Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * eCryptfs: Linux filesystem encryption layer
4 *
5 * Copyright (C) 1997-2004 Erez Zadok
6 * Copyright (C) 2001-2004 Stony Brook University
7 * Copyright (C) 2004-2007 International Business Machines Corp.
8 * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>
9 * Michael C. Thompsion <mcthomps@us.ibm.com>
10 */
11
12#include <linux/file.h>
13#include <linux/vmalloc.h>
14#include <linux/pagemap.h>
15#include <linux/dcache.h>
16#include <linux/namei.h>
17#include <linux/mount.h>
18#include <linux/fs_stack.h>
19#include <linux/slab.h>
20#include <linux/xattr.h>
21#include <linux/posix_acl.h>
22#include <linux/posix_acl_xattr.h>
23#include <linux/fileattr.h>
24#include <linux/unaligned.h>
25#include "ecryptfs_kernel.h"
26
27static struct dentry *ecryptfs_start_creating_dentry(struct dentry *dentry)
28{
29 struct dentry *parent = dget_parent(dentry);
30 struct dentry *ret;
31
32 ret = start_creating_dentry(ecryptfs_dentry_to_lower(parent),
33 ecryptfs_dentry_to_lower(dentry));
34 dput(parent);
35 return ret;
36}
37
38static struct dentry *ecryptfs_start_removing_dentry(struct dentry *dentry)
39{
40 struct dentry *parent = dget_parent(dentry);
41 struct dentry *ret;
42
43 ret = start_removing_dentry(ecryptfs_dentry_to_lower(parent),
44 ecryptfs_dentry_to_lower(dentry));
45 dput(parent);
46 return ret;
47}
48
49static int ecryptfs_inode_test(struct inode *inode, void *lower_inode)
50{
51 return ecryptfs_inode_to_lower(inode) == lower_inode;
52}
53
54static int ecryptfs_inode_set(struct inode *inode, void *opaque)
55{
56 struct inode *lower_inode = opaque;
57
58 ecryptfs_set_inode_lower(inode, lower_inode);
59 fsstack_copy_attr_all(inode, lower_inode);
60 /* i_size will be overwritten for encrypted regular files */
61 fsstack_copy_inode_size(inode, lower_inode);
62 inode->i_ino = lower_inode->i_ino;
63 inode->i_mapping->a_ops = &ecryptfs_aops;
64
65 if (S_ISLNK(inode->i_mode))
66 inode->i_op = &ecryptfs_symlink_iops;
67 else if (S_ISDIR(inode->i_mode))
68 inode->i_op = &ecryptfs_dir_iops;
69 else
70 inode->i_op = &ecryptfs_main_iops;
71
72 if (S_ISDIR(inode->i_mode))
73 inode->i_fop = &ecryptfs_dir_fops;
74 else if (special_file(inode->i_mode))
75 init_special_inode(inode, inode->i_mode, inode->i_rdev);
76 else
77 inode->i_fop = &ecryptfs_main_fops;
78
79 return 0;
80}
81
82static struct inode *__ecryptfs_get_inode(struct inode *lower_inode,
83 struct super_block *sb)
84{
85 struct inode *inode;
86
87 if (lower_inode->i_sb != ecryptfs_superblock_to_lower(sb))
88 return ERR_PTR(-EXDEV);
89
90 /* Reject dealing with casefold directories. */
91 if (IS_CASEFOLDED(lower_inode)) {
92 pr_err_ratelimited("%s: Can't handle casefolded directory.\n",
93 __func__);
94 return ERR_PTR(-EREMOTE);
95 }
96
97 if (!igrab(lower_inode))
98 return ERR_PTR(-ESTALE);
99 inode = iget5_locked(sb, (unsigned long)lower_inode,
100 ecryptfs_inode_test, ecryptfs_inode_set,
101 lower_inode);
102 if (!inode) {
103 iput(lower_inode);
104 return ERR_PTR(-EACCES);
105 }
106 if (!(inode_state_read_once(inode) & I_NEW))
107 iput(lower_inode);
108
109 return inode;
110}
111
112struct inode *ecryptfs_get_inode(struct inode *lower_inode,
113 struct super_block *sb)
114{
115 struct inode *inode = __ecryptfs_get_inode(lower_inode, sb);
116
117 if (!IS_ERR(inode) && (inode_state_read_once(inode) & I_NEW))
118 unlock_new_inode(inode);
119
120 return inode;
121}
122
123/**
124 * ecryptfs_interpose
125 * @lower_dentry: Existing dentry in the lower filesystem
126 * @dentry: ecryptfs' dentry
127 * @sb: ecryptfs's super_block
128 *
129 * Interposes upper and lower dentries.
