eCryptfs: Filename Encryption: filldir, lookup, and readlink
Make the requisite modifications to ecryptfs_filldir(), ecryptfs_lookup(), and ecryptfs_readlink() to call out to filename encryption functions. Propagate filename encryption policy flags from mount-wide crypt_stat to inode crypt_stat. Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com> Cc: Dustin Kirkland <dustin.kirkland@gmail.com> Cc: Eric Sandeen <sandeen@redhat.com> Cc: Tyler Hicks <tchicks@us.ibm.com> Cc: David Kleikamp <shaggy@us.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
51ca58dcc9
commit
addd65ad8d
|
@ -924,6 +924,15 @@ static void ecryptfs_copy_mount_wide_flags_to_inode_flags(
|
||||||
crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
|
crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
|
||||||
if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
|
if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
|
||||||
crypt_stat->flags |= ECRYPTFS_VIEW_AS_ENCRYPTED;
|
crypt_stat->flags |= ECRYPTFS_VIEW_AS_ENCRYPTED;
|
||||||
|
if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
|
||||||
|
crypt_stat->flags |= ECRYPTFS_ENCRYPT_FILENAMES;
|
||||||
|
if (mount_crypt_stat->flags
|
||||||
|
& ECRYPTFS_GLOBAL_ENCFN_USE_MOUNT_FNEK)
|
||||||
|
crypt_stat->flags |= ECRYPTFS_ENCFN_USE_MOUNT_FNEK;
|
||||||
|
else if (mount_crypt_stat->flags
|
||||||
|
& ECRYPTFS_GLOBAL_ENCFN_USE_FEK)
|
||||||
|
crypt_stat->flags |= ECRYPTFS_ENCFN_USE_FEK;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
static int ecryptfs_copy_mount_wide_sigs_to_inode_sigs(
|
static int ecryptfs_copy_mount_wide_sigs_to_inode_sigs(
|
||||||
|
@ -1060,7 +1069,8 @@ struct ecryptfs_flag_map_elem {
|
||||||
static struct ecryptfs_flag_map_elem ecryptfs_flag_map[] = {
|
static struct ecryptfs_flag_map_elem ecryptfs_flag_map[] = {
|
||||||
{0x00000001, ECRYPTFS_ENABLE_HMAC},
|
{0x00000001, ECRYPTFS_ENABLE_HMAC},
|
||||||
{0x00000002, ECRYPTFS_ENCRYPTED},
|
{0x00000002, ECRYPTFS_ENCRYPTED},
|
||||||
{0x00000004, ECRYPTFS_METADATA_IN_XATTR}
|
{0x00000004, ECRYPTFS_METADATA_IN_XATTR},
|
||||||
|
{0x00000008, ECRYPTFS_ENCRYPT_FILENAMES}
|
||||||
};
|
};
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
@ -1213,6 +1223,8 @@ int ecryptfs_read_and_validate_header_region(char *data,
|
||||||
&(ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat);
|
&(ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat);
|
||||||
int rc;
|
int rc;
|
||||||
|
|
||||||
|
if (crypt_stat->extent_size == 0)
|
||||||
|
crypt_stat->extent_size = ECRYPTFS_DEFAULT_EXTENT_SIZE;
|
||||||
rc = ecryptfs_read_lower(data, 0, crypt_stat->extent_size,
|
rc = ecryptfs_read_lower(data, 0, crypt_stat->extent_size,
|
||||||
ecryptfs_inode);
|
ecryptfs_inode);
|
||||||
if (rc) {
|
if (rc) {
|
||||||
|
@ -1222,7 +1234,6 @@ int ecryptfs_read_and_validate_header_region(char *data,
|
||||||
}
|
}
|
||||||
if (!contains_ecryptfs_marker(data + ECRYPTFS_FILE_SIZE_BYTES)) {
|
if (!contains_ecryptfs_marker(data + ECRYPTFS_FILE_SIZE_BYTES)) {
|
||||||
rc = -EINVAL;
|
rc = -EINVAL;
|
||||||
ecryptfs_printk(KERN_DEBUG, "Valid marker not found\n");
|
|
||||||
}
|
}
|
||||||
out:
|
out:
|
||||||
return rc;
|
return rc;
|
||||||
|
@ -1628,98 +1639,6 @@ out:
|
||||||
return rc;
|
return rc;
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* ecryptfs_encode_filename - converts a plaintext file name to cipher text
|
|
||||||
* @crypt_stat: The crypt_stat struct associated with the file anem to encode
|
|
||||||
* @name: The plaintext name
|
|
||||||
* @length: The length of the plaintext
|
|
||||||
* @encoded_name: The encypted name
|
|
||||||
*
|
|
||||||
* Encrypts and encodes a filename into something that constitutes a
|
|
||||||
* valid filename for a filesystem, with printable characters.
