1 /** 2 * eCryptfs: Linux filesystem encryption layer 3 * 4 * Copyright (C) 1997-2004 Erez Zadok 5 * Copyright (C) 2001-2004 Stony Brook University 6 * Copyright (C) 2004-2007 International Business Machines Corp. 7 * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com> 8 * Michael C. Thompsion <mcthomps@us.ibm.com> 9 * 10 * This program is free software; you can redistribute it and/or 11 * modify it under the terms of the GNU General Public License as 12 * published by the Free Software Foundation; either version 2 of the 13 * License, or (at your option) any later version. 14 * 15 * This program is distributed in the hope that it will be useful, but 16 * WITHOUT ANY WARRANTY; without even the implied warranty of 17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 18 * General Public License for more details. 19 * 20 * You should have received a copy of the GNU General Public License 21 * along with this program; if not, write to the Free Software 22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 23 * 02111-1307, USA. 24 */ 25 26 #include <linux/file.h> 27 #include <linux/vmalloc.h> 28 #include <linux/pagemap.h> 29 #include <linux/dcache.h> 30 #include <linux/namei.h> 31 #include <linux/mount.h> 32 #include <linux/crypto.h> 33 #include <linux/fs_stack.h> 34 #include <linux/slab.h> 35 #include <linux/xattr.h> 36 #include <asm/unaligned.h> 37 #include "ecryptfs_kernel.h" 38 39 static struct dentry *lock_parent(struct dentry *dentry) 40 { 41 struct dentry *dir; 42 43 dir = dget_parent(dentry); 44 mutex_lock_nested(&(dir->d_inode->i_mutex), I_MUTEX_PARENT); 45 return dir; 46 } 47 48 static void unlock_dir(struct dentry *dir) 49 { 50 mutex_unlock(&dir->d_inode->i_mutex); 51 dput(dir); 52 } 53 54 /** 55 * ecryptfs_create_underlying_file 56 * @lower_dir_inode: inode of the parent in the lower fs of the new file 57 * @dentry: New file's dentry 58 * @mode: The mode of the new file 59 * @nd: nameidata of ecryptfs' parent's dentry & vfsmount 60 * 61 * Creates the file in the lower file system. 62 * 63 * Returns zero on success; non-zero on error condition 64 */ 65 static int 66 ecryptfs_create_underlying_file(struct inode *lower_dir_inode, 67 struct dentry *dentry, int mode, 68 struct nameidata *nd) 69 { 70 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry); 71 struct vfsmount *lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry); 72 struct dentry *dentry_save; 73 struct vfsmount *vfsmount_save; 74 unsigned int flags_save; 75 int rc; 76 77 if (nd) { 78 dentry_save = nd->path.dentry; 79 vfsmount_save = nd->path.mnt; 80 flags_save = nd->flags; 81 nd->path.dentry = lower_dentry; 82 nd->path.mnt = lower_mnt; 83 nd->flags &= ~LOOKUP_OPEN; 84 } 85 rc = vfs_create(lower_dir_inode, lower_dentry, mode, nd); 86 if (nd) { 87 nd->path.dentry = dentry_save; 88 nd->path.mnt = vfsmount_save; 89 nd->flags = flags_save; 90 } 91 return rc; 92 } 93 94 /** 95 * ecryptfs_do_create 96 * @directory_inode: inode of the new file's dentry's parent in ecryptfs 97 * @ecryptfs_dentry: New file's dentry in ecryptfs 98 * @mode: The mode of the new file 99 * @nd: nameidata of ecryptfs' parent's dentry & vfsmount 100 * 101 * Creates the underlying file and the eCryptfs inode which will link to 102 * it. It will also update the eCryptfs directory inode to mimic the 103 * stat of the lower directory inode. 104 * 105 * Returns zero on success; non-zero on error condition 106 */ 107 static int 108 ecryptfs_do_create(struct inode *directory_inode, 109 struct dentry *ecryptfs_dentry, int mode, 110 struct nameidata *nd) 111 { 112 int rc; 113 struct dentry *lower_dentry; 114 struct dentry *lower_dir_dentry; 115 116 lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry); 117 lower_dir_dentry = lock_parent(lower_dentry); 118 if (IS_ERR(lower_dir_dentry)) { 119 ecryptfs_printk(KERN_ERR, "Error locking directory of " 120 "dentry\n"); 121 rc = PTR_ERR(lower_dir_dentry); 122 goto out; 123 } 124 rc = ecryptfs_create_underlying_file(lower_dir_dentry->d_inode, 125 ecryptfs_dentry, mode, nd); 126 if (rc) { 127 printk(KERN_ERR "%s: Failure to create dentry in lower fs; " 128 "rc = [%d]\n", __func__, rc); 129 goto out_lock; 130 } 131 rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry, 132 directory_inode->i_sb, 0); 133 if (rc) { 134 ecryptfs_printk(KERN_ERR, "Failure in ecryptfs_interpose\n"); 135 goto out_lock; 136 } 137 fsstack_copy_attr_times(directory_inode, lower_dir_dentry->d_inode); 138 fsstack_copy_inode_size(directory_inode, lower_dir_dentry->d_inode); 139 out_lock: 140 unlock_dir(lower_dir_dentry); 141 