130 *
131 * Returns zero on success; non-zero otherwise
132 */
133static int ecryptfs_interpose(struct dentry *lower_dentry,
134 struct dentry *dentry, struct super_block *sb)
135{
136 struct inode *inode = ecryptfs_get_inode(d_inode(lower_dentry), sb);
137
138 if (IS_ERR(inode))
139 return PTR_ERR(inode);
140 d_instantiate(dentry, inode);
141
142 return 0;
143}
144
145static int ecryptfs_do_unlink(struct inode *dir, struct dentry *dentry,
146 struct inode *inode)
147{
148 struct dentry *lower_dentry;
149 struct inode *lower_dir;
150 int rc;
151
152 lower_dentry = ecryptfs_start_removing_dentry(dentry);
153 if (IS_ERR(lower_dentry))
154 return PTR_ERR(lower_dentry);
155
156 lower_dir = lower_dentry->d_parent->d_inode;
157 rc = vfs_unlink(&nop_mnt_idmap, lower_dir, lower_dentry, NULL);
158 if (rc) {
159 printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
160 goto out_unlock;
161 }
162 fsstack_copy_attr_times(dir, lower_dir);
163 set_nlink(inode, ecryptfs_inode_to_lower(inode)->i_nlink);
164 inode_set_ctime_to_ts(inode, inode_get_ctime(dir));
165out_unlock:
166 end_removing(lower_dentry);
167 if (!rc)
168 d_drop(dentry);
169 return rc;
170}
171
172/**
173 * ecryptfs_do_create
174 * @directory_inode: inode of the new file's dentry's parent in ecryptfs
175 * @ecryptfs_dentry: New file's dentry in ecryptfs
176 * @mode: The mode of the new file
177 *
178 * Creates the underlying file and the eCryptfs inode which will link to
179 * it. It will also update the eCryptfs directory inode to mimic the
180 * stat of the lower directory inode.
181 *
182 * Returns the new eCryptfs inode on success; an ERR_PTR on error condition
183 */
184static struct inode *
185ecryptfs_do_create(struct inode *directory_inode,
186 struct dentry *ecryptfs_dentry, umode_t mode)
187{
188 int rc;
189 struct dentry *lower_dentry;
190 struct inode *lower_dir;
191 struct inode *inode;
192
193 lower_dentry = ecryptfs_start_creating_dentry(ecryptfs_dentry);
194 if (IS_ERR(lower_dentry))
195 return ERR_CAST(lower_dentry);
196 lower_dir = lower_dentry->d_parent->d_inode;
197 rc = vfs_create(&nop_mnt_idmap, lower_dentry, mode, NULL);
198 if (rc) {
199 printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
200 "rc = [%d]\n", __func__, rc);
201 inode = ERR_PTR(rc);
202 goto out_lock;
203 }
204 inode = __ecryptfs_get_inode(d_inode(lower_dentry),
205 directory_inode->i_sb);
206 if (IS_ERR(inode)) {
207 vfs_unlink(&nop_mnt_idmap, lower_dir, lower_dentry, NULL);
208 goto out_lock;
209 }
210 fsstack_copy_attr_times(directory_inode, lower_dir);
211 fsstack_copy_inode_size(directory_inode, lower_dir);
212out_lock:
213 end_creating(lower_dentry);
214 return inode;
215}
216
217/*
218 * ecryptfs_initialize_file
219 *
220 * Cause the file to be changed from a basic empty file to an ecryptfs
221 * file with a header and first data page.
222 *
223 * Returns zero on success
224 */
225int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry,
226 struct inode *ecryptfs_inode)
227{
228 struct ecryptfs_crypt_stat *crypt_stat =
229 &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
230 int rc = 0;
231
232 if (S_ISDIR(ecryptfs_inode->i_mode)) {
233 ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
234 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
235 goto out;
236 }
237 ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n");
238 rc = ecryptfs_new_file_context(ecryptfs_inode);
239 if (rc) {
240 ecryptfs_printk(KERN_ERR, "Error creating new file "
241 "context; rc = [%d]\n", rc);
242 goto out;
243 }
244 rc = ecryptfs_get_lower_file(ecryptfs_dentry, ecryptfs_inode);
245 if (rc) {
246 printk(KERN_ERR "%s: Error attempting to initialize "
247 "the lower file for the dentry with name "
248 "[%pd]; rc = [%d]\n", __func__,
249 ecryptfs_dentry, rc);
250 goto out;
251 }
252 rc = ecryptfs_write_metadata(ecryptfs_dentry, ecryptfs_inode);
253 if (rc)
254 printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
255 ecryptfs_put_lower_file(ecryptfs_inode);
256out:
257 return rc;
258}
259
260/*
261 * ecryptfs_create
262 * @mode: The mode of the new file.
263 *
264 * Creates a new file.
