1 /** 2 * eCryptfs: Linux filesystem encryption layer 3 * 4 * Copyright (C) 1997-2004 Erez Zadok 5 * Copyright (C) 2001-2004 Stony Brook University 6 * Copyright (C) 2004-2007 International Business Machines Corp. 7 * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com> 8 * Michael C. Thompsion <mcthomps@us.ibm.com> 9 * 10 * This program is free software; you can redistribute it and/or 11 * modify it under the terms of the GNU General Public License as 12 * published by the Free Software Foundation; either version 2 of the 13 * License, or (at your option) any later version. 14 * 15 * This program is distributed in the hope that it will be useful, but 16 * WITHOUT ANY WARRANTY; without even the implied warranty of 17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 18 * General Public License for more details. 19 * 20 * You should have received a copy of the GNU General Public License 21 * along with this program; if not, write to the Free Software 22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 23 * 02111-1307, USA. 24 */ 25 26 #include <linux/file.h> 27 #include <linux/vmalloc.h> 28 #include <linux/pagemap.h> 29 #include <linux/dcache.h> 30 #include <linux/namei.h> 31 #include <linux/mount.h> 32 #include <linux/crypto.h> 33 #include <linux/fs_stack.h> 34 #include <linux/slab.h> 35 #include <linux/xattr.h> 36 #include <asm/unaligned.h> 37 #include "ecryptfs_kernel.h" 38 39 static struct dentry *lock_parent(struct dentry *dentry) 40 { 41 struct dentry *dir; 42 43 dir = dget_parent(dentry); 44 mutex_lock_nested(&(dir->d_inode->i_mutex), I_MUTEX_PARENT); 45 return dir; 46 } 47 48 static void unlock_dir(struct dentry *dir) 49 { 50 mutex_unlock(&dir->d_inode->i_mutex); 51 dput(dir); 52 } 53 54 /** 55 * ecryptfs_create_underlying_file 56 * @lower_dir_inode: inode of the parent in the lower fs of the new file 57 * @dentry: New file's dentry 58 * @mode: The mode of the new file 59 * @nd: nameidata of ecryptfs' parent's dentry & vfsmount 60 * 61 * Creates the file in the lower file system. 62 * 63 * Returns zero on success; non-zero on error condition 64 */ 65 static int 66 ecryptfs_create_underlying_file(struct inode *lower_dir_inode, 67 struct dentry *dentry, int mode, 68 struct nameidata *nd) 69 { 70 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry); 71 struct vfsmount *lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry); 72 struct dentry *dentry_save; 73 struct vfsmount *vfsmount_save; 74 unsigned int flags_save; 75 int rc; 76 77 if (nd) { 78 dentry_save = nd->path.dentry; 79 vfsmount_save = nd->path.mnt; 80 flags_save = nd->flags; 81 nd->path.dentry = lower_dentry; 82 nd->path.mnt = lower_mnt; 83 nd->flags &= ~LOOKUP_OPEN; 84 } 85 rc = vfs_create(lower_dir_inode, lower_dentry, mode, nd); 86 if (nd) { 87 nd->path.dentry = dentry_save; 88 nd->path.mnt = vfsmount_save; 89 nd->flags = flags_save; 90 } 91 return rc; 92 } 93 94 /** 95 * ecryptfs_do_create 96 * @directory_inode: inode of the new file's dentry's parent in ecryptfs 97 * @ecryptfs_dentry: New file's dentry in ecryptfs 98 * @mode: The mode of the new file 99 * @nd: nameidata of ecryptfs' parent's dentry & vfsmount 100 * 101 * Creates the underlying file and the eCryptfs inode which will link to 102 * it. It will also update the eCryptfs directory inode to mimic the 103 * stat of the lower directory inode. 104 * 105 * Returns zero on success; non-zero on error condition 106 */ 107 static int 108 ecryptfs_do_create(struct inode *directory_inode, 109 struct dentry *ecryptfs_dentry, int mode, 110 struct nameidata *nd) 111 { 112 int rc; 113 struct dentry *lower_dentry; 114 struct dentry *lower_dir_dentry; 115 116 lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry); 117 lower_dir_dentry = lock_parent(lower_dentry); 118 if (IS_ERR(lower_dir_dentry)) { 119 ecryptfs_printk(KERN_ERR, "Error locking directory of " 120 "dentry\n"); 121 rc = PTR_ERR(lower_dir_dentry); 122 goto out; 123 } 124 rc = ecryptfs_create_underlying_file(lower_dir_dentry->d_inode, 125 ecryptfs_dentry, mode, nd); 126 if (rc) { 127 printk(KERN_ERR "%s: Failure to create dentry in lower fs; " 128 "rc = [%d]\n", __func__, rc); 129 goto out_lock; 130 } 131 rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry, 132 directory_inode->i_sb, 0); 133 if (rc) { 134 ecryptfs_printk(KERN_ERR, "Failure in ecryptfs_interpose\n"); 135 goto out_lock; 136 } 137 fsstack_copy_attr_times(directory_inode, lower_dir_dentry->d_inode); 138 fsstack_copy_inode_size(directory_inode, lower_dir_dentry->d_inode); 