1 /** 2 * eCryptfs: Linux filesystem encryption layer 3 * 4 * Copyright (C) 1997-2003 Erez Zadok 5 * Copyright (C) 2001-2003 Stony Brook University 6 * Copyright (C) 2004-2007 International Business Machines Corp. 7 * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com> 8 * Michael C. Thompson <mcthomps@us.ibm.com> 9 * Tyler Hicks <tyhicks@ou.edu> 10 * 11 * This program is free software; you can redistribute it and/or 12 * modify it under the terms of the GNU General Public License as 13 * published by the Free Software Foundation; either version 2 of the 14 * License, or (at your option) any later version. 15 * 16 * This program is distributed in the hope that it will be useful, but 17 * WITHOUT ANY WARRANTY; without even the implied warranty of 18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 19 * General Public License for more details. 20 * 21 * You should have received a copy of the GNU General Public License 22 * along with this program; if not, write to the Free Software 23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 24 * 02111-1307, USA. 25 */ 26 27 #include <linux/dcache.h> 28 #include <linux/file.h> 29 #include <linux/module.h> 30 #include <linux/namei.h> 31 #include <linux/skbuff.h> 32 #include <linux/crypto.h> 33 #include <linux/netlink.h> 34 #include <linux/mount.h> 35 #include <linux/pagemap.h> 36 #include <linux/key.h> 37 #include <linux/parser.h> 38 #include <linux/fs_stack.h> 39 #include "ecryptfs_kernel.h" 40 41 /** 42 * Module parameter that defines the ecryptfs_verbosity level. 43 */ 44 int ecryptfs_verbosity = 0; 45 46 module_param(ecryptfs_verbosity, int, 0); 47 MODULE_PARM_DESC(ecryptfs_verbosity, 48 "Initial verbosity level (0 or 1; defaults to " 49 "0, which is Quiet)"); 50 51 /** 52 * Module parameter that defines the number of netlink message buffer 53 * elements 54 */ 55 unsigned int ecryptfs_message_buf_len = ECRYPTFS_DEFAULT_MSG_CTX_ELEMS; 56 57 module_param(ecryptfs_message_buf_len, uint, 0); 58 MODULE_PARM_DESC(ecryptfs_message_buf_len, 59 "Number of message buffer elements"); 60 61 /** 62 * Module parameter that defines the maximum guaranteed amount of time to wait 63 * for a response through netlink. The actual sleep time will be, more than 64 * likely, a small amount greater than this specified value, but only less if 65 * the netlink message successfully arrives. 66 */ 67 signed long ecryptfs_message_wait_timeout = ECRYPTFS_MAX_MSG_CTX_TTL / HZ; 68 69 module_param(ecryptfs_message_wait_timeout, long, 0); 70 MODULE_PARM_DESC(ecryptfs_message_wait_timeout, 71 "Maximum number of seconds that an operation will " 72 "sleep while waiting for a message response from " 73 "userspace"); 74 75 /** 76 * Module parameter that is an estimate of the maximum number of users 77 * that will be concurrently using eCryptfs. Set this to the right 78 * value to balance performance and memory use. 79 */ 80 unsigned int ecryptfs_number_of_users = ECRYPTFS_DEFAULT_NUM_USERS; 81 82 module_param(ecryptfs_number_of_users, uint, 0); 83 MODULE_PARM_DESC(ecryptfs_number_of_users, "An estimate of the number of " 84 "concurrent users of eCryptfs"); 85 86 unsigned int ecryptfs_transport = ECRYPTFS_DEFAULT_TRANSPORT; 87 88 void __ecryptfs_printk(const char *fmt, ...) 