1 /** 2 * eCryptfs: Linux filesystem encryption layer 3 * 4 * Copyright (C) 1997-2003 Erez Zadok 5 * Copyright (C) 2001-2003 Stony Brook University 6 * Copyright (C) 2004-2006 International Business Machines Corp. 7 * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com> 8 * Michael C. Thompson <mcthomps@us.ibm.com> 9 * 10 * This program is free software; you can redistribute it and/or 11 * modify it under the terms of the GNU General Public License as 12 * published by the Free Software Foundation; either version 2 of the 13 * License, or (at your option) any later version. 14 * 15 * This program is distributed in the hope that it will be useful, but 16 * WITHOUT ANY WARRANTY; without even the implied warranty of 17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 18 * General Public License for more details. 19 * 20 * You should have received a copy of the GNU General Public License 21 * along with this program; if not, write to the Free Software 22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 23 * 02111-1307, USA. 24 */ 25 26 #include <linux/dcache.h> 27 #include <linux/file.h> 28 #include <linux/module.h> 29 #include <linux/namei.h> 30 #include <linux/skbuff.h> 31 #include <linux/crypto.h> 32 #include <linux/netlink.h> 33 #include <linux/mount.h> 34 #include <linux/dcache.h> 35 #include <linux/pagemap.h> 36 #include <linux/key.h> 37 #include <linux/parser.h> 38 #include <linux/fs_stack.h> 39 #include "ecryptfs_kernel.h" 40 41 /** 42 * Module parameter that defines the ecryptfs_verbosity level. 43 */ 44 int ecryptfs_verbosity = 0; 45 46 module_param(ecryptfs_verbosity, int, 0); 47 MODULE_PARM_DESC(ecryptfs_verbosity, 48 "Initial verbosity level (0 or 1; defaults to " 49 "0, which is Quiet)"); 50 51 void __ecryptfs_printk(const char *fmt, ...) 52 { 53 va_list args; 54 va_start(args, fmt); 55 if (fmt[1] == '7') { /* KERN_DEBUG */ 56 if (ecryptfs_verbosity >= 1) 57 vprintk(fmt, args); 58 } else 59 vprintk(fmt, args); 60 va_end(args); 61 } 62 63 /** 64 * ecryptfs_interpose 65 * @lower_dentry: Existing dentry in the lower filesystem 66 * @dentry: ecryptfs' dentry 67 * @sb: ecryptfs's super_block 68 * @flag: If set to true, then d_add is called, else d_instantiate is called 69 * 70 * Interposes upper and lower dentries. 71 * 72 * Returns zero on success; non-zero otherwise 73 */ 74 int ecryptfs_interpose(struct dentry *lower_dentry, struct dentry *dentry, 75 struct super_block *sb, int flag) 76 { 77 struct inode *lower_inode; 78 struct inode *inode; 79 int rc = 0; 80 81 lower_inode = lower_dentry->d_inode; 82 if (lower_inode->i_sb != ecryptfs_superblock_to_lower(sb)) { 83 rc = -EXDEV; 84 goto out; 85 } 86 if (!igrab(lower_inode)) { 87 rc = -ESTALE; 88 goto out; 89 } 90 inode = iget5_locked(sb, (unsigned long)lower_inode, 91 ecryptfs_inode_test, ecryptfs_inode_set, 92 lower_inode); 93 if (!inode) { 94 rc = -EACCES; 95 iput(lower_inode); 96 goto out; 97 } 98 if (inode->i_state & I_NEW) 99 unlock_new_inode(inode); 100 else 101 iput(lower_inode); 102 if (S_ISLNK(lower_inode->i_mode)) 