1 /** 2 * eCryptfs: Linux filesystem encryption layer 3 * 4 * Copyright (C) 1997-2004 Erez Zadok 5 * Copyright (C) 2001-2004 Stony Brook University 6 * Copyright (C) 2004-2007 International Business Machines Corp. 7 * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com> 8 * Michael C. Thompsion <mcthomps@us.ibm.com> 9 * 10 * This program is free software; you can redistribute it and/or 11 * modify it under the terms of the GNU General Public License as 12 * published by the Free Software Foundation; either version 2 of the 13 * License, or (at your option) any later version. 14 * 15 * This program is distributed in the hope that it will be useful, but 16 * WITHOUT ANY WARRANTY; without even the implied warranty of 17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 18 * General Public License for more details. 19 * 20 * You should have received a copy of the GNU General Public License 21 * along with this program; if not, write to the Free Software 22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 23 * 02111-1307, USA. 24 */ 25 26 #include <linux/file.h> 27 #include <linux/vmalloc.h> 28 #include <linux/pagemap.h> 29 #include <linux/dcache.h> 30 #include <linux/namei.h> 31 #include <linux/mount.h> 32 #include <linux/crypto.h> 33 #include <linux/fs_stack.h> 34 #include <linux/slab.h> 35 #include <asm/unaligned.h> 36 #include "ecryptfs_kernel.h" 37 38 static struct dentry *lock_parent(struct dentry *dentry) 39 { 40 struct dentry *dir; 41 42 dir = dget_parent(dentry); 43 mutex_lock_nested(&(dir->d_inode->i_mutex), I_MUTEX_PARENT); 44 return dir; 45 } 46 47 static void unlock_dir(struct dentry *dir) 48 { 49 mutex_unlock(&dir->d_inode->i_mutex); 50 dput(dir); 51 } 52 53 /** 54 * ecryptfs_create_underlying_file 55 * @lower_dir_inode: inode of the parent in the lower fs of the new file 56 * @dentry: New file's dentry 57 * @mode: The mode of the new file 58 * @nd: nameidata of ecryptfs' parent's dentry & vfsmount 59 * 60 * Creates the file in the lower file system. 61 * 62 * Returns zero on success; non-zero on error condition 63 */ 64 static int 65 ecryptfs_create_underlying_file(struct inode *lower_dir_inode, 66 struct dentry *dentry, int mode, 67 struct nameidata *nd) 68 { 69 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry); 70 struct vfsmount *lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry); 71 struct dentry *dentry_save; 72 struct vfsmount *vfsmount_save; 73 int rc; 74 75 dentry_save = nd->path.dentry; 76 vfsmount_save = nd->path.mnt; 77 nd->path.dentry = lower_dentry; 78 nd->path.mnt = lower_mnt; 79 rc = vfs_create(lower_dir_inode, lower_dentry, mode, nd); 80 nd->path.dentry = dentry_save; 81 nd->path.mnt = vfsmount_save; 82 return rc; 83 } 84 85 /** 86 * ecryptfs_do_create 87 * @directory_inode: inode of the new file's dentry's parent in ecryptfs 88 * @ecryptfs_dentry: New file's dentry in ecryptfs 89 * @mode: The mode of the new file 90 * @nd: nameidata of ecryptfs' parent's dentry & vfsmount 91 * 92 * Creates the underlying file and the eCryptfs inode which will link to 93 * it. It will also update the eCryptfs directory inode to mimic the 94 * stat of the lower directory inode. 95 * 96 * Returns zero on success; non-zero on error condition 97 */ 98 static int 99 ecryptfs_do_create(struct inode *directory_inode, 100 struct dentry *ecryptfs_dentry, int mode, 101 struct nameidata *nd) 102 { 103 int rc; 104 struct dentry *lower_dentry; 105 struct dentry *lower_dir_dentry; 106 107 lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry); 108 lower_dir_dentry = lock_parent(lower_dentry); 109 if (IS_ERR(lower_dir_dentry)) { 110 ecryptfs_printk(KERN_ERR, "Error locking directory of " 111 "dentry\n"); 112 rc = PTR_ERR(lower_dir_dentry); 113 goto out; 114 } 115 rc = ecryptfs_create_underlying_file(lower_dir_dentry->d_inode, 116 ecryptfs_dentry, mode, nd); 117 if (rc) { 118 printk(KERN_ERR "%s: Failure to create dentry in lower fs; " 119 "rc = [%d]\n", __func__, rc); 120 goto out_lock; 121 } 122 rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry, 123 directory_inode->i_sb, 0); 124 if (rc) { 125 ecryptfs_printk(KERN_ERR, "Failure in ecryptfs_interpose\n"); 126 goto out_lock; 127 } 128 fsstack_copy_attr_times(directory_inode, lower_dir_dentry->d_inode); 129 fsstack_copy_inode_size(directory_inode, lower_dir_dentry->d_inode); 130 out_lock: 131 unlock_dir(lower_dir_dentry); 132 out: 133 return rc; 134 } 135 136 /** 137 * grow_file 138 * @ecryptfs_dentry: the eCryptfs dentry 139 * 140 * This is the code which will grow the