|
|
||||||
*
|
|
||||||
* We assume that we have a properly initialized crypto context,
|
|
||||||
* pointed to by crypt_stat->tfm.
|
|
||||||
*
|
|
||||||
* TODO: Implement filename decoding and decryption here, in place of
|
|
||||||
* memcpy. We are keeping the framework around for now to (1)
|
|
||||||
* facilitate testing of the components needed to implement filename
|
|
||||||
* encryption and (2) to provide a code base from which other
|
|
||||||
* developers in the community can easily implement this feature.
|
|
||||||
*
|
|
||||||
* Returns the length of encoded filename; negative if error
|
|
||||||
*/
|
|
||||||
int
|
|
||||||
ecryptfs_encode_filename(struct ecryptfs_crypt_stat *crypt_stat,
|
|
||||||
const char *name, int length, char **encoded_name)
|
|
||||||
{
|
|
||||||
int error = 0;
|
|
||||||
|
|
||||||
(*encoded_name) = kmalloc(length + 2, GFP_KERNEL);
|
|
||||||
if (!(*encoded_name)) {
|
|
||||||
error = -ENOMEM;
|
|
||||||
goto out;
|
|
||||||
}
|
|
||||||
/* TODO: Filename encryption is a scheduled feature for a
|
|
||||||
* future version of eCryptfs. This function is here only for
|
|
||||||
* the purpose of providing a framework for other developers
|
|
||||||
* to easily implement filename encryption. Hint: Replace this
|
|
||||||
* memcpy() with a call to encrypt and encode the
|
|
||||||
* filename, the set the length accordingly. */
|
|
||||||
memcpy((void *)(*encoded_name), (void *)name, length);
|
|
||||||
(*encoded_name)[length] = '\0';
|
|
||||||
error = length + 1;
|
|
||||||
out:
|
|
||||||
return error;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* ecryptfs_decode_filename - converts the cipher text name to plaintext
|
|
||||||
* @crypt_stat: The crypt_stat struct associated with the file
|
|
||||||
* @name: The filename in cipher text
|
|
||||||
* @length: The length of the cipher text name
|
|
||||||
* @decrypted_name: The plaintext name
|
|
||||||
*
|
|
||||||
* Decodes and decrypts the filename.
|
|
||||||
*
|
|
||||||
* We assume that we have a properly initialized crypto context,
|
|
||||||
* pointed to by crypt_stat->tfm.
|
|
||||||
*
|
|
||||||
* TODO: Implement filename decoding and decryption here, in place of
|
|
||||||
* memcpy. We are keeping the framework around for now to (1)
|
|
||||||
* facilitate testing of the components needed to implement filename
|
|
||||||
* encryption and (2) to provide a code base from which other
|
|
||||||
* developers in the community can easily implement this feature.
|
|
||||||
*
|
|
||||||
* Returns the length of decoded filename; negative if error
|
|
||||||
*/
|
|
||||||
int
|
|
||||||
ecryptfs_decode_filename(struct ecryptfs_crypt_stat *crypt_stat,
|
|
||||||
const char *name, int length, char **decrypted_name)
|
|
||||||
{
|
|
||||||
int error = 0;
|
|
||||||
|
|
||||||
(*decrypted_name) = kmalloc(length + 2, GFP_KERNEL);
|
|
||||||
if (!(*decrypted_name)) {
|
|
||||||
error = -ENOMEM;
|
|
||||||
goto out;
|
|
||||||
}
|
|
||||||
/* TODO: Filename encryption is a scheduled feature for a
|
|
||||||
* future version of eCryptfs. This function is here only for
|
|
||||||
* the purpose of providing a framework for other developers
|
|
||||||
* to easily implement filename encryption. Hint: Replace this
|
|
||||||
* memcpy() with a call to decode and decrypt the
|
|
||||||
* filename, the set the length accordingly. */
|
|
||||||
memcpy((void *)(*decrypted_name), (void *)name, length);
|
|
||||||
(*decrypted_name)[length + 1] = '\0'; /* Only for convenience
|
|
||||||
* in printing out the
|
|
||||||
* string in debug
|
|
||||||
* messages */
|
|
||||||
error = length;
|
|
||||||
out:
|
|
||||||
return error;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* ecryptfs_encrypt_filename - encrypt filename
|
* ecryptfs_encrypt_filename - encrypt filename
|
||||||
*
|
*
|
||||||
|
|
|
@ -627,12 +627,6 @@ int ecryptfs_decode_and_decrypt_filename(char **decrypted_name,
|
||||||
struct dentry *ecryptfs_dentry,
|
struct dentry *ecryptfs_dentry,
|
||||||
const char *name, size_t name_size);
|
const char *name, size_t name_size);
|
||||||
