xref: /openbmc/linux/fs/ecryptfs/inode.c (revision 82ced6fd)
1 /**
2  * eCryptfs: Linux filesystem encryption layer
3  *
4  * Copyright (C) 1997-2004 Erez Zadok
5  * Copyright (C) 2001-2004 Stony Brook University
6  * Copyright (C) 2004-2007 International Business Machines Corp.
7  *   Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>
8  *              Michael C. Thompsion <mcthomps@us.ibm.com>
9  *
10  * This program is free software; you can redistribute it and/or
11  * modify it under the terms of the GNU General Public License as
12  * published by the Free Software Foundation; either version 2 of the
13  * License, or (at your option) any later version.
14  *
15  * This program is distributed in the hope that it will be useful, but
16  * WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
18  * General Public License for more details.
19  *
20  * You should have received a copy of the GNU General Public License
21  * along with this program; if not, write to the Free Software
22  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
23  * 02111-1307, USA.
24  */
25 
26 #include <linux/file.h>
27 #include <linux/vmalloc.h>
28 #include <linux/pagemap.h>
29 #include <linux/dcache.h>
30 #include <linux/namei.h>
31 #include <linux/mount.h>
32 #include <linux/crypto.h>
33 #include <linux/fs_stack.h>
34 #include <asm/unaligned.h>
35 #include "ecryptfs_kernel.h"
36 
37 static struct dentry *lock_parent(struct dentry *dentry)
38 {
39 	struct dentry *dir;
40 
41 	dir = dget_parent(dentry);
42 	mutex_lock_nested(&(dir->d_inode->i_mutex), I_MUTEX_PARENT);
43 	return dir;
44 }
45 
46 static void unlock_dir(struct dentry *dir)
47 {
48 	mutex_unlock(&dir->d_inode->i_mutex);
49 	dput(dir);
50 }
51 
52 /**
53  * ecryptfs_create_underlying_file
54  * @lower_dir_inode: inode of the parent in the lower fs of the new file
55  * @dentry: New file's dentry
56  * @mode: The mode of the new file
57  * @nd: nameidata of ecryptfs' parent's dentry & vfsmount
58  *
59  * Creates the file in the lower file system.
60  *
61  * Returns zero on success; non-zero on error condition
62  */
63 static int
64 ecryptfs_create_underlying_file(struct inode *lower_dir_inode,
65 				struct dentry *dentry, int mode,
66 				struct nameidata *nd)
67 {
68 	struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
69 	struct vfsmount *lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry);
70 	struct dentry *dentry_save;
71 	struct vfsmount *vfsmount_save;
72 	int rc;
73 
74 	dentry_save = nd->path.dentry;
75 	vfsmount_save = nd->path.mnt;
76 	nd->path.dentry = lower_dentry;
77 	nd->path.mnt = lower_mnt;
78 	rc = vfs_create(lower_dir_inode, lower_dentry, mode, nd);
79 	nd->path.dentry = dentry_save;
80 	nd->path.mnt = vfsmount_save;
81 	return rc;
82 }
83 
84 /**
85  * ecryptfs_do_create
86  * @directory_inode: inode of the new file's dentry's parent in ecryptfs
87  * @ecryptfs_dentry: New file's dentry in ecryptfs
88  * @mode: The mode of the new file
89  * @nd: nameidata of ecryptfs' parent's dentry & vfsmount
90  *
91  * Creates the underlying file and the eCryptfs inode which will link to
92  * it. It will also update the eCryptfs directory inode to mimic the
93  * stat of the lower directory inode.
94  *
95  * Returns zero on success; non-zero on error condition
96  */
97 static int
98 ecryptfs_do_create(struct inode *directory_inode,
99 		   struct dentry *ecryptfs_dentry, int mode,
100 		   struct nameidata *nd)
101 {
102 	int rc;
103 	struct dentry *lower_dentry;
104 	struct dentry *lower_dir_dentry;
105 
106 	lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
107 	lower_dir_dentry = lock_parent(lower_dentry);
108 	if (IS_ERR(lower_dir_dentry)) {
109 		ecryptfs_printk(KERN_ERR, "Error locking directory of "
110 				"dentry\n");
111 		rc = PTR_ERR(lower_dir_dentry);
112 		goto out;
113 	}
114 	rc = ecryptfs_create_underlying_file(lower_dir_dentry->d_inode,
115 					     ecryptfs_dentry, mode, nd);
116 	if (rc) {
117 		printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
118 		       "rc = [%d]\n", __func__, rc);
119 		goto out_lock;
120 	}
121 	rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
122 				directory_inode->i_sb, 0);
123 	if (rc) {
124 		ecryptfs_printk(KERN_ERR, "Failure in ecryptfs_interpose\n");
125 		goto out_lock;
126 	}
127 	fsstack_copy_attr_times(directory_inode, lower_dir_dentry->d_inode);
128 	fsstack_copy_inode_size(directory_inode, lower_dir_dentry->d_inode);
129 out_lock:
130 	unlock_dir(lower_dir_dentry);
131 out:
132 	return rc;
133 }
134 
135 /**
136  * grow_file
137  * @ecryptfs_dentry: the eCryptfs dentry
138  *
139  * This is the code which will grow the file to its correct size.