file to its correct size. 141 */ 142 static int grow_file(struct dentry *ecryptfs_dentry) 143 { 144 struct inode *ecryptfs_inode = ecryptfs_dentry->d_inode; 145 char zero_virt[] = { 0x00 }; 146 int rc = 0; 147 148 rc = ecryptfs_write(ecryptfs_inode, zero_virt, 0, 1); 149 i_size_write(ecryptfs_inode, 0); 150 rc = ecryptfs_write_inode_size_to_metadata(ecryptfs_inode); 151 ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat.flags |= 152 ECRYPTFS_NEW_FILE; 153 return rc; 154 } 155 156 /** 157 * ecryptfs_initialize_file 158 * 159 * Cause the file to be changed from a basic empty file to an ecryptfs 160 * file with a header and first data page. 161 * 162 * Returns zero on success 163 */ 164 static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry) 165 { 166 struct ecryptfs_crypt_stat *crypt_stat = 167 &ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->crypt_stat; 168 int rc = 0; 169 170 if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) { 171 ecryptfs_printk(KERN_DEBUG, "This is a directory\n"); 172 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED); 173 goto out; 174 } 175 crypt_stat->flags |= ECRYPTFS_NEW_FILE; 176 ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n"); 177 rc = ecryptfs_new_file_context(ecryptfs_dentry); 178 if (rc) { 179 ecryptfs_printk(KERN_ERR, "Error creating new file " 180 "context; rc = [%d]\n", rc); 181 goto out; 182 } 183 if (!ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->lower_file) { 184 rc = ecryptfs_init_persistent_file(ecryptfs_dentry); 185 if (rc) { 186 printk(KERN_ERR "%s: Error attempting to initialize " 187 "the persistent file for the dentry with name " 188 "[%s]; rc = [%d]\n", __func__, 189 ecryptfs_dentry->d_name.name, rc); 190 goto out; 191 } 192 } 193 rc = ecryptfs_write_metadata(ecryptfs_dentry); 194 if (rc) { 195 printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc); 196 goto out; 197 } 198 rc = grow_file(ecryptfs_dentry); 199 if (rc) 200 printk(KERN_ERR "Error growing file; rc = [%d]\n", rc); 201 out: 202 return rc; 203 } 204 205 /** 206 * ecryptfs_create 207 * @dir: The inode of the directory in which to create the file. 208 * @dentry: The eCryptfs dentry 209 * @mode: The mode of the new file. 210 * @nd: nameidata 211 * 212 * Creates a new file. 213 * 214 * Returns zero on success; non-zero on error condition 215 */ 216 static int 217 ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry, 218 int mode, struct nameidata *nd) 219 { 220 int rc; 221 222 /* ecryptfs_do_create() calls ecryptfs_interpose() */ 223 rc = ecryptfs_do_create(directory_inode, ecryptfs_dentry, mode, nd); 224 if (unlikely(rc)) { 225 ecryptfs_printk(KERN_WARNING, "Failed to create file in" 226 "lower filesystem\n"); 227 goto out; 228 } 229 /* At this point, a file exists on "disk"; we need to make sure 230 * that this on disk file is prepared to be an ecryptfs file */ 231 rc = ecryptfs_initialize_file(ecryptfs_dentry); 232 out: 233 return rc; 234 } 235 236 /** 237 * ecryptfs_lookup_and_interpose_lower - Perform a lookup 238 */ 239 int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry, 240 struct dentry *lower_dentry, 241 struct inode *ecryptfs_dir_inode, 242 struct nameidata *ecryptfs_nd) 243 { 244 struct dentry *lower_dir_dentry; 245 struct vfsmount *lower_mnt; 246 struct inode *lower_inode; 247 struct ecryptfs_mount_crypt_stat *mount_crypt_stat; 248 struct ecryptfs_crypt_stat *crypt_stat; 249 char *page_virt = NULL; 250 u64 file_size; 251 int rc = 0; 252 253 lower_dir_dentry = lower_dentry->d_parent; 254 lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt( 255 ecryptfs_dentry->d_parent)); 256 lower_inode = lower_dentry->d_inode; 257 fsstack_copy_attr_atime(ecryptfs_dir_inode, lower_dir_dentry->d_inode); 258 BUG_ON(!atomic_read(&lower_dentry->d_count)); 259 ecryptfs_set_dentry_private(ecryptfs_dentry, 260 kmem_cache_alloc(ecryptfs_dentry_info_cache, 261 GFP_KERNEL)); 262 if (!ecryptfs_dentry_to_private(ecryptfs_dentry)) { 263 rc = -ENOMEM; 264 printk(KERN_ERR "%s: Out of memory whilst attempting " 265 "to allocate ecryptfs_dentry_info struct\n", 266 __func__); 267 goto out_dput; 268 } 269 ecryptfs_set_dentry_lower(ecryptfs_dentry, lower_dentry); 270 ecryptfs_set_dentry_lower_mnt(ecryptfs_dentry, lower_mnt); 271 if (!lower_dentry->d_inode) { 272 /* We want to add because we couldn't find in lower */ 273 d_add(ecryptfs_dentry, NULL); 274 goto out; 275 } 276 rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry, 277 ecryptfs_dir_inode->i_sb, 278 ECRYPTFS_INTERPOSE_FLAG_D_ADD); 279 if (rc) { 280 printk(KERN_ERR "%s: Error interposing; rc = [%d]\n", 281 __func__, rc); 282 goto out; 283 } 284 if (S_ISDIR(lower_inode->i_mode)) 285 goto out; 286 if (S_ISLNK(lower_inode->i_mode)) 287 goto out; 288 if (special_file(lower_inode->i_mode)) 289 goto out; 290 if (!ecryptfs_nd) 291 goto out; 292 /* Released in this function */ 293 page_virt = kmem_cache_zalloc(ecryptfs_header_cache_2, GFP_USER); 294 if (!page_virt) { 295 printk(KERN_ERR "%s: Cannot kmem_cache_zalloc() a page\n", 296 __func__); 297 rc = -ENOMEM; 298 goto out; 299 } 300 if (!ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->lower_file) { 301 rc = ecryptfs_init_persistent_file(ecryptfs_dentry); 302 if (rc) { 303 printk(KERN_ERR "%s: Error attempting to initialize " 304 "the persistent file for the dentry with name " 305 "[%s]; rc = [%d]\n", __func__, 306 ecryptfs_dentry->d_name.name, rc); 307 goto out_free_kmem; 308 } 309 } 310 crypt_stat = &ecryptfs_inode_to_private( 311 ecryptfs_dentry->d_inode)->crypt_stat; 312 /* TODO: lock for crypt_stat comparison */ 313 if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)) 314 ecryptfs_set_default_sizes(crypt_stat); 315 rc = ecryptfs_read_and_validate_header_region(page_virt, 316 ecryptfs_dentry->d_inode); 317 if (rc) { 318 memset(page_virt, 0, PAGE_CACHE_SIZE); 319 rc = ecryptfs_read_and_validate_xattr_region(page_virt, 320 ecryptfs_dentry); 321 if (rc) { 322 rc = 0; 323 goto out_free_kmem; 324 } 325 crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR; 326 } 327 mount_crypt_stat = &ecryptfs_superblock_to_private( 328 ecryptfs_dentry->d_sb)->mount_crypt_stat; 329 if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) { 330 if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) 331 file_size = (crypt_stat->metadata_size 332 + i_size_read(lower_dentry->d_inode)); 333 else 334 file_size = i_size_read(lower_dentry->d_inode); 335 } else { 336 file_size = get_unaligned_be64(page_virt); 337 } 338 i_size_write(ecryptfs_dentry->d_inode, (loff_t)file_size); 339 out_free_kmem: 340 kmem_cache_free(ecryptfs_header_cache_2, page_virt); 341 goto out; 342 out_dput: 343 dput(lower_dentry); 344 d_drop(ecryptfs_dentry); 345 out: 346 return rc; 347 } 348 349 /** 350 * ecryptfs_lookup 351 * @ecryptfs_dir_inode: The eCryptfs directory inode 352 * @ecryptfs_dentry: The eCryptfs dentry that we are looking up 353 * @ecryptfs_nd: nameidata; may be NULL 354 * 355 * Find a file on disk. If the file does not exist, then we'll add it to the 356 * dentry cache and continue on to read it from the disk. 357 */ 358 static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode, 359 struct dentry *ecryptfs_dentry, 360 struct nameidata *ecryptfs_nd) 361 { 362 char *encrypted_and_encoded_name = NULL; 363 size_t encrypted_and_encoded_name_size; 364 struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL; 365 struct dentry *lower_dir_dentry, *lower_dentry; 366 int rc = 0; 367 368 ecryptfs_dentry->d_op = &ecryptfs_dops; 369 if ((ecryptfs_dentry->d_name.len == 1 370 && !strcmp(ecryptfs_dentry->d_name.name, ".")) 371 || (ecryptfs_dentry->d_name.len == 2 372 && !strcmp(ecryptfs_dentry->d_name.name, ".."))) { 373 goto out_d_drop; 374 } 375 lower_dir_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry->d_parent); 376 mutex_lock(&lower_dir_dentry->d_inode->i_mutex); 377 lower_dentry = lookup_one_len(ecryptfs_dentry->d_name.name, 378 lower_dir_dentry, 379 ecryptfs_dentry->d_name.len); 380 mutex_unlock(&lower_dir_dentry->d_inode->i_mutex); 381 if (IS_ERR(lower_dentry)) { 382 rc = PTR_ERR(lower_dentry); 383 ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned " 384 "[%d] on lower_dentry = [%s]\n", __func__, rc, 385 encrypted_and_encoded_name); 386 goto out_d_drop; 387 } 388 if (lower_dentry->d_inode) 389 goto lookup_and_interpose; 390 mount_crypt_stat = &ecryptfs_superblock_to_private( 391 ecryptfs_dentry->d_sb)->mount_crypt_stat; 392 if (!