265 *
266 * Returns zero on success; non-zero on error condition
267 */
268static int
269ecryptfs_create(struct mnt_idmap *idmap,
270 struct inode *directory_inode, struct dentry *ecryptfs_dentry,
271 umode_t mode, bool excl)
272{
273 struct inode *ecryptfs_inode;
274 int rc;
275
276 ecryptfs_inode = ecryptfs_do_create(directory_inode, ecryptfs_dentry,
277 mode);
278 if (IS_ERR(ecryptfs_inode)) {
279 ecryptfs_printk(KERN_WARNING, "Failed to create file in"
280 "lower filesystem\n");
281 rc = PTR_ERR(ecryptfs_inode);
282 goto out;
283 }
284 /* At this point, a file exists on "disk"; we need to make sure
285 * that this on disk file is prepared to be an ecryptfs file */
286 rc = ecryptfs_initialize_file(ecryptfs_dentry, ecryptfs_inode);
287 if (rc) {
288 ecryptfs_do_unlink(directory_inode, ecryptfs_dentry,
289 ecryptfs_inode);
290 iget_failed(ecryptfs_inode);
291 goto out;
292 }
293 d_instantiate_new(ecryptfs_dentry, ecryptfs_inode);
294out:
295 return rc;
296}
297
298static int ecryptfs_i_size_read(struct dentry *dentry, struct inode *inode)
299{
300 struct ecryptfs_crypt_stat *crypt_stat;
301 int rc;
302
303 rc = ecryptfs_get_lower_file(dentry, inode);
304 if (rc) {
305 printk(KERN_ERR "%s: Error attempting to initialize "
306 "the lower file for the dentry with name "
307 "[%pd]; rc = [%d]\n", __func__,
308 dentry, rc);
309 return rc;
310 }
311
312 crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
313 /* TODO: lock for crypt_stat comparison */
314 if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
315 ecryptfs_set_default_sizes(crypt_stat);
316
317 rc = ecryptfs_read_and_validate_header_region(inode);
318 ecryptfs_put_lower_file(inode);
319 if (rc) {
320 rc = ecryptfs_read_and_validate_xattr_region(dentry, inode);
321 if (!rc)
322 crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
323 }
324
325 /* Must return 0 to allow non-eCryptfs files to be looked up, too */
326 return 0;
327}
328
329/*
330 * ecryptfs_lookup_interpose - Dentry interposition for a lookup
331 */
332static struct dentry *ecryptfs_lookup_interpose(struct dentry *dentry,
333 struct dentry *lower_dentry)
334{
335 struct dentry *lower_parent = ecryptfs_dentry_to_lower(dentry->d_parent);
336 struct inode *inode, *lower_inode;
337 int rc = 0;
338
339 fsstack_copy_attr_atime(d_inode(dentry->d_parent),
340 d_inode(lower_parent));
341 BUG_ON(!d_count(lower_dentry));
342
343 ecryptfs_set_dentry_lower(dentry, lower_dentry);
344
345 /*
346 * negative dentry can go positive under us here - its parent is not
347 * locked. That's OK and that could happen just as we return from
348 * ecryptfs_lookup() anyway. Just need to be careful and fetch
349 * ->d_inode only once - it's not stable here.
350 */
351 lower_inode = READ_ONCE(lower_dentry->d_inode);
352
353 if (!lower_inode) {
354 /* We want to add because we couldn't find in lower */
355 d_add(dentry, NULL);
356 return NULL;
357 }
358 inode = __ecryptfs_get_inode(lower_inode, dentry->d_sb);
359 if (IS_ERR(inode)) {
360 printk(KERN_ERR "%s: Error interposing; rc = [%ld]\n",
361 __func__, PTR_ERR(inode));
362 return ERR_CAST(inode);
363 }
364 if (S_ISREG(inode->i_mode)) {
365 rc = ecryptfs_i_size_read(dentry, inode);
366 if (rc) {
367 make_bad_inode(inode);
368 return ERR_PTR(rc);
369 }
370 }
371
372 if (inode_state_read_once(inode) & I_NEW)
373 unlock_new_inode(inode);
374 return d_splice_alias(inode, dentry);
375}
376
377/**
378 * ecryptfs_lookup
379 * @ecryptfs_dir_inode: The eCryptfs directory inode
380 * @ecryptfs_dentry: The eCryptfs dentry that we are looking up
381 * @flags: lookup flags
382 *
383 * Find a file on disk. If the file does not exist, then we'll add it to the
384 * dentry cache and continue on to read it from the disk.
385 */
386static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
387 struct dentry *ecryptfs_dentry,
388 unsigned int flags)
389{
390 char *encrypted_and_encoded_name = NULL;
391 struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
392 struct dentry *lower_dir_dentry, *lower_dentry;
393 struct qstr qname = QSTR_INIT(ecryptfs_dentry->d_name.name,
394 ecryptfs_dentry->d_name.len);
395 struct dentry *res;
396 int rc = 0;
397
398 lower_dir_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry->d_parent);
399
400 mount_crypt_stat = &ecryptfs_superblock_to_private(
401 ecryptfs_dentry->d_sb)->mount_crypt_stat;
402 if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
403 size_t len = qname.len;
404 rc = ecryptfs_encrypt_and_encode_filename(
405 &encrypted_and_encoded_name, &len,
406 mount_crypt_stat, qname.name, len);
407 if (rc) {
408 printk(KERN_ERR "%s: Error attempting to encrypt and encode "
409 "filename; rc = [%d]\n", __func__, rc);
410 return ERR_PTR(rc);
411 }
412 qname.name = encrypted_and_encoded_name;
413 qname.len = len;
414 }
415
416 lower_dentry = lookup_noperm_unlocked(&qname, lower_dir_dentry);
417 if (IS_ERR(lower_dentry)) {
418 ecryptfs_printk(KERN_DEBUG, "%s: lookup_noperm() returned "
419 "[%ld] on lower_dentry = [%s]\n", __func__,
420 PTR_ERR(lower_dentry),
421 qname.name);
422 res = ERR_CAST(lower_dentry);
423 } else {
424 res = ecryptfs_lookup_interpose(ecryptfs_dentry, lower_dentry);
425 }