int ecryptfs_fill_zeros(struct file *file, loff_t new_length);
|
int ecryptfs_fill_zeros(struct file *file, loff_t new_length);
|
||||||
int ecryptfs_decode_filename(struct ecryptfs_crypt_stat *crypt_stat,
|
|
||||||
const char *name, int length,
|
|
||||||
char **decrypted_name);
|
|
||||||
int ecryptfs_encode_filename(struct ecryptfs_crypt_stat *crypt_stat,
|
|
||||||
const char *name, int length,
|
|
||||||
char **encoded_name);
|
|
||||||
int ecryptfs_encrypt_and_encode_filename(
|
int ecryptfs_encrypt_and_encode_filename(
|
||||||
char **encoded_name,
|
char **encoded_name,
|
||||||
size_t *encoded_name_size,
|
size_t *encoded_name_size,
|
||||||
|
|
|
@ -77,27 +77,27 @@ struct ecryptfs_getdents_callback {
|
||||||
|
|
||||||
/* Inspired by generic filldir in fs/readdir.c */
|
/* Inspired by generic filldir in fs/readdir.c */
|
||||||
static int
|
static int
|
||||||
ecryptfs_filldir(void *dirent, const char *name, int namelen, loff_t offset,
|
ecryptfs_filldir(void *dirent, const char *lower_name, int lower_namelen,
|
||||||
u64 ino, unsigned int d_type)
|
loff_t offset, u64 ino, unsigned int d_type)
|
||||||
{
|
{
|
||||||
struct ecryptfs_crypt_stat *crypt_stat;
|
|
||||||
struct ecryptfs_getdents_callback *buf =
|
struct ecryptfs_getdents_callback *buf =
|
||||||
(struct ecryptfs_getdents_callback *)dirent;
|
(struct ecryptfs_getdents_callback *)dirent;
|
||||||
|
int name_size;
|
||||||
|
char *name;
|
||||||
int rc;
|
int rc;
|
||||||
int decoded_length;
|
|
||||||
char *decoded_name;
|
|
||||||
|
|
||||||
crypt_stat = ecryptfs_dentry_to_private(buf->dentry)->crypt_stat;
|
|
||||||
buf->filldir_called++;
|
buf->filldir_called++;
|
||||||
decoded_length = ecryptfs_decode_filename(crypt_stat, name, namelen,
|
rc = ecryptfs_decode_and_decrypt_filename(&name, &name_size,
|
||||||
&decoded_name);
|
buf->dentry, lower_name,
|
||||||
if (decoded_length < 0) {
|
lower_namelen);
|
||||||
rc = decoded_length;
|
if (rc) {
|
||||||
|
printk(KERN_ERR "%s: Error attempting to decode and decrypt "
|
||||||
|
"filename [%s]; rc = [%d]\n", __func__, lower_name,
|
||||||
|
rc);
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
rc = buf->filldir(buf->dirent, decoded_name, decoded_length, offset,
|
rc = buf->filldir(buf->dirent, name, name_size, offset, ino, d_type);
|
||||||
ino, d_type);
|
kfree(name);
|
||||||
kfree(decoded_name);
|
|
||||||
if (rc >= 0)
|
if (rc >= 0)
|
||||||
buf->entries_written++;
|
buf->entries_written++;
|
||||||
out:
|
out:
|
||||||
|
@ -106,8 +106,8 @@ out:
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* ecryptfs_readdir
|
* ecryptfs_readdir
|
||||||
* @file: The ecryptfs file struct
|
* @file: The eCryptfs directory file
|
||||||
* @dirent: Directory entry
|
* @dirent: Directory entry handle
|
||||||
* @filldir: The filldir callback function
|
* @filldir: The filldir callback function
|
||||||
*/
|
*/
|
||||||
static int ecryptfs_readdir(struct file *file, void *dirent, filldir_t filldir)
|
static int ecryptfs_readdir(struct file *file, void *dirent, filldir_t filldir)
|
||||||
|
|
|
@ -228,8 +228,7 @@ ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry,
|
||||||
{
|
{
|
||||||
int rc;
|
int rc;
|
||||||
|
|
||||||
/* ecryptfs_do_create() calls ecryptfs_interpose(), which opens
|
/* ecryptfs_do_create() calls ecryptfs_interpose() */
|
||||||
* the crypt_stat->lower_file (persistent file) */
|
|
||||||
rc = ecryptfs_do_create(directory_inode, ecryptfs_dentry, mode, nd);
|
rc = ecryptfs_do_create(directory_inode, ecryptfs_dentry, mode, nd);
|
||||||
if (unlikely(rc)) {
|
if (unlikely(rc)) {
|
||||||
ecryptfs_printk(KERN_WARNING, "Failed to create file in"
|
ecryptfs_printk(KERN_WARNING, "Failed to create file in"
|
||||||
|
@ -244,141 +243,91 @@ out:
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* ecryptfs_lookup
|
* ecryptfs_lookup_and_interpose_lower - Perform a lookup
|
||||||
* @dir: inode
|
|
||||||
* @dentry: The dentry
|
|
||||||
* @nd: nameidata, may be NULL
|
|
||||||
*
|
|
||||||
* Find a file on disk. If the file does not exist, then we'll add it to the
|
|
||||||
* dentry cache and continue on to read it from the disk.