out: 142 return rc; 143 } 144 145 /** 146 * grow_file 147 * @ecryptfs_dentry: the eCryptfs dentry 148 * 149 * This is the code which will grow the file to its correct size. 150 */ 151 static int grow_file(struct dentry *ecryptfs_dentry) 152 { 153 struct inode *ecryptfs_inode = ecryptfs_dentry->d_inode; 154 char zero_virt[] = { 0x00 }; 155 int rc = 0; 156 157 rc = ecryptfs_write(ecryptfs_inode, zero_virt, 0, 1); 158 i_size_write(ecryptfs_inode, 0); 159 rc = ecryptfs_write_inode_size_to_metadata(ecryptfs_inode); 160 ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat.flags |= 161 ECRYPTFS_NEW_FILE; 162 return rc; 163 } 164 165 /** 166 * ecryptfs_initialize_file 167 * 168 * Cause the file to be changed from a basic empty file to an ecryptfs 169 * file with a header and first data page. 170 * 171 * Returns zero on success 172 */ 173 static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry) 174 { 175 struct ecryptfs_crypt_stat *crypt_stat = 176 &ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->crypt_stat; 177 int rc = 0; 178 179 if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) { 180 ecryptfs_printk(KERN_DEBUG, "This is a directory\n"); 181 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED); 182 goto out; 183 } 184 crypt_stat->flags |= ECRYPTFS_NEW_FILE; 185 ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n"); 186 rc = ecryptfs_new_file_context(ecryptfs_dentry); 187 if (rc) { 188 ecryptfs_printk(KERN_ERR, "Error creating new file " 189 "context; rc = [%d]\n", rc); 190 goto out; 191 } 192 rc = ecryptfs_init_persistent_file(ecryptfs_dentry); 193 if (rc) { 194 printk(KERN_ERR "%s: Error attempting to initialize " 195 "the persistent file for the dentry with name " 196 "[%s]; rc = [%d]\n", __func__, 197 ecryptfs_dentry->d_name.name, rc); 198 goto out; 199 } 200 rc = ecryptfs_write_metadata(ecryptfs_dentry); 201 if (rc) { 202 printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc); 203 goto out; 204 } 205 rc = grow_file(ecryptfs_dentry); 206 if (rc) 207 printk(KERN_ERR "Error growing file; rc = [%d]\n", rc); 208 out: 209 return rc; 210 } 211 212 /** 213 * ecryptfs_create 214 * @dir: The inode of the directory in which to create the file. 215 * @dentry: The eCryptfs dentry 216 * @mode: The mode of the new file. 217 * @nd: nameidata 218 * 219 * Creates a new file. 220 * 221 * Returns zero on success; non-zero on error condition 222 */ 223 static int 224 ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry, 225 int mode, struct nameidata *nd) 226 { 227 int rc; 228 229 /* ecryptfs_do_create() calls ecryptfs_interpose() */ 230 rc = ecryptfs_do_create(directory_inode, ecryptfs_dentry, mode, nd); 231 if (unlikely(rc)) { 232 ecryptfs_printk(KERN_WARNING, "Failed to create file in" 233 "lower filesystem\n"); 234 goto out; 235 } 236 /* At this point, a file exists on "disk"; we need to make sure 237 * that this on disk file is prepared to be an ecryptfs file */ 238 rc = ecryptfs_initialize_file(ecryptfs_dentry); 239 out: 240 return rc; 241 } 242 243 /** 244 * ecryptfs_lookup_and_interpose_lower - Perform a lookup 245 */ 246 int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry, 247 struct dentry *lower_dentry, 248 struct inode *ecryptfs_dir_inode) 249 { 250 struct dentry *lower_dir_dentry; 251 struct vfsmount *lower_mnt; 252 struct inode *lower_inode; 253 struct ecryptfs_mount_crypt_stat *mount_crypt_stat; 254 struct ecryptfs_crypt_stat *crypt_stat; 255 char *page_virt = NULL; 256 u64 file_size; 257 int rc = 0; 258 259 lower_dir_dentry = lower_dentry->d_parent; 260 lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt( 261 ecryptfs_dentry->d_parent)); 262 lower_inode = lower_dentry->d_inode; 263 fsstack_copy_attr_atime(ecryptfs_dir_inode, lower_dir_dentry->d_inode); 264 BUG_ON(!lower_dentry->d_count); 265 ecryptfs_set_dentry_private(ecryptfs_dentry, 266 kmem_cache_alloc(ecryptfs_dentry_info_cache, 267 GFP_KERNEL)); 268 if (!ecryptfs_dentry_to_private(ecryptfs_dentry)) { 269 rc = -ENOMEM; 270 printk(KERN_ERR "%s: Out of memory whilst attempting " 271 "to allocate ecryptfs_dentry_info struct\n", 272 __func__); 273 goto out_put; 274 } 275 ecryptfs_set_dentry_lower(ecryptfs_dentry, lower_dentry); 276 ecryptfs_set_dentry_lower_mnt(ecryptfs_dentry, lower_mnt); 277 if (!lower_dentry->d_inode) { 278 /* We want to add because we couldn't find in lower */ 279 d_add(ecryptfs_dentry, NULL); 280 goto out; 281 } 282 rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry, 283 ecryptfs_dir_inode->i_sb, 284 ECRYPTFS_INTERPOSE_FLAG_D_ADD); 285 if (rc) { 286 printk(KERN_ERR "%s: Error interposing; rc = [%d]\n", 287 __func__, rc); 288 goto out; 289 } 290 if (S_ISDIR(lower_inode->i_mode)) 291 goto out; 292 if (S_ISLNK(lower_inode->i_mode)) 293 goto out; 294 if (special_file(lower_inode->i_mode)) 295 goto out; 296 /* Released in this function */ 297 page_virt = kmem_cache_zalloc(ecryptfs_header_cache_2, GFP_USER); 298 if (!page_virt) { 299 printk(KERN_ERR "%s: Cannot kmem_cache_zalloc() a page\n", 300 __func__); 301 rc = -ENOMEM; 302 goto out; 303 } 304 rc = ecryptfs_init_persistent_file(ecryptfs_dentry); 305 if (rc) { 306 printk(KERN_ERR "%s: Error attempting to initialize " 307 "the persistent file for the dentry with name " 308 "[%s]; rc = [%d]\n", __func__, 309 ecryptfs_dentry->d_name.name, rc); 310 goto out_free_kmem; 311 } 312 crypt_stat = &ecryptfs_inode_to_private( 313 ecryptfs_dentry->d_inode)->crypt_stat; 314 /* TODO: lock for crypt_stat comparison */ 315 if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)) 316 ecryptfs_set_default_sizes(crypt_stat); 317 rc = ecryptfs_read_and_validate_header_region(page_virt, 318 ecryptfs_dentry->d_inode); 319 if (rc) { 320 memset(page_virt, 0, PAGE_CACHE_SIZE); 321 rc = ecryptfs_read_and_validate_xattr_region(page_virt, 322 ecryptfs_dentry); 323 if (rc) { 324 rc = 0; 325 goto out_free_kmem; 326 } 327 crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR; 328 } 329 mount_crypt_stat = &ecryptfs_superblock_to_private( 330 ecryptfs_dentry->d_sb)->mount_crypt_stat; 331 if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) { 332 if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) 333 file_size = (crypt_stat->metadata_size 334 + i_size_read(lower_dentry->d_inode)); 335 else 336 file_size = i_size_read(lower_dentry->d_inode); 337 } else { 338 file_size = get_unaligned_be64(page_virt); 339 } 340 i_size_write(ecryptfs_dentry->d_inode, (loff_t)file_size); 341 out_free_kmem: 342 kmem_cache_free(ecryptfs_header_cache_2, page_virt); 343 goto out; 344 out_put: 345 dput(lower_dentry); 346 mntput(lower_mnt); 347 d_drop(ecryptfs_dentry); 348 out: 349 return rc; 350 } 351 352 /** 353 * ecryptfs_lookup 354 * @ecryptfs_dir_inode: The eCryptfs directory inode 355 * @ecryptfs_dentry: The eCryptfs dentry that we are looking up 356 * @ecryptfs_nd: nameidata; may be NULL 357 * 358 * Find a file on disk. If the file does not exist, then we'll add it to the 359 * dentry cache and continue on to read it from the disk. 360 */ 361 static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode, 362 struct dentry *ecryptfs_dentry, 363 struct nameidata *ecryptfs_nd) 364 { 365 char *encrypted_and_encoded_name = NULL; 366 size_t encrypted_and_encoded_name_size; 367 struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL; 368 struct dentry *lower_dir_dentry, *lower_dentry; 369 int rc = 0; 370 371 if ((ecryptfs_dentry->d_name.len == 1 372 && !strcmp(ecryptfs_dentry->d_name.name, ".")) 373 || (ecryptfs_dentry->d_name.len == 2 374 && !strcmp(ecryptfs_dentry->d_name.name, ".."))) { 375 goto out_d_drop; 376 } 377 lower_dir_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry->d_parent); 378 mutex_lock(&lower_dir_dentry->d_inode->i_mutex); 379 lower_dentry = lookup_one_len(ecryptfs_dentry->d_name.name, 380 lower_dir_dentry, 381 ecryptfs_dentry->d_name.len); 382 mutex_unlock(&lower_dir_dentry->d_inode->i_mutex); 383 if (IS_ERR(lower_dentry)) { 384 rc = PTR_ERR(lower_dentry); 385 ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned " 386 "[%d] on lower_dentry = [%s]\n", __func__, rc, 387 encrypted_and_encoded_name); 388 goto out_d_drop; 389 } 390 if (lower_dentry->d_inode) 391 goto lookup_and_interpose; 392 mount_crypt_stat = &ecryptfs_superblock_to_private( 393 ecryptfs_dentry->d_sb)->mount_crypt_stat; 394 if (!(mount_crypt_stat 395 && (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES))) 396 goto lookup_and_interpose; 397 dput(lower_dentry); 398 rc = ecryptfs_encrypt_and_encode_filename( 399 &encrypted_and_encoded_name, &encrypted_and_encoded_name_size, 400 NULL, mount_crypt_stat, ecryptfs_dentry->d_name.name, 401 ecryptfs_dentry->d_name.len); 402 if (rc) { 403 printk(KERN_ERR "%s: Error attempting to encrypt and encode " 404 "filename; rc = [%d]\n", __func__, rc); 405 goto out_d_drop; 406 } 407 mutex_lock(&lower_dir_dentry->d_inode->i_mutex); 408 lower_dentry = lookup_one_len(encrypted_and_encoded_name, 409 lower_dir_dentry, 410 encrypted_and_encoded_name_size); 411 mutex_unlock(&lower_dir_dentry->d_inode->i_mutex); 412 if (IS_ERR(lower_dentry)) { 413 rc = PTR_ERR(lower_dentry); 414 ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned " 415 "[%d] on lower_dentry = [%s]\n", __func__, rc, 416 encrypted_and_encoded_name); 417 goto out_d_drop; 418 } 419 lookup_and_interpose: 420 rc = ecryptfs_lookup_and_interpose_lower(ecryptfs_dentry, lower_dentry, 421 ecryptfs_dir_inode); 422 goto out; 423 out_d_drop: 424 d_drop(ecryptfs_dentry); 425 out: 426 kfree(encrypted_and_encoded_name); 427 return ERR_PTR(rc); 428 } 429 430 static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir, 431 struct dentry *new_dentry) 432 { 433 struct dentry *lower_old_dentry; 434 struct dentry *lower_new_dentry; 435 struct dentry *lower_dir_dentry; 436 u64 file_size_save; 437 int rc; 438 439 file_size_save = i_size_read(old_dentry->d_inode); 440 lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry); 441 lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry); 442 dget(lower_old_dentry); 443 dget(lower_new_dentry); 444 lower_dir_dentry = lock_parent(lower_new_dentry); 445 rc = vfs_link(lower_old_dentry, lower_dir_dentry->d_inode, 446 lower_new_dentry); 447 if (rc || !lower_new_dentry->d_inode) 448 goto out_lock; 449 rc = ecryptfs_interpose(lower_new_dentry, new_dentry, dir->i_sb, 0); 450 if (rc) 451 goto out_lock; 452 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 453 fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode); 454 old_dentry->d_inode->i_nlink = 455 ecryptfs_inode_to_lower(old_dentry->d_inode)->i_nlink; 456 i_size_write(new_dentry->d_inode, file_size_save); 457 out_lock: 458 unlock_dir(lower_dir_dentry); 459 dput(lower_new_dentry); 460 dput(lower_old_dentry); 461 return rc; 462 } 463 464 static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry) 465 { 466 int rc = 0; 467 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry); 468 struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir); 469 struct dentry *lower_dir_dentry; 470 471 dget(lower_dentry); 472 lower_dir_dentry = lock_parent(lower_dentry); 473 rc = vfs_unlink(lower_dir_inode, lower_dentry); 474 if (rc) { 475 printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc); 476 goto out_unlock; 477 } 478 fsstack_copy_attr_times(dir, lower_dir_inode); 479 dentry->d_inode->i_nlink = 480 ecryptfs_inode_to_lower(dentry->d_inode)->i_nlink; 481 dentry->d_inode->i_ctime = dir->i_ctime; 482 d_drop(dentry); 483 out_unlock: 484 unlock_dir(lower_dir_dentry); 485 dput(lower_dentry); 486 return rc; 487 } 488 489 static int ecryptfs_symlink(struct inode *dir, struct dentry *dentry, 490 const char *symname) 491 { 492 int rc; 493 struct dentry *lower_dentry; 494 struct dentry *lower_dir_dentry; 495 char *encoded_symname; 496 size_t encoded_symlen; 497 struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL; 498 499 lower_dentry = ecryptfs_dentry_to_lower(dentry); 500 dget(lower_dentry); 501 lower_dir_dentry = lock_parent(lower_dentry); 502 mount_crypt_stat = &ecryptfs_superblock_to_private( 503 dir->i_sb)->mount_crypt_stat; 504 rc = ecryptfs_encrypt_and_encode_filename(&encoded_symname, 505 &encoded_symlen, 506 NULL, 507 mount_crypt_stat, symname, 508 strlen(symname)); 509 if (rc) 510 goto out_lock; 511 rc = vfs_symlink(lower_dir_dentry->d_inode, lower_dentry, 512 encoded_symname); 513 kfree(encoded_symname); 514 if (rc || !lower_dentry->d_inode) 515 goto out_lock; 516 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb, 0); 517 if (rc) 518 goto out_lock; 519 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 520 fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode); 521 out_lock: 522 unlock_dir(lower_dir_dentry); 523 dput(lower_dentry); 524 if (!dentry->d_inode) 525 d_drop(dentry); 526 return rc; 527 } 528 529 static int ecryptfs_mkdir(struct inode *dir, struct dentry *dentry, int mode) 530 { 531 int rc; 532 struct dentry *lower_dentry; 533 struct dentry *lower_dir_dentry; 534 535 lower_dentry = ecryptfs_dentry_to_lower(dentry); 536 lower_dir_dentry = lock_parent(lower_dentry); 537 rc = vfs_mkdir(lower_dir_dentry->d_inode, lower_dentry, mode); 538 if (rc || !lower_dentry->d_inode) 539 goto out; 540 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb, 0); 541 if (rc) 542 goto out; 543 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 544 fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode); 545 dir->i_nlink = lower_dir_dentry->d_inode->i_nlink; 546 out: 547 unlock_dir(lower_dir_dentry); 548 if (!dentry->d_inode) 549 d_drop(dentry); 550 return rc; 551 } 552 553 static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry) 554 { 555 struct dentry *lower_dentry; 556 struct dentry *lower_dir_dentry; 557 int rc; 558 559 lower_dentry = ecryptfs_dentry_to_lower(dentry); 560 dget(dentry); 561 lower_dir_dentry = lock_parent(lower_dentry); 562 dget(lower_dentry); 563 rc = vfs_rmdir(lower_dir_dentry->d_inode, lower_dentry); 564 dput(lower_dentry); 565 if (!rc) 566 d_delete(lower_dentry); 567 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 568 dir->i_nlink = lower_dir_dentry->d_inode->i_nlink; 569 unlock_dir(lower_dir_dentry); 570 if (!rc) 571 d_drop(dentry); 572 dput(dentry); 573 return rc; 574 } 575 576 static int 577 ecryptfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev) 578 { 579 int rc; 580 struct dentry *lower_dentry; 581 struct dentry *lower_dir_dentry; 582 583 lower_dentry = ecryptfs_dentry_to_lower(dentry); 584 lower_dir_dentry = lock_parent(lower_dentry); 585 rc = vfs_mknod(lower_dir_dentry->d_inode, lower_dentry, mode, dev); 586 if (rc || !lower_dentry->d_inode) 587 goto out; 588 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb, 0); 589 if (rc) 590 goto out; 591 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 592 fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode); 593 out: 594 unlock_dir(lower_dir_dentry); 595 if (!dentry->d_inode) 596 d_drop(dentry); 597 return rc; 598 } 599 600 static int 601 ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry, 602 struct inode *new_dir, struct dentry *new_dentry) 603 { 604 int rc; 605 struct dentry *lower_old_dentry; 606 struct dentry *lower_new_dentry; 607 struct dentry *lower_old_dir_dentry; 608 struct dentry *lower_new_dir_dentry; 609 struct dentry *trap = NULL; 610 611 lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry); 612 lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry); 613 dget(lower_old_dentry); 614 dget(lower_new_dentry); 615 lower_old_dir_dentry = dget_parent(lower_old_dentry); 616 lower_new_dir_dentry = dget_parent(lower_new_dentry); 617 trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry); 618 /* source should not be ancestor of target */ 619 if (trap == lower_old_dentry) { 620 rc = -EINVAL; 621 goto out_lock; 622 } 623 /* target should not be ancestor of source */ 624 if (trap == lower_new_dentry) { 625 rc = -ENOTEMPTY; 626 goto out_lock; 627 } 628 rc = vfs_rename(lower_old_dir_dentry->d_inode, lower_old_dentry, 629 lower_new_dir_dentry->d_inode, lower_new_dentry); 630 if (rc) 631 goto out_lock; 632 fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode); 633 if (new_dir != old_dir) 634 fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode); 635 out_lock: 636 unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry); 637 dput(lower_new_dentry->d_parent); 638 dput(lower_old_dentry->d_parent); 639 dput(lower_new_dentry); 640 dput(lower_old_dentry); 641 return rc; 642 } 643 644 static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf, 645 size_t *bufsiz) 646 { 647 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry); 648 char *lower_buf; 649 size_t lower_bufsiz = PATH_MAX; 650 mm_segment_t old_fs; 651 int rc; 652 653 lower_buf = kmalloc(lower_bufsiz, GFP_KERNEL); 654 if (!lower_buf) { 655 rc = -ENOMEM; 656 goto out; 657 } 658 old_fs = get_fs(); 659 set_fs(get_ds()); 660 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry, 661 (char __user *)lower_buf, 662 lower_bufsiz); 663 set_fs(old_fs); 664 if (rc < 0) 665 goto out; 666 lower_bufsiz = rc; 667 rc = ecryptfs_decode_and_decrypt_filename(buf, bufsiz, dentry, 668 lower_buf, lower_bufsiz); 669 out: 670 kfree(lower_buf); 671 return rc; 672 } 673 674 static int 675 ecryptfs_readlink(struct dentry *dentry, char __user *buf, int bufsiz) 676 { 677 char *kbuf; 678 size_t kbufsiz, copied; 679 int rc; 680 681 rc = ecryptfs_readlink_lower(dentry, &kbuf, &kbufsiz); 682 if (rc) 683 goto out; 684 copied = min_t(size_t, bufsiz, kbufsiz); 685 rc = copy_to_user(buf, kbuf, copied) ? -EFAULT : copied; 686 kfree(kbuf); 687 fsstack_copy_attr_atime(dentry->d_inode, 688 ecryptfs_dentry_to_lower(dentry)->d_inode); 689 out: 690 return rc; 691 } 692 693 static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd) 694 { 695 char *buf; 696 int len = PAGE_SIZE, rc; 697 mm_segment_t old_fs; 698 699 /* Released in ecryptfs_put_link(); only release here on error */ 700 buf = kmalloc(len, GFP_KERNEL); 701 if (!buf) { 702 buf = ERR_PTR(-ENOMEM); 703 goto out; 704 } 705 old_fs = get_fs(); 706 set_fs(get_ds()); 707 rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len); 708 set_fs(old_fs); 709 if (rc < 0) { 710 kfree(buf); 711 buf = ERR_PTR(rc); 712 } else 713 buf[rc] = '\0'; 714 out: 715 nd_set_link(nd, buf); 716 return NULL; 717 } 718 719 static void 720 