103 inode->i_op = &ecryptfs_symlink_iops; 104 else if (S_ISDIR(lower_inode->i_mode)) 105 inode->i_op = &ecryptfs_dir_iops; 106 if (S_ISDIR(lower_inode->i_mode)) 107 inode->i_fop = &ecryptfs_dir_fops; 108 if (special_file(lower_inode->i_mode)) 109 init_special_inode(inode, lower_inode->i_mode, 110 lower_inode->i_rdev); 111 dentry->d_op = &ecryptfs_dops; 112 if (flag) 113 d_add(dentry, inode); 114 else 115 d_instantiate(dentry, inode); 116 fsstack_copy_attr_all(inode, lower_inode, NULL); 117 /* This size will be overwritten for real files w/ headers and 118 * other metadata */ 119 fsstack_copy_inode_size(inode, lower_inode); 120 out: 121 return rc; 122 } 123 124 enum { ecryptfs_opt_sig, ecryptfs_opt_ecryptfs_sig, ecryptfs_opt_debug, 125 ecryptfs_opt_ecryptfs_debug, ecryptfs_opt_cipher, 126 ecryptfs_opt_ecryptfs_cipher, ecryptfs_opt_ecryptfs_key_bytes, 127 ecryptfs_opt_passthrough, ecryptfs_opt_err }; 128 129 static match_table_t tokens = { 130 {ecryptfs_opt_sig, "sig=%s"}, 131 {ecryptfs_opt_ecryptfs_sig, "ecryptfs_sig=%s"}, 132 {ecryptfs_opt_debug, "debug=%u"}, 133 {ecryptfs_opt_ecryptfs_debug, "ecryptfs_debug=%u"}, 134 {ecryptfs_opt_cipher, "cipher=%s"}, 135 {ecryptfs_opt_ecryptfs_cipher, "ecryptfs_cipher=%s"}, 136 {ecryptfs_opt_ecryptfs_key_bytes, "ecryptfs_key_bytes=%u"}, 137 {ecryptfs_opt_passthrough, "ecryptfs_passthrough"}, 138 {ecryptfs_opt_err, NULL} 139 }; 140 141 /** 142 * ecryptfs_verify_version 143 * @version: The version number to confirm 144 * 145 * Returns zero on good version; non-zero otherwise 146 */ 147 static int ecryptfs_verify_version(u16 version) 148 { 149 int rc = 0; 150 unsigned char major; 151 unsigned char minor; 152 153 major = ((version >> 8) & 0xFF); 154 minor = (version & 0xFF); 155 if (major != ECRYPTFS_VERSION_MAJOR) { 156 ecryptfs_printk(KERN_ERR, "Major version number mismatch. " 157 "Expected [%d]; got [%d]\n", 158 ECRYPTFS_VERSION_MAJOR, major); 159 rc = -EINVAL; 160 goto out; 161 } 162 if (minor != ECRYPTFS_VERSION_MINOR) { 163 ecryptfs_printk(KERN_ERR, "Minor version number mismatch. " 164 "Expected [%d]; got [%d]\n", 165 ECRYPTFS_VERSION_MINOR, minor); 166 rc = -EINVAL; 167 goto out; 168 } 169 out: 170 return rc; 171 } 172 173 /** 174 * ecryptfs_parse_options 175 * @sb: The ecryptfs super block 176 * @options: The options pased to the kernel 177 * 178 * Parse mount options: 179 * debug=N - ecryptfs_verbosity level for debug output 180 * sig=XXX - description(signature) of the key to use 181 * 182 * Returns the dentry object of the lower-level (lower/interposed) 183 * directory; We want to mount our stackable file system on top of 184 * that lower directory. 185 * 186 * The signature of the key to use must be the description of a key 187 * already in the keyring. Mounting will fail if the key can not be 188 * found. 