(mount_crypt_stat 393 && (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES))) 394 goto lookup_and_interpose; 395 dput(lower_dentry); 396 rc = ecryptfs_encrypt_and_encode_filename( 397 &encrypted_and_encoded_name, &encrypted_and_encoded_name_size, 398 NULL, mount_crypt_stat, ecryptfs_dentry->d_name.name, 399 ecryptfs_dentry->d_name.len); 400 if (rc) { 401 printk(KERN_ERR "%s: Error attempting to encrypt and encode " 402 "filename; rc = [%d]\n", __func__, rc); 403 goto out_d_drop; 404 } 405 mutex_lock(&lower_dir_dentry->d_inode->i_mutex); 406 lower_dentry = lookup_one_len(encrypted_and_encoded_name, 407 lower_dir_dentry, 408 encrypted_and_encoded_name_size - 1); 409 mutex_unlock(&lower_dir_dentry->d_inode->i_mutex); 410 if (IS_ERR(lower_dentry)) { 411 rc = PTR_ERR(lower_dentry); 412 ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned " 413 "[%d] on lower_dentry = [%s]\n", __func__, rc, 414 encrypted_and_encoded_name); 415 goto out_d_drop; 416 } 417 lookup_and_interpose: 418 rc = ecryptfs_lookup_and_interpose_lower(ecryptfs_dentry, lower_dentry, 419 ecryptfs_dir_inode, 420 ecryptfs_nd); 421 goto out; 422 out_d_drop: 423 d_drop(ecryptfs_dentry); 424 out: 425 kfree(encrypted_and_encoded_name); 426 return ERR_PTR(rc); 427 } 428 429 static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir, 430 struct dentry *new_dentry) 431 { 432 struct dentry *lower_old_dentry; 433 struct dentry *lower_new_dentry; 434 struct dentry *lower_dir_dentry; 435 u64 file_size_save; 436 int rc; 437 438 file_size_save = i_size_read(old_dentry->d_inode); 439 lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry); 440 lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry); 441 dget(lower_old_dentry); 442 dget(lower_new_dentry); 443 lower_dir_dentry = lock_parent(lower_new_dentry); 444 rc = vfs_link(lower_old_dentry, lower_dir_dentry->d_inode, 445 lower_new_dentry); 446 if (rc || !lower_new_dentry->d_inode) 447 goto out_lock; 448 rc = ecryptfs_interpose(lower_new_dentry, new_dentry, dir->i_sb, 0); 449 if (rc) 450 goto out_lock; 451 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 452 fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode); 453 old_dentry->d_inode->i_nlink = 454 ecryptfs_inode_to_lower(old_dentry->d_inode)->i_nlink; 455 i_size_write(new_dentry->d_inode, file_size_save); 456 out_lock: 457 unlock_dir(lower_dir_dentry); 458 dput(lower_new_dentry); 459 dput(lower_old_dentry); 460 return rc; 461 } 462 463 static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry) 464 { 465 int rc = 0; 466 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry); 467 struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir); 468 struct dentry *lower_dir_dentry; 469 470 dget(lower_dentry); 471 lower_dir_dentry = lock_parent(lower_dentry); 472 rc = vfs_unlink(lower_dir_inode, lower_dentry); 473 if (rc) { 474 printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc); 475 goto out_unlock; 476 } 477 fsstack_copy_attr_times(dir, lower_dir_inode); 478 dentry->d_inode->i_nlink = 479 ecryptfs_inode_to_lower(dentry->d_inode)->i_nlink; 480 dentry->d_inode->i_ctime = dir->i_ctime; 481 d_drop(dentry); 482 out_unlock: 483 unlock_dir(lower_dir_dentry); 484 dput(lower_dentry); 485 return rc; 486 } 487 488 static int ecryptfs_symlink(struct inode *dir, struct dentry *dentry, 489 const char *symname) 490 { 491 int rc; 492 struct dentry *lower_dentry; 493 struct dentry *lower_dir_dentry; 494 char *encoded_symname; 495 size_t encoded_symlen; 496 struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL; 497 498 lower_dentry = ecryptfs_dentry_to_lower(dentry); 499 dget(lower_dentry); 500 lower_dir_dentry = lock_parent(lower_dentry); 501 mount_crypt_stat = &ecryptfs_superblock_to_private( 502 dir->i_sb)->mount_crypt_stat; 503 rc = ecryptfs_encrypt_and_encode_filename(&encoded_symname, 504 &encoded_symlen, 505 NULL, 506 mount_crypt_stat, symname, 507 strlen(symname)); 508 if (rc) 509 goto out_lock; 510 rc = vfs_symlink(lower_dir_dentry->d_inode, lower_dentry, 511 encoded_symname); 512 kfree(encoded_symname); 513 if (rc || !lower_dentry->d_inode) 514 goto out_lock; 515 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb, 0); 516 if (rc) 517 goto out_lock; 518 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 519 fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode); 520 out_lock: 521 unlock_dir(lower_dir_dentry); 522 dput(lower_dentry); 523 if (!dentry->d_inode) 524 d_drop(dentry); 525 return rc; 526 } 527 528 static int ecryptfs_mkdir(struct inode *dir, struct dentry *dentry, int mode) 529 { 530 int rc; 531 struct dentry *lower_dentry; 532 struct dentry *lower_dir_dentry; 533 534 lower_dentry = ecryptfs_dentry_to_lower(dentry); 535 lower_dir_dentry = lock_parent(lower_dentry); 536 rc = vfs_mkdir(lower_dir_dentry->d_inode, lower_dentry, mode); 537 if (rc || !lower_dentry->d_inode) 538 goto out; 539 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb, 0); 540 if (rc) 541 goto out; 542 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 543 fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode); 544 dir->i_nlink = lower_dir_dentry->d_inode->i_nlink; 545 out: 546 unlock_dir(lower_dir_dentry); 