426 kfree(encrypted_and_encoded_name);
427 return res;
428}
429
430static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir,
431 struct dentry *new_dentry)
432{
433 struct dentry *lower_old_dentry;
434 struct dentry *lower_new_dentry;
435 struct inode *lower_dir;
436 u64 file_size_save;
437 int rc;
438
439 file_size_save = i_size_read(d_inode(old_dentry));
440 lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
441 lower_new_dentry = ecryptfs_start_creating_dentry(new_dentry);
442 if (IS_ERR(lower_new_dentry))
443 return PTR_ERR(lower_new_dentry);
444 lower_dir = lower_new_dentry->d_parent->d_inode;
445 rc = vfs_link(lower_old_dentry, &nop_mnt_idmap, lower_dir,
446 lower_new_dentry, NULL);
447 if (rc || d_really_is_negative(lower_new_dentry))
448 goto out_lock;
449 rc = ecryptfs_interpose(lower_new_dentry, new_dentry, dir->i_sb);
450 if (rc)
451 goto out_lock;
452 fsstack_copy_attr_times(dir, lower_dir);
453 fsstack_copy_inode_size(dir, lower_dir);
454 set_nlink(d_inode(old_dentry),
455 ecryptfs_inode_to_lower(d_inode(old_dentry))->i_nlink);
456 i_size_write(d_inode(new_dentry), file_size_save);
457out_lock:
458 end_creating(lower_new_dentry);
459 return rc;
460}
461
462static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
463{
464 return ecryptfs_do_unlink(dir, dentry, d_inode(dentry));
465}
466
467static int ecryptfs_symlink(struct mnt_idmap *idmap,
468 struct inode *dir, struct dentry *dentry,
469 const char *symname)
470{
471 int rc;
472 struct dentry *lower_dentry;
473 struct inode *lower_dir;
474 char *encoded_symname;
475 size_t encoded_symlen;
476 struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
477
478 lower_dentry = ecryptfs_start_creating_dentry(dentry);
479 if (IS_ERR(lower_dentry))
480 return PTR_ERR(lower_dentry);
481 lower_dir = lower_dentry->d_parent->d_inode;
482
483 mount_crypt_stat = &ecryptfs_superblock_to_private(
484 dir->i_sb)->mount_crypt_stat;
485 rc = ecryptfs_encrypt_and_encode_filename(&encoded_symname,
486 &encoded_symlen,
487 mount_crypt_stat, symname,
488 strlen(symname));
489 if (rc)
490 goto out_lock;
491 rc = vfs_symlink(&nop_mnt_idmap, lower_dir, lower_dentry,
492 encoded_symname, NULL);
493 kfree(encoded_symname);
494 if (rc || d_really_is_negative(lower_dentry))
495 goto out_lock;
496 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
497 if (rc)
498 goto out_lock;
499 fsstack_copy_attr_times(dir, lower_dir);
500 fsstack_copy_inode_size(dir, lower_dir);
501out_lock:
502 end_creating(lower_dentry);
503 if (d_really_is_negative(dentry))
504 d_drop(dentry);
505 return rc;
506}
507
508static struct dentry *ecryptfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
509 struct dentry *dentry, umode_t mode)
510{
511 int rc;
512 struct dentry *lower_dentry;
513 struct dentry *lower_dir_dentry;
514 struct inode *lower_dir;
515
516 lower_dentry = ecryptfs_start_creating_dentry(dentry);
517 if (IS_ERR(lower_dentry))
518 return lower_dentry;
519 lower_dir_dentry = dget(lower_dentry->d_parent);
520 lower_dir = lower_dir_dentry->d_inode;
521 lower_dentry = vfs_mkdir(&nop_mnt_idmap, lower_dir,
522 lower_dentry, mode, NULL);
523 rc = PTR_ERR(lower_dentry);
524 if (IS_ERR(lower_dentry))
525 goto out;
526 rc = 0;
527 if (d_unhashed(lower_dentry))
528 goto out;
529 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
530 if (rc)
531 goto out;
532 fsstack_copy_attr_times(dir, lower_dir);
533 fsstack_copy_inode_size(dir, lower_dir);
534 set_nlink(dir, lower_dir->i_nlink);
535out:
536 dput(lower_dir_dentry);
537 end_creating(lower_dentry);
538 if (d_really_is_negative(dentry))
539 d_drop(dentry);
540 return ERR_PTR(rc);
541}
542
543static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry)
544{
545 struct dentry *lower_dentry;
546 struct inode *lower_dir;
547 int rc;
548
549 lower_dentry = ecryptfs_start_removing_dentry(dentry);
550 if (IS_ERR(lower_dentry))
551 return PTR_ERR(lower_dentry);
552 lower_dir = lower_dentry->d_parent->d_inode;
553
554 rc = vfs_rmdir(&nop_mnt_idmap, lower_dir, lower_dentry, NULL);
555 if (!rc) {
556 clear_nlink(d_inode(dentry));
557 fsstack_copy_attr_times(dir, lower_dir);
558 set_nlink(dir, lower_dir->i_nlink);
559 }
560 end_removing(lower_dentry);
561 if (!rc)
562 d_drop(dentry);
563 return rc;
564}
565
566static int
567ecryptfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
568 struct dentry *dentry, umode_t mode, dev_t dev)
569{
570 int rc;
571 struct dentry *lower_dentry;
572 struct inode *lower_dir;
573
574 lower_dentry = ecryptfs_start_creating_dentry(dentry);
575 if (IS_ERR(lower_dentry))
576 return PTR_ERR(lower_dentry);
577 lower_dir = lower_dentry->d_parent->d_inode;
578
579 rc = vfs_mknod(&nop_mnt_idmap, lower_dir, lower_dentry, mode, dev, NULL);
580 if (rc || d_really_is_negative(lower_dentry))
581 goto out;
582 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
583 if (rc)
584 goto out;
585 fsstack_copy_attr_times(dir, lower_dir);
586 fsstack_copy_inode_size(dir, lower_dir);
587out:
588 end_creating(lower_dentry);
589 if (d_really_is_negative(dentry))
590 d_drop(dentry);
591 return rc;
592}
593
594static int
595ecryptfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
596 struct dentry *old_dentry, struct inode *new_dir,