139 out_lock: 140 unlock_dir(lower_dir_dentry); 141 out: 142 return rc; 143 } 144 145 /** 146 * ecryptfs_initialize_file 147 * 148 * Cause the file to be changed from a basic empty file to an ecryptfs 149 * file with a header and first data page. 150 * 151 * Returns zero on success 152 */ 153 static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry) 154 { 155 struct ecryptfs_crypt_stat *crypt_stat = 156 &ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->crypt_stat; 157 int rc = 0; 158 159 if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) { 160 ecryptfs_printk(KERN_DEBUG, "This is a directory\n"); 161 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED); 162 goto out; 163 } 164 ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n"); 165 rc = ecryptfs_new_file_context(ecryptfs_dentry); 166 if (rc) { 167 ecryptfs_printk(KERN_ERR, "Error creating new file " 168 "context; rc = [%d]\n", rc); 169 goto out; 170 } 171 rc = ecryptfs_get_lower_file(ecryptfs_dentry); 172 if (rc) { 173 printk(KERN_ERR "%s: Error attempting to initialize " 174 "the lower file for the dentry with name " 175 "[%s]; rc = [%d]\n", __func__, 176 ecryptfs_dentry->d_name.name, rc); 177 goto out; 178 } 179 rc = ecryptfs_write_metadata(ecryptfs_dentry); 180 if (rc) 181 printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc); 182 ecryptfs_put_lower_file(ecryptfs_dentry->d_inode); 183 out: 184 return rc; 185 } 186 187 /** 188 * ecryptfs_create 189 * @dir: The inode of the directory in which to create the file. 190 * @dentry: The eCryptfs dentry 191 * @mode: The mode of the new file. 192 * @nd: nameidata 193 * 194 * Creates a new file. 195 * 196 * Returns zero on success; non-zero on error condition 197 */ 198 static int 199 ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry, 200 int mode, struct nameidata *nd) 201 { 202 int rc; 203 204 /* ecryptfs_do_create() calls ecryptfs_interpose() */ 205 rc = ecryptfs_do_create(directory_inode, ecryptfs_dentry, mode, nd); 206 if (unlikely(rc)) { 207 ecryptfs_printk(KERN_WARNING, "Failed to create file in" 208 "lower filesystem\n"); 209 goto out; 210 } 211 /* At this point, a file exists on "disk"; we need to make sure 212 * that this on disk file is prepared to be an ecryptfs file */ 213 rc = ecryptfs_initialize_file(ecryptfs_dentry); 214 out: 215 return rc; 216 } 217 218 /** 219 * ecryptfs_lookup_and_interpose_lower - Perform a lookup 220 */ 221 int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry, 222 struct dentry *lower_dentry, 223 struct inode *ecryptfs_dir_inode) 224 { 225 struct dentry *lower_dir_dentry; 226 struct vfsmount *lower_mnt; 227 struct inode *lower_inode; 228 struct ecryptfs_crypt_stat *crypt_stat; 229 char *page_virt = NULL; 230 int put_lower = 0, rc = 0; 231 232 lower_dir_dentry = lower_dentry->d_parent; 233 lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt( 234 ecryptfs_dentry->d_parent)); 235 lower_inode = lower_dentry->d_inode; 236 fsstack_copy_attr_atime(ecryptfs_dir_inode, lower_dir_dentry->d_inode); 237 BUG_ON(!lower_dentry->d_count); 238 ecryptfs_set_dentry_private(ecryptfs_dentry, 239 kmem_cache_alloc(ecryptfs_dentry_info_cache, 240 GFP_KERNEL)); 241 if (!ecryptfs_dentry_to_private(ecryptfs_dentry)) { 242 rc = -ENOMEM; 243 printk(KERN_ERR "%s: Out of memory whilst attempting " 244 "to allocate ecryptfs_dentry_info struct\n", 245 __func__); 246 goto out_put; 247 } 248 ecryptfs_set_dentry_lower(ecryptfs_dentry, lower_dentry); 249 ecryptfs_set_dentry_lower_mnt(ecryptfs_dentry, lower_mnt); 250 if (!lower_dentry->d_inode) { 251 /* We want to add because we couldn't find in lower */ 252 d_add(ecryptfs_dentry, NULL); 253 goto out; 254 } 255 rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry, 256 ecryptfs_dir_inode->i_sb, 257 ECRYPTFS_INTERPOSE_FLAG_D_ADD); 258 if (rc) { 259 printk(KERN_ERR "%s: Error interposing; rc = [%d]\n", 260 __func__, rc); 261 goto out; 262 } 263 if (S_ISDIR(lower_inode->i_mode)) 264 goto out; 265 if (S_ISLNK(lower_inode->i_mode)) 266 goto out; 267 if (special_file(lower_inode->i_mode)) 268 goto out; 269 /* Released in this function */ 270 page_virt = kmem_cache_zalloc(ecryptfs_header_cache_2, GFP_USER); 271 if (!page_virt) { 272 printk(KERN_ERR "%s: Cannot kmem_cache_zalloc() a page\n", 273 __func__); 274 rc = -ENOMEM; 275 goto out; 276 } 277 rc = ecryptfs_get_lower_file(ecryptfs_dentry); 278 if (rc) { 279 printk(KERN_ERR "%s: Error attempting to initialize " 280 "the lower file for the dentry