547 if (!dentry->d_inode) 548 d_drop(dentry); 549 return rc; 550 } 551 552 static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry) 553 { 554 struct dentry *lower_dentry; 555 struct dentry *lower_dir_dentry; 556 int rc; 557 558 lower_dentry = ecryptfs_dentry_to_lower(dentry); 559 dget(dentry); 560 lower_dir_dentry = lock_parent(lower_dentry); 561 dget(lower_dentry); 562 rc = vfs_rmdir(lower_dir_dentry->d_inode, lower_dentry); 563 dput(lower_dentry); 564 if (!rc) 565 d_delete(lower_dentry); 566 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 567 dir->i_nlink = lower_dir_dentry->d_inode->i_nlink; 568 unlock_dir(lower_dir_dentry); 569 if (!rc) 570 d_drop(dentry); 571 dput(dentry); 572 return rc; 573 } 574 575 static int 576 ecryptfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev) 577 { 578 int rc; 579 struct dentry *lower_dentry; 580 struct dentry *lower_dir_dentry; 581 582 lower_dentry = ecryptfs_dentry_to_lower(dentry); 583 lower_dir_dentry = lock_parent(lower_dentry); 584 rc = vfs_mknod(lower_dir_dentry->d_inode, lower_dentry, mode, dev); 585 if (rc || !lower_dentry->d_inode) 586 goto out; 587 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb, 0); 588 if (rc) 589 goto out; 590 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 591 fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode); 592 out: 593 unlock_dir(lower_dir_dentry); 594 if (!dentry->d_inode) 595 d_drop(dentry); 596 return rc; 597 } 598 599 static int 600 ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry, 601 struct inode *new_dir, struct dentry *new_dentry) 602 { 603 int rc; 604 struct dentry *lower_old_dentry; 605 struct dentry *lower_new_dentry; 606 struct dentry *lower_old_dir_dentry; 607 struct dentry *lower_new_dir_dentry; 608 struct dentry *trap = NULL; 609 610 lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry); 611 lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry); 612 dget(lower_old_dentry); 613 dget(lower_new_dentry); 614 lower_old_dir_dentry = dget_parent(lower_old_dentry); 615 lower_new_dir_dentry = dget_parent(lower_new_dentry); 616 trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry); 617 /* source should not be ancestor of target */ 618 if (trap == lower_old_dentry) { 619 rc = -EINVAL; 620 goto out_lock; 621 } 622 /* target should not be ancestor of source */ 623 if (trap == lower_new_dentry) { 624 rc = -ENOTEMPTY; 625 goto out_lock; 626 } 627 rc = vfs_rename(lower_old_dir_dentry->d_inode, lower_old_dentry, 628 lower_new_dir_dentry->d_inode, lower_new_dentry); 629 if (rc) 630 goto out_lock; 631 fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode); 632 if (new_dir != old_dir) 633 fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode); 634 out_lock: 635 unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry); 636 dput(lower_new_dentry->d_parent); 637 dput(lower_old_dentry->d_parent); 638 dput(lower_new_dentry); 639 dput(lower_old_dentry); 640 return rc; 641 } 642 643 static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf, 644 size_t *bufsiz) 645 { 646 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry); 647 char *lower_buf; 648 size_t lower_bufsiz = PATH_MAX; 649 mm_segment_t old_fs; 650 int rc; 651 652 lower_buf = kmalloc(lower_bufsiz, GFP_KERNEL); 653 if (!lower_buf) { 654 rc = -ENOMEM; 655 goto out; 656 } 657 old_fs = get_fs(); 658 set_fs(get_ds()); 659 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry, 660 (char __user *)lower_buf, 661 lower_bufsiz); 662 set_fs(old_fs); 663 if (rc < 0) 664 goto out; 665 lower_bufsiz = rc; 666 rc = ecryptfs_decode_and_decrypt_filename(buf, bufsiz, dentry, 667 lower_buf, lower_bufsiz); 668 out: 669 kfree(lower_buf); 670 return rc; 671 } 672 673 static int 674 ecryptfs_readlink(struct dentry *dentry, char __user *buf, int bufsiz) 675 { 676 char *kbuf; 677 size_t kbufsiz, copied; 678 int rc; 679 680 rc = ecryptfs_readlink_lower(dentry, &kbuf, &kbufsiz); 681 if (rc) 682 goto out; 683 copied = min_t(size_t, bufsiz, kbufsiz); 684 rc = copy_to_user(buf, kbuf, copied) ? -EFAULT : copied; 685 kfree(kbuf); 686 fsstack_copy_attr_atime(dentry->d_inode, 687 ecryptfs_dentry_to_lower(dentry)->d_inode); 688 out: 689 return rc; 690 } 691 692 static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd) 693 { 694 char *buf; 695 int len = PAGE_SIZE, rc; 696 mm_segment_t old_fs; 697 698 /* Released in ecryptfs_put_link(); only release here on error */ 699 buf = kmalloc(len, GFP_KERNEL); 700 if (!buf) { 701 buf = ERR_PTR(-ENOMEM); 702 goto out; 703 } 704 old_fs = get_fs(); 705 set_fs(get_ds()); 706 rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len); 707 set_fs(old_fs); 708 if (rc < 0) { 709 kfree(buf); 710 buf = ERR_PTR(rc); 711 } else 712 buf[rc] = '\0'; 713 out: 714 nd_set_link(nd, buf); 715 return NULL; 716 } 717 718 static void 719 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr) 720 { 721 char *buf = nd_get_link(nd); 722 if (!IS_ERR(buf)) { 723 /* Free the char* */ 724 kfree(buf); 725 } 726 } 727 728 /** 729 * upper_size_to_lower_size 730 * @crypt_stat: Crypt_stat associated with file 731 * @upper_size: Size of the upper file 732 * 733 * Calculate the required size of the lower file based on the 734 * specified size of the upper file. This calculation is based on the 735 * number of headers in the underlying file and the extent size. 736 * 737 * Returns Calculated size of the lower file. 738 */ 739 static loff_t 740 upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat, 741 loff_t upper_size) 742 { 743 loff_t lower_size; 744 745 lower_size = ecryptfs_lower_header_size(crypt_stat); 746 if (upper_size != 0) { 747 loff_t num_extents; 748 749 num_extents = upper_size >> crypt_stat->extent_shift; 750 if (upper_size & ~crypt_stat->extent_mask) 751 num_extents++; 752 lower_size += (num_extents * crypt_stat->extent_size); 753 } 754 return lower_size; 755 } 756 757 /** 758 * truncate_upper 759 * @dentry: The ecryptfs layer dentry 760 * @ia: Address of the ecryptfs inode's attributes 761 * @lower_ia: Address of the lower inode's attributes 762 * 763 * Function to handle truncations modifying the size of the file. Note 764 * that the file sizes are interpolated. When expanding, we are simply 765 * writing strings of 0's out. When truncating, we truncate the upper 766 * inode and update the lower_ia according to the page index 767 * interpolations. If ATTR_SIZE is set in lower_ia->ia_valid upon return, 768 * the caller must use lower_ia in a call to notify_change() to perform 769 * the truncation of the lower inode. 770 * 771 * Returns zero on success; non-zero otherwise 772 */ 773 static int truncate_upper(struct dentry *dentry, struct iattr *ia, 774 struct iattr *lower_ia) 775 { 776 int rc = 0; 777 struct inode *inode = dentry->d_inode; 778 struct ecryptfs_crypt_stat *crypt_stat; 779 loff_t i_size = i_size_read(inode); 780 loff_t lower_size_before_truncate; 781 loff_t lower_size_after_truncate; 782 783 if (unlikely((ia->ia_size == i_size))) { 784 lower_ia->ia_valid &= ~ATTR_SIZE; 785 goto out; 786 } 787 crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat; 788 /* Switch on growing or shrinking file */ 789 if (ia->ia_size > i_size) { 790 char zero[] = { 0x00 }; 791 792 lower_ia->ia_valid &= ~ATTR_SIZE; 793 /* Write a single 0 at the last position of the file; 794 * this triggers code that will fill in 0's throughout 795 * the intermediate portion of the previous end of the 796 * file and the new and of the file */ 797 rc = ecryptfs_write(inode, zero, 798 (ia->ia_size - 1), 1); 799 } else { /* ia->ia_size < i_size_read(inode) */ 800 /* We're chopping off all the pages down to the page 801 * in which ia->ia_size is located. Fill in the end of 802 * that page from (ia->ia_size & ~PAGE_CACHE_MASK) to 803 * PAGE_CACHE_SIZE with zeros. */ 804 size_t num_zeros = (PAGE_CACHE_SIZE 805 - (ia->ia_size & ~PAGE_CACHE_MASK)); 806 807 if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) { 808 rc = simple_setsize(inode, ia->ia_size); 809 if (rc) 810 goto out; 811 lower_ia->ia_size = ia->ia_size; 812 lower_ia->ia_valid |= ATTR_SIZE; 813 goto out; 814 } 815 if (num_zeros) { 816 char *zeros_virt; 817 818 zeros_virt = kzalloc(num_zeros, GFP_KERNEL); 819 if (!zeros_virt) { 820 rc = -ENOMEM; 821 goto out; 822 } 823 rc = ecryptfs_write(inode, zeros_virt, 824 ia->ia_size, num_zeros); 825 kfree(zeros_virt); 826 if (rc) { 827 printk(KERN_ERR "Error attempting to zero out " 828 "the remainder of the end page on " 829 "reducing truncate; rc = [%d]\n", rc); 830 goto out; 831 } 832 } 833 simple_setsize(inode, ia->ia_size); 834 rc = ecryptfs_write_inode_size_to_metadata(inode); 835 if (rc) { 836 printk(KERN_ERR "Problem with " 837 "ecryptfs_write_inode_size_to_metadata; " 838 "rc = [%d]\n", rc); 839 goto out; 840 } 841 /* We are reducing the size of the ecryptfs file, and need to 842 * know if we need to reduce the size of the lower file. */ 843 lower_size_before_truncate = 844 upper_size_to_lower_size(crypt_stat, i_size); 845 lower_size_after_truncate = 846 upper_size_to_lower_size(crypt_stat, ia->ia_size); 847 if (lower_size_after_truncate < lower_size_before_truncate) { 848 lower_ia->ia_size = lower_size_after_truncate; 849 lower_ia->ia_valid |= ATTR_SIZE; 850 } else 851 lower_ia->ia_valid &= ~ATTR_SIZE; 852 } 853 out: 854 return rc; 855 } 856 857 /** 858 * ecryptfs_truncate 859 * @dentry: The ecryptfs layer dentry 860 * @new_length: The length to expand the file to 861 * 862 * Simple function that handles the truncation of an eCryptfs inode and 863 * its corresponding lower inode. 