189 * 190 * Returns zero on success; non-zero on error 191 */ 192 static int ecryptfs_parse_options(struct super_block *sb, char *options) 193 { 194 char *p; 195 int rc = 0; 196 int sig_set = 0; 197 int cipher_name_set = 0; 198 int cipher_key_bytes; 199 int cipher_key_bytes_set = 0; 200 struct key *auth_tok_key = NULL; 201 struct ecryptfs_auth_tok *auth_tok = NULL; 202 struct ecryptfs_mount_crypt_stat *mount_crypt_stat = 203 &ecryptfs_superblock_to_private(sb)->mount_crypt_stat; 204 substring_t args[MAX_OPT_ARGS]; 205 int token; 206 char *sig_src; 207 char *sig_dst; 208 char *debug_src; 209 char *cipher_name_dst; 210 char *cipher_name_src; 211 char *cipher_key_bytes_src; 212 int cipher_name_len; 213 214 if (!options) { 215 rc = -EINVAL; 216 goto out; 217 } 218 while ((p = strsep(&options, ",")) != NULL) { 219 if (!*p) 220 continue; 221 token = match_token(p, tokens, args); 222 switch (token) { 223 case ecryptfs_opt_sig: 224 case ecryptfs_opt_ecryptfs_sig: 225 sig_src = args[0].from; 226 sig_dst = 227 mount_crypt_stat->global_auth_tok_sig; 228 memcpy(sig_dst, sig_src, ECRYPTFS_SIG_SIZE_HEX); 229 sig_dst[ECRYPTFS_SIG_SIZE_HEX] = '\0'; 230 ecryptfs_printk(KERN_DEBUG, 231 "The mount_crypt_stat " 232 "global_auth_tok_sig set to: " 233 "[%s]\n", sig_dst); 234 sig_set = 1; 235 break; 236 case ecryptfs_opt_debug: 237 case ecryptfs_opt_ecryptfs_debug: 238 debug_src = args[0].from; 239 ecryptfs_verbosity = 240 (int)simple_strtol(debug_src, &debug_src, 241 0); 242 ecryptfs_printk(KERN_DEBUG, 243 "Verbosity set to [%d]" "\n", 244 ecryptfs_verbosity); 245 break; 246 case ecryptfs_opt_cipher: 247 case ecryptfs_opt_ecryptfs_cipher: 248 cipher_name_src = args[0].from; 249 cipher_name_dst = 250 mount_crypt_stat-> 251 global_default_cipher_name; 252 strncpy(cipher_name_dst, cipher_name_src, 253 ECRYPTFS_MAX_CIPHER_NAME_SIZE); 254 ecryptfs_printk(KERN_DEBUG, 255 "The mount_crypt_stat " 256 "global_default_cipher_name set to: " 257 "[%s]\n", cipher_name_dst); 258 cipher_name_set = 1; 259 break; 260 case ecryptfs_opt_ecryptfs_key_bytes: 261 cipher_key_bytes_src = args[0].from; 262 cipher_key_bytes = 263 (int)simple_strtol(cipher_key_bytes_src, 264 &cipher_key_bytes_src, 0); 265 mount_crypt_stat->global_default_cipher_key_size = 266 cipher_key_bytes; 267 ecryptfs_printk(KERN_DEBUG, 268 "The mount_crypt_stat " 269 "global_default_cipher_key_size " 270 "set to: [%d]\n", mount_crypt_stat-> 271 global_default_cipher_key_size); 272 cipher_key_bytes_set = 1; 273 break; 274 case ecryptfs_opt_passthrough: 275 mount_crypt_stat->flags |= 276 ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED; 277 break; 278 case ecryptfs_opt_err: 279 default: 280 ecryptfs_printk(KERN_WARNING, 281 "eCryptfs: unrecognized option '%s'\n", 282 p); 283 } 284 } 285 /* Do not support lack of mount-wide signature in 0.1 286 * release */ 287 if (!sig_set) { 288 rc = -EINVAL; 289 ecryptfs_printk(KERN_ERR, "You must supply a valid " 290 "passphrase auth tok signature as a mount " 291 "parameter; see the eCryptfs README\n"); 292 goto out; 293 } 294 if (!cipher_name_set) { 295 cipher_name_len = strlen(ECRYPTFS_DEFAULT_CIPHER); 296 if (unlikely(cipher_name_len 297 >= ECRYPTFS_MAX_CIPHER_NAME_SIZE)) { 298 rc = -EINVAL; 299 BUG(); 300 goto out; 301 } 302 