140  */
141 static int grow_file(struct dentry *ecryptfs_dentry)
142 {
143 	struct inode *ecryptfs_inode = ecryptfs_dentry->d_inode;
144 	struct file fake_file;
145 	struct ecryptfs_file_info tmp_file_info;
146 	char zero_virt[] = { 0x00 };
147 	int rc = 0;
148 
149 	memset(&fake_file, 0, sizeof(fake_file));
150 	fake_file.f_path.dentry = ecryptfs_dentry;
151 	memset(&tmp_file_info, 0, sizeof(tmp_file_info));
152 	ecryptfs_set_file_private(&fake_file, &tmp_file_info);
153 	ecryptfs_set_file_lower(
154 		&fake_file,
155 		ecryptfs_inode_to_private(ecryptfs_inode)->lower_file);
156 	rc = ecryptfs_write(&fake_file, zero_virt, 0, 1);
157 	i_size_write(ecryptfs_inode, 0);
158 	rc = ecryptfs_write_inode_size_to_metadata(ecryptfs_inode);
159 	ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat.flags |=
160 		ECRYPTFS_NEW_FILE;
161 	return rc;
162 }
163 
164 /**
165  * ecryptfs_initialize_file
166  *
167  * Cause the file to be changed from a basic empty file to an ecryptfs
168  * file with a header and first data page.
169  *
170  * Returns zero on success
171  */
172 static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry)
173 {
174 	struct ecryptfs_crypt_stat *crypt_stat =
175 		&ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->crypt_stat;
176 	int rc = 0;
177 
178 	if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
179 		ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
180 		crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
181 		goto out;
182 	}
183 	crypt_stat->flags |= ECRYPTFS_NEW_FILE;
184 	ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n");
185 	rc = ecryptfs_new_file_context(ecryptfs_dentry);
186 	if (rc) {
187 		ecryptfs_printk(KERN_ERR, "Error creating new file "
188 				"context; rc = [%d]\n", rc);
189 		goto out;
190 	}
191 	if (!ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->lower_file) {
192 		rc = ecryptfs_init_persistent_file(ecryptfs_dentry);
193 		if (rc) {
194 			printk(KERN_ERR "%s: Error attempting to initialize "
195 			       "the persistent file for the dentry with name "
196 			       "[%s]; rc = [%d]\n", __func__,
197 			       ecryptfs_dentry->d_name.name, rc);
198 			goto out;
199 		}
200 	}
201 	rc = ecryptfs_write_metadata(ecryptfs_dentry);
202 	if (rc) {
203 		printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
204 		goto out;
205 	}
206 	rc = grow_file(ecryptfs_dentry);
207 	if (rc)
208 		printk(KERN_ERR "Error growing file; rc = [%d]\n", rc);
209 out:
210 	return rc;
211 }
212 
213 /**
214  * ecryptfs_create
215  * @dir: The inode of the directory in which to create the file.
216  * @dentry: The eCryptfs dentry
217  * @mode: The mode of the new file.
218  * @nd: nameidata
219  *
220  * Creates a new file.
221  *
222  * Returns zero on success; non-zero on error condition
223  */
224 static int
225 ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry,
226 		int mode, struct nameidata *nd)
227 {
228 	int rc;
229 
230 	/* ecryptfs_do_create() calls ecryptfs_interpose() */
231 	rc = ecryptfs_do_create(directory_inode, ecryptfs_dentry, mode, nd);
232 	if (unlikely(rc)) {
233 		ecryptfs_printk(KERN_WARNING, "Failed to create file in"
234 				"lower filesystem\n");
235 		goto out;
236 	}
237 	/* At this point, a file exists on "disk"; we need to make sure
238 	 * that this on disk file is prepared to be an ecryptfs file */
239 	rc = ecryptfs_initialize_file(ecryptfs_dentry);
240 out:
241 	return rc;
242 }
243 
244 /**
245  * ecryptfs_lookup_and_interpose_lower - Perform a lookup
246  */
247 int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
248 					struct dentry *lower_dentry,
249 					struct inode *ecryptfs_dir_inode,
250 					struct nameidata *ecryptfs_nd)
251 {
252 	struct dentry *lower_dir_dentry;
253 	struct vfsmount *lower_mnt;
254 	struct inode *lower_inode;
255 	struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
256 	struct ecryptfs_crypt_stat *crypt_stat;
257 	char *page_virt = NULL;
258 	u64 file_size;
259 	int rc = 0;
260 
261 	lower_dir_dentry = lower_dentry->d_parent;
262 	lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(
263 				   ecryptfs_dentry->d_parent));