864 * 865 * Returns zero on success; non-zero otherwise 866 */ 867 int ecryptfs_truncate(struct dentry *dentry, loff_t new_length) 868 { 869 struct iattr ia = { .ia_valid = ATTR_SIZE, .ia_size = new_length }; 870 struct iattr lower_ia = { .ia_valid = 0 }; 871 int rc; 872 873 rc = truncate_upper(dentry, &ia, &lower_ia); 874 if (!rc && lower_ia.ia_valid & ATTR_SIZE) { 875 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry); 876 877 mutex_lock(&lower_dentry->d_inode->i_mutex); 878 rc = notify_change(lower_dentry, &lower_ia); 879 mutex_unlock(&lower_dentry->d_inode->i_mutex); 880 } 881 return rc; 882 } 883 884 static int 885 ecryptfs_permission(struct inode *inode, int mask) 886 { 887 return inode_permission(ecryptfs_inode_to_lower(inode), mask); 888 } 889 890 /** 891 * ecryptfs_setattr 892 * @dentry: dentry handle to the inode to modify 893 * @ia: Structure with flags of what to change and values 894 * 895 * Updates the metadata of an inode. If the update is to the size 896 * i.e. truncation, then ecryptfs_truncate will handle the size modification 897 * of both the ecryptfs inode and the lower inode. 898 * 899 * All other metadata changes will be passed right to the lower filesystem, 900 * and we will just update our inode to look like the lower. 901 */ 902 static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia) 903 { 904 int rc = 0; 905 struct dentry *lower_dentry; 906 struct iattr lower_ia; 907 struct inode *inode; 908 struct inode *lower_inode; 909 struct ecryptfs_crypt_stat *crypt_stat; 910 911 crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat; 912 if (!(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)) 913 ecryptfs_init_crypt_stat(crypt_stat); 914 inode = dentry->d_inode; 915 lower_inode = ecryptfs_inode_to_lower(inode); 916 lower_dentry = ecryptfs_dentry_to_lower(dentry); 917 mutex_lock(&crypt_stat->cs_mutex); 918 if (S_ISDIR(dentry->d_inode->i_mode)) 919 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED); 920 else if (S_ISREG(dentry->d_inode->i_mode) 921 && (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED) 922 || !(crypt_stat->flags & ECRYPTFS_KEY_VALID))) { 923 struct ecryptfs_mount_crypt_stat *mount_crypt_stat; 924 925 mount_crypt_stat = &ecryptfs_superblock_to_private( 926 dentry->d_sb)->mount_crypt_stat; 927 rc = ecryptfs_read_metadata(dentry); 928 if (rc) { 929 if (!(mount_crypt_stat->flags 930 & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) { 931 rc = -EIO; 932 printk(KERN_WARNING "Either the lower file " 933 "is not in a valid eCryptfs format, " 934 "or the key could not be retrieved. " 935 "Plaintext passthrough mode is not " 936 "enabled; returning -EIO\n"); 937 mutex_unlock(&crypt_stat->cs_mutex); 938 goto out; 939 } 940 rc = 0; 941 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED); 942 } 943 } 944 mutex_unlock(&crypt_stat->cs_mutex); 945 memcpy(&lower_ia, ia, sizeof(lower_ia)); 946 if (ia->ia_valid & ATTR_FILE) 947 lower_ia.ia_file = ecryptfs_file_to_lower(ia->ia_file); 948 if (ia->ia_valid & ATTR_SIZE) { 949 rc = truncate_upper(dentry, ia, &lower_ia); 950 if (rc < 0) 951 goto out; 952 } 953 954 /* 955 * mode change is for clearing setuid/setgid bits. Allow lower fs 956 * to interpret this in its own way. 957 */ 958 if (lower_ia.ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID)) 959 lower_ia.ia_valid &= ~ATTR_MODE; 960 961 mutex_lock(&lower_dentry->d_inode->i_mutex); 962 rc = notify_change(lower_dentry, &lower_ia); 963 mutex_unlock(&lower_dentry->d_inode->i_mutex); 964 out: 965 fsstack_copy_attr_all(inode, lower_inode); 966 return rc; 967 } 968 969 int ecryptfs_getattr_link(struct vfsmount *mnt, struct dentry *dentry, 970 struct kstat *stat) 971 { 972 struct ecryptfs_mount_crypt_stat *mount_crypt_stat; 973 int rc = 0; 974 975 mount_crypt_stat = &ecryptfs_superblock_to_private( 976 dentry->d_sb)->mount_crypt_stat; 977 generic_fillattr(dentry->d_inode, stat); 978 if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) { 979 char *target; 980 size_t targetsiz; 981 982 rc = ecryptfs_readlink_lower(dentry, &target, &targetsiz); 