with name " 281 "[%s]; rc = [%d]\n", __func__, 282 ecryptfs_dentry->d_name.name, rc); 283 goto out_free_kmem; 284 } 285 put_lower = 1; 286 crypt_stat = &ecryptfs_inode_to_private( 287 ecryptfs_dentry->d_inode)->crypt_stat; 288 /* TODO: lock for crypt_stat comparison */ 289 if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)) 290 ecryptfs_set_default_sizes(crypt_stat); 291 rc = ecryptfs_read_and_validate_header_region(page_virt, 292 ecryptfs_dentry->d_inode); 293 if (rc) { 294 memset(page_virt, 0, PAGE_CACHE_SIZE); 295 rc = ecryptfs_read_and_validate_xattr_region(page_virt, 296 ecryptfs_dentry); 297 if (rc) { 298 rc = 0; 299 goto out_free_kmem; 300 } 301 crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR; 302 } 303 ecryptfs_i_size_init(page_virt, ecryptfs_dentry->d_inode); 304 out_free_kmem: 305 kmem_cache_free(ecryptfs_header_cache_2, page_virt); 306 goto out; 307 out_put: 308 dput(lower_dentry); 309 mntput(lower_mnt); 310 d_drop(ecryptfs_dentry); 311 out: 312 if (put_lower) 313 ecryptfs_put_lower_file(ecryptfs_dentry->d_inode); 314 return rc; 315 } 316 317 /** 318 * ecryptfs_lookup 319 * @ecryptfs_dir_inode: The eCryptfs directory inode 320 * @ecryptfs_dentry: The eCryptfs dentry that we are looking up 321 * @ecryptfs_nd: nameidata; may be NULL 322 * 323 * Find a file on disk. If the file does not exist, then we'll add it to the 324 * dentry cache and continue on to read it from the disk. 325 */ 326 static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode, 327 struct dentry *ecryptfs_dentry, 328 struct nameidata *ecryptfs_nd) 329 { 330 char *encrypted_and_encoded_name = NULL; 331 size_t encrypted_and_encoded_name_size; 332 struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL; 333 struct dentry *lower_dir_dentry, *lower_dentry; 334 int rc = 0; 335 336 if ((ecryptfs_dentry->d_name.len == 1 337 && !strcmp(ecryptfs_dentry->d_name.name, ".")) 338 || (ecryptfs_dentry->d_name.len == 2 339 && !strcmp(ecryptfs_dentry->d_name.name, ".."))) { 340 goto out_d_drop; 341 } 342 lower_dir_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry->d_parent); 343 mutex_lock(&lower_dir_dentry->d_inode->i_mutex); 344 lower_dentry = lookup_one_len(ecryptfs_dentry->d_name.name, 345 lower_dir_dentry, 346 ecryptfs_dentry->d_name.len); 347 mutex_unlock(&lower_dir_dentry->d_inode->i_mutex); 348 if (IS_ERR(lower_dentry)) { 349 rc = PTR_ERR(lower_dentry); 350 ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned " 351 "[%d] on lower_dentry = [%s]\n", __func__, rc, 352 encrypted_and_encoded_name); 353 goto out_d_drop; 354 } 355 if (lower_dentry->d_inode) 356 goto lookup_and_interpose; 357 mount_crypt_stat = &ecryptfs_superblock_to_private( 358 ecryptfs_dentry->d_sb)->mount_crypt_stat; 359 if (!(mount_crypt_stat 360 && (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES))) 361 goto lookup_and_interpose; 362 dput(lower_dentry); 363 rc = ecryptfs_encrypt_and_encode_filename( 364 &encrypted_and_encoded_name, &encrypted_and_encoded_name_size, 365 NULL, mount_crypt_stat, ecryptfs_dentry->d_name.name, 366 ecryptfs_dentry->d_name.len); 367 if (rc) { 368 printk(KERN_ERR "%s: Error attempting to encrypt and encode " 369 "filename; rc = [%d]\n", __func__, rc); 370 goto out_d_drop; 371 } 372 mutex_lock(&lower_dir_dentry->d_inode->i_mutex); 373 lower_dentry = lookup_one_len(encrypted_and_encoded_name, 374 lower_dir_dentry, 375 encrypted_and_encoded_name_size); 376 mutex_unlock(&lower_dir_dentry->d_inode->i_mutex); 377 if (IS_ERR(lower_dentry)) { 378 rc = PTR_ERR(lower_dentry); 379 ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned " 380 "[%d] on lower_dentry = [%s]\n", __func__, rc, 381 encrypted_and_encoded_name); 382 goto out_d_drop; 383 } 384 lookup_and_interpose: 385 rc = ecryptfs_lookup_and_interpose_lower(ecryptfs_dentry, lower_dentry, 386 ecryptfs_dir_inode); 387 goto out; 388 out_d_drop: 389 d_drop(ecryptfs_dentry); 390 out: 391 kfree(encrypted_and_encoded_name); 392 return ERR_PTR(rc); 393 } 394 395 static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir, 396 struct dentry *new_dentry) 397 { 398 struct dentry *lower_old_dentry; 399 struct dentry *lower_new_dentry; 400 struct dentry *lower_dir_dentry; 401 u64 file_size_save; 402 int rc; 403 404 file_size_save = i_size_read(old_dentry->d_inode); 405 lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry); 406 lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry); 407 dget(lower_old_dentry); 408 dget(lower_new_dentry); 409 lower_dir_dentry = lock_parent(lower_new_dentry); 410 rc = vfs_link(lower_old_dentry, lower_dir_dentry->d_inode, 411 lower_new_dentry); 412 if (rc || !lower_new_dentry->d_inode) 413 goto out_lock; 414 rc = ecryptfs_interpose(lower_new_dentry, new_dentry, dir->i_sb, 0); 415 if (rc) 416 goto out_lock; 417 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 418 fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode); 419 old_dentry->d_inode->i_nlink = 420 ecryptfs_inode_to_lower(old_dentry->d_inode)->i_nlink; 421 i_size_write(new_dentry->d_inode, file_size_save); 422 out_lock: 423 unlock_dir(lower_dir_dentry); 424 dput(lower_new_dentry); 425 dput(lower_old_dentry); 426 return rc; 427 } 428 429 static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry) 430 { 431 int rc = 0; 432 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry); 433 struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir); 434 struct dentry *lower_dir_dentry; 435 436 dget(lower_dentry); 437 lower_dir_dentry = lock_parent(lower_dentry); 438 rc = vfs_unlink(lower_dir_inode, lower_dentry); 439 if (rc) { 440 printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc); 441 goto out_unlock; 442 } 443 fsstack_copy_attr_times(dir, lower_dir_inode); 444 dentry->d_inode->i_nlink = 445 ecryptfs_inode_to_lower(dentry->d_inode)->i_nlink; 446 dentry->d_inode->i_ctime = dir->i_ctime; 447 d_drop(dentry); 448 out_unlock: 449 unlock_dir(lower_dir_dentry); 450 dput(lower_dentry); 451 return rc; 452 } 453 454 static int ecryptfs_symlink(struct inode *dir, struct dentry *dentry, 455 const char *symname) 456 { 457 int rc; 458 struct dentry *lower_dentry; 459 struct dentry *lower_dir_dentry; 460 char *encoded_symname; 461 size_t encoded_symlen; 462 struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL; 463 464 lower_dentry = ecryptfs_dentry_to_lower(dentry); 465 dget(lower_dentry); 466 lower_dir_dentry = lock_parent(lower_dentry); 467 mount_crypt_stat = &ecryptfs_superblock_to_private( 468 dir->i_sb)->mount_crypt_stat; 469 rc = ecryptfs_encrypt_and_encode_filename(&encoded_symname, 470 &encoded_symlen, 471 NULL, 472 mount_crypt_stat, symname, 473 strlen(symname)); 474 if (rc) 475 goto out_lock; 476 rc = vfs_symlink(lower_dir_dentry->d_inode, lower_dentry, 477 encoded_symname); 478 kfree(encoded_symname); 479 if (rc || !lower_dentry->d_inode) 480 goto out_lock; 481 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb, 0); 482 if (rc) 483 goto out_lock; 484 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 485 fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode); 486 out_lock: 487 unlock_dir(lower_dir_dentry); 488 dput(lower_dentry); 489 if (!dentry->d_inode) 490 d_drop(dentry); 491 return rc; 492 } 493 494 static int ecryptfs_mkdir(struct inode *dir, struct dentry *dentry, int mode) 495 { 496 int rc; 497 struct dentry *lower_dentry; 498 struct dentry *lower_dir_dentry; 499 500 lower_dentry = ecryptfs_dentry_to_lower(dentry); 501 lower_dir_dentry = lock_parent(lower_dentry); 502 rc = vfs_mkdir(lower_dir_dentry->d_inode, lower_dentry, mode); 503 if (rc || !lower_dentry->d_inode) 504 goto out; 505 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb, 0); 506 if (rc) 507 goto out; 508 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 509 fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode); 510 dir->i_nlink = lower_dir_dentry->d_inode->i_nlink; 511 out: 512 unlock_dir(lower_dir_dentry); 513 if (!dentry->d_inode) 514 d_drop(dentry); 515 return rc; 516 } 517 518 static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry) 519 { 520 struct dentry *lower_dentry; 521 struct dentry *lower_dir_dentry; 522 int rc; 523 524 dentry_unhash(dentry); 525 526 lower_dentry = ecryptfs_dentry_to_lower(dentry); 527 dget(dentry); 528 lower_dir_dentry = lock_parent(lower_dentry); 529 dget(lower_dentry); 530 rc = vfs_rmdir(lower_dir_dentry->d_inode, lower_dentry); 531 dput(lower_dentry); 532 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 533 dir->i_nlink = lower_dir_dentry->d_inode->i_nlink; 534 unlock_dir(lower_dir_dentry); 535 if (!rc) 536 d_drop(dentry); 537 dput(dentry); 538 return rc; 539 } 540 541 static int 542 ecryptfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev) 543 { 544 int rc; 545 struct dentry *lower_dentry; 546 struct dentry *lower_dir_dentry; 547 548 lower_dentry = ecryptfs_dentry_to_lower(dentry); 549 lower_dir_dentry = lock_parent(lower_dentry); 550 rc = vfs_mknod(lower_dir_dentry->d_inode, lower_dentry, mode, dev); 551 if (rc || !lower_dentry->d_inode) 552 goto out; 553 rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb, 0); 554 if (rc) 555 goto out; 556 fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode); 557 fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode); 558 out: 559 unlock_dir(lower_dir_dentry); 560 if (!dentry->d_inode) 561 d_drop(dentry); 562 return rc; 563 } 564 565 static int 566 ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry, 567 struct inode *new_dir, struct dentry *new_dentry) 568 { 569 int rc; 570 struct dentry *lower_old_dentry; 571 struct dentry *lower_new_dentry; 572 struct dentry *lower_old_dir_dentry; 573 struct dentry *lower_new_dir_dentry; 574 struct dentry *trap = NULL; 575 576 if (new_dentry->d_inode && S_ISDIR(new_dentry->d_inode->i_mode)) 577 dentry_unhash(new_dentry); 578 579 lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry); 580 lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry); 581 dget(lower_old_dentry); 582 dget(lower_new_dentry); 583 lower_old_dir_dentry = dget_parent(lower_old_dentry); 584 lower_new_dir_dentry = dget_parent(lower_new_dentry); 585 trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry); 586 /* source should not be ancestor of target */ 587 if (trap == lower_old_dentry) { 588 rc = -EINVAL; 589 goto out_lock; 590 } 591 /* target should not be ancestor of source */ 592 if (trap == lower_new_dentry) { 593 rc = -ENOTEMPTY; 594 goto out_lock; 595 } 596 rc = vfs_rename(lower_old_dir_dentry->d_inode, lower_old_dentry, 597 lower_new_dir_dentry->d_inode, lower_new_dentry); 598 if (rc) 599 goto out_lock; 600 fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode); 601 if (new_dir != old_dir) 602 fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode); 603 out_lock: 604 unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry); 605 dput(lower_new_dir_dentry); 606 dput(lower_old_dir_dentry); 607 dput(lower_new_dentry); 608 dput(lower_old_dentry); 609 return rc; 610 } 611 612 static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf, 613 size_t *bufsiz) 614 { 615 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry); 616 char *lower_buf; 617 size_t lower_bufsiz = PATH_MAX; 618 mm_segment_t old_fs; 619 int rc; 620 621 lower_buf = kmalloc(lower_bufsiz, GFP_KERNEL); 622 if (!lower_buf) { 623 rc = -ENOMEM; 624 goto out; 625 } 626 old_fs = get_fs(); 627 set_fs(get_ds()); 628 rc = lower_dentry->d_inode->i_op->readlink(lower_dentry, 629 (char __user *)lower_buf, 630 lower_bufsiz); 631 set_fs(old_fs); 632 if (rc < 0) 633 goto out; 634 lower_bufsiz = rc; 635 rc = ecryptfs_decode_and_decrypt_filename(buf, bufsiz, dentry, 636 lower_buf, lower_bufsiz); 637 out: 638 kfree(lower_buf); 639 return rc; 640 } 641 642 static int 643 ecryptfs_readlink(struct dentry *dentry, char __user *buf, int bufsiz) 644 { 645 char *kbuf; 646 size_t kbufsiz, copied; 647 int rc; 648 649 rc = ecryptfs_readlink_lower(dentry, &kbuf, &kbufsiz); 650 if (rc) 651 goto out; 652 copied = min_t(size_t, bufsiz, kbufsiz); 653 rc = copy_to_user(buf, kbuf, copied) ? -EFAULT : copied; 654 kfree(kbuf); 655 fsstack_copy_attr_atime(dentry->d_inode, 656 ecryptfs_dentry_to_lower(dentry)->d_inode); 657 out: 658 return rc; 659 } 660 661 static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd) 662 { 663 char *buf; 664 int len = PAGE_SIZE, rc; 665 mm_segment_t old_fs; 666 667 /* Released in ecryptfs_put_link(); only release here on error */ 668 buf = kmalloc(len, GFP_KERNEL); 669 if (!buf) { 670 buf = ERR_PTR(-ENOMEM); 671 goto out; 672 } 673 old_fs = get_fs(); 674 set_fs(get_ds()); 675 rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len); 676 set_fs(old_fs); 677 if (rc < 0) { 678 kfree(buf); 679 buf = ERR_PTR(rc); 680 } else 681 buf[rc] = '\0'; 682 out: 683 nd_set_link(nd, buf); 684 return NULL; 685 } 686 687 static void 688 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr) 689 { 690 char *buf = nd_get_link(nd); 691 if (!IS_ERR(buf)) { 692 /* Free the char* */ 693 kfree(buf); 694 } 695 } 696 697 /** 698 * upper_size_to_lower_size 699 * @crypt_stat: Crypt_stat associated with file 700 * @upper_size: Size of the upper file 701 * 702 * Calculate the required size of the lower file based on the 703 * specified size of the upper file. This calculation is based on the 704 * number of headers in the underlying file and the extent size. 705 * 706 * Returns Calculated size of the lower file. 707 */ 708 static loff_t 709 upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat, 710 loff_t