597 struct dentry *new_dentry, unsigned int flags)
598{
599 int rc;
600 struct dentry *lower_old_dentry;
601 struct dentry *lower_new_dentry;
602 struct dentry *lower_old_dir_dentry;
603 struct dentry *lower_new_dir_dentry;
604 struct inode *target_inode;
605 struct renamedata rd = {};
606
607 if (flags)
608 return -EINVAL;
609
610 lower_old_dir_dentry = ecryptfs_dentry_to_lower(old_dentry->d_parent);
611 lower_new_dir_dentry = ecryptfs_dentry_to_lower(new_dentry->d_parent);
612
613 lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
614 lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
615
616 target_inode = d_inode(new_dentry);
617
618 rd.mnt_idmap = &nop_mnt_idmap;
619 rd.old_parent = lower_old_dir_dentry;
620 rd.new_parent = lower_new_dir_dentry;
621 rc = start_renaming_two_dentries(&rd, lower_old_dentry, lower_new_dentry);
622 if (rc)
623 return rc;
624
625 rc = vfs_rename(&rd);
626 if (rc)
627 goto out_lock;
628 if (target_inode)
629 fsstack_copy_attr_all(target_inode,
630 ecryptfs_inode_to_lower(target_inode));
631 fsstack_copy_attr_all(new_dir, d_inode(lower_new_dir_dentry));
632 if (new_dir != old_dir)
633 fsstack_copy_attr_all(old_dir, d_inode(lower_old_dir_dentry));
634out_lock:
635 end_renaming(&rd);
636 return rc;
637}
638
639static char *ecryptfs_readlink_lower(struct dentry *dentry, size_t *bufsiz)
640{
641 DEFINE_DELAYED_CALL(done);
642 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
643 const char *link;
644 char *buf;
645 int rc;
646
647 link = vfs_get_link(lower_dentry, &done);
648 if (IS_ERR(link))
649 return ERR_CAST(link);
650
651 rc = ecryptfs_decode_and_decrypt_filename(&buf, bufsiz, dentry->d_sb,
652 link, strlen(link));
653 do_delayed_call(&done);
654 if (rc)
655 return ERR_PTR(rc);
656
657 return buf;
658}
659
660static const char *ecryptfs_get_link(struct dentry *dentry,
661 struct inode *inode,
662 struct delayed_call *done)
663{
664 size_t len;
665 char *buf;
666
667 if (!dentry)
668 return ERR_PTR(-ECHILD);
669
670 buf = ecryptfs_readlink_lower(dentry, &len);
671 if (IS_ERR(buf))
672 return buf;
673 fsstack_copy_attr_atime(d_inode(dentry),
674 d_inode(ecryptfs_dentry_to_lower(dentry)));
675 buf[len] = '\0';
676 set_delayed_call(done, kfree_link, buf);
677 return buf;
678}
679
680static void ecryptfs_iattr_to_lower(struct iattr *lower_ia,
681 const struct iattr *ia)
682{
683 memcpy(lower_ia, ia, sizeof(*lower_ia));
684 if (ia->ia_valid & ATTR_FILE)
685 lower_ia->ia_file = ecryptfs_file_to_lower(ia->ia_file);
686 /*
687 * If the mode change is for clearing setuid/setgid bits, allow the lower
688 * file system to interpret this in its own way.
689 */
690 if (lower_ia->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
691 lower_ia->ia_valid &= ~ATTR_MODE;
692}
693
694/**
695 * upper_size_to_lower_size
696 * @crypt_stat: Crypt_stat associated with file
697 * @upper_size: Size of the upper file
698 *
699 * Calculate the required size of the lower file based on the
700 * specified size of the upper file. This calculation is based on the
701 * number of headers in the underlying file and the extent size.
702 *
703 * Returns Calculated size of the lower file.
704 */
705static loff_t
706upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat,
707 loff_t upper_size)
708{
709 loff_t lower_size;
710
711 lower_size = ecryptfs_lower_header_size(crypt_stat);
712 if (upper_size != 0) {
713 loff_t num_extents;
714
715 num_extents = upper_size >> crypt_stat->extent_shift;
716 if (upper_size & ~crypt_stat->extent_mask)
717 num_extents++;
718 lower_size += (num_extents * crypt_stat->extent_size);
719 }
720 return lower_size;
721}
722
723/**
724 * __ecryptfs_truncate
725 * @dentry: The ecryptfs layer dentry
726 * @ia: Address of the ecryptfs inode's attributes
727 *
728 * Handle truncations modifying the size of the file. Note that the file sizes
729 * are interpolated. When expanding, we are simply writing strings of 0's out.
730 * When truncating, we truncate the upper inode and update the lower_ia
731 * according to the page index interpolations.
732 *
733 * Returns zero on success; non-zero otherwise
734 */
735static int __ecryptfs_truncate(struct dentry *dentry, const struct iattr *ia)
736{
737 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
738 struct inode *inode = d_inode(dentry);
739 struct ecryptfs_crypt_stat *crypt_stat;
740 loff_t i_size = i_size_read(inode);
741 loff_t lower_size_before_truncate;
742 loff_t lower_size_after_truncate;
743 struct iattr lower_ia;
744 size_t num_zeros;
745 int rc;
746
747 ecryptfs_iattr_to_lower(&lower_ia, ia);
748
749 if (unlikely((ia->ia_size == i_size)))
750 return 0;
751
752 crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
753 lower_size_before_truncate =
754 upper_size_to_lower_size(crypt_stat, i_size);
755 lower_size_after_truncate =
756 upper_size_to_lower_size(crypt_stat, ia->ia_size);
757 if (lower_size_after_truncate > lower_size_before_truncate) {
758 /*
759 * The eCryptfs inode and the new *lower* size are mixed here
760 * because we may not have the lower i_mutex held and/or it may
761 * not be appropriate to call inode_newsize_ok() with inodes
762 * from other filesystems.