983 if (!rc) { 984 kfree(target); 985 stat->size = targetsiz; 986 } 987 } 988 return rc; 989 } 990 991 int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry, 992 struct kstat *stat) 993 { 994 struct kstat lower_stat; 995 int rc; 996 997 rc = vfs_getattr(ecryptfs_dentry_to_lower_mnt(dentry), 998 ecryptfs_dentry_to_lower(dentry), &lower_stat); 999 if (!rc) { 1000 generic_fillattr(dentry->d_inode, stat); 1001 stat->blocks = lower_stat.blocks; 1002 } 1003 return rc; 1004 } 1005 1006 int 1007 ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value, 1008 size_t size, int flags) 1009 { 1010 int rc = 0; 1011 struct dentry *lower_dentry; 1012 1013 lower_dentry = ecryptfs_dentry_to_lower(dentry); 1014 if (!lower_dentry->d_inode->i_op->setxattr) { 1015 rc = -EOPNOTSUPP; 1016 goto out; 1017 } 1018 mutex_lock(&lower_dentry->d_inode->i_mutex); 1019 rc = lower_dentry->d_inode->i_op->setxattr(lower_dentry, name, value, 1020 size, flags); 1021 mutex_unlock(&lower_dentry->d_inode->i_mutex); 1022 out: 1023 return rc; 1024 } 1025 1026 ssize_t 1027 ecryptfs_getxattr_lower(struct dentry *lower_dentry, const char *name, 1028 void *value, size_t size) 1029 { 1030 int rc = 0; 1031 1032 if (!lower_dentry->d_inode->i_op->getxattr) { 1033 rc = -EOPNOTSUPP; 1034 goto out; 1035 } 1036 mutex_lock(&lower_dentry->d_inode->i_mutex); 1037 rc = lower_dentry->d_inode->i_op->getxattr(lower_dentry, name, value, 1038 size); 1039 mutex_unlock(&lower_dentry->d_inode->i_mutex); 1040 out: 1041 return rc; 1042 } 1043 1044 static ssize_t 1045 ecryptfs_getxattr(struct dentry *dentry, const char *name, void *value, 1046 size_t size) 1047 { 1048 return ecryptfs_getxattr_lower(ecryptfs_dentry_to_lower(dentry), name, 1049 value, size); 1050 } 1051 1052 static ssize_t 1053 ecryptfs_listxattr(struct dentry *dentry, char *list, size_t size) 1054 { 1055 int rc = 0; 1056 struct dentry *lower_dentry; 1057 1058 lower_dentry = ecryptfs_dentry_to_lower(dentry); 1059 if (!lower_dentry->d_inode->i_op->listxattr) { 1060 rc = -EOPNOTSUPP; 1061 goto out; 1062 } 1063 mutex_lock(&lower_dentry->d_inode->i_mutex); 1064 rc = lower_dentry->d_inode->i_op->listxattr(lower_dentry, list, size); 1065 mutex_unlock(&lower_dentry->d_inode->i_mutex); 1066 out: 1067 return rc; 1068 } 1069 1070 static int ecryptfs_removexattr(struct dentry *dentry, const char *name) 1071 { 1072 int rc = 0; 1073 struct dentry *lower_dentry; 1074 1075 lower_dentry = ecryptfs_dentry_to_lower(dentry); 1076 if (!lower_dentry->d_inode->i_op->removexattr) { 1077 rc = -EOPNOTSUPP; 1078 goto out; 1079 } 1080 mutex_lock(&lower_dentry->d_inode->i_mutex); 1081 rc = lower_dentry->d_inode->i_op->removexattr(lower_dentry, name); 1082 mutex_unlock(&lower_dentry->d_inode->i_mutex); 1083 out: 1084 return rc; 1085 } 1086 1087 int ecryptfs_inode_test(struct inode *inode, void *candidate_lower_inode) 1088 { 1089 if ((ecryptfs_inode_to_lower(inode) 1090 == (struct inode *)candidate_lower_inode)) 1091 return 1; 1092 else 1093 return 0; 1094 } 1095 1096 int ecryptfs_inode_set(struct inode *inode, void *lower_inode) 1097 { 1098 ecryptfs_init_inode(inode, (struct inode *)lower_inode); 1099 return 0; 1100 } 1101 1102 const struct inode_operations ecryptfs_symlink_iops = { 1103 .readlink = ecryptfs_readlink, 1104 .follow_link = ecryptfs_follow_link, 1105 .put_link = ecryptfs_put_link, 1106 .permission = ecryptfs_permission, 1107 .setattr = ecryptfs_setattr, 1108 .getattr = ecryptfs_getattr_link, 1109 .setxattr = ecryptfs_setxattr, 1110 .getxattr = ecryptfs_getxattr, 1111 .listxattr = ecryptfs_listxattr, 1112 .removexattr = ecryptfs_removexattr 1113 }; 1114 1115 const struct inode_operations ecryptfs_dir_iops = { 1116 .create = ecryptfs_create, 1117 .lookup = ecryptfs_lookup, 1118 .link = ecryptfs_link, 1119 .unlink = ecryptfs_unlink, 1120 .symlink = ecryptfs_symlink, 1121 .mkdir = ecryptfs_mkdir, 1122 .rmdir = ecryptfs_rmdir, 1123 .mknod = ecryptfs_mknod, 1124 .rename = ecryptfs_rename, 1125 .permission = ecryptfs_permission, 1126 .setattr = ecryptfs_setattr, 1127 .setxattr = ecryptfs_setxattr, 1128 .getxattr = ecryptfs_getxattr, 1129 .listxattr = ecryptfs_listxattr, 1130 .removexattr = ecryptfs_removexattr 1131 }; 1132 1133 const struct inode_operations ecryptfs_main_iops = { 1134 .permission = ecryptfs_permission, 1135 .setattr = ecryptfs_setattr, 1136 .getattr = ecryptfs_getattr, 1137 .setxattr = ecryptfs_setxattr, 1138 .getxattr = ecryptfs_getxattr, 1139 .listxattr = ecryptfs_listxattr, 1140 .removexattr = ecryptfs_removexattr 1141 }; 1142