upper_size) 711 { 712 loff_t lower_size; 713 714 lower_size = ecryptfs_lower_header_size(crypt_stat); 715 if (upper_size != 0) { 716 loff_t num_extents; 717 718 num_extents = upper_size >> crypt_stat->extent_shift; 719 if (upper_size & ~crypt_stat->extent_mask) 720 num_extents++; 721 lower_size += (num_extents * crypt_stat->extent_size); 722 } 723 return lower_size; 724 } 725 726 /** 727 * truncate_upper 728 * @dentry: The ecryptfs layer dentry 729 * @ia: Address of the ecryptfs inode's attributes 730 * @lower_ia: Address of the lower inode's attributes 731 * 732 * Function to handle truncations modifying the size of the file. Note 733 * that the file sizes are interpolated. When expanding, we are simply 734 * writing strings of 0's out. When truncating, we truncate the upper 735 * inode and update the lower_ia according to the page index 736 * interpolations. If ATTR_SIZE is set in lower_ia->ia_valid upon return, 737 * the caller must use lower_ia in a call to notify_change() to perform 738 * the truncation of the lower inode. 739 * 740 * Returns zero on success; non-zero otherwise 741 */ 742 static int truncate_upper(struct dentry *dentry, struct iattr *ia, 743 struct iattr *lower_ia) 744 { 745 int rc = 0; 746 struct inode *inode = dentry->d_inode; 747 struct ecryptfs_crypt_stat *crypt_stat; 748 loff_t i_size = i_size_read(inode); 749 loff_t lower_size_before_truncate; 750 loff_t lower_size_after_truncate; 751 752 if (unlikely((ia->ia_size == i_size))) { 753 lower_ia->ia_valid &= ~ATTR_SIZE; 754 return 0; 755 } 756 rc = ecryptfs_get_lower_file(dentry); 757 if (rc) 758 return rc; 759 crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat; 760 /* Switch on growing or shrinking file */ 761 if (ia->ia_size > i_size) { 762 char zero[] = { 0x00 }; 763 764 lower_ia->ia_valid &= ~ATTR_SIZE; 765 /* Write a single 0 at the last position of the file; 766 * this triggers code that will fill in 0's throughout 767 * the intermediate portion of the previous end of the 768 * file and the new and of the file */ 769 rc = ecryptfs_write(inode, zero, 770 (ia->ia_size - 1), 1); 771 } else { /* ia->ia_size < i_size_read(inode) */ 772 /* We're chopping off all the pages down to the page 773 * in which ia->ia_size is located. Fill in the end of 774 * that page from (ia->ia_size & ~PAGE_CACHE_MASK) to 775 * PAGE_CACHE_SIZE with zeros. */ 776 size_t num_zeros = (PAGE_CACHE_SIZE 777 - (ia->ia_size & ~PAGE_CACHE_MASK)); 778 779 780 /* 781 * XXX(truncate) this should really happen at the begginning 782 * of ->setattr. But the code is too messy to that as part 783 * of a larger patch. ecryptfs is also totally missing out 784 * on the inode_change_ok check at the beginning of 785 * ->setattr while would include this. 786 */ 787 rc = inode_newsize_ok(inode, ia->ia_size); 788 if (rc) 789 goto out; 790 791 if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) { 792 truncate_setsize(inode, ia->ia_size); 793 lower_ia->ia_size = ia->ia_size; 794 lower_ia->ia_valid |= ATTR_SIZE; 795 goto out; 796 } 797 if (num_zeros) { 798 char *zeros_virt; 799 800 zeros_virt = kzalloc(num_zeros, GFP_KERNEL); 801 if (!zeros_virt) { 802 rc = -ENOMEM; 803 goto out; 804 } 805 rc = ecryptfs_write(inode, zeros_virt, 806 ia->ia_size, num_zeros); 807 kfree(zeros_virt); 808 if (rc) { 809 printk(KERN_ERR "Error attempting to zero out " 810 "the remainder of the end page on " 811 "reducing truncate; rc = [%d]\n", rc); 812 goto out; 813 } 814 } 815 truncate_setsize(inode, ia->ia_size); 816 rc = ecryptfs_write_inode_size_to_metadata(inode); 817 if (rc) { 818 printk(KERN_ERR "Problem with " 819 "ecryptfs_write_inode_size_to_metadata; " 820 "rc = [%d]\n", rc); 821 goto out; 822 } 823 /* We are reducing the size of the ecryptfs file, and need to 824 * know if we need to reduce the size of the lower file. */ 825 lower_size_before_truncate = 826 upper_size_to_lower_size(crypt_stat, i_size); 827 lower_size_after_truncate = 828 upper_size_to_lower_size(crypt_stat, ia->ia_size); 829 if (lower_size_after_truncate < lower_size_before_truncate) { 830 lower_ia->ia_size = lower_size_after_truncate; 831 lower_ia->ia_valid |= ATTR_SIZE; 832 } else 833 lower_ia->ia_valid &= ~ATTR_SIZE; 834 } 835 out: 836 ecryptfs_put_lower_file(inode); 837 return rc; 838 } 839 840 /** 841 * ecryptfs_truncate 842 * @dentry: The ecryptfs layer dentry 843 * @new_length: The length to expand the file to 844 * 845 * Simple function that handles the truncation of an eCryptfs inode and 846 * its corresponding lower inode. 