memcpy(mount_crypt_stat->global_default_cipher_name, 303 ECRYPTFS_DEFAULT_CIPHER, cipher_name_len); 304 mount_crypt_stat->global_default_cipher_name[cipher_name_len] 305 = '\0'; 306 } 307 if (!cipher_key_bytes_set) { 308 mount_crypt_stat->global_default_cipher_key_size = 0; 309 } 310 rc = ecryptfs_process_cipher( 311 &mount_crypt_stat->global_key_tfm, 312 mount_crypt_stat->global_default_cipher_name, 313 &mount_crypt_stat->global_default_cipher_key_size); 314 if (rc) { 315 printk(KERN_ERR "Error attempting to initialize cipher [%s] " 316 "with key size [%Zd] bytes; rc = [%d]\n", 317 mount_crypt_stat->global_default_cipher_name, 318 mount_crypt_stat->global_default_cipher_key_size, rc); 319 mount_crypt_stat->global_key_tfm = NULL; 320 mount_crypt_stat->global_auth_tok_key = NULL; 321 rc = -EINVAL; 322 goto out; 323 } 324 mutex_init(&mount_crypt_stat->global_key_tfm_mutex); 325 ecryptfs_printk(KERN_DEBUG, "Requesting the key with description: " 326 "[%s]\n", mount_crypt_stat->global_auth_tok_sig); 327 /* The reference to this key is held until umount is done The 328 * call to key_put is done in ecryptfs_put_super() */ 329 auth_tok_key = request_key(&key_type_user, 330 mount_crypt_stat->global_auth_tok_sig, 331 NULL); 332 if (!auth_tok_key || IS_ERR(auth_tok_key)) { 333 ecryptfs_printk(KERN_ERR, "Could not find key with " 334 "description: [%s]\n", 335 mount_crypt_stat->global_auth_tok_sig); 336 process_request_key_err(PTR_ERR(auth_tok_key)); 337 rc = -EINVAL; 338 goto out; 339 } 340 auth_tok = ecryptfs_get_key_payload_data(auth_tok_key); 341 if (ecryptfs_verify_version(auth_tok->version)) { 342 ecryptfs_printk(KERN_ERR, "Data structure version mismatch. " 343 "Userspace tools must match eCryptfs kernel " 344 "module with major version [%d] and minor " 345 "version [%d]\n", ECRYPTFS_VERSION_MAJOR, 346 ECRYPTFS_VERSION_MINOR); 347 rc = -EINVAL; 348 goto out; 349 } 350 if (auth_tok->token_type != ECRYPTFS_PASSWORD) { 351 ecryptfs_printk(KERN_ERR, "Invalid auth_tok structure " 352 "returned from key\n"); 353 rc = -EINVAL; 354 goto out; 355 } 356 mount_crypt_stat->global_auth_tok_key = auth_tok_key; 357 mount_crypt_stat->global_auth_tok = auth_tok; 358 out: 359 return rc; 360 } 361 362 struct kmem_cache *ecryptfs_sb_info_cache; 363 364 /** 365 * ecryptfs_fill_super 366 * @sb: The ecryptfs super block 367 * @raw_data: The options passed to mount 368 * @silent: Not used but required by function prototype 369 * 370 * Sets up what we can of the sb, rest is done in ecryptfs_read_super 371 * 372 * Returns zero on success; non-zero otherwise 373 */ 374 static int 375 ecryptfs_fill_super(struct super_block *sb, void *raw_data, int silent) 376 { 377 int rc = 0; 378 379 /* Released in ecryptfs_put_super() */ 380 ecryptfs_set_superblock_private(sb, 381 kmem_cache_zalloc(ecryptfs_sb_info_cache, 382 GFP_KERNEL)); 383 if (!ecryptfs_superblock_to_private(sb)) { 384 ecryptfs_printk(KERN_WARNING, "Out of memory\n"); 385 rc = -ENOMEM; 386 goto out; 387 } 388 sb->s_op = &ecryptfs_sops; 389 /* Released through deactivate_super(sb) from