264 	lower_inode = lower_dentry->d_inode;
265 	fsstack_copy_attr_atime(ecryptfs_dir_inode, lower_dir_dentry->d_inode);
266 	BUG_ON(!atomic_read(&lower_dentry->d_count));
267 	ecryptfs_set_dentry_private(ecryptfs_dentry,
268 				    kmem_cache_alloc(ecryptfs_dentry_info_cache,
269 						     GFP_KERNEL));
270 	if (!ecryptfs_dentry_to_private(ecryptfs_dentry)) {
271 		rc = -ENOMEM;
272 		printk(KERN_ERR "%s: Out of memory whilst attempting "
273 		       "to allocate ecryptfs_dentry_info struct\n",
274 			__func__);
275 		goto out_dput;
276 	}
277 	ecryptfs_set_dentry_lower(ecryptfs_dentry, lower_dentry);
278 	ecryptfs_set_dentry_lower_mnt(ecryptfs_dentry, lower_mnt);
279 	if (!lower_dentry->d_inode) {
280 		/* We want to add because we couldn't find in lower */
281 		d_add(ecryptfs_dentry, NULL);
282 		goto out;
283 	}
284 	rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
285 				ecryptfs_dir_inode->i_sb, 1);
286 	if (rc) {
287 		printk(KERN_ERR "%s: Error interposing; rc = [%d]\n",
288 		       __func__, rc);
289 		goto out;
290 	}
291 	if (S_ISDIR(lower_inode->i_mode))
292 		goto out;
293 	if (S_ISLNK(lower_inode->i_mode))
294 		goto out;
295 	if (special_file(lower_inode->i_mode))
296 		goto out;
297 	if (!ecryptfs_nd)
298 		goto out;
299 	/* Released in this function */
300 	page_virt = kmem_cache_zalloc(ecryptfs_header_cache_2, GFP_USER);
301 	if (!page_virt) {
302 		printk(KERN_ERR "%s: Cannot kmem_cache_zalloc() a page\n",
303 		       __func__);
304 		rc = -ENOMEM;
305 		goto out;
306 	}
307 	if (!ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->lower_file) {
308 		rc = ecryptfs_init_persistent_file(ecryptfs_dentry);
309 		if (rc) {
310 			printk(KERN_ERR "%s: Error attempting to initialize "
311 			       "the persistent file for the dentry with name "
312 			       "[%s]; rc = [%d]\n", __func__,
313 			       ecryptfs_dentry->d_name.name, rc);
314 			goto out_free_kmem;
315 		}
316 	}
317 	crypt_stat = &ecryptfs_inode_to_private(
318 					ecryptfs_dentry->d_inode)->crypt_stat;
319 	/* TODO: lock for crypt_stat comparison */
320 	if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
321 			ecryptfs_set_default_sizes(crypt_stat);
322 	rc = ecryptfs_read_and_validate_header_region(page_virt,
323 						      ecryptfs_dentry->d_inode);
324 	if (rc) {
325 		rc = ecryptfs_read_and_validate_xattr_region(page_virt,
326 							     ecryptfs_dentry);
327 		if (rc) {
328 			rc = 0;
329 			goto out_free_kmem;
330 		}
331 		crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
332 	}
333 	mount_crypt_stat = &ecryptfs_superblock_to_private(
334 		ecryptfs_dentry->d_sb)->mount_crypt_stat;
335 	if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) {
336 		if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
337 			file_size = (crypt_stat->num_header_bytes_at_front
338 				     + i_size_read(lower_dentry->d_inode));
339 		else
340 			file_size = i_size_read(lower_dentry->d_inode);
341 	} else {
342 		file_size = get_unaligned_be64(page_virt);
343 	}
344 	i_size_write(ecryptfs_dentry->d_inode, (loff_t)file_size);
345 out_free_kmem:
346 	kmem_cache_free(ecryptfs_header_cache_2, page_virt);
347 	goto out;
348 out_dput:
349 	dput(lower_dentry);
350 	d_drop(ecryptfs_dentry);
351 out:
352 	return rc;
353 }
354 
355 /**
356  * ecryptfs_lookup
357  * @ecryptfs_dir_inode: The eCryptfs directory inode
358  * @ecryptfs_dentry: The eCryptfs dentry that we are looking up
359  * @ecryptfs_nd: nameidata; may be NULL
360  *
361  * Find a file on disk. If the file does not exist, then we'll add it to the
362  * dentry cache and continue on to read it from the disk.
363  */
364 static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
365 				      struct dentry *ecryptfs_dentry,
366 				      struct nameidata *ecryptfs_nd)
367 {
368 	char *encrypted_and_encoded_name = NULL;
369 	size_t encrypted_and_encoded_name_size;
370 	struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
371 	struct dentry *lower_dir_dentry, *lower_dentry;
372 	int rc = 0;
373 
374 	ecryptfs_dentry->d_op = &ecryptfs_dops;
375 	if ((ecryptfs_dentry->d_name.len == 1
376 	     && !strcmp(ecryptfs_dentry->d_name.name, "."))