763 */
764 rc = inode_newsize_ok(inode, lower_size_after_truncate);
765 if (rc)
766 return rc;
767 }
768
769 rc = ecryptfs_get_lower_file(dentry, inode);
770 if (rc)
771 return rc;
772
773 if (ia->ia_size > i_size) {
774 char zero[] = { 0x00 };
775
776 /*
777 * Write a single 0 at the last position of the file; this
778 * triggers code that will fill in 0's throughout the
779 * intermediate portion of the previous end of the file and the
780 * new end of the file.
781 */
782 rc = ecryptfs_write(inode, zero, ia->ia_size - 1, 1);
783 goto out;
784 }
785
786 if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
787 truncate_setsize(inode, ia->ia_size);
788 lower_ia.ia_size = ia->ia_size;
789 goto set_size;
790 }
791
792 /*
793 * We're chopping off all the pages down to the page in which
794 * ia->ia_size is located. Fill in the end of that page from
795 * (ia->ia_size & ~PAGE_MASK) to PAGE_SIZE with zeros.
796 */
797 num_zeros = PAGE_SIZE - (ia->ia_size & ~PAGE_MASK);
798 if (num_zeros) {
799 rc = ecryptfs_write(inode, page_address(ZERO_PAGE(0)),
800 ia->ia_size, num_zeros);
801 if (rc) {
802 pr_err("Error attempting to zero out the remainder of the end page on reducing truncate; rc = [%d]\n",
803 rc);
804 goto out;
805 }
806 }
807 truncate_setsize(inode, ia->ia_size);
808 rc = ecryptfs_write_inode_size_to_metadata(inode);
809 if (rc) {
810 pr_err("Problem with ecryptfs_write_inode_size_to_metadata; rc = [%d]\n",
811 rc);
812 goto out;
813 }
814
815 /*
816 * We are reducing the size of the ecryptfs file, and need to know if we
817 * need to reduce the size of the lower file.
818 */
819 if (lower_size_after_truncate >= lower_size_before_truncate)
820 goto out;
821
822 lower_ia.ia_size = lower_size_after_truncate;
823set_size:
824 lower_ia.ia_valid |= ATTR_SIZE;
825 inode_lock(d_inode(lower_dentry));
826 rc = notify_change(&nop_mnt_idmap, lower_dentry, &lower_ia, NULL);
827 inode_unlock(d_inode(lower_dentry));
828out:
829 ecryptfs_put_lower_file(inode);
830 return rc;
831}
832
833/**
834 * ecryptfs_truncate
835 * @dentry: The ecryptfs layer dentry
836 * @new_length: The length to expand the file to
837 *
838 * Simple function that handles the truncation of an eCryptfs inode and
839 * its corresponding lower inode.
840 *
841 * Returns zero on success; non-zero otherwise
842 */
843int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
844{
845 const struct iattr ia = {
846 .ia_valid = ATTR_SIZE,
847 .ia_size = new_length,
848 };
849
850 return __ecryptfs_truncate(dentry, &ia);
851}
852
853static int
854ecryptfs_permission(struct mnt_idmap *idmap, struct inode *inode,
855 int mask)
856{
857 return inode_permission(&nop_mnt_idmap,
858 ecryptfs_inode_to_lower(inode), mask);
859}
860
861/**
862 * ecryptfs_setattr
863 * @idmap: idmap of the target mount
864 * @dentry: dentry handle to the inode to modify
865 * @ia: Structure with flags of what to change and values
866 *
867 * Updates the metadata of an inode. If the update is to the size
868 * i.e. truncation, then ecryptfs_truncate will handle the size modification
869 * of both the ecryptfs inode and the lower inode.
870 *
871 * All other metadata changes will be passed right to the lower filesystem,
872 * and we will just update our inode to look like the lower.