get_sb_nodev */ 390 sb->s_root = d_alloc(NULL, &(const struct qstr) { 391 .hash = 0,.name = "/",.len = 1}); 392 if (!sb->s_root) { 393 ecryptfs_printk(KERN_ERR, "d_alloc failed\n"); 394 rc = -ENOMEM; 395 goto out; 396 } 397 sb->s_root->d_op = &ecryptfs_dops; 398 sb->s_root->d_sb = sb; 399 sb->s_root->d_parent = sb->s_root; 400 /* Released in d_release when dput(sb->s_root) is called */ 401 /* through deactivate_super(sb) from get_sb_nodev() */ 402 ecryptfs_set_dentry_private(sb->s_root, 403 kmem_cache_zalloc(ecryptfs_dentry_info_cache, 404 GFP_KERNEL)); 405 if (!ecryptfs_dentry_to_private(sb->s_root)) { 406 ecryptfs_printk(KERN_ERR, 407 "dentry_info_cache alloc failed\n"); 408 rc = -ENOMEM; 409 goto out; 410 } 411 rc = 0; 412 out: 413 /* Should be able to rely on deactivate_super called from 414 * get_sb_nodev */ 415 return rc; 416 } 417 418 /** 419 * ecryptfs_read_super 420 * @sb: The ecryptfs super block 421 * @dev_name: The path to mount over 422 * 423 * Read the super block of the lower filesystem, and use 424 * ecryptfs_interpose to create our initial inode and super block 425 * struct. 426 */ 427 static int ecryptfs_read_super(struct super_block *sb, const char *dev_name) 428 { 429 int rc; 430 struct nameidata nd; 431 struct dentry *lower_root; 432 struct vfsmount *lower_mnt; 433 434 memset(&nd, 0, sizeof(struct nameidata)); 435 rc = path_lookup(dev_name, LOOKUP_FOLLOW, &nd); 436 if (rc) { 437 ecryptfs_printk(KERN_WARNING, "path_lookup() failed\n"); 438 goto out_free; 439 } 440 lower_root = nd.dentry; 441 if (!lower_root->d_inode) { 442 ecryptfs_printk(KERN_WARNING, 443 "No directory to interpose on\n"); 444 rc = -ENOENT; 445 goto out_free; 446 } 447 lower_mnt = nd.mnt; 448 ecryptfs_set_superblock_lower(sb, lower_root->d_sb); 449 sb->s_maxbytes = lower_root->d_sb->s_maxbytes; 450 ecryptfs_set_dentry_lower(sb->s_root, lower_root); 451 ecryptfs_set_dentry_lower_mnt(sb->s_root, lower_mnt); 452 if ((rc = ecryptfs_interpose(lower_root, sb->s_root, sb, 0))) 453 goto out_free; 454 rc = 0; 455 goto out; 456 out_free: 457 path_release(&nd); 458 out: 459 return rc; 460 } 461 462 /** 463 * ecryptfs_get_sb 464 * @fs_type 465 * @flags 466 * @dev_name: The path to mount over 467 * @raw_data: The options passed into the kernel 468 * 469 * The whole ecryptfs_get_sb process is broken into 4 functions: 470 * ecryptfs_parse_options(): handle options passed to ecryptfs, if any 471 * ecryptfs_fill_super(): used by get_sb_nodev, fills out the super_block 472 * with as much information as it can before needing 473 * the lower filesystem. 474 * ecryptfs_read_super(): this accesses the lower filesystem and uses 475 * ecryptfs_interpolate to perform most of the linking 476 * ecryptfs_interpolate(): links the lower filesystem into ecryptfs 477 */ 478 static int ecryptfs_get_sb(struct file_system_type *fs_type, int flags, 479 const char *dev_name, void *raw_data, 480 struct vfsmount *mnt) 481 { 482 int rc; 483 struct super_block *sb; 484 485 rc = get_sb_nodev(fs_type, flags, raw_data, ecryptfs_fill_super, mnt); 