377 	    || (ecryptfs_dentry->d_name.len == 2
378 		&& !strcmp(ecryptfs_dentry->d_name.name, ".."))) {
379 		goto out_d_drop;
380 	}
381 	lower_dir_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry->d_parent);
382 	mutex_lock(&lower_dir_dentry->d_inode->i_mutex);
383 	lower_dentry = lookup_one_len(ecryptfs_dentry->d_name.name,
384 				      lower_dir_dentry,
385 				      ecryptfs_dentry->d_name.len);
386 	mutex_unlock(&lower_dir_dentry->d_inode->i_mutex);
387 	if (IS_ERR(lower_dentry)) {
388 		rc = PTR_ERR(lower_dentry);
389 		printk(KERN_ERR "%s: lookup_one_len() returned [%d] on "
390 		       "lower_dentry = [%s]\n", __func__, rc,
391 		       ecryptfs_dentry->d_name.name);
392 		goto out_d_drop;
393 	}
394 	if (lower_dentry->d_inode)
395 		goto lookup_and_interpose;
396 	mount_crypt_stat = &ecryptfs_superblock_to_private(
397 				ecryptfs_dentry->d_sb)->mount_crypt_stat;
398 	if (!(mount_crypt_stat
399 	    && (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)))
400 		goto lookup_and_interpose;
401 	dput(lower_dentry);
402 	rc = ecryptfs_encrypt_and_encode_filename(
403 		&encrypted_and_encoded_name, &encrypted_and_encoded_name_size,
404 		NULL, mount_crypt_stat, ecryptfs_dentry->d_name.name,
405 		ecryptfs_dentry->d_name.len);
406 	if (rc) {
407 		printk(KERN_ERR "%s: Error attempting to encrypt and encode "
408 		       "filename; rc = [%d]\n", __func__, rc);
409 		goto out_d_drop;
410 	}
411 	mutex_lock(&lower_dir_dentry->d_inode->i_mutex);
412 	lower_dentry = lookup_one_len(encrypted_and_encoded_name,
413 				      lower_dir_dentry,
414 				      encrypted_and_encoded_name_size - 1);
415 	mutex_unlock(&lower_dir_dentry->d_inode->i_mutex);
416 	if (IS_ERR(lower_dentry)) {
417 		rc = PTR_ERR(lower_dentry);
418 		printk(KERN_ERR "%s: lookup_one_len() returned [%d] on "
419 		       "lower_dentry = [%s]\n", __func__, rc,
420 		       encrypted_and_encoded_name);
421 		goto out_d_drop;
422 	}
423 lookup_and_interpose:
424 	rc = ecryptfs_lookup_and_interpose_lower(ecryptfs_dentry, lower_dentry,
425 						 ecryptfs_dir_inode,
426 						 ecryptfs_nd);
427 	goto out;
428 out_d_drop:
429 	d_drop(ecryptfs_dentry);
430 out:
431 	kfree(encrypted_and_encoded_name);
432 	return ERR_PTR(rc);
433 }
434 
435 static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir,
436 			 struct dentry *new_dentry)
437 {
438 	struct dentry *lower_old_dentry;
439 	struct dentry *lower_new_dentry;
440 	struct dentry *lower_dir_dentry;
441 	u64 file_size_save;
442 	int rc;
443 
444 	file_size_save = i_size_read(old_dentry->d_inode);
445 	lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
446 	lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
447 	dget(lower_old_dentry);
448 	dget(lower_new_dentry);
449 	lower_dir_dentry = lock_parent(lower_new_dentry);
450 	rc = vfs_link(lower_old_dentry, lower_dir_dentry->d_inode,
451 		      lower_new_dentry);
452 	if (rc || !lower_new_dentry->d_inode)
453 		goto out_lock;
454 	rc = ecryptfs_interpose(lower_new_dentry, new_dentry, dir->i_sb, 0);
455 	if (rc)
456 		goto out_lock;
457 	fsstack_copy_attr_times(dir, lower_new_dentry->d_inode);
458 	fsstack_copy_inode_size(dir, lower_new_dentry->d_inode);
459 	old_dentry->d_inode->i_nlink =
460 		ecryptfs_inode_to_lower(old_dentry->d_inode)->i_nlink;
461 	i_size_write(new_dentry->d_inode, file_size_save);
462 out_lock:
463 	unlock_dir(lower_dir_dentry);
464 	dput(lower_new_dentry);
465 	dput(lower_old_dentry);
466 	d_drop(lower_old_dentry);
467 	d_drop(new_dentry);
468 	d_drop(old_dentry);
469 	return rc;
470 }
471 
472 static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
473 {
474 	int rc = 0;
475 	struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
476 	struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
477 	struct dentry *lower_dir_dentry;
478 
479 	lower_dir_dentry = lock_parent(lower_dentry);
480 	rc = vfs_unlink(lower_dir_inode, lower_dentry);
481 	if (rc) {
482 		printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
483 		goto out_unlock;
484 	}
485 	fsstack_copy_attr_times(dir, lower_dir_inode);
486 	dentry->d_inode->i_nlink =
487 		ecryptfs_inode_to_lower(dentry->d_inode)->i_nlink;
488 	dentry->d_inode->i_ctime = dir->i_ctime;
489 	d_drop(dentry);
490 out_unlock:
491 	unlock_dir(lower_dir_dentry);
492 	return rc;
493 }
494 
495 static int ecryptfs_symlink(struct inode *dir, struct dentry *dentry,
496 			    const char *symname)
497 {
498 	int rc;
499 	struct dentry *lower_dentry;
500 	struct dentry *lower_dir_dentry;
501 	char *encoded_symname;
502 	size_t encoded_symlen;
503 	struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
504 
505 	lower_dentry = ecryptfs_dentry_to_lower(dentry);
506 	dget(lower_dentry);
507 	lower_dir_dentry = lock_parent(lower_dentry);
508 	mount_crypt_stat = &ecryptfs_superblock_to_private(
509 		dir->i_sb)->mount_crypt_stat;
510 	rc = ecryptfs_encrypt_and_encode_filename(&encoded_symname,