|
|
||||||
*/
|
*/
|
||||||
static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
|
int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
|
||||||
struct nameidata *nd)
|
struct dentry *lower_dentry,
|
||||||
|
struct ecryptfs_crypt_stat *crypt_stat,
|
||||||
|
struct inode *ecryptfs_dir_inode,
|
||||||
|
struct nameidata *ecryptfs_nd)
|
||||||
{
|
{
|
||||||
int rc = 0;
|
|
||||||
struct dentry *lower_dir_dentry;
|
struct dentry *lower_dir_dentry;
|
||||||
struct dentry *lower_dentry;
|
|
||||||
struct vfsmount *lower_mnt;
|
struct vfsmount *lower_mnt;
|
||||||
char *encoded_name;
|
struct inode *lower_inode;
|
||||||
int encoded_namelen;
|
|
||||||
struct ecryptfs_crypt_stat *crypt_stat = NULL;
|
|
||||||
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
|
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
|
||||||
char *page_virt = NULL;
|
char *page_virt = NULL;
|
||||||
struct inode *lower_inode;
|
|
||||||
u64 file_size;
|
u64 file_size;
|
||||||
|
int rc = 0;
|
||||||
|
|
||||||
lower_dir_dentry = ecryptfs_dentry_to_lower(dentry->d_parent);
|
lower_dir_dentry = lower_dentry->d_parent;
|
||||||
dentry->d_op = &ecryptfs_dops;
|
lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(
|
||||||
if ((dentry->d_name.len == 1 && !strcmp(dentry->d_name.name, "."))
|
ecryptfs_dentry->d_parent));
|
||||||
|| (dentry->d_name.len == 2
|
|
||||||
&& !strcmp(dentry->d_name.name, ".."))) {
|
|
||||||
d_drop(dentry);
|
|
||||||
goto out;
|
|
||||||
}
|
|
||||||
encoded_namelen = ecryptfs_encode_filename(crypt_stat,
|
|
||||||
dentry->d_name.name,
|
|
||||||
dentry->d_name.len,
|
|
||||||
&encoded_name);
|
|
||||||
if (encoded_namelen < 0) {
|
|
||||||
rc = encoded_namelen;
|
|
||||||
d_drop(dentry);
|
|
||||||
goto out;
|
|
||||||
}
|
|
||||||
ecryptfs_printk(KERN_DEBUG, "encoded_name = [%s]; encoded_namelen "
|
|
||||||
"= [%d]\n", encoded_name, encoded_namelen);
|
|
||||||
lower_dentry = lookup_one_len(encoded_name, lower_dir_dentry,
|
|
||||||
encoded_namelen - 1);
|
|
||||||
kfree(encoded_name);
|
|
||||||
if (IS_ERR(lower_dentry)) {
|
|
||||||
ecryptfs_printk(KERN_ERR, "ERR from lower_dentry\n");
|
|
||||||
rc = PTR_ERR(lower_dentry);
|
|
||||||
d_drop(dentry);
|
|
||||||
goto out;
|
|
||||||
}
|
|
||||||
lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
|
|
||||||
ecryptfs_printk(KERN_DEBUG, "lower_dentry = [%p]; lower_dentry->"
|
|
||||||
"d_name.name = [%s]\n", lower_dentry,
|
|
||||||
lower_dentry->d_name.name);
|
|
||||||
lower_inode = lower_dentry->d_inode;
|
lower_inode = lower_dentry->d_inode;
|
||||||
fsstack_copy_attr_atime(dir, lower_dir_dentry->d_inode);
|
fsstack_copy_attr_atime(ecryptfs_dir_inode, lower_dir_dentry->d_inode);
|
||||||
BUG_ON(!atomic_read(&lower_dentry->d_count));
|
BUG_ON(!atomic_read(&lower_dentry->d_count));
|
||||||
ecryptfs_set_dentry_private(dentry,
|
ecryptfs_set_dentry_private(ecryptfs_dentry,
|
||||||
kmem_cache_alloc(ecryptfs_dentry_info_cache,
|
kmem_cache_alloc(ecryptfs_dentry_info_cache,
|
||||||
GFP_KERNEL));
|
GFP_KERNEL));
|
||||||
if (!ecryptfs_dentry_to_private(dentry)) {
|
if (!ecryptfs_dentry_to_private(ecryptfs_dentry)) {
|
||||||
rc = -ENOMEM;
|
rc = -ENOMEM;
|
||||||
ecryptfs_printk(KERN_ERR, "Out of memory whilst attempting "
|
printk(KERN_ERR "%s: Out of memory whilst attempting "
|
||||||
"to allocate ecryptfs_dentry_info struct\n");
|
"to allocate ecryptfs_dentry_info struct\n",
|
||||||
|
__func__);
|
||||||
goto out_dput;
|
goto out_dput;
|
||||||
}
|
}
|
||||||
ecryptfs_set_dentry_lower(dentry, lower_dentry);
|
ecryptfs_set_dentry_lower(ecryptfs_dentry, lower_dentry);