486 if (rc < 0) { 487 printk(KERN_ERR "Getting sb failed; rc = [%d]\n", rc); 488 goto out; 489 } 490 sb = mnt->mnt_sb; 491 rc = ecryptfs_parse_options(sb, raw_data); 492 if (rc) { 493 printk(KERN_ERR "Error parsing options; rc = [%d]\n", rc); 494 goto out_abort; 495 } 496 rc = ecryptfs_read_super(sb, dev_name); 497 if (rc) { 498 printk(KERN_ERR "Reading sb failed; rc = [%d]\n", rc); 499 goto out_abort; 500 } 501 goto out; 502 out_abort: 503 dput(sb->s_root); 504 up_write(&sb->s_umount); 505 deactivate_super(sb); 506 out: 507 return rc; 508 } 509 510 /** 511 * ecryptfs_kill_block_super 512 * @sb: The ecryptfs super block 513 * 514 * Used to bring the superblock down and free the private data. 515 * Private data is free'd in ecryptfs_put_super() 516 */ 517 static void ecryptfs_kill_block_super(struct super_block *sb) 518 { 519 generic_shutdown_super(sb); 520 } 521 522 static struct file_system_type ecryptfs_fs_type = { 523 .owner = THIS_MODULE, 524 .name = "ecryptfs", 525 .get_sb = ecryptfs_get_sb, 526 .kill_sb = ecryptfs_kill_block_super, 527 .fs_flags = 0 528 }; 529 530 /** 531 * inode_info_init_once 532 * 533 * Initializes the ecryptfs_inode_info_cache when it is created 534 */ 535 static void 536 inode_info_init_once(void *vptr, struct kmem_cache *cachep, unsigned long flags) 537 { 538 struct ecryptfs_inode_info *ei = (struct ecryptfs_inode_info *)vptr; 539 540 if ((flags & (SLAB_CTOR_VERIFY | SLAB_CTOR_CONSTRUCTOR)) == 541 SLAB_CTOR_CONSTRUCTOR) 542 inode_init_once(&ei->vfs_inode); 543 } 544 545 static struct ecryptfs_cache_info { 546 struct kmem_cache **cache; 547 const char *name; 548 size_t size; 549 void (*ctor)(void*, struct kmem_cache *, unsigned long); 550 } ecryptfs_cache_infos[] = { 551 { 552 .cache = &ecryptfs_auth_tok_list_item_cache, 553 .name = "ecryptfs_auth_tok_list_item", 554 .size = sizeof(struct ecryptfs_auth_tok_list_item), 555 }, 556 { 557 .cache = &ecryptfs_file_info_cache, 558 .name = "ecryptfs_file_cache", 559 .size = sizeof(struct ecryptfs_file_info), 560 }, 561 { 562 .cache = &ecryptfs_dentry_info_cache, 563 .name = "ecryptfs_dentry_info_cache", 564 .size = sizeof(struct ecryptfs_dentry_info), 565 }, 566 { 567 .cache = &ecryptfs_inode_info_cache, 568 .name = "ecryptfs_inode_cache", 569 .size = sizeof(struct ecryptfs_inode_info), 570 .ctor = inode_info_init_once, 571 }, 572 { 573 .cache = &ecryptfs_sb_info_cache, 574 .name = "ecryptfs_sb_cache", 575 .size = sizeof(struct ecryptfs_sb_info), 576 }, 577 { 578 .cache = &ecryptfs_header_cache_0, 579 .name = "ecryptfs_headers_0", 580 .size = PAGE_CACHE_SIZE, 581 }, 582 { 583 .cache = &ecryptfs_header_cache_1, 584 .name = "ecryptfs_headers_1", 585 .size = PAGE_CACHE_SIZE, 586 }, 587 { 588 .cache = &ecryptfs_header_cache_2, 589 .name = "ecryptfs_headers_2", 590 .size = PAGE_CACHE_SIZE, 591 }, 592 { 593 .cache = &ecryptfs_lower_page_cache, 594 .name = "ecryptfs_lower_page_cache", 595 .size = PAGE_CACHE_SIZE, 596 }, 597 }; 598 599 static void ecryptfs_free_kmem_caches(void) 600 { 601 int i; 602 603 