}752 753static struct kobject *ecryptfs_kobj;754 755static ssize_t version_show(struct kobject *kobj,756 struct kobj_attribute *attr, char *buff)757{758 return snprintf(buff, PAGE_SIZE, "%d\n", ECRYPTFS_VERSIONING_MASK);759}760 761static struct kobj_attribute version_attr = __ATTR_RO(version);762 763static struct attribute *attributes[] = {764 &version_attr.attr,765 NULL,766};767 768static const struct attribute_group attr_group = {769 .attrs = attributes,770};771 772static int do_sysfs_registration(void)773{774 int rc;775 776 ecryptfs_kobj = kobject_create_and_add("ecryptfs", fs_kobj);777 if (!ecryptfs_kobj) {778 printk(KERN_ERR "Unable to create ecryptfs kset\n");779 rc = -ENOMEM;780 goto out;781 }782 rc = sysfs_create_group(ecryptfs_kobj, &attr_group);783 if (rc) {784 printk(KERN_ERR785 "Unable to create ecryptfs version attributes\n");786 kobject_put(ecryptfs_kobj);787 }788out:789 return rc;790}791 792static void do_sysfs_unregistration(void)793{794 sysfs_remove_group(ecryptfs_kobj, &attr_group);795 kobject_put(ecryptfs_kobj);796}797 798static int __init ecryptfs_init(void)799{800 int rc;801 802 if (ECRYPTFS_DEFAULT_EXTENT_SIZE > PAGE_SIZE) {803 rc = -EINVAL;804 ecryptfs_printk(KERN_ERR, "The eCryptfs extent size is "805 "larger than the host's page size, and so "806 "eCryptfs cannot run on this system. The "807 "default eCryptfs extent size is [%u] bytes; "808 "the page size is [%lu] bytes.\n",809 ECRYPTFS_DEFAULT_EXTENT_SIZE,810 (unsigned long)PAGE_SIZE);811 goto out;812 }813 rc = ecryptfs_init_kmem_caches();814 if (rc) {815 printk(KERN_ERR816 "Failed to allocate one or more kmem_cache objects\n");817 goto out;818 }819 rc = do_sysfs_registration();820 if (rc) {821 printk(KERN_ERR "sysfs registration failed\n");822 goto out_free_kmem_caches;823 }824 rc = ecryptfs_init_kthread();825 if (rc) {826 printk(KERN_ERR "%s: kthread initialization failed; "827 "rc = [%d]\n", __func__, rc);828 goto out_do_sysfs_unregistration;829 }830 rc = ecryptfs_init_messaging();831 if (rc) {832 printk(KERN_ERR "Failure occurred while attempting to "833 "initialize the communications channel to "834 "ecryptfsd\n");835 goto out_destroy_kthread;836 }837 rc = ecryptfs_init_crypto();838 if (rc) {839 printk(KERN_ERR "Failure whilst attempting to init crypto; "840 "rc = [%d]\n", rc);841 goto out_release_messaging;842 }843 rc = register_filesystem(&ecryptfs_fs_type);844 if (rc) {845 printk(KERN_ERR "Failed to register filesystem\n");846 goto out_destroy_crypto;847 }848 if (ecryptfs_verbosity > 0)849 printk(KERN_CRIT "eCryptfs verbosity set to %d. Secret values "850 "will be written to the syslog!\n", ecryptfs_verbosity);851 852 goto out;853out_destroy_crypto:854 ecryptfs_destroy_crypto();855out_release_messaging:856 ecryptfs_release_messaging();857out_destroy_kthread:858 ecryptfs_destroy_kthread();859out_do_sysfs_unregistration:860 do_sysfs_unregistration();861out_free_kmem_caches:862 ecryptfs_free_kmem_caches();863out:864 return rc;865}866 867static void __exit ecryptfs_exit(void)868{869 int rc;870 871 rc = ecryptfs_destroy_crypto();872 if (rc)873 printk(KERN_ERR "Failure whilst attempting to destroy crypto; "874 "rc = [%d]\n", rc);875 ecryptfs_release_messaging();876 ecryptfs_destroy_kthread();877 do_sysfs_unregistration();878 unregister_filesystem(&ecryptfs_fs_type);879 ecryptfs_free_kmem_caches();880}881 882MODULE_AUTHOR("Michael A. Halcrow <mhalcrow@us.ibm.com>");883MODULE_DESCRIPTION("eCryptfs");884 885MODULE_LICENSE("GPL");886 887module_init(ecryptfs_init)888module_exit(ecryptfs_exit)889