847 * 848 * Returns zero on success; non-zero otherwise 849 */ 850 int ecryptfs_truncate(struct dentry *dentry, loff_t new_length) 851 { 852 struct iattr ia = { .ia_valid = ATTR_SIZE, .ia_size = new_length }; 853 struct iattr lower_ia = { .ia_valid = 0 }; 854 int rc; 855 856 rc = truncate_upper(dentry, &ia, &lower_ia); 857 if (!rc && lower_ia.ia_valid & ATTR_SIZE) { 858 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry); 859 860 mutex_lock(&lower_dentry->d_inode->i_mutex); 861 rc = notify_change(lower_dentry, &lower_ia); 862 mutex_unlock(&lower_dentry->d_inode->i_mutex); 863 } 864 return rc; 865 } 866 867 static int 868 ecryptfs_permission(struct inode *inode, int mask, unsigned int flags) 869 { 870 if (flags & IPERM_FLAG_RCU) 871 return -ECHILD; 872 return inode_permission(ecryptfs_inode_to_lower(inode), mask); 873 } 874 875 /** 876 * ecryptfs_setattr 877 * @dentry: dentry handle to the inode to modify 878 * @ia: Structure with flags of what to change and values 879 * 880 * Updates the metadata of an inode. If the update is to the size 881 * i.e. truncation, then ecryptfs_truncate will handle the size modification 882 * of both the ecryptfs inode and the lower inode. 883 * 884 * All other metadata changes will be passed right to the lower filesystem, 885 * and we will just update our inode to look like the lower. 886 */ 887 static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia) 888 { 889 int rc = 0; 890 struct dentry *lower_dentry; 891 struct iattr lower_ia; 892 struct inode *inode; 893 struct inode *lower_inode; 894 struct ecryptfs_crypt_stat *crypt_stat; 895 896 crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat; 897 if (!(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED)) 898 ecryptfs_init_crypt_stat(crypt_stat); 899 inode = dentry->d_inode; 900 lower_inode = ecryptfs_inode_to_lower(inode); 901 lower_dentry = ecryptfs_dentry_to_lower(dentry); 902 mutex_lock(&crypt_stat->cs_mutex); 903 if (S_ISDIR(dentry->d_inode->i_mode)) 904 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED); 905 else if (S_ISREG(dentry->d_inode->i_mode) 906 && (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED) 907 || !(crypt_stat->flags & ECRYPTFS_KEY_VALID))) { 908 struct ecryptfs_mount_crypt_stat *mount_crypt_stat; 909 910 mount_crypt_stat = &ecryptfs_superblock_to_private( 911 dentry->d_sb)->mount_crypt_stat; 912 rc = ecryptfs_get_lower_file(dentry); 913 if (rc) { 914 mutex_unlock(&crypt_stat->cs_mutex); 915 goto out; 916 } 917 rc = ecryptfs_read_metadata(dentry); 918 ecryptfs_put_lower_file(inode); 919 if (rc) { 920 if (!(mount_crypt_stat->flags 921 & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) { 922 rc = -EIO; 923 printk(KERN_WARNING "Either the lower file " 924 "is not in a valid eCryptfs format, " 925 "or the key could not be retrieved. " 926 "Plaintext passthrough mode is not " 927 "enabled; returning -EIO\n"); 928 mutex_unlock(&crypt_stat->cs_mutex); 929 goto out; 930 } 931 rc = 0; 932 crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED 933 | ECRYPTFS_ENCRYPTED); 934 } 935 } 936 mutex_unlock(&crypt_stat->cs_mutex); 937 if (S_ISREG(inode->i_mode)) { 938 rc = filemap_write_and_wait(inode->i_mapping); 939 if (rc) 940 goto out; 941 fsstack_copy_attr_all(inode, lower_inode); 942 } 943 memcpy(&lower_ia, ia, sizeof(lower_ia)); 944 if (ia->ia_valid & ATTR_FILE) 945 lower_ia.ia_file = ecryptfs_file_to_lower(ia->ia_file); 946 if (ia->ia_valid & ATTR_SIZE) { 947 rc = truncate_upper(dentry, ia, &lower_ia); 948 if (rc < 0) 949 goto out; 950 } 951 952 /* 953 * mode change is for clearing setuid/setgid bits. Allow lower fs 954 * to interpret this in its own way. 955 */ 956 if (lower_ia.ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID)) 957 lower_ia.ia_valid &= ~ATTR_MODE; 958 959 mutex_lock(&lower_dentry->d_inode->i_mutex); 960 rc = notify_change(lower_dentry, &lower_ia); 961 mutex_unlock(&lower_dentry->d_inode->i_mutex); 962 out: 963 fsstack_copy_attr_all(inode, lower_inode); 964 return rc; 965 } 966 967 int ecryptfs_getattr_link(struct vfsmount *mnt, struct dentry *dentry, 968 struct kstat *stat) 969 { 970 struct ecryptfs_mount_crypt_stat *mount_crypt_stat; 971 int rc = 0; 972 973 mount_crypt_stat = &ecryptfs_superblock_to_private( 974 dentry->d_sb)->mount_crypt_stat; 975 generic_fillattr(dentry->d_inode, stat); 976 if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) { 977 char *target; 978 size_t targetsiz; 979 980 rc = ecryptfs_readlink_lower(dentry, &target, &targetsiz); 