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr) 721 { 722 char *buf = nd_get_link(nd); 723 if (!IS_ERR(buf)) { 724 /* Free the char* */ 725 kfree(buf); 726 } 727 } 728 729 /** 730 * upper_size_to_lower_size 731 * @crypt_stat: Crypt_stat associated with file 732 * @upper_size: Size of the upper file 733 * 734 * Calculate the required size of the lower file based on the 735 * specified size of the upper file. This calculation is based on the 736 * number of headers in the underlying file and the extent size. 737 * 738 * Returns Calculated size of the lower file. 739 */ 740 static loff_t 741 upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat, 742 loff_t upper_size) 743 { 744 loff_t lower_size; 745 746 lower_size = ecryptfs_lower_header_size(crypt_stat); 747 if (upper_size != 0) { 748 loff_t num_extents; 749 750 num_extents = upper_size >> crypt_stat->extent_shift; 751 if (upper_size & ~crypt_stat->extent_mask) 752 num_extents++; 753 lower_size += (num_extents * crypt_stat->extent_size); 754 } 755 return lower_size; 756 } 757 758 /** 759 * truncate_upper 760 * @dentry: The ecryptfs layer dentry 761 * @ia: Address of the ecryptfs inode's attributes 762 * @lower_ia: Address of the lower inode's attributes 763 * 764 * Function to handle truncations modifying the size of the file. Note 765 * that the file sizes are interpolated. When expanding, we are simply 766 * writing strings of 0's out. When truncating, we truncate the upper 767 * inode and update the lower_ia according to the page index 768 * interpolations. If ATTR_SIZE is set in lower_ia->ia_valid upon return, 769 * the caller must use lower_ia in a call to notify_change() to perform 770 * the truncation of the lower inode. 771 * 772 * Returns zero on success; non-zero otherwise 773 */ 774 static int truncate_upper(struct dentry *dentry, struct iattr *ia, 775 struct iattr *lower_ia) 776 { 777 int rc = 0; 778 struct inode *inode = dentry->d_inode; 779 struct ecryptfs_crypt_stat *crypt_stat; 780 loff_t i_size = i_size_read(inode); 781 loff_t lower_size_before_truncate; 782 loff_t lower_size_after_truncate; 783 784 if (unlikely((ia->ia_size == i_size))) { 785 lower_ia->ia_valid &= ~ATTR_SIZE; 786 goto out; 787 } 788 crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat; 789 /* Switch on growing or shrinking file */ 790 if (ia->ia_size > i_size) { 791 char zero[] = { 0x00 }; 792 793 lower_ia->ia_valid &= ~ATTR_SIZE; 794 /* Write a single 0 at the last position of the file; 795 * this triggers code that will fill in 0's throughout 796 * the intermediate portion of the previous end of the 797 * file and the new and of the file */ 798 rc = ecryptfs_write(inode, zero, 799 (ia->ia_size - 1), 1); 800 } else { /* ia->ia_size < i_size_read(inode) */ 801 /* We're chopping off all the pages down to the page 802 * in which ia->ia_size is located. Fill in the end of 803 * that page from (ia->ia_size & ~PAGE_CACHE_MASK) to 804 * PAGE_CACHE_SIZE with zeros. */ 805 size_t num_zeros = (PAGE_CACHE_SIZE 806 - (ia->ia_size & ~PAGE_CACHE_MASK)); 807 808 809 /* 810 * XXX(truncate) this should really happen at the begginning 811 * of ->setattr. But the code is too messy to that as part 812 * of a larger patch. ecryptfs is also totally missing out 813 * on the inode_change_ok check at the beginning of 814 * ->setattr while would include this. 815 */ 816 rc = inode_newsize_ok(inode, ia->ia_size); 817 if (rc) 818 goto out; 819 820 if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) { 821 truncate_setsize(inode, ia->ia_size); 822 lower_ia->ia_size = ia->ia_size; 823 lower_ia->ia_valid |= ATTR_SIZE; 824 goto out; 825 } 826 if (num_zeros) { 827 char *zeros_virt; 828 829 zeros_virt = kzalloc(num_zeros, GFP_KERNEL); 830 if (!zeros_virt) { 831 rc = -ENOMEM; 832 goto out; 833 } 834 rc = ecryptfs_write(inode, zeros_virt, 835 ia->ia_size, num_zeros); 836 kfree(zeros_virt); 837 if (rc) { 838 printk(KERN_ERR "Error attempting to zero out " 839 "the remainder of the end page on " 840 "reducing truncate; rc = [%d]\n", rc); 841 goto out; 842 } 843 } 844 truncate_setsize(inode, ia->ia_size); 845 rc = ecryptfs_write_inode_size_to_metadata(inode); 846 if (rc) { 847 printk(KERN_ERR "Problem with " 848 "ecryptfs_write_inode_size_to_metadata; " 849 "rc = [%d]\n", rc); 850 goto out; 851 } 852 /* We are reducing the size of the ecryptfs file, and need to 853 * know if we need to reduce the size of the lower file. */ 854 lower_size_before_truncate = 855 upper_size_to_lower_size(crypt_stat, i_size); 856 lower_size_after_truncate = 857 upper_size_to_lower_size(crypt_stat, ia->ia_size); 858 if (lower_size_after_truncate < lower_size_before_truncate) { 859 lower_ia->ia_size = lower_size_after_truncate; 860 lower_ia->ia_valid |= ATTR_SIZE; 861 } else 862 lower_ia->ia_valid &= ~ATTR_SIZE; 863 } 864 out: 865 return rc; 866 } 867 868 /** 869 * ecryptfs_truncate 870 * @dentry: The ecryptfs layer dentry 871 * @new_length: The length to expand the file to 872 * 873 * Simple function that handles the truncation of an eCryptfs inode and 874 * its corresponding lower inode. 