511 						  &encoded_symlen,
512 						  NULL,
513 						  mount_crypt_stat, symname,
514 						  strlen(symname));
515 	if (rc)
516 		goto out_lock;
517 	rc = vfs_symlink(lower_dir_dentry->d_inode, lower_dentry,
518 			 encoded_symname);
519 	kfree(encoded_symname);
520 	if (rc || !lower_dentry->d_inode)
521 		goto out_lock;
522 	rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb, 0);
523 	if (rc)
524 		goto out_lock;
525 	fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
526 	fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
527 out_lock:
528 	unlock_dir(lower_dir_dentry);
529 	dput(lower_dentry);
530 	if (!dentry->d_inode)
531 		d_drop(dentry);
532 	return rc;
533 }
534 
535 static int ecryptfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
536 {
537 	int rc;
538 	struct dentry *lower_dentry;
539 	struct dentry *lower_dir_dentry;
540 
541 	lower_dentry = ecryptfs_dentry_to_lower(dentry);
542 	lower_dir_dentry = lock_parent(lower_dentry);
543 	rc = vfs_mkdir(lower_dir_dentry->d_inode, lower_dentry, mode);
544 	if (rc || !lower_dentry->d_inode)
545 		goto out;
546 	rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb, 0);
547 	if (rc)
548 		goto out;
549 	fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
550 	fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
551 	dir->i_nlink = lower_dir_dentry->d_inode->i_nlink;
552 out:
553 	unlock_dir(lower_dir_dentry);
554 	if (!dentry->d_inode)
555 		d_drop(dentry);
556 	return rc;
557 }
558 
559 static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry)
560 {
561 	struct dentry *lower_dentry;
562 	struct dentry *lower_dir_dentry;
563 	int rc;
564 
565 	lower_dentry = ecryptfs_dentry_to_lower(dentry);
566 	dget(dentry);
567 	lower_dir_dentry = lock_parent(lower_dentry);
568 	dget(lower_dentry);
569 	rc = vfs_rmdir(lower_dir_dentry->d_inode, lower_dentry);
570 	dput(lower_dentry);
571 	if (!rc)
572 		d_delete(lower_dentry);
573 	fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
574 	dir->i_nlink = lower_dir_dentry->d_inode->i_nlink;
575 	unlock_dir(lower_dir_dentry);
576 	if (!rc)
577 		d_drop(dentry);
578 	dput(dentry);
579 	return rc;
580 }
581 
582 static int
583 ecryptfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
584 {
585 	int rc;
586 	struct dentry *lower_dentry;
587 	struct dentry *lower_dir_dentry;
588 
589 	lower_dentry = ecryptfs_dentry_to_lower(dentry);
590 	lower_dir_dentry = lock_parent(lower_dentry);
591 	rc = vfs_mknod(lower_dir_dentry->d_inode, lower_dentry, mode, dev);
592 	if (rc || !lower_dentry->d_inode)
593 		goto out;
594 	rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb, 0);
595 	if (rc)
596 		goto out;
597 	fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
598 	fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
599 out:
600 	unlock_dir(lower_dir_dentry);
601 	if (!dentry->d_inode)
602 		d_drop(dentry);
603 	return rc;
604 }
605 
606 static int
607 ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
608 		struct inode *new_dir, struct dentry *new_dentry)
609 {
610 	int rc;
611 	struct dentry *lower_old_dentry;
612 	struct dentry *lower_new_dentry;
613 	struct dentry *lower_old_dir_dentry;
614 	struct dentry *lower_new_dir_dentry;
615 
616 	lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
617 	lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
618 	dget(lower_old_dentry);
619 	dget(lower_new_dentry);
620 	lower_old_dir_dentry = dget_parent(lower_old_dentry);
621 	lower_new_dir_dentry = dget_parent(lower_new_dentry);
622 	lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
623 	rc = vfs_rename(lower_old_dir_dentry->d_inode, lower_old_dentry,
624 			lower_new_dir_dentry->d_inode, lower_new_dentry);
625 	if (rc)
626 		goto out_lock;
627 	fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode, NULL);
628 	if (new_dir != old_dir)
629 		fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode, NULL);
630 out_lock:
631 	unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
632 	dput(lower_new_dentry->d_parent);
633 	dput(lower_old_dentry->d_parent);
634 	dput(lower_new_dentry);
635 	dput(lower_old_dentry);
636 	return rc;
637 }
638 
639 static int
640 ecryptfs_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
641 {
642 	char *lower_buf;
643 	size_t lower_bufsiz;
644 	struct dentry *lower_dentry;
645 	struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
646 	char *plaintext_name;
647 	size_t plaintext_name_size;
648 	mm_segment_t old_fs;
649 	int rc;
650 
651 	lower_dentry = ecryptfs_dentry_to_lower(dentry);
652 	if (!lower_dentry->d_inode->i_op->readlink) {
653 		rc = -EINVAL;
654 		goto out;
655 	}
656 	mount_crypt_stat = &ecryptfs_superblock_to_private(
657 						dentry->d_sb)->mount_crypt_stat;
658 	/*
659 	 * If the lower filename is encrypted, it will result in a significantly
660 	 * longer name.  If needed, truncate the name after decode and decrypt.