for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) { 604 struct ecryptfs_cache_info *info; 605 606 info = &ecryptfs_cache_infos[i]; 607 if (*(info->cache)) 608 kmem_cache_destroy(*(info->cache)); 609 } 610 } 611 612 /** 613 * ecryptfs_init_kmem_caches 614 * 615 * Returns zero on success; non-zero otherwise 616 */ 617 static int ecryptfs_init_kmem_caches(void) 618 { 619 int i; 620 621 for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) { 622 struct ecryptfs_cache_info *info; 623 624 info = &ecryptfs_cache_infos[i]; 625 *(info->cache) = kmem_cache_create(info->name, info->size, 626 0, SLAB_HWCACHE_ALIGN, info->ctor, NULL); 627 if (!*(info->cache)) { 628 ecryptfs_free_kmem_caches(); 629 ecryptfs_printk(KERN_WARNING, "%s: " 630 "kmem_cache_create failed\n", 631 info->name); 632 return -ENOMEM; 633 } 634 } 635 return 0; 636 } 637 638 struct ecryptfs_obj { 639 char *name; 640 struct list_head slot_list; 641 struct kobject kobj; 642 }; 643 644 struct ecryptfs_attribute { 645 struct attribute attr; 646 ssize_t(*show) (struct ecryptfs_obj *, char *); 647 ssize_t(*store) (struct ecryptfs_obj *, const char *, size_t); 648 }; 649 650 static ssize_t 651 ecryptfs_attr_store(struct kobject *kobj, 652 struct attribute *attr, const char *buf, size_t len) 653 { 654 struct ecryptfs_obj *obj = container_of(kobj, struct ecryptfs_obj, 655 kobj); 656 struct ecryptfs_attribute *attribute = 657 container_of(attr, struct ecryptfs_attribute, attr); 658 659 return (attribute->store ? attribute->store(obj, buf, len) : 0); 660 } 661 662 static ssize_t 663 ecryptfs_attr_show(struct kobject *kobj, struct attribute *attr, char *buf) 664 { 665 struct ecryptfs_obj *obj = container_of(kobj, struct ecryptfs_obj, 666 kobj); 667 struct ecryptfs_attribute *attribute = 668 container_of(attr, struct ecryptfs_attribute, attr); 669 670 return (attribute->show ? attribute->show(obj, buf) : 0); 671 } 672 673 static struct sysfs_ops ecryptfs_sysfs_ops = { 674 .show = ecryptfs_attr_show, 675 .store = ecryptfs_attr_store 676 }; 677 678 static struct kobj_type ecryptfs_ktype = { 679 .sysfs_ops = &ecryptfs_sysfs_ops 680 }; 681 682 static decl_subsys(ecryptfs, &ecryptfs_ktype, NULL); 683 684 static ssize_t version_show(struct ecryptfs_obj *obj, char *buff) 685 { 686 return snprintf(buff, PAGE_SIZE, "%d\n", ECRYPTFS_VERSIONING_MASK); 687 } 688 689 static struct ecryptfs_attribute sysfs_attr_version = __ATTR_RO(version); 690 691 static struct ecryptfs_version_str_map_elem { 692 u32 flag; 693 char *str; 694 } ecryptfs_version_str_map[] = { 695 {ECRYPTFS_VERSIONING_PASSPHRASE, "passphrase"}, 696 {ECRYPTFS_VERSIONING_PUBKEY, "pubkey"}, 697 {ECRYPTFS_VERSIONING_PLAINTEXT_PASSTHROUGH, "plaintext passthrough"}, 698 {ECRYPTFS_VERSIONING_POLICY, "policy"} 699 }; 700 701 static ssize_t version_str_show(struct ecryptfs_obj *obj, char *buff) 702 { 703 int i; 704 int remaining = PAGE_SIZE; 705 int total_written = 0; 706 707 buff[0] = '\0'; 708 for (i = 0; i < ARRAY_SIZE(ecryptfs_version_str_map); i++) { 709 int entry_size; 710 711 if (!