873 */
874static int ecryptfs_setattr(struct mnt_idmap *idmap,
875 struct dentry *dentry, struct iattr *ia)
876{
877 struct inode *inode = d_inode(dentry);
878 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
879 struct inode *lower_inode = ecryptfs_inode_to_lower(inode);
880 struct ecryptfs_crypt_stat *crypt_stat;
881 int rc;
882
883 crypt_stat = &ecryptfs_inode_to_private(d_inode(dentry))->crypt_stat;
884 if (!(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED))
885 ecryptfs_init_crypt_stat(crypt_stat);
886
887 mutex_lock(&crypt_stat->cs_mutex);
888 if (d_is_dir(dentry))
889 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
890 else if (d_is_reg(dentry) &&
891 (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED) ||
892 !(crypt_stat->flags & ECRYPTFS_KEY_VALID))) {
893 struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
894
895 mount_crypt_stat = &ecryptfs_superblock_to_private(
896 dentry->d_sb)->mount_crypt_stat;
897 rc = ecryptfs_get_lower_file(dentry, inode);
898 if (rc) {
899 mutex_unlock(&crypt_stat->cs_mutex);
900 goto out;
901 }
902 rc = ecryptfs_read_metadata(dentry);
903 ecryptfs_put_lower_file(inode);
904 if (rc) {
905 if (!(mount_crypt_stat->flags &
906 ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
907 rc = -EIO;
908 printk(KERN_WARNING "Either the lower file "
909 "is not in a valid eCryptfs format, "
910 "or the key could not be retrieved. "
911 "Plaintext passthrough mode is not "
912 "enabled; returning -EIO\n");
913 mutex_unlock(&crypt_stat->cs_mutex);
914 goto out;
915 }
916 rc = 0;
917 crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
918 | ECRYPTFS_ENCRYPTED);
919 }
920 }
921 mutex_unlock(&crypt_stat->cs_mutex);
922
923 rc = setattr_prepare(&nop_mnt_idmap, dentry, ia);
924 if (rc)
925 goto out;
926
927 if (ia->ia_valid & ATTR_SIZE) {
928 rc = __ecryptfs_truncate(dentry, ia);
929 } else {
930 struct iattr lower_ia;
931
932 ecryptfs_iattr_to_lower(&lower_ia, ia);
933
934 inode_lock(d_inode(lower_dentry));
935 rc = notify_change(&nop_mnt_idmap, lower_dentry, &lower_ia,
936 NULL);
937 inode_unlock(d_inode(lower_dentry));
938 }
939out:
940 fsstack_copy_attr_all(inode, lower_inode);
941 return rc;
942}
943
944static int ecryptfs_getattr_link(struct mnt_idmap *idmap,
945 const struct path *path, struct kstat *stat,
946 u32 request_mask, unsigned int flags)
947{
948 struct dentry *dentry = path->dentry;
949 struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
950 int rc = 0;
951
952 mount_crypt_stat = &ecryptfs_superblock_to_private(
953 dentry->d_sb)->mount_crypt_stat;
954 generic_fillattr(&nop_mnt_idmap, request_mask, d_inode(dentry), stat);
955 if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
956 char *target;
957 size_t targetsiz;
958
959 target = ecryptfs_readlink_lower(dentry, &targetsiz);
960 if (!IS_ERR(target)) {
961 kfree(target);
962 stat->size = targetsiz;
963 } else {
964 rc = PTR_ERR(target);
965 }
966 }
967 return rc;
968}
969
970static int ecryptfs_getattr(struct mnt_idmap *idmap,
971 const struct path *path, struct kstat *stat,
972 u32 request_mask, unsigned int flags)
973{
974 struct dentry *dentry = path->dentry;
975 struct kstat lower_stat;
976 struct path lower_path = ecryptfs_lower_path(dentry);
977 int rc;
978
979 rc = vfs_getattr_nosec(&lower_path, &lower_stat, request_mask, flags);
980 if (!rc) {
981 fsstack_copy_attr_all(d_inode(dentry),
982 ecryptfs_inode_to_lower(d_inode(dentry)));
983 generic_fillattr(&nop_mnt_idmap, request_mask,
984 d_inode(dentry), stat);
985 stat->blocks = lower_stat.blocks;
986 }
987 return rc;
988}
989
990int
991ecryptfs_setxattr(struct dentry *dentry, struct inode *inode,
992 const char *name, const void *value,
993 size_t size, int flags)
994{
995 int rc;
996 struct dentry *lower_dentry;
997 struct inode *lower_inode;
998
999 lower_dentry = ecryptfs_dentry_to_lower(dentry);
1000 lower_inode = d_inode(lower_dentry);
1001 if (!(lower_inode->i_opflags & IOP_XATTR)) {
1002 rc = -EOPNOTSUPP;
1003 goto out;
1004 }
1005 inode_lock(lower_inode);
1006 rc = __vfs_setxattr_locked(&nop_mnt_idmap, lower_dentry, name, value, size, flags, NULL);
1007 inode_unlock(lower_inode);
1008 if (!rc && inode)
1009 fsstack_copy_attr_all(inode, lower_inode);
1010out:
1011 return rc;
1012}
1013
1014ssize_t
1015ecryptfs_getxattr_lower(struct dentry *lower_dentry, struct inode *lower_inode,
1016 const char *name, void *value, size_t size)
1017{
1018 int rc;
1019
1020 if (!(lower_inode->i_opflags & IOP_XATTR)) {
1021 rc = -EOPNOTSUPP;
1022 goto out;
1023 }
1024 inode_lock(lower_inode);
1025 rc = __vfs_getxattr(lower_dentry, lower_inode, name, value, size);
1026 inode_unlock(lower_inode);
1027out:
1028 return rc;
1029}
1030
1031static ssize_t