661 	 */
662 	if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
663 		lower_bufsiz = PATH_MAX;
664 	else
665 		lower_bufsiz = bufsiz;
666 	/* Released in this function */
667 	lower_buf = kmalloc(lower_bufsiz, GFP_KERNEL);
668 	if (lower_buf == NULL) {
669 		printk(KERN_ERR "%s: Out of memory whilst attempting to "
670 		       "kmalloc [%zd] bytes\n", __func__, lower_bufsiz);
671 		rc = -ENOMEM;
672 		goto out;
673 	}
674 	old_fs = get_fs();
675 	set_fs(get_ds());
676 	rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
677 						   (char __user *)lower_buf,
678 						   lower_bufsiz);
679 	set_fs(old_fs);
680 	if (rc >= 0) {
681 		rc = ecryptfs_decode_and_decrypt_filename(&plaintext_name,
682 							  &plaintext_name_size,
683 							  dentry, lower_buf,
684 							  rc);
685 		if (rc) {
686 			printk(KERN_ERR "%s: Error attempting to decode and "
687 			       "decrypt filename; rc = [%d]\n", __func__,
688 				rc);
689 			goto out_free_lower_buf;
690 		}
691 		/* Check for bufsiz <= 0 done in sys_readlinkat() */
692 		rc = copy_to_user(buf, plaintext_name,
693 				  min((size_t) bufsiz, plaintext_name_size));
694 		if (rc)
695 			rc = -EFAULT;
696 		else
697 			rc = plaintext_name_size;
698 		kfree(plaintext_name);
699 		fsstack_copy_attr_atime(dentry->d_inode, lower_dentry->d_inode);
700 	}
701 out_free_lower_buf:
702 	kfree(lower_buf);
703 out:
704 	return rc;
705 }
706 
707 static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
708 {
709 	char *buf;
710 	int len = PAGE_SIZE, rc;
711 	mm_segment_t old_fs;
712 
713 	/* Released in ecryptfs_put_link(); only release here on error */
714 	buf = kmalloc(len, GFP_KERNEL);
715 	if (!buf) {
716 		rc = -ENOMEM;
717 		goto out;
718 	}
719 	old_fs = get_fs();
720 	set_fs(get_ds());
721 	rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
722 	set_fs(old_fs);
723 	if (rc < 0)
724 		goto out_free;
725 	else
726 		buf[rc] = '\0';
727 	rc = 0;
728 	nd_set_link(nd, buf);
729 	goto out;
730 out_free:
731 	kfree(buf);
732 out:
733 	return ERR_PTR(rc);
734 }
735 
736 static void
737 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
738 {
739 	/* Free the char* */
740 	kfree(nd_get_link(nd));
741 }
742 
743 /**
744  * upper_size_to_lower_size
745  * @crypt_stat: Crypt_stat associated with file
746  * @upper_size: Size of the upper file
747  *
748  * Calculate the required size of the lower file based on the
749  * specified size of the upper file. This calculation is based on the
750  * number of headers in the underlying file and the extent size.
751  *
752  * Returns Calculated size of the lower file.
753  */
754 static loff_t
755 upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat,
756 			 loff_t upper_size)
757 {
758 	loff_t lower_size;
759 
760 	lower_size = crypt_stat->num_header_bytes_at_front;
761 	if (upper_size != 0) {
762 		loff_t num_extents;
763 
764 		num_extents = upper_size >> crypt_stat->extent_shift;
765 		if (upper_size & ~crypt_stat->extent_mask)
766 			num_extents++;
767 		lower_size += (num_extents * crypt_stat->extent_size);
768 	}
769 	return lower_size;
770 }
771 
772 /**
773  * ecryptfs_truncate
774  * @dentry: The ecryptfs layer dentry
775  * @new_length: The length to expand the file to
776  *
777  * Function to handle truncations modifying the size of the file. Note
778  * that the file sizes are interpolated. When expanding, we are simply
779  * writing strings of 0's out. When truncating, we need to modify the
780  * underlying file size according to the page index interpolations.
781  *
782  * Returns zero on success; non-zero otherwise
783  */
784 int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
785 {
786 	int rc = 0;
787 	struct inode *inode = dentry->d_inode;
788 	struct dentry *lower_dentry;
789 	struct file fake_ecryptfs_file;
790 	struct ecryptfs_crypt_stat *crypt_stat;
791 	loff_t i_size = i_size_read(inode);
792 	loff_t lower_size_before_truncate;
793 	loff_t lower_size_after_truncate;
794 
795 	if (unlikely((new_length == i_size)))
796 		goto out;
797 	crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
798 	/* Set up a fake ecryptfs file, this is used to interface with
799 	 * the file in the underlying filesystem so that the
800 	 * truncation has an effect there as well. */
801 	memset(&fake_ecryptfs_file, 0, sizeof(fake_ecryptfs_file));
802 	fake_ecryptfs_file.f_path.dentry = dentry;
803 	/* Released at out_free: label */
804 	ecryptfs_set_file_private(&fake_ecryptfs_file,
805 				  kmem_cache_alloc(ecryptfs_file_info_cache,
806 						   GFP_KERNEL));
807 	if (unlikely(!ecryptfs_file_to_private(&fake_ecryptfs_file))) {
808 		rc = -ENOMEM;
809 		goto out;
810 	}
811 	lower_dentry = ecryptfs_dentry_to_lower(dentry);
812 	ecryptfs_set_file_lower(
813 		&fake_ecryptfs_file,
814 		ecryptfs_inode_to_private(dentry->d_inode)->lower_file);
815 	/* Switch on growing or shrinking file */
816 	if (new_length > i_size) {
817 		char zero[] = { 0x00 };
818 
819 		/* Write a single 0 at the last position of the file;
820 		 * this triggers code that will fill in 0's throughout
821 		 * the intermediate portion of the previous end of the