|
||||||
ecryptfs_set_dentry_lower_mnt(dentry, lower_mnt);
|
ecryptfs_set_dentry_lower_mnt(ecryptfs_dentry, lower_mnt);
|
||||||
if (!lower_dentry->d_inode) {
|
if (!lower_dentry->d_inode) {
|
||||||
/* We want to add because we couldn't find in lower */
|
/* We want to add because we couldn't find in lower */
|
||||||
d_add(dentry, NULL);
|
d_add(ecryptfs_dentry, NULL);
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb,
|
rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
|
||||||
ECRYPTFS_INTERPOSE_FLAG_D_ADD);
|
ecryptfs_dir_inode->i_sb, 1);
|
||||||
if (rc) {
|
if (rc) {
|
||||||
ecryptfs_printk(KERN_ERR, "Error interposing\n");
|
printk(KERN_ERR "%s: Error interposing; rc = [%d]\n",
|
||||||
|
__func__, rc);
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
if (S_ISDIR(lower_inode->i_mode)) {
|
if (S_ISDIR(lower_inode->i_mode))
|
||||||
ecryptfs_printk(KERN_DEBUG, "Is a directory; returning\n");
|
|
||||||
goto out;
|
goto out;
|
||||||
}
|
if (S_ISLNK(lower_inode->i_mode))
|
||||||
if (S_ISLNK(lower_inode->i_mode)) {
|
|
||||||
ecryptfs_printk(KERN_DEBUG, "Is a symlink; returning\n");
|
|
||||||
goto out;
|
goto out;
|
||||||
}
|
if (special_file(lower_inode->i_mode))
|
||||||
if (special_file(lower_inode->i_mode)) {
|
|
||||||
ecryptfs_printk(KERN_DEBUG, "Is a special file; returning\n");
|
|
||||||
goto out;
|
goto out;
|
||||||
}
|
if (!ecryptfs_nd)
|
||||||
if (!nd) {
|
|
||||||
ecryptfs_printk(KERN_DEBUG, "We have a NULL nd, just leave"
|
|
||||||
"as we *think* we are about to unlink\n");
|
|
||||||
goto out;
|
goto out;
|
||||||
}
|
|
||||||
/* Released in this function */
|
/* Released in this function */
|
||||||
page_virt = kmem_cache_zalloc(ecryptfs_header_cache_2,
|
page_virt = kmem_cache_zalloc(ecryptfs_header_cache_2, GFP_USER);
|
||||||
GFP_USER);
|
|
||||||
if (!page_virt) {
|
if (!page_virt) {
|
||||||
|
printk(KERN_ERR "%s: Cannot kmem_cache_zalloc() a page\n",
|
||||||
|
__func__);
|
||||||
rc = -ENOMEM;
|
rc = -ENOMEM;
|
||||||
ecryptfs_printk(KERN_ERR,
|
|
||||||
"Cannot ecryptfs_kmalloc a page\n");
|
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
|
if (!ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->lower_file) {
|
||||||
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
|
rc = ecryptfs_init_persistent_file(ecryptfs_dentry);
|
||||||
ecryptfs_set_default_sizes(crypt_stat);
|
|
||||||
if (!ecryptfs_inode_to_private(dentry->d_inode)->lower_file) {
|
|
||||||
rc = ecryptfs_init_persistent_file(dentry);
|
|
||||||
if (rc) {
|
if (rc) {
|
||||||
printk(KERN_ERR "%s: Error attempting to initialize "
|
printk(KERN_ERR "%s: Error attempting to initialize "
|
||||||
"the persistent file for the dentry with name "
|
"the persistent file for the dentry with name "
|
||||||
"[%s]; rc = [%d]\n", __func__,
|
"[%s]; rc = [%d]\n", __func__,
|
||||||
dentry->d_name.name, rc);
|
ecryptfs_dentry->d_name.name, rc);
|
||||||
goto out;
|
goto out_free_kmem;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
rc = ecryptfs_read_and_validate_header_region(page_virt,
|
rc = ecryptfs_read_and_validate_header_region(page_virt,
|
||||||
dentry->d_inode);
|
ecryptfs_dentry->d_inode);
|
||||||
if (rc) {
|
if (rc) {
|
||||||
rc = ecryptfs_read_and_validate_xattr_region(page_virt, dentry);
|
rc = ecryptfs_read_and_validate_xattr_region(page_virt,
|
||||||
|
ecryptfs_dentry);
|
||||||
if (rc) {
|
if (rc) {
|
||||||
printk(KERN_DEBUG "Valid metadata not found in header "
|
|
||||||
"region or xattr region; treating file as "
|
|
||||||
"unencrypted\n");
|
|
||||||
rc = 0;
|
rc = 0;
|
||||||