(ECRYPTFS_VERSIONING_MASK 712 & ecryptfs_version_str_map[i].flag)) 713 continue; 714 entry_size = strlen(ecryptfs_version_str_map[i].str); 715 if ((entry_size + 2) > remaining) 716 goto out; 717 memcpy(buff, ecryptfs_version_str_map[i].str, entry_size); 718 buff[entry_size++] = '\n'; 719 buff[entry_size] = '\0'; 720 buff += entry_size; 721 total_written += entry_size; 722 remaining -= entry_size; 723 } 724 out: 725 return total_written; 726 } 727 728 static struct ecryptfs_attribute sysfs_attr_version_str = __ATTR_RO(version_str); 729 730 static int do_sysfs_registration(void) 731 { 732 int rc; 733 734 if ((rc = subsystem_register(&ecryptfs_subsys))) { 735 printk(KERN_ERR 736 "Unable to register ecryptfs sysfs subsystem\n"); 737 goto out; 738 } 739 rc = sysfs_create_file(&ecryptfs_subsys.kset.kobj, 740 &sysfs_attr_version.attr); 741 if (rc) { 742 printk(KERN_ERR 743 "Unable to create ecryptfs version attribute\n"); 744 subsystem_unregister(&ecryptfs_subsys); 745 goto out; 746 } 747 rc = sysfs_create_file(&ecryptfs_subsys.kset.kobj, 748 &sysfs_attr_version_str.attr); 749 if (rc) { 750 printk(KERN_ERR 751 "Unable to create ecryptfs version_str attribute\n"); 752 sysfs_remove_file(&ecryptfs_subsys.kset.kobj, 753 &sysfs_attr_version.attr); 754 subsystem_unregister(&ecryptfs_subsys); 755 goto out; 756 } 757 out: 758 return rc; 759 } 760 761 static int __init ecryptfs_init(void) 762 { 763 int rc; 764 765 if (ECRYPTFS_DEFAULT_EXTENT_SIZE > PAGE_CACHE_SIZE) { 766 rc = -EINVAL; 767 ecryptfs_printk(KERN_ERR, "The eCryptfs extent size is " 768 "larger than the host's page size, and so " 769 "eCryptfs cannot run on this system. The " 770 "default eCryptfs extent size is [%d] bytes; " 771 "the page size is [%d] bytes.\n", 772 ECRYPTFS_DEFAULT_EXTENT_SIZE, PAGE_CACHE_SIZE); 773 goto out; 774 } 775 rc = ecryptfs_init_kmem_caches(); 776 if (rc) { 777 printk(KERN_ERR 778 "Failed to allocate one or more kmem_cache objects\n"); 779 goto out; 780 } 781 rc = register_filesystem(&ecryptfs_fs_type); 782 if (rc) { 783 printk(KERN_ERR "Failed to register filesystem\n"); 784 ecryptfs_free_kmem_caches(); 785 goto out; 786 } 787 kset_set_kset_s(&ecryptfs_subsys, fs_subsys); 788 sysfs_attr_version.attr.owner = THIS_MODULE; 789 sysfs_attr_version_str.attr.owner = THIS_MODULE; 790 rc = do_sysfs_registration(); 791 if (rc) { 792 printk(KERN_ERR "sysfs registration failed\n"); 793 unregister_filesystem(&ecryptfs_fs_type); 794 ecryptfs_free_kmem_caches(); 795 goto out; 796 } 797 out: 798 return rc; 799 } 800 801 static void __exit ecryptfs_exit(void) 802 { 803 sysfs_remove_file(&ecryptfs_subsys.kset.kobj, 804 &sysfs_attr_version.attr); 805 sysfs_remove_file(&ecryptfs_subsys.kset.kobj, 806 &sysfs_attr_version_str.attr); 807 subsystem_unregister(&ecryptfs_subsys); 808 unregister_filesystem(&ecryptfs_fs_type); 809 ecryptfs_free_kmem_caches(); 810 } 811 812 MODULE_AUTHOR("Michael A. Halcrow <mhalcrow@us.ibm.com>"); 813 MODULE_DESCRIPTION("eCryptfs"); 814 815 MODULE_LICENSE("GPL"); 816 817 module_init(ecryptfs_init) 818 module_exit(ecryptfs_exit) 819