89 { 90 va_list args; 91 va_start(args, fmt); 92 if (fmt[1] == '7') { /* KERN_DEBUG */ 93 if (ecryptfs_verbosity >= 1) 94 vprintk(fmt, args); 95 } else 96 vprintk(fmt, args); 97 va_end(args); 98 } 99 100 /** 101 * ecryptfs_init_persistent_file 102 * @ecryptfs_dentry: Fully initialized eCryptfs dentry object, with 103 * the lower dentry and the lower mount set 104 * 105 * eCryptfs only ever keeps a single open file for every lower 106 * inode. All I/O operations to the lower inode occur through that 107 * file. When the first eCryptfs dentry that interposes with the first 108 * lower dentry for that inode is created, this function creates the 109 * persistent file struct and associates it with the eCryptfs 110 * inode. When the eCryptfs inode is destroyed, the file is closed. 111 * 112 * The persistent file will be opened with read/write permissions, if 113 * possible. Otherwise, it is opened read-only. 114 * 115 * This function does nothing if a lower persistent file is already 116 * associated with the eCryptfs inode. 117 * 118 * Returns zero on success; non-zero otherwise 119 */ 120 int ecryptfs_init_persistent_file(struct dentry *ecryptfs_dentry) 121 { 122 struct ecryptfs_inode_info *inode_info = 123 ecryptfs_inode_to_private(ecryptfs_dentry->d_inode); 124 int rc = 0; 125 126 mutex_lock(&inode_info->lower_file_mutex); 127 if (!inode_info->lower_file) { 128 struct dentry *lower_dentry; 129 struct vfsmount *lower_mnt = 130 ecryptfs_dentry_to_lower_mnt(ecryptfs_dentry); 131 132 lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry); 133 rc = ecryptfs_privileged_open(&inode_info->lower_file, 134 lower_dentry, lower_mnt); 135 if (rc || IS_ERR(inode_info->lower_file)) { 136 printk(KERN_ERR "Error opening lower persistent file " 137 "for lower_dentry [0x%p] and lower_mnt [0x%p]; " 138 "rc = [%d]\n", lower_dentry, lower_mnt, rc); 139 rc = PTR_ERR(inode_info->lower_file); 140 inode_info->lower_file = NULL; 141 } 142 } 143 mutex_unlock(&inode_info->lower_file_mutex); 144 return rc; 145 } 146 147 /** 148 * ecryptfs_interpose 149 * @lower_dentry: Existing dentry in the lower filesystem 150 * @dentry: ecryptfs' dentry 151 * @sb: ecryptfs's super_block 152 * @flags: flags to govern behavior of interpose procedure 153 * 154 * Interposes upper and lower dentries. 155 * 156 * Returns zero on success; non-zero otherwise 157 */ 158 int ecryptfs_interpose(struct dentry *lower_dentry, struct dentry *dentry, 159 struct super_block *sb, u32 flags) 160 { 161 struct inode *lower_inode; 162 struct inode *inode; 163 int rc = 0; 164 165 lower_inode = lower_dentry->d_inode; 166 if (lower_inode->i_sb != ecryptfs_superblock_to_lower(sb)) { 167 rc = -EXDEV; 168 goto out; 169 } 170 if (!igrab(lower_inode)) { 171 rc = -ESTALE; 172 goto out; 173 } 174 inode = iget5_locked(sb, (unsigned long)lower_inode, 175 ecryptfs_inode_test, ecryptfs_inode_set, 176 lower_inode); 177 if (!inode) { 178 rc = -EACCES; 179 iput(lower_inode); 180 goto out; 181 } 182 if (inode->i_state & I_NEW) 183 unlock_new_inode(inode); 184 else 185 iput(lower_inode); 186 if (S_ISLNK(lower_inode->i_mode)) 187 inode->i_op = &ecryptfs_symlink_iops; 188 else if (S_ISDIR(lower_inode->i_mode)) 189 inode->i_op = &ecryptfs_dir_iops; 190 if (S_ISDIR(lower_inode->i_mode)) 191 inode->i_fop = &ecryptfs_dir_fops; 192 if (special_file(lower_inode->i_mode)) 193 init_special_inode(inode, lower_inode->i_mode, 194 lower_inode->i_rdev); 195 dentry->d_op = &ecryptfs_dops; 196 if (flags & ECRYPTFS_INTERPOSE_FLAG_D_ADD) 197 d_add(dentry, inode); 198 else 199 d_instantiate(dentry, inode); 200 fsstack_copy_attr_all(inode, lower_inode, NULL); 201 /* This size will be overwritten for real files w/ headers and 202 * other metadata */ 203 fsstack_copy_inode_size(inode, lower_inode); 204 out: 205 return rc; 206 } 207 208 enum { ecryptfs_opt_sig, ecryptfs_opt_ecryptfs_sig, 209 ecryptfs_opt_cipher, ecryptfs_opt_ecryptfs_cipher, 210 ecryptfs_opt_ecryptfs_key_bytes, 211 ecryptfs_opt_passthrough, ecryptfs_opt_xattr_metadata, 212 ecryptfs_opt_encrypted_view, ecryptfs_opt_err }; 213 214 static match_table_t tokens = { 215 {ecryptfs_opt_sig, "sig=%s"}, 216 {ecryptfs_opt_ecryptfs_sig, "ecryptfs_sig=%s"}, 217 {ecryptfs_opt_cipher, "cipher=%s"}, 218 {ecryptfs_opt_ecryptfs_cipher, "ecryptfs_cipher=%s"}, 219 {ecryptfs_opt_ecryptfs_key_bytes, "ecryptfs_key_bytes=%u"}, 220 {ecryptfs_opt_passthrough, "ecryptfs_passthrough"}, 221 {ecryptfs_opt_xattr_metadata, "ecryptfs_xattr_metadata"}, 222 {ecryptfs_opt_encrypted_view, "ecryptfs_encrypted_view"}, 223 {ecryptfs_opt_err, NULL} 224 }; 225 226 static int ecryptfs_init_global_auth_toks( 227 struct ecryptfs_mount_crypt_stat *mount_crypt_stat) 228 { 229 struct ecryptfs_global_auth_tok *global_auth_tok; 230 int rc = 0; 231 232 list_for_each_entry(global_auth_tok, 233 &mount_crypt_stat->global_auth_tok_list, 234 mount_crypt_stat_list) { 235 rc = ecryptfs_keyring_auth_tok_for_sig( 236 &global_auth_tok->global_auth_tok_key, 237 &global_auth_tok->global_auth_tok, 238 global_auth_tok->sig); 239 if (rc) { 240 printk(KERN_ERR "Could not find valid key in user " 241 "session keyring for sig specified in mount " 242 "option: [%s]\n", global_auth_tok->sig); 243 global_auth_tok->flags |= ECRYPTFS_AUTH_TOK_INVALID; 244 goto out; 245 } else 246 global_auth_tok->flags &= ~ECRYPTFS_AUTH_TOK_INVALID; 247 } 248 out: 249 return rc; 250 } 251 252 static void ecryptfs_init_mount_crypt_stat( 253 struct ecryptfs_mount_crypt_stat *mount_crypt_stat) 254 { 255 memset((void *)mount_crypt_stat, 0, 256 sizeof(struct ecryptfs_mount_crypt_stat)); 257 INIT_LIST_HEAD(&mount_crypt_stat->global_auth_tok_list); 258 mutex_init(&mount_crypt_stat->global_auth_tok_list_mutex); 259 mount_crypt_stat->flags |= ECRYPTFS_MOUNT_CRYPT_STAT_INITIALIZED; 260 } 261 262 /** 263 * ecryptfs_parse_options 264 * @sb: The ecryptfs super block 265 * @options: The options pased to the kernel 266 * 267 * Parse mount options: 268 * debug=N - ecryptfs_verbosity level for debug output 269 * sig=XXX - description(signature) of the key to use 270 * 271 * Returns the dentry object of the lower-level (lower/interposed) 272 * directory; We want to mount our stackable file system on top of 273 * that lower directory. 274 * 275 * The signature of the key to use must be the description of a key 276 * already in the keyring. Mounting will fail if the key can not be 277 * found. 