kmem_cache_free(ecryptfs_header_cache_2, page_virt);
|
goto out_free_kmem;
|
||||||
goto out;
|
|
||||||
}
|
}
|
||||||
crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
|
crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
|
||||||
}
|
}
|
||||||
mount_crypt_stat = &ecryptfs_superblock_to_private(
|
mount_crypt_stat = &ecryptfs_superblock_to_private(
|
||||||
dentry->d_sb)->mount_crypt_stat;
|
ecryptfs_dentry->d_sb)->mount_crypt_stat;
|
||||||
if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) {
|
if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) {
|
||||||
if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
|
if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
|
||||||
file_size = (crypt_stat->num_header_bytes_at_front
|
file_size = (crypt_stat->num_header_bytes_at_front
|
||||||
|
@ -388,14 +337,103 @@ static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
|
||||||
} else {
|
} else {
|
||||||
file_size = get_unaligned_be64(page_virt);
|
file_size = get_unaligned_be64(page_virt);
|
||||||
}
|
}
|
||||||
i_size_write(dentry->d_inode, (loff_t)file_size);
|
i_size_write(ecryptfs_dentry->d_inode, (loff_t)file_size);
|
||||||
|
out_free_kmem:
|
||||||
kmem_cache_free(ecryptfs_header_cache_2, page_virt);
|
kmem_cache_free(ecryptfs_header_cache_2, page_virt);
|
||||||
goto out;
|
goto out;
|
||||||
|
|
||||||
out_dput:
|
out_dput:
|
||||||
dput(lower_dentry);
|
dput(lower_dentry);
|
||||||
d_drop(dentry);
|
d_drop(ecryptfs_dentry);
|
||||||
out:
|
out:
|
||||||
|
return rc;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* ecryptfs_lookup
|
||||||
|
* @ecryptfs_dir_inode: The eCryptfs directory inode
|
||||||
|
* @ecryptfs_dentry: The eCryptfs dentry that we are looking up
|
||||||
|
* @ecryptfs_nd: nameidata; may be NULL
|
||||||
|
*
|
||||||
|
* Find a file on disk. If the file does not exist, then we'll add it to the
|
||||||
|
* dentry cache and continue on to read it from the disk.
|
||||||
|
*/
|
||||||
|
static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
|
||||||
|
struct dentry *ecryptfs_dentry,
|
||||||
|
struct nameidata *ecryptfs_nd)
|
||||||
|
{
|
||||||
|
char *encrypted_and_encoded_name = NULL;
|
||||||
|
int encrypted_and_encoded_name_size;
|
||||||
|
struct ecryptfs_crypt_stat *crypt_stat = NULL;
|
||||||
|
struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
|
||||||
|
struct ecryptfs_inode_info *inode_info;
|
||||||
|
struct dentry *lower_dir_dentry, *lower_dentry;
|
||||||
|
int rc = 0;
|
||||||
|
|
||||||
|
ecryptfs_dentry->d_op = &ecryptfs_dops;
|
||||||
|
if ((ecryptfs_dentry->d_name.len == 1
|
||||||
|
&& !strcmp(ecryptfs_dentry->d_name.name, "."))
|
||||||
|
|| (ecryptfs_dentry->d_name.len == 2
|
||||||
|
&& !strcmp(ecryptfs_dentry->d_name.name, ".."))) {
|
||||||
|
goto out_d_drop;
|
||||||
|
}
|
||||||
|
lower_dir_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry->d_parent);
|
||||||
|
lower_dentry = lookup_one_len(ecryptfs_dentry->d_name.name,
|
||||||
|
lower_dir_dentry,
|
||||||
|
ecryptfs_dentry->d_name.len);
|
||||||
|
if (IS_ERR(lower_dentry)) {
|
||||||
|
rc = PTR_ERR(lower_dentry);
|
||||||
|
printk(KERN_ERR "%s: lookup_one_len() returned [%d] on "
|
||||||
|
"lower_dentry = [%s]\n", __func__, rc,
|
||||||
|
ecryptfs_dentry->d_name.name);
|
||||||
|
goto out_d_drop;
|
||||||
|
}
|
||||||
|
if (lower_dentry->d_inode)
|
||||||
|
goto lookup_and_interpose;
|
||||||
|
inode_info = ecryptfs_inode_to_private(ecryptfs_dentry->d_inode);
|
||||||
|
if (inode_info) {
|
||||||
|
crypt_stat = &inode_info->crypt_stat;
|
||||||
|
/* TODO: lock for crypt_stat comparison */
|
||||||
|