875 * 876 * Returns zero on success; non-zero otherwise 877 */ 878 int ecryptfs_truncate(struct dentry *dentry, loff_t new_length) 879 { 880 struct iattr ia = { .ia_valid = ATTR_SIZE, .ia_size = new_length }; 881 struct iattr lower_ia = { .ia_valid = 0 }; 882 int rc; 883 884 rc = truncate_upper(dentry, &ia, &lower_ia); 885 if (!rc && lower_ia.ia_valid & ATTR_SIZE) { 886 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry); 887 888 mutex_lock(&lower_dentry->d_inode->i_mutex); 889 rc = notify_change(lower_dentry, &lower_ia); 890 mutex_unlock(&lower_dentry->d_inode->i_mutex); 891 } 892 return rc; 893 } 894 895 static int 896 ecryptfs_permission(struct inode *inode, int mask, unsigned int flags) 897 { 898 if (flags & IPERM_FLAG_RCU) 899 return -ECHILD; 900 return inode_permission(ecryptfs_inode_to_lower(inode), mask); 901 } 902 903 /** 904 * ecryptfs_setattr 905 * @dentry: dentry handle to the inode to modify 906 * @ia: Structure with flags of what to change and values 907 * 908 * Updates the metadata of an inode. If the update is to the size 909 * i.e. truncation, then ecryptfs_truncate will handle the size modification 910 * of both the ecryptfs inode and the lower inode. 911 * 912 * All other metadata changes will be passed right to the lower filesystem, 913 * and we will just update our inode to look like the lower. 914 */ 915 static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia) 916 { 917 int rc = 0; 918 struct dentry *lower_dentry; 919 struct iattr lower_ia; 920 struct inode *inode; 921 struct inode *lower_inode; 922 struct ecryptfs_crypt_stat *crypt_stat; 923 924 crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat; 925 if (!(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)) 926 ecryptfs_init_crypt_stat(crypt_stat); 927 inode = dentry->d_inode; 928 lower_inode = ecryptfs_inode_to_lower(inode); 929 lower_dentry = ecryptfs_dentry_to_lower(dentry); 930 mutex_lock(&crypt_stat->cs_mutex); 931 if (S_ISDIR(dentry->d_inode->i_mode)) 932 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED); 933 else if (S_ISREG(dentry->d_inode->i_mode) 934 && (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED) 935 || !(crypt_stat->flags & ECRYPTFS_KEY_VALID))) { 936 struct ecryptfs_mount_crypt_stat *mount_crypt_stat; 937 938 mount_crypt_stat = &ecryptfs_superblock_to_private( 939 dentry->d_sb)->mount_crypt_stat; 940 rc = ecryptfs_read_metadata(dentry); 941 if (rc) { 942 if (!(mount_crypt_stat->flags 943 & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) { 944 rc = -EIO; 945 printk(KERN_WARNING "Either the lower file " 946 "is not in a valid eCryptfs format, " 947 "or the key could not be retrieved. " 948 "Plaintext passthrough mode is not " 949 "enabled; returning -EIO\n"); 950 mutex_unlock(&crypt_stat->cs_mutex); 951 goto out; 952 } 953 rc = 0; 954 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED); 955 } 956 } 957 mutex_unlock(&crypt_stat->cs_mutex); 958 memcpy(&lower_ia, ia, sizeof(lower_ia)); 959 if (ia->ia_valid & ATTR_FILE) 960 lower_ia.ia_file = ecryptfs_file_to_lower(ia->ia_file); 961 if (ia->ia_valid & ATTR_SIZE) { 962 rc = truncate_upper(dentry, ia, &lower_ia); 963 if (rc < 0) 964 goto out; 965 } 966 967 /* 968 * mode change is for clearing setuid/setgid bits. Allow lower fs 969 * to interpret this in its own way. 970 */ 971 if (lower_ia.ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID)) 972 lower_ia.ia_valid &= ~ATTR_MODE; 973 974 mutex_lock(&lower_dentry->d_inode->i_mutex); 975 rc = notify_change(lower_dentry, &lower_ia); 976 mutex_unlock(&lower_dentry->d_inode->i_mutex); 977 out: 978 fsstack_copy_attr_all(inode, lower_inode); 979 return rc; 980 } 981 982 int ecryptfs_getattr_link(struct vfsmount *mnt, struct dentry *dentry, 983 struct kstat *stat) 984 { 985 struct ecryptfs_mount_crypt_stat *mount_crypt_stat; 986 int rc = 0; 987 988 mount_crypt_stat = &ecryptfs_superblock_to_private( 989 dentry->d_sb)->mount_crypt_stat; 990 generic_fillattr(dentry->d_inode, stat); 991 if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) { 992 char *target; 993 