1032ecryptfs_getxattr(struct dentry *dentry, struct inode *inode,
1033 const char *name, void *value, size_t size)
1034{
1035 return ecryptfs_getxattr_lower(ecryptfs_dentry_to_lower(dentry),
1036 ecryptfs_inode_to_lower(inode),
1037 name, value, size);
1038}
1039
1040static ssize_t
1041ecryptfs_listxattr(struct dentry *dentry, char *list, size_t size)
1042{
1043 int rc = 0;
1044 struct dentry *lower_dentry;
1045
1046 lower_dentry = ecryptfs_dentry_to_lower(dentry);
1047 if (!d_inode(lower_dentry)->i_op->listxattr) {
1048 rc = -EOPNOTSUPP;
1049 goto out;
1050 }
1051 inode_lock(d_inode(lower_dentry));
1052 rc = d_inode(lower_dentry)->i_op->listxattr(lower_dentry, list, size);
1053 inode_unlock(d_inode(lower_dentry));
1054out:
1055 return rc;
1056}
1057
1058static int ecryptfs_removexattr(struct dentry *dentry, struct inode *inode,
1059 const char *name)
1060{
1061 int rc;
1062 struct dentry *lower_dentry;
1063 struct inode *lower_inode;
1064
1065 lower_dentry = ecryptfs_dentry_to_lower(dentry);
1066 lower_inode = ecryptfs_inode_to_lower(inode);
1067 if (!(lower_inode->i_opflags & IOP_XATTR)) {
1068 rc = -EOPNOTSUPP;
1069 goto out;
1070 }
1071 inode_lock(lower_inode);
1072 rc = __vfs_removexattr(&nop_mnt_idmap, lower_dentry, name);
1073 inode_unlock(lower_inode);
1074out:
1075 return rc;
1076}
1077
1078static int ecryptfs_fileattr_get(struct dentry *dentry, struct file_kattr *fa)
1079{
1080 return vfs_fileattr_get(ecryptfs_dentry_to_lower(dentry), fa);
1081}
1082
1083static int ecryptfs_fileattr_set(struct mnt_idmap *idmap,
1084 struct dentry *dentry, struct file_kattr *fa)
1085{
1086 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
1087 int rc;
1088
1089 rc = vfs_fileattr_set(&nop_mnt_idmap, lower_dentry, fa);
1090 fsstack_copy_attr_all(d_inode(dentry), d_inode(lower_dentry));
1091
1092 return rc;
1093}
1094
1095static struct posix_acl *ecryptfs_get_acl(struct mnt_idmap *idmap,
1096 struct dentry *dentry, int type)
1097{
1098 return vfs_get_acl(idmap, ecryptfs_dentry_to_lower(dentry),
1099 posix_acl_xattr_name(type));
1100}
1101
1102static int ecryptfs_set_acl(struct mnt_idmap *idmap,
1103 struct dentry *dentry, struct posix_acl *acl,
1104 int type)
1105{
1106 int rc;
1107 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
1108 struct inode *lower_inode = d_inode(lower_dentry);
1109
1110 rc = vfs_set_acl(&nop_mnt_idmap, lower_dentry,
1111 posix_acl_xattr_name(type), acl);
1112 if (!rc)
1113 fsstack_copy_attr_all(d_inode(dentry), lower_inode);
1114 return rc;
1115}
1116
1117const struct inode_operations ecryptfs_symlink_iops = {
1118 .get_link = ecryptfs_get_link,
1119 .permission = ecryptfs_permission,
1120 .setattr = ecryptfs_setattr,
1121 .getattr = ecryptfs_getattr_link,
1122 .listxattr = ecryptfs_listxattr,
1123};
1124
1125const struct inode_operations ecryptfs_dir_iops = {
1126 .create = ecryptfs_create,
1127 .lookup = ecryptfs_lookup,
1128 .link = ecryptfs_link,
1129 .unlink = ecryptfs_unlink,
1130 .symlink = ecryptfs_symlink,
1131 .mkdir = ecryptfs_mkdir,
1132 .rmdir = ecryptfs_rmdir,
1133 .mknod = ecryptfs_mknod,
1134 .rename = ecryptfs_rename,
1135 .permission = ecryptfs_permission,
1136 .setattr = ecryptfs_setattr,
1137 .listxattr = ecryptfs_listxattr,
1138 .fileattr_get = ecryptfs_fileattr_get,
1139 .fileattr_set = ecryptfs_fileattr_set,
1140 .get_acl = ecryptfs_get_acl,
1141 .set_acl = ecryptfs_set_acl,
1142};
1143
1144const struct inode_operations ecryptfs_main_iops = {
1145 .permission = ecryptfs_permission,
1146 .setattr = ecryptfs_setattr,
1147 .getattr = ecryptfs_getattr,
1148 .listxattr = ecryptfs_listxattr,
1149 .fileattr_get = ecryptfs_fileattr_get,
1150 .fileattr_set = ecryptfs_fileattr_set,
1151 .get_acl = ecryptfs_get_acl,
1152 .set_acl = ecryptfs_set_acl,
1153};
1154
1155static int ecryptfs_xattr_get(const struct xattr_handler *handler,
1156 struct dentry *dentry, struct inode *inode,
1157 const char *name, void *buffer, size_t size)
1158{
1159 return ecryptfs_getxattr(dentry, inode, name, buffer, size);
1160}
1161
1162static int ecryptfs_xattr_set(const struct xattr_handler *handler,
1163 struct mnt_idmap *idmap,
1164 struct dentry *dentry, struct inode *inode,
1165 const char *name, const void *value, size_t size,
1166 int flags)
1167{
1168 if (value)
1169 return ecryptfs_setxattr(dentry, inode, name, value, size, flags);
1170 else {
1171 BUG_ON(flags != XATTR_REPLACE);
1172 return ecryptfs_removexattr(dentry, inode, name);
1173 }
1174}
1175
1176static const struct xattr_handler ecryptfs_xattr_handler = {
1177 .prefix = "", /* match anything */
1178 .get = ecryptfs_xattr_get,
1179 .set = ecryptfs_xattr_set,
1180};
1181
1182const struct xattr_handler * const ecryptfs_xattr_handlers[] = {
1183 &ecryptfs_xattr_handler,
1184 NULL
1185};