278 * 279 * Returns zero on success; non-zero on error 280 */ 281 static int ecryptfs_parse_options(struct super_block *sb, char *options) 282 { 283 char *p; 284 int rc = 0; 285 int sig_set = 0; 286 int cipher_name_set = 0; 287 int cipher_key_bytes; 288 int cipher_key_bytes_set = 0; 289 struct ecryptfs_mount_crypt_stat *mount_crypt_stat = 290 &ecryptfs_superblock_to_private(sb)->mount_crypt_stat; 291 substring_t args[MAX_OPT_ARGS]; 292 int token; 293 char *sig_src; 294 char *cipher_name_dst; 295 char *cipher_name_src; 296 char *cipher_key_bytes_src; 297 298 if (!options) { 299 rc = -EINVAL; 300 goto out; 301 } 302 ecryptfs_init_mount_crypt_stat(mount_crypt_stat); 303 while ((p = strsep(&options, ",")) != NULL) { 304 if (!*p) 305 continue; 306 token = match_token(p, tokens, args); 307 switch (token) { 308 case ecryptfs_opt_sig: 309 case ecryptfs_opt_ecryptfs_sig: 310 sig_src = args[0].from; 311 rc = ecryptfs_add_global_auth_tok(mount_crypt_stat, 312 sig_src); 313 if (rc) { 314 printk(KERN_ERR "Error attempting to register " 315 "global sig; rc = [%d]\n", rc); 316 goto out; 317 } 318 sig_set = 1; 319 break; 320 case ecryptfs_opt_cipher: 321 case ecryptfs_opt_ecryptfs_cipher: 322 cipher_name_src = args[0].from; 323 cipher_name_dst = 324 mount_crypt_stat-> 325 global_default_cipher_name; 326 strncpy(cipher_name_dst, cipher_name_src, 327 ECRYPTFS_MAX_CIPHER_NAME_SIZE); 328 ecryptfs_printk(KERN_DEBUG, 329 "The mount_crypt_stat " 330 "global_default_cipher_name set to: " 331 "[%s]\n", cipher_name_dst); 332 cipher_name_set = 1; 333 break; 334 case ecryptfs_opt_ecryptfs_key_bytes: 335 cipher_key_bytes_src = args[0].from; 336 cipher_key_bytes = 337 (int)simple_strtol(cipher_key_bytes_src, 338 &cipher_key_bytes_src, 0); 339 mount_crypt_stat->global_default_cipher_key_size = 340 cipher_key_bytes; 341 ecryptfs_printk(KERN_DEBUG, 342 "The mount_crypt_stat " 343 "global_default_cipher_key_size " 344 "set to: [%d]\n", mount_crypt_stat-> 345 global_default_cipher_key_size); 346 cipher_key_bytes_set = 1; 347 break; 348 case ecryptfs_opt_passthrough: 349 mount_crypt_stat->flags |= 350 ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED; 351 break; 352 case ecryptfs_opt_xattr_metadata: 353 mount_crypt_stat->flags |= 354 ECRYPTFS_XATTR_METADATA_ENABLED; 355 break; 356 case ecryptfs_opt_encrypted_view: 357 mount_crypt_stat->flags |= 358 ECRYPTFS_XATTR_METADATA_ENABLED; 359 mount_crypt_stat->flags |= 360 ECRYPTFS_ENCRYPTED_VIEW_ENABLED; 361 break; 362 case ecryptfs_opt_err: 363 default: 364 ecryptfs_printk(KERN_WARNING, 365 "eCryptfs: unrecognized option '%s'\n", 366 p); 367 } 368 } 369 if (!sig_set) { 370 rc = -EINVAL; 371 ecryptfs_printk(KERN_ERR, "You must supply at least one valid " 372 "auth tok signature as a mount " 373 "parameter; see the eCryptfs README\n"); 374 goto out; 375 } 376 if (!cipher_name_set) { 377 int cipher_name_len = strlen(ECRYPTFS_DEFAULT_CIPHER); 378 379 BUG_ON(cipher_name_len >= ECRYPTFS_MAX_CIPHER_NAME_SIZE); 380 381 strcpy(mount_crypt_stat->global_default_cipher_name, 382 ECRYPTFS_DEFAULT_CIPHER); 383 } 384 if (!cipher_key_bytes_set) { 385 mount_crypt_stat->global_default_cipher_key_size = 0; 386 } 387 mutex_lock(&key_tfm_list_mutex); 388 if (!ecryptfs_tfm_exists(mount_crypt_stat->global_default_cipher_name, 389 NULL)) 390 rc = ecryptfs_add_new_key_tfm( 391 NULL, mount_crypt_stat->global_default_cipher_name, 392 mount_crypt_stat->global_default_cipher_key_size); 393 mutex_unlock(&key_tfm_list_mutex); 394 if (rc) { 395 printk(KERN_ERR "Error attempting to initialize cipher with " 396 "name = [%s] and key size = [%td]; rc = [%d]\n", 397 mount_crypt_stat->global_default_cipher_name, 398 mount_crypt_stat->global_default_cipher_key_size, rc); 399 rc = -EINVAL; 400 goto out; 401 } 402 rc = ecryptfs_init_global_auth_toks(mount_crypt_stat); 403 if (rc) { 404 printk(KERN_WARNING "One or more global auth toks could not " 405 "properly register; rc = [%d]\n", rc); 406 } 407 out: 408 return rc; 409 } 410 411 struct kmem_cache *ecryptfs_sb_info_cache; 412 413 /** 414 * ecryptfs_fill_super 415 * @sb: The ecryptfs super block 416 * @raw_data: The options passed to mount 417 * @silent: Not used but required by function prototype 418 * 419 * Sets up what we can of the sb, rest is done in ecryptfs_read_super 420 * 421 * Returns zero on success; non-zero otherwise 422 */ 423 static int 424 ecryptfs_fill_super(struct super_block *sb, void *raw_data, int silent) 425 { 426 int rc = 0; 427 428 /* Released in ecryptfs_put_super() */ 429 ecryptfs_set_superblock_private(sb, 430 kmem_cache_zalloc(ecryptfs_sb_info_cache, 431 GFP_KERNEL)); 432 if (!ecryptfs_superblock_to_private(sb)) { 433 ecryptfs_printk(KERN_WARNING, "Out of memory\n"); 434 rc = -ENOMEM; 435 goto out; 436 } 437 sb->s_op = &ecryptfs_sops; 438 /* Released through deactivate_super(sb) from get_sb_nodev */ 439 sb->s_root = d_alloc(NULL, &(const struct qstr) { 440 .hash = 0,.name = "/",.len = 1}); 441 if (!sb->s_root) { 442 ecryptfs_printk(KERN_ERR, "d_alloc failed\n"); 443 rc = -ENOMEM; 444 goto out; 445 } 446 sb->s_root->d_op = &ecryptfs_dops; 447 sb->s_root->d_sb = sb; 448 sb->s_root->d_parent = sb->s_root; 449 /* Released in d_release when dput(sb->s_root) is called */ 450 /* through deactivate_super(sb) from get_sb_nodev() */ 451 ecryptfs_set_dentry_private(sb->s_root, 452 kmem_cache_zalloc(ecryptfs_dentry_info_cache, 453 GFP_KERNEL)); 454 if (!ecryptfs_dentry_to_private(sb->s_root)) { 455 ecryptfs_printk(KERN_ERR, 456 "dentry_info_cache alloc failed\n"); 457 rc = -ENOMEM; 458 goto out; 459 } 460 rc = 0; 461 out: 462 /* Should be able to rely on deactivate_super called from 463 * get_sb_nodev */ 464 return rc; 465 } 466 467 /** 468 * ecryptfs_read_super 469 * @sb: The ecryptfs super block 470 * @dev_name: The path to mount over 471 * 472 * Read the super block of the lower filesystem, and use 473 * ecryptfs_interpose to create our initial inode and super block 474 * struct. 