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
|
||||||
|
ecryptfs_set_default_sizes(crypt_stat);
|
||||||
|
}
|
||||||
|
if (crypt_stat)
|
||||||
|
mount_crypt_stat = crypt_stat->mount_crypt_stat;
|
||||||
|
else
|
||||||
|
mount_crypt_stat = &ecryptfs_superblock_to_private(
|
||||||
|
ecryptfs_dentry->d_sb)->mount_crypt_stat;
|
||||||
|
if (!(crypt_stat && (crypt_stat->flags & ECRYPTFS_ENCRYPT_FILENAMES))
|
||||||
|
&& !(mount_crypt_stat && (mount_crypt_stat->flags
|
||||||
|
& ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)))
|
||||||
|
goto lookup_and_interpose;
|
||||||
|
dput(lower_dentry);
|
||||||
|
rc = ecryptfs_encrypt_and_encode_filename(
|
||||||
|
&encrypted_and_encoded_name, &encrypted_and_encoded_name_size,
|
||||||
|
crypt_stat, mount_crypt_stat, ecryptfs_dentry->d_name.name,
|
||||||
|
ecryptfs_dentry->d_name.len);
|
||||||
|
if (rc) {
|
||||||
|
printk(KERN_ERR "%s: Error attempting to encrypt and encode "
|
||||||
|
"filename; rc = [%d]\n", __func__, rc);
|
||||||
|
goto out_d_drop;
|
||||||
|
}
|
||||||
|
lower_dentry = lookup_one_len(encrypted_and_encoded_name,
|
||||||
|
lower_dir_dentry,
|
||||||
|
encrypted_and_encoded_name_size - 1);
|
||||||
|
if (IS_ERR(lower_dentry)) {
|
||||||
|
rc = PTR_ERR(lower_dentry);
|
||||||
|
printk(KERN_ERR "%s: lookup_one_len() returned [%d] on "
|
||||||
|
"lower_dentry = [%s]\n", __func__, rc,
|
||||||
|
encrypted_and_encoded_name);
|
||||||
|
goto out_d_drop;
|
||||||
|
}
|
||||||
|
lookup_and_interpose:
|
||||||
|
rc = ecryptfs_lookup_and_interpose_lower(ecryptfs_dentry, lower_dentry,
|
||||||
|
crypt_stat, ecryptfs_dir_inode,
|
||||||
|
ecryptfs_nd);
|
||||||
|
goto out;
|
||||||
|
out_d_drop:
|
||||||
|
d_drop(ecryptfs_dentry);
|
||||||
|
out:
|
||||||
|
kfree(encrypted_and_encoded_name);
|
||||||
return ERR_PTR(rc);
|
return ERR_PTR(rc);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -466,19 +504,21 @@ static int ecryptfs_symlink(struct inode *dir, struct dentry *dentry,
|
||||||
struct dentry *lower_dentry;
|
struct dentry *lower_dentry;
|
||||||
struct dentry *lower_dir_dentry;
|
struct dentry *lower_dir_dentry;
|
||||||
char *encoded_symname;
|
char *encoded_symname;
|
||||||
int encoded_symlen;
|
size_t encoded_symlen;
|
||||||
struct ecryptfs_crypt_stat *crypt_stat = NULL;
|
struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
|
||||||
|
|
||||||
lower_dentry = ecryptfs_dentry_to_lower(dentry);
|
lower_dentry = ecryptfs_dentry_to_lower(dentry);
|
||||||
dget(lower_dentry);
|
dget(lower_dentry);
|
||||||
lower_dir_dentry = lock_parent(lower_dentry);
|
lower_dir_dentry = lock_parent(lower_dentry);
|
||||||
encoded_symlen = ecryptfs_encode_filename(crypt_stat, symname,
|
mount_crypt_stat = &ecryptfs_superblock_to_private(
|
||||||
strlen(symname),
|
dir->i_sb)->mount_crypt_stat;
|
||||||
&encoded_symname);
|
rc = ecryptfs_encrypt_and_encode_filename(&encoded_symname,
|
||||||
if (encoded_symlen < 0) {
|
&encoded_symlen,
|
||||||
rc = encoded_symlen;
|
NULL,
|
||||||
|
mount_crypt_stat, symname,
|
||||||
|
strlen(symname));
|
||||||
|
if (rc)
|
||||||
goto out_lock;
|
goto out_lock;
|
||||||
}
|
|
||||||
rc = vfs_symlink(lower_dir_dentry->d_inode, lower_dentry,
|
rc = vfs_symlink(lower_dir_dentry->d_inode, lower_dentry,
|
||||||
encoded_symname);
|
encoded_symname);
|
||||||
kfree(encoded_symname);
|
kfree(encoded_symname);
|
||||||
|
@ -602,52 +642,54 @@ out_lock:
|
||||||
}
|
}
|
||||||
|
|
||||||
static int
|
static int
|
||||||
ecryptfs_readlink(struct dentry *dentry, char __user * buf, int bufsiz)
|
ecryptfs_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