981 if (!rc) { 982 kfree(target); 983 stat->size = targetsiz; 984 } 985 } 986 return rc; 987 } 988 989 int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry, 990 struct kstat *stat) 991 { 992 struct kstat lower_stat; 993 int rc; 994 995 rc = vfs_getattr(ecryptfs_dentry_to_lower_mnt(dentry), 996 ecryptfs_dentry_to_lower(dentry), &lower_stat); 997 if (!rc) { 998 fsstack_copy_attr_all(dentry->d_inode, 999 ecryptfs_inode_to_lower(dentry->d_inode)); 1000 generic_fillattr(dentry->d_inode, stat); 1001 stat->blocks = lower_stat.blocks; 1002 } 1003 return rc; 1004 } 1005 1006 int 1007 ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value, 1008 size_t size, int flags) 1009 { 1010 int rc = 0; 1011 struct dentry *lower_dentry; 1012 1013 lower_dentry = ecryptfs_dentry_to_lower(dentry); 1014 if (!lower_dentry->d_inode->i_op->setxattr) { 1015 rc = -EOPNOTSUPP; 1016 goto out; 1017 } 1018 1019 rc = vfs_setxattr(lower_dentry, name, value, size, flags); 1020 out: 1021 return rc; 1022 } 1023 1024 ssize_t 1025 ecryptfs_getxattr_lower(struct dentry *lower_dentry, const char *name, 1026 void *value, size_t size) 1027 { 1028 int rc = 0; 1029 1030 if (!lower_dentry->d_inode->i_op->getxattr) { 1031 rc = -EOPNOTSUPP; 1032 goto out; 1033 } 1034 mutex_lock(&lower_dentry->d_inode->i_mutex); 1035 rc = lower_dentry->d_inode->i_op->getxattr(lower_dentry, name, value, 1036 size); 1037 mutex_unlock(&lower_dentry->d_inode->i_mutex); 1038 out: 1039 return rc; 1040 } 1041 1042 static ssize_t 1043 ecryptfs_getxattr(struct dentry *dentry, const char *name, void *value, 1044 size_t size) 1045 { 1046 return ecryptfs_getxattr_lower(ecryptfs_dentry_to_lower(dentry), name, 1047 value, size); 1048 } 1049 1050 static ssize_t 1051 ecryptfs_listxattr(struct dentry *dentry, char *list, size_t size) 1052 { 1053 int rc = 0; 1054 struct dentry *lower_dentry; 1055 1056 lower_dentry = ecryptfs_dentry_to_lower(dentry); 1057 if (!lower_dentry->d_inode->i_op->listxattr) { 1058 rc = -EOPNOTSUPP; 1059 goto out; 1060 } 1061 mutex_lock(&lower_dentry->d_inode->i_mutex); 1062 rc = lower_dentry->d_inode->i_op->listxattr(lower_dentry, list, size); 1063 mutex_unlock(&lower_dentry->d_inode->i_mutex); 1064 out: 1065 return rc; 1066 } 1067 1068 static int ecryptfs_removexattr(struct dentry *dentry, const char *name) 1069 { 1070 int rc = 0; 1071 struct dentry *lower_dentry; 1072 1073 lower_dentry = ecryptfs_dentry_to_lower(dentry); 1074 if (!lower_dentry->d_inode->i_op->removexattr) { 1075 rc = -EOPNOTSUPP; 1076 goto out; 1077 } 1078 mutex_lock(&lower_dentry->d_inode->i_mutex); 1079 rc = lower_dentry->d_inode->i_op->removexattr(lower_dentry, name); 1080 mutex_unlock(&lower_dentry->d_inode->i_mutex); 1081 out: 1082 return rc; 1083 } 1084 1085 int ecryptfs_inode_test(struct inode *inode, void *candidate_lower_inode) 1086 { 1087 if ((ecryptfs_inode_to_lower(inode) 1088 == (struct inode *)candidate_lower_inode)) 1089 return 1; 1090 else 1091 return 0; 1092 } 1093 1094 int ecryptfs_inode_set(struct inode *inode, void *lower_inode) 1095 { 1096 ecryptfs_init_inode(inode, (struct inode *)lower_inode); 1097 return 0; 1098 } 1099 1100 const struct inode_operations ecryptfs_symlink_iops = { 1101 .readlink = ecryptfs_readlink, 1102 .follow_link = ecryptfs_follow_link, 1103 .put_link = ecryptfs_put_link, 1104 .permission = ecryptfs_permission, 1105 .setattr = ecryptfs_setattr, 1106 .getattr = ecryptfs_getattr_link, 1107 .setxattr = ecryptfs_setxattr, 1108 .getxattr = ecryptfs_getxattr, 1109 .listxattr = ecryptfs_listxattr, 1110 .removexattr = ecryptfs_removexattr 1111 }; 1112 1113 const struct inode_operations ecryptfs_dir_iops = { 1114 .create = ecryptfs_create, 1115 .lookup = ecryptfs_lookup, 1116 .link = ecryptfs_link, 1117 .unlink = ecryptfs_unlink, 1118 .symlink = ecryptfs_symlink, 1119 .mkdir = ecryptfs_mkdir, 1120 .rmdir = ecryptfs_rmdir, 1121 .mknod = ecryptfs_mknod, 1122 .rename = ecryptfs_rename, 1123 .permission = ecryptfs_permission, 1124 .setattr = ecryptfs_setattr, 1125 .setxattr = ecryptfs_setxattr, 1126 .getxattr = ecryptfs_getxattr, 1127 .listxattr = ecryptfs_listxattr, 1128 .removexattr = ecryptfs_removexattr 1129 }; 1130 1131 const struct inode_operations ecryptfs_main_iops = { 1132 .permission = ecryptfs_permission, 1133 .setattr = ecryptfs_setattr, 1134 .getattr = ecryptfs_getattr, 1135 .setxattr = ecryptfs_setxattr, 1136 .getxattr = ecryptfs_getxattr, 1137 .listxattr = ecryptfs_listxattr, 1138 .removexattr = ecryptfs_removexattr 1139 }; 1140