475 */ 476 static int ecryptfs_read_super(struct super_block *sb, const char *dev_name) 477 { 478 int rc; 479 struct nameidata nd; 480 struct dentry *lower_root; 481 struct vfsmount *lower_mnt; 482 483 memset(&nd, 0, sizeof(struct nameidata)); 484 rc = path_lookup(dev_name, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &nd); 485 if (rc) { 486 ecryptfs_printk(KERN_WARNING, "path_lookup() failed\n"); 487 goto out; 488 } 489 lower_root = nd.path.dentry; 490 lower_mnt = nd.path.mnt; 491 ecryptfs_set_superblock_lower(sb, lower_root->d_sb); 492 sb->s_maxbytes = lower_root->d_sb->s_maxbytes; 493 sb->s_blocksize = lower_root->d_sb->s_blocksize; 494 ecryptfs_set_dentry_lower(sb->s_root, lower_root); 495 ecryptfs_set_dentry_lower_mnt(sb->s_root, lower_mnt); 496 rc = ecryptfs_interpose(lower_root, sb->s_root, sb, 0); 497 if (rc) 498 goto out_free; 499 rc = 0; 500 goto out; 501 out_free: 502 path_put(&nd.path); 503 out: 504 return rc; 505 } 506 507 /** 508 * ecryptfs_get_sb 509 * @fs_type 510 * @flags 511 * @dev_name: The path to mount over 512 * @raw_data: The options passed into the kernel 513 * 514 * The whole ecryptfs_get_sb process is broken into 4 functions: 515 * ecryptfs_parse_options(): handle options passed to ecryptfs, if any 516 * ecryptfs_fill_super(): used by get_sb_nodev, fills out the super_block 517 * with as much information as it can before needing 518 * the lower filesystem. 519 * ecryptfs_read_super(): this accesses the lower filesystem and uses 520 * ecryptfs_interpolate to perform most of the linking 521 * ecryptfs_interpolate(): links the lower filesystem into ecryptfs 522 */ 523 static int ecryptfs_get_sb(struct file_system_type *fs_type, int flags, 524 const char *dev_name, void *raw_data, 525 struct vfsmount *mnt) 526 { 527 int rc; 528 struct super_block *sb; 529 530 rc = get_sb_nodev(fs_type, flags, raw_data, ecryptfs_fill_super, mnt); 531 if (rc < 0) { 532 printk(KERN_ERR "Getting sb failed; rc = [%d]\n", rc); 533 goto out; 534 } 535 sb = mnt->mnt_sb; 536 rc = ecryptfs_parse_options(sb, raw_data); 537 if (rc) { 538 printk(KERN_ERR "Error parsing options; rc = [%d]\n", rc); 539 goto out_abort; 540 } 541 rc = ecryptfs_read_super(sb, dev_name); 542 if (rc) { 543 printk(KERN_ERR "Reading sb failed; rc = [%d]\n", rc); 544 goto out_abort; 545 } 546 goto out; 547 out_abort: 548 dput(sb->s_root); 549 up_write(&sb->s_umount); 550 deactivate_super(sb); 551 out: 552 return rc; 553 } 554 555 /** 556 * ecryptfs_kill_block_super 557 * @sb: The ecryptfs super block 558 * 559 * Used to bring the superblock down and free the private data. 560 * Private data is free'd in ecryptfs_put_super() 561 */ 562 static void ecryptfs_kill_block_super(struct super_block *sb) 563 { 564 generic_shutdown_super(sb); 565 } 566 567 static struct file_system_type ecryptfs_fs_type = { 568 .owner = THIS_MODULE, 569 .name = "ecryptfs", 570 .get_sb = ecryptfs_get_sb, 571 .kill_sb = ecryptfs_kill_block_super, 572 .fs_flags = 0 573 }; 574 575 /** 576 * inode_info_init_once 577 * 578 * Initializes the ecryptfs_inode_info_cache when it is created 579 */ 580 static void 581 inode_info_init_once(struct kmem_cache *cachep, void *vptr) 582 { 583 struct ecryptfs_inode_info *ei = (struct ecryptfs_inode_info *)vptr; 584 585 inode_init_once(&ei->vfs_inode); 586 } 587 588 static struct ecryptfs_cache_info { 589 struct kmem_cache **cache; 590 const char *name; 591 size_t size; 592 void (*ctor)(struct kmem_cache *cache, void *obj); 593 } ecryptfs_cache_infos[] = { 594 { 595 .cache = &ecryptfs_auth_tok_list_item_cache, 596 .name = "ecryptfs_auth_tok_list_item", 597 .size = sizeof(struct ecryptfs_auth_tok_list_item), 598 }, 599 { 600 .cache = &ecryptfs_file_info_cache, 601 .name = "ecryptfs_file_cache", 602 .size = sizeof(struct ecryptfs_file_info), 603 }, 604 { 605 .cache = &ecryptfs_dentry_info_cache, 606 .name = "ecryptfs_dentry_info_cache", 607 .size = sizeof(struct ecryptfs_dentry_info), 608 }, 609 { 610 .cache = &ecryptfs_inode_info_cache, 611 .name = "ecryptfs_inode_cache", 612 .size = sizeof(struct ecryptfs_inode_info), 613 .ctor = inode_info_init_once, 614 }, 615 { 616 .cache = &ecryptfs_sb_info_cache, 617 .name = "ecryptfs_sb_cache", 618 .size = sizeof(struct ecryptfs_sb_info), 619 }, 620 { 621 .cache = &ecryptfs_header_cache_1, 622 .name = "ecryptfs_headers_1", 623 .size = PAGE_CACHE_SIZE, 624 }, 625 { 626 .cache = &ecryptfs_header_cache_2, 627 .name = "ecryptfs_headers_2", 628 .size = PAGE_CACHE_SIZE, 629 }, 630 { 631 .cache = &ecryptfs_xattr_cache, 632 .name = "ecryptfs_xattr_cache", 633 .size = PAGE_CACHE_SIZE, 634 }, 635 { 636 .cache = &ecryptfs_key_record_cache, 637 .name = "ecryptfs_key_record_cache", 638 .size = sizeof(struct ecryptfs_key_record), 639 }, 640 { 641 .cache = &ecryptfs_key_sig_cache, 642 .name = "ecryptfs_key_sig_cache", 643 .size = sizeof(struct ecryptfs_key_sig), 644 }, 645 { 646 .cache = &ecryptfs_global_auth_tok_cache, 647 .name = "ecryptfs_global_auth_tok_cache", 648 .size = sizeof(struct ecryptfs_global_auth_tok), 649 }, 650 { 651 .cache = &ecryptfs_key_tfm_cache, 652 .name = "ecryptfs_key_tfm_cache", 653 .size = sizeof(struct ecryptfs_key_tfm), 654 }, 655 { 656 .cache = &ecryptfs_open_req_cache, 657 .name = "ecryptfs_open_req_cache", 658 .size = sizeof(struct ecryptfs_open_req), 659 }, 660 }; 661 662 static void ecryptfs_free_kmem_caches(void) 663 { 664 int i; 665 666 for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) { 667 struct ecryptfs_cache_info *info; 668 669 info = &ecryptfs_cache_infos[i]; 670 if (*(info->cache)) 671 kmem_cache_destroy(*(info->cache)); 672 } 673 } 674 675 /** 676 * ecryptfs_init_kmem_caches 677 * 678 * Returns zero on success; non-zero otherwise 679 */ 680 static int ecryptfs_init_kmem_caches(void) 681 { 682 int i; 683 684 for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) { 685 struct ecryptfs_cache_info *info; 686 687 info = &ecryptfs_cache_infos[i]; 688 *(info->cache) = kmem_cache_create(info->name, info->size, 689 0, SLAB_HWCACHE_ALIGN, info->ctor); 690 if (!*(info->cache)) { 691 ecryptfs_free_kmem_caches(); 692 ecryptfs_printk(KERN_WARNING, "%s: " 693 "kmem_cache_create failed\n", 694 info->name); 695 return -ENOMEM; 696 } 697 } 698 return 0; 699 } 700 701 static struct kobject *ecryptfs_kobj; 702 703 static ssize_t version_show(struct kobject *kobj, 704 struct kobj_attribute *attr, char *buff) 705 { 706 return snprintf(buff, PAGE_SIZE, "%d\n", ECRYPTFS_VERSIONING_MASK); 707 } 708 709 static struct kobj_attribute version_attr = __ATTR_RO(version); 710 711 static struct attribute *attributes[] = { 712 &version_attr.attr, 713 NULL, 714 }; 715 716 static struct attribute_group attr_group = { 717 .attrs = attributes, 718 }; 719 720 static int do_sysfs_registration(void) 721 { 722 int rc; 