size_t targetsiz; 994 995 rc = ecryptfs_readlink_lower(dentry, &target, &targetsiz); 996 if (!rc) { 997 kfree(target); 998 stat->size = targetsiz; 999 } 1000 } 1001 return rc; 1002 } 1003 1004 int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry, 1005 struct kstat *stat) 1006 { 1007 struct kstat lower_stat; 1008 int rc; 1009 1010 rc = vfs_getattr(ecryptfs_dentry_to_lower_mnt(dentry), 1011 ecryptfs_dentry_to_lower(dentry), &lower_stat); 1012 if (!rc) { 1013 fsstack_copy_attr_all(dentry->d_inode, 1014 ecryptfs_inode_to_lower(dentry->d_inode)); 1015 generic_fillattr(dentry->d_inode, stat); 1016 stat->blocks = lower_stat.blocks; 1017 } 1018 return rc; 1019 } 1020 1021 int 1022 ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value, 1023 size_t size, int flags) 1024 { 1025 int rc = 0; 1026 struct dentry *lower_dentry; 1027 1028 lower_dentry = ecryptfs_dentry_to_lower(dentry); 1029 if (!lower_dentry->d_inode->i_op->setxattr) { 1030 rc = -EOPNOTSUPP; 1031 goto out; 1032 } 1033 1034 rc = vfs_setxattr(lower_dentry, name, value, size, flags); 1035 out: 1036 return rc; 1037 } 1038 1039 ssize_t 1040 ecryptfs_getxattr_lower(struct dentry *lower_dentry, const char *name, 1041 void *value, size_t size) 1042 { 1043 int rc = 0; 1044 1045 if (!lower_dentry->d_inode->i_op->getxattr) { 1046 rc = -EOPNOTSUPP; 1047 goto out; 1048 } 1049 mutex_lock(&lower_dentry->d_inode->i_mutex); 1050 rc = lower_dentry->d_inode->i_op->getxattr(lower_dentry, name, value, 1051 size); 1052 mutex_unlock(&lower_dentry->d_inode->i_mutex); 1053 out: 1054 return rc; 1055 } 1056 1057 static ssize_t 1058 ecryptfs_getxattr(struct dentry *dentry, const char *name, void *value, 1059 size_t size) 1060 { 1061 return ecryptfs_getxattr_lower(ecryptfs_dentry_to_lower(dentry), name, 1062 value, size); 1063 } 1064 1065 static ssize_t 1066 ecryptfs_listxattr(struct dentry *dentry, char *list, size_t size) 1067 { 1068 int rc = 0; 1069 struct dentry *lower_dentry; 1070 1071 lower_dentry = ecryptfs_dentry_to_lower(dentry); 1072 if (!lower_dentry->d_inode->i_op->listxattr) { 1073 rc = -EOPNOTSUPP; 1074 goto out; 1075 } 1076 mutex_lock(&lower_dentry->d_inode->i_mutex); 1077 rc = lower_dentry->d_inode->i_op->listxattr(lower_dentry, list, size); 1078 mutex_unlock(&lower_dentry->d_inode->i_mutex); 1079 out: 1080 return rc; 1081 } 1082 1083 static int ecryptfs_removexattr(struct dentry *dentry, const char *name) 1084 { 1085 int rc = 0; 1086 struct dentry *lower_dentry; 1087 1088 lower_dentry = ecryptfs_dentry_to_lower(dentry); 1089 if (!lower_dentry->d_inode->i_op->removexattr) { 1090 rc = -EOPNOTSUPP; 1091 goto out; 1092 } 1093 mutex_lock(&lower_dentry->d_inode->i_mutex); 1094 rc = lower_dentry->d_inode->i_op->removexattr(lower_dentry, name); 1095 mutex_unlock(&lower_dentry->d_inode->i_mutex); 1096 out: 1097 return rc; 1098 } 1099 1100 int ecryptfs_inode_test(struct inode *inode, void *candidate_lower_inode) 1101 { 1102 if ((ecryptfs_inode_to_lower(inode) 1103 == (struct inode *)candidate_lower_inode)) 1104 return 1; 1105 else 1106 return 0; 1107 } 1108 1109 int ecryptfs_inode_set(struct inode *inode, void *lower_inode) 1110 { 1111 ecryptfs_init_inode(inode, (struct inode *)lower_inode); 1112 return 0; 1113 } 1114 1115 const struct inode_operations ecryptfs_symlink_iops = { 1116 .readlink = ecryptfs_readlink, 1117 .follow_link = ecryptfs_follow_link, 1118 .put_link = ecryptfs_put_link, 1119 .permission = ecryptfs_permission, 1120 .setattr = ecryptfs_setattr, 1121 .getattr = ecryptfs_getattr_link, 1122 .setxattr = ecryptfs_setxattr, 1123 .getxattr = ecryptfs_getxattr, 1124 .listxattr = ecryptfs_listxattr, 1125 .removexattr = ecryptfs_removexattr 1126 }; 1127 1128 const struct inode_operations ecryptfs_dir_iops = { 1129 .create = ecryptfs_create, 1130 .lookup = ecryptfs_lookup, 1131 .link = ecryptfs_link, 1132 .unlink = ecryptfs_unlink, 1133 .symlink = ecryptfs_symlink, 1134 .mkdir = ecryptfs_mkdir, 1135 .rmdir = ecryptfs_rmdir, 1136 .mknod = ecryptfs_mknod, 1137 .rename = ecryptfs_rename, 1138 .permission = ecryptfs_permission, 1139 .setattr = ecryptfs_setattr, 1140 .setxattr = ecryptfs_setxattr, 1141 .getxattr = ecryptfs_getxattr, 1142 .listxattr = ecryptfs_listxattr, 1143 .removexattr = ecryptfs_removexattr 1144 }; 1145 1146 const struct inode_operations ecryptfs_main_iops = { 1147 .permission = ecryptfs_permission, 1148 .setattr = ecryptfs_setattr, 1149 .getattr = ecryptfs_getattr, 1150 .setxattr = ecryptfs_setxattr, 1151 .getxattr = ecryptfs_getxattr, 1152 .listxattr = ecryptfs_listxattr, 1153 .removexattr = ecryptfs_removexattr 1154 }; 1155