|
||||||
{
|
{
|
||||||
int rc;
|
|
||||||
struct dentry *lower_dentry;
|
|
||||||
char *decoded_name;
|
|
||||||
char *lower_buf;
|
char *lower_buf;
|
||||||
mm_segment_t old_fs;
|
struct dentry *lower_dentry;
|
||||||
struct ecryptfs_crypt_stat *crypt_stat;
|
struct ecryptfs_crypt_stat *crypt_stat;
|
||||||
|
char *plaintext_name;
|
||||||
|
size_t plaintext_name_size;
|
||||||
|
mm_segment_t old_fs;
|
||||||
|
int rc;
|
||||||
|
|
||||||
lower_dentry = ecryptfs_dentry_to_lower(dentry);
|
lower_dentry = ecryptfs_dentry_to_lower(dentry);
|
||||||
if (!lower_dentry->d_inode->i_op->readlink) {
|
if (!lower_dentry->d_inode->i_op->readlink) {
|
||||||
rc = -EINVAL;
|
rc = -EINVAL;
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
|
crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
|
||||||
/* Released in this function */
|
/* Released in this function */
|
||||||
lower_buf = kmalloc(bufsiz, GFP_KERNEL);
|
lower_buf = kmalloc(bufsiz, GFP_KERNEL);
|
||||||
if (lower_buf == NULL) {
|
if (lower_buf == NULL) {
|
||||||
ecryptfs_printk(KERN_ERR, "Out of memory\n");
|
printk(KERN_ERR "%s: Out of memory whilst attempting to "
|
||||||
|
"kmalloc [%d] bytes\n", __func__, bufsiz);
|
||||||
rc = -ENOMEM;
|
rc = -ENOMEM;
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
old_fs = get_fs();
|
old_fs = get_fs();
|
||||||
set_fs(get_ds());
|
set_fs(get_ds());
|
||||||
ecryptfs_printk(KERN_DEBUG, "Calling readlink w/ "
|
|
||||||
"lower_dentry->d_name.name = [%s]\n",
|
|
||||||
lower_dentry->d_name.name);
|
|
||||||
rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
|
rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
|
||||||
(char __user *)lower_buf,
|
(char __user *)lower_buf,
|
||||||
bufsiz);
|
bufsiz);
|
||||||
set_fs(old_fs);
|
set_fs(old_fs);
|
||||||
if (rc >= 0) {
|
if (rc >= 0) {
|
||||||
crypt_stat = NULL;
|
rc = ecryptfs_decode_and_decrypt_filename(&plaintext_name,
|
||||||
rc = ecryptfs_decode_filename(crypt_stat, lower_buf, rc,
|
&plaintext_name_size,
|
||||||
&decoded_name);
|
dentry, lower_buf,
|
||||||
if (rc == -ENOMEM)
|
rc);
|
||||||
|
if (rc) {
|
||||||
|
printk(KERN_ERR "%s: Error attempting to decode and "
|
||||||
|
"decrypt filename; rc = [%d]\n", __func__,
|
||||||
|
rc);
|
||||||
goto out_free_lower_buf;
|
goto out_free_lower_buf;
|
||||||
if (rc > 0) {
|
|
||||||
ecryptfs_printk(KERN_DEBUG, "Copying [%d] bytes "
|
|
||||||
"to userspace: [%*s]\n", rc,
|
|
||||||
decoded_name);
|
|
||||||
if (copy_to_user(buf, decoded_name, rc))
|
|
||||||
rc = -EFAULT;
|
|
||||||
}
|
}
|
||||||
kfree(decoded_name);
|
rc = copy_to_user(buf, plaintext_name, plaintext_name_size);
|
||||||
fsstack_copy_attr_atime(dentry->d_inode,
|
if (rc)
|
||||||
lower_dentry->d_inode);
|
rc = -EFAULT;
|
||||||
|
else
|
||||||
|
rc = plaintext_name_size;
|
||||||
|
kfree(plaintext_name);
|
||||||
|
fsstack_copy_attr_atime(dentry->d_inode, lower_dentry->d_inode);
|
||||||
}
|
}
|
||||||
out_free_lower_buf:
|
out_free_lower_buf:
|
||||||
kfree(lower_buf);
|
kfree(lower_buf);
|
||||||
|
@ -669,8 +711,6 @@ static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
|
||||||
}
|
}
|
||||||
old_fs = get_fs();
|
old_fs = get_fs();
|
||||||
set_fs(get_ds());
|
set_fs(get_ds());
|
||||||
ecryptfs_printk(KERN_DEBUG, "Calling readlink w/ "
|
|
||||||
"dentry->d_name.name = [%s]\n", dentry->d_name.name);
|
|
||||||
rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
|
rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
|
||||||
set_fs(old_fs);
|
set_fs(old_fs);
|
||||||
if (rc < 0)
|
if (rc < 0)
|
||||||
|
|
Loading…
Reference in New Issue