822 		 * file and the new and of the file */
823 		rc = ecryptfs_write(&fake_ecryptfs_file, zero,
824 				    (new_length - 1), 1);
825 	} else { /* new_length < i_size_read(inode) */
826 		/* We're chopping off all the pages down do the page
827 		 * in which new_length is located. Fill in the end of
828 		 * that page from (new_length & ~PAGE_CACHE_MASK) to
829 		 * PAGE_CACHE_SIZE with zeros. */
830 		size_t num_zeros = (PAGE_CACHE_SIZE
831 				    - (new_length & ~PAGE_CACHE_MASK));
832 
833 		if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
834 			rc = vmtruncate(inode, new_length);
835 			if (rc)
836 				goto out_free;
837 			rc = vmtruncate(lower_dentry->d_inode, new_length);
838 			goto out_free;
839 		}
840 		if (num_zeros) {
841 			char *zeros_virt;
842 
843 			zeros_virt = kzalloc(num_zeros, GFP_KERNEL);
844 			if (!zeros_virt) {
845 				rc = -ENOMEM;
846 				goto out_free;
847 			}
848 			rc = ecryptfs_write(&fake_ecryptfs_file, zeros_virt,
849 					    new_length, num_zeros);
850 			kfree(zeros_virt);
851 			if (rc) {
852 				printk(KERN_ERR "Error attempting to zero out "
853 				       "the remainder of the end page on "
854 				       "reducing truncate; rc = [%d]\n", rc);
855 				goto out_free;
856 			}
857 		}
858 		vmtruncate(inode, new_length);
859 		rc = ecryptfs_write_inode_size_to_metadata(inode);
860 		if (rc) {
861 			printk(KERN_ERR	"Problem with "
862 			       "ecryptfs_write_inode_size_to_metadata; "
863 			       "rc = [%d]\n", rc);
864 			goto out_free;
865 		}
866 		/* We are reducing the size of the ecryptfs file, and need to
867 		 * know if we need to reduce the size of the lower file. */
868 		lower_size_before_truncate =
869 		    upper_size_to_lower_size(crypt_stat, i_size);
870 		lower_size_after_truncate =
871 		    upper_size_to_lower_size(crypt_stat, new_length);
872 		if (lower_size_after_truncate < lower_size_before_truncate)
873 			vmtruncate(lower_dentry->d_inode,
874 				   lower_size_after_truncate);
875 	}
876 out_free:
877 	if (ecryptfs_file_to_private(&fake_ecryptfs_file))
878 		kmem_cache_free(ecryptfs_file_info_cache,
879 				ecryptfs_file_to_private(&fake_ecryptfs_file));
880 out:
881 	return rc;
882 }
883 
884 static int
885 ecryptfs_permission(struct inode *inode, int mask)
886 {
887 	return inode_permission(ecryptfs_inode_to_lower(inode), mask);
888 }
889 
890 /**
891  * ecryptfs_setattr
892  * @dentry: dentry handle to the inode to modify
893  * @ia: Structure with flags of what to change and values
894  *
895  * Updates the metadata of an inode. If the update is to the size
896  * i.e. truncation, then ecryptfs_truncate will handle the size modification
897  * of both the ecryptfs inode and the lower inode.
898  *
899  * All other metadata changes will be passed right to the lower filesystem,
900  * and we will just update our inode to look like the lower.
901  */
902 static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
903 {
904 	int rc = 0;
905 	struct dentry *lower_dentry;
906 	struct inode *inode;
907 	struct inode *lower_inode;
908 	struct ecryptfs_crypt_stat *crypt_stat;
909 
910 	crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
911 	if (!(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED))
912 		ecryptfs_init_crypt_stat(crypt_stat);
913 	inode = dentry->d_inode;
914 	lower_inode = ecryptfs_inode_to_lower(inode);
915 	lower_dentry = ecryptfs_dentry_to_lower(dentry);
916 	mutex_lock(&crypt_stat->cs_mutex);
917 	if (S_ISDIR(dentry->d_inode->i_mode))
918 		crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
919 	else if (S_ISREG(dentry->d_inode->i_mode)
920 		 && (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)
921 		     || !(crypt_stat->flags & ECRYPTFS_KEY_VALID))) {
922 		struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
923 
924 		mount_crypt_stat = &ecryptfs_superblock_to_private(
925 			dentry->d_sb)->mount_crypt_stat;
926 		rc = ecryptfs_read_metadata(dentry);
927 		if (rc) {
928 			if (!(mount_crypt_stat->flags
929 			      & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
930 				rc = -EIO;
931 				printk(KERN_WARNING "Either the lower file "
932 				       "is not in a valid eCryptfs format, "
933 				       "or the key could not be retrieved. "
934 				       "Plaintext passthrough mode is not "
935 				       "enabled; returning -EIO\n");
936 				mutex_unlock(&crypt_stat->cs_mutex);
937 				goto out;
938 			}
939 			rc = 0;
940 			crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
941 		}
942 	}
943 	mutex_unlock(&crypt_stat->cs_mutex);
944 	if (ia->ia_valid & ATTR_SIZE) {
945 		ecryptfs_printk(KERN_DEBUG,
946 				"ia->ia_valid = [0x%x] ATTR_SIZE" " = [0x%x]\n",
947 				ia->ia_valid, ATTR_SIZE);
948 		rc = ecryptfs_truncate(dentry, ia->ia_size);
949 		/* ecryptfs_truncate handles resizing of the lower file */
950 		ia->ia_valid &= ~ATTR_SIZE;
951 		ecryptfs_printk(KERN_DEBUG, "ia->ia_valid = [%x]\n",
952 				ia->ia_valid);
953 		if (rc < 0)
954 			goto out;
955 	}
956 
957 	/*
958 	 * mode change is for clearing setuid/setgid bits. Allow lower fs
959 	 * to interpret this in its own way.