723 724 ecryptfs_kobj = kobject_create_and_add("ecryptfs", fs_kobj); 725 if (!ecryptfs_kobj) { 726 printk(KERN_ERR "Unable to create ecryptfs kset\n"); 727 rc = -ENOMEM; 728 goto out; 729 } 730 rc = sysfs_create_group(ecryptfs_kobj, &attr_group); 731 if (rc) { 732 printk(KERN_ERR 733 "Unable to create ecryptfs version attributes\n"); 734 kobject_put(ecryptfs_kobj); 735 } 736 out: 737 return rc; 738 } 739 740 static void do_sysfs_unregistration(void) 741 { 742 sysfs_remove_group(ecryptfs_kobj, &attr_group); 743 kobject_put(ecryptfs_kobj); 744 } 745 746 static int __init ecryptfs_init(void) 747 { 748 int rc; 749 750 if (ECRYPTFS_DEFAULT_EXTENT_SIZE > PAGE_CACHE_SIZE) { 751 rc = -EINVAL; 752 ecryptfs_printk(KERN_ERR, "The eCryptfs extent size is " 753 "larger than the host's page size, and so " 754 "eCryptfs cannot run on this system. The " 755 "default eCryptfs extent size is [%d] bytes; " 756 "the page size is [%d] bytes.\n", 757 ECRYPTFS_DEFAULT_EXTENT_SIZE, PAGE_CACHE_SIZE); 758 goto out; 759 } 760 rc = ecryptfs_init_kmem_caches(); 761 if (rc) { 762 printk(KERN_ERR 763 "Failed to allocate one or more kmem_cache objects\n"); 764 goto out; 765 } 766 rc = register_filesystem(&ecryptfs_fs_type); 767 if (rc) { 768 printk(KERN_ERR "Failed to register filesystem\n"); 769 goto out_free_kmem_caches; 770 } 771 rc = do_sysfs_registration(); 772 if (rc) { 773 printk(KERN_ERR "sysfs registration failed\n"); 774 goto out_unregister_filesystem; 775 } 776 rc = ecryptfs_init_kthread(); 777 if (rc) { 778 printk(KERN_ERR "%s: kthread initialization failed; " 779 "rc = [%d]\n", __func__, rc); 780 goto out_do_sysfs_unregistration; 781 } 782 rc = ecryptfs_init_messaging(ecryptfs_transport); 783 if (rc) { 784 printk(KERN_ERR "Failure occured while attempting to " 785 "initialize the eCryptfs netlink socket\n"); 786 goto out_destroy_kthread; 787 } 788 rc = ecryptfs_init_crypto(); 789 if (rc) { 790 printk(KERN_ERR "Failure whilst attempting to init crypto; " 791 "rc = [%d]\n", rc); 792 goto out_release_messaging; 793 } 794 if (ecryptfs_verbosity > 0) 795 printk(KERN_CRIT "eCryptfs verbosity set to %d. Secret values " 796 "will be written to the syslog!\n", ecryptfs_verbosity); 797 798 goto out; 799 out_release_messaging: 800 ecryptfs_release_messaging(ecryptfs_transport); 801 out_destroy_kthread: 802 ecryptfs_destroy_kthread(); 803 out_do_sysfs_unregistration: 804 do_sysfs_unregistration(); 805 out_unregister_filesystem: 806 unregister_filesystem(&ecryptfs_fs_type); 807 out_free_kmem_caches: 808 ecryptfs_free_kmem_caches(); 809 out: 810 return rc; 811 } 812 813 static void __exit ecryptfs_exit(void) 814 { 815 int rc; 816 817 rc = ecryptfs_destroy_crypto(); 818 if (rc) 819 printk(KERN_ERR "Failure whilst attempting to destroy crypto; " 820 "rc = [%d]\n", rc); 821 ecryptfs_release_messaging(ecryptfs_transport); 822 ecryptfs_destroy_kthread(); 823 do_sysfs_unregistration(); 824 unregister_filesystem(&ecryptfs_fs_type); 825 ecryptfs_free_kmem_caches(); 826 } 827 828 MODULE_AUTHOR("Michael A. Halcrow <mhalcrow@us.ibm.com>"); 829 MODULE_DESCRIPTION("eCryptfs"); 830 831 MODULE_LICENSE("GPL"); 832 833 module_init(ecryptfs_init) 834 module_exit(ecryptfs_exit) 835