960 	 */
961 	if (ia->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
962 		ia->ia_valid &= ~ATTR_MODE;
963 
964 	mutex_lock(&lower_dentry->d_inode->i_mutex);
965 	rc = notify_change(lower_dentry, ia);
966 	mutex_unlock(&lower_dentry->d_inode->i_mutex);
967 out:
968 	fsstack_copy_attr_all(inode, lower_inode, NULL);
969 	return rc;
970 }
971 
972 int
973 ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
974 		  size_t size, int flags)
975 {
976 	int rc = 0;
977 	struct dentry *lower_dentry;
978 
979 	lower_dentry = ecryptfs_dentry_to_lower(dentry);
980 	if (!lower_dentry->d_inode->i_op->setxattr) {
981 		rc = -ENOSYS;
982 		goto out;
983 	}
984 	mutex_lock(&lower_dentry->d_inode->i_mutex);
985 	rc = lower_dentry->d_inode->i_op->setxattr(lower_dentry, name, value,
986 						   size, flags);
987 	mutex_unlock(&lower_dentry->d_inode->i_mutex);
988 out:
989 	return rc;
990 }
991 
992 ssize_t
993 ecryptfs_getxattr_lower(struct dentry *lower_dentry, const char *name,
994 			void *value, size_t size)
995 {
996 	int rc = 0;
997 
998 	if (!lower_dentry->d_inode->i_op->getxattr) {
999 		rc = -ENOSYS;
1000 		goto out;
1001 	}
1002 	mutex_lock(&lower_dentry->d_inode->i_mutex);
1003 	rc = lower_dentry->d_inode->i_op->getxattr(lower_dentry, name, value,
1004 						   size);
1005 	mutex_unlock(&lower_dentry->d_inode->i_mutex);
1006 out:
1007 	return rc;
1008 }
1009 
1010 static ssize_t
1011 ecryptfs_getxattr(struct dentry *dentry, const char *name, void *value,
1012 		  size_t size)
1013 {
1014 	return ecryptfs_getxattr_lower(ecryptfs_dentry_to_lower(dentry), name,
1015 				       value, size);
1016 }
1017 
1018 static ssize_t
1019 ecryptfs_listxattr(struct dentry *dentry, char *list, size_t size)
1020 {
1021 	int rc = 0;
1022 	struct dentry *lower_dentry;
1023 
1024 	lower_dentry = ecryptfs_dentry_to_lower(dentry);
1025 	if (!lower_dentry->d_inode->i_op->listxattr) {
1026 		rc = -ENOSYS;
1027 		goto out;
1028 	}
1029 	mutex_lock(&lower_dentry->d_inode->i_mutex);
1030 	rc = lower_dentry->d_inode->i_op->listxattr(lower_dentry, list, size);
1031 	mutex_unlock(&lower_dentry->d_inode->i_mutex);
1032 out:
1033 	return rc;
1034 }
1035 
1036 static int ecryptfs_removexattr(struct dentry *dentry, const char *name)
1037 {
1038 	int rc = 0;
1039 	struct dentry *lower_dentry;
1040 
1041 	lower_dentry = ecryptfs_dentry_to_lower(dentry);
1042 	if (!lower_dentry->d_inode->i_op->removexattr) {
1043 		rc = -ENOSYS;
1044 		goto out;
1045 	}
1046 	mutex_lock(&lower_dentry->d_inode->i_mutex);
1047 	rc = lower_dentry->d_inode->i_op->removexattr(lower_dentry, name);
1048 	mutex_unlock(&lower_dentry->d_inode->i_mutex);
1049 out:
1050 	return rc;
1051 }
1052 
1053 int ecryptfs_inode_test(struct inode *inode, void *candidate_lower_inode)
1054 {
1055 	if ((ecryptfs_inode_to_lower(inode)
1056 	     == (struct inode *)candidate_lower_inode))
1057 		return 1;
1058 	else
1059 		return 0;
1060 }
1061 
1062 int ecryptfs_inode_set(struct inode *inode, void *lower_inode)
1063 {
1064 	ecryptfs_init_inode(inode, (struct inode *)lower_inode);
1065 	return 0;
1066 }
1067 
1068 const struct inode_operations ecryptfs_symlink_iops = {
1069 	.readlink = ecryptfs_readlink,
1070 	.follow_link = ecryptfs_follow_link,
1071 	.put_link = ecryptfs_put_link,
1072 	.permission = ecryptfs_permission,
1073 	.setattr = ecryptfs_setattr,
1074 	.setxattr = ecryptfs_setxattr,
1075 	.getxattr = ecryptfs_getxattr,
1076 	.listxattr = ecryptfs_listxattr,
1077 	.removexattr = ecryptfs_removexattr
1078 };
1079 
1080 const struct inode_operations ecryptfs_dir_iops = {
1081 	.create = ecryptfs_create,
1082 	.lookup = ecryptfs_lookup,
1083 	.link = ecryptfs_link,
1084 	.unlink = ecryptfs_unlink,
1085 	.symlink = ecryptfs_symlink,
1086 	.mkdir = ecryptfs_mkdir,
1087 	.rmdir = ecryptfs_rmdir,
1088 	.mknod = ecryptfs_mknod,
1089 	.rename = ecryptfs_rename,
1090 	.permission = ecryptfs_permission,
1091 	.setattr = ecryptfs_setattr,
1092 	.setxattr = ecryptfs_setxattr,
1093 	.getxattr = ecryptfs_getxattr,
1094 	.listxattr = ecryptfs_listxattr,
1095 	.removexattr = ecryptfs_removexattr
1096 };
1097 
1098 const struct inode_operations ecryptfs_main_iops = {
1099 	.permission = ecryptfs_permission,
1100 	.setattr = ecryptfs_setattr,
1101 	.setxattr = ecryptfs_setxattr,
1102 	.getxattr = ecryptfs_getxattr,
1103 	.listxattr = ecryptfs_listxattr,
1104 	.removexattr = ecryptfs_removexattr
1105 };
1106