1// SPDX-License-Identifier: GPL-2.0-or-later
2/*
3 * eCryptfs: Linux filesystem encryption layer
4 *
5 * Copyright (C) 1997-2004 Erez Zadok
6 * Copyright (C) 2001-2004 Stony Brook University
7 * Copyright (C) 2004-2007 International Business Machines Corp.
8 * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>
9 * Michael C. Thompsion <mcthomps@us.ibm.com>
10 */
11
12#include <linux/file.h>
13#include <linux/vmalloc.h>
14#include <linux/pagemap.h>
15#include <linux/dcache.h>
16#include <linux/namei.h>
17#include <linux/mount.h>
18#include <linux/fs_stack.h>
19#include <linux/slab.h>
20#include <linux/xattr.h>
21#include <linux/posix_acl.h>
22#include <linux/posix_acl_xattr.h>
23#include <linux/fileattr.h>
24#include <linux/unaligned.h>
25#include "ecryptfs_kernel.h"
26
27static struct dentry *ecryptfs_start_creating_dentry(struct dentry *dentry)
28{
29 struct dentry *parent = dget_parent(dentry);
30 struct dentry *ret;
31
32 ret = start_creating_dentry(parent: ecryptfs_dentry_to_lower(dentry: parent),
33 child: ecryptfs_dentry_to_lower(dentry));
34 dput(parent);
35 return ret;
36}
37
38static struct dentry *ecryptfs_start_removing_dentry(struct dentry *dentry)
39{
40 struct dentry *parent = dget_parent(dentry);
41 struct dentry *ret;
42
43 ret = start_removing_dentry(parent: ecryptfs_dentry_to_lower(dentry: parent),
44 child: ecryptfs_dentry_to_lower(dentry));
45 dput(parent);
46 return ret;
47}
48
49static int ecryptfs_inode_test(struct inode *inode, void *lower_inode)
50{
51 return ecryptfs_inode_to_lower(inode) == lower_inode;
52}
53
54static int ecryptfs_inode_set(struct inode *inode, void *opaque)
55{
56 struct inode *lower_inode = opaque;
57
58 ecryptfs_set_inode_lower(inode, lower_inode);
59 fsstack_copy_attr_all(dest: inode, src: lower_inode);
60 /* i_size will be overwritten for encrypted regular files */
61 fsstack_copy_inode_size(dst: inode, src: lower_inode);
62 inode->i_ino = lower_inode->i_ino;
63 inode->i_mapping->a_ops = &ecryptfs_aops;
64
65 if (S_ISLNK(inode->i_mode))
66 inode->i_op = &ecryptfs_symlink_iops;
67 else if (S_ISDIR(inode->i_mode))
68 inode->i_op = &ecryptfs_dir_iops;
69 else
70 inode->i_op = &ecryptfs_main_iops;
71
72 if (S_ISDIR(inode->i_mode))
73 inode->i_fop = &ecryptfs_dir_fops;
74 else if (special_file(inode->i_mode))
75 init_special_inode(inode, inode->i_mode, inode->i_rdev);
76 else
77 inode->i_fop = &ecryptfs_main_fops;
78
79 return 0;
80}
81
82static struct inode *__ecryptfs_get_inode(struct inode *lower_inode,
83 struct super_block *sb)
84{
85 struct inode *inode;
86
87 if (lower_inode->i_sb != ecryptfs_superblock_to_lower(sb))
88 return ERR_PTR(error: -EXDEV);
89
90 /* Reject dealing with casefold directories. */
91 if (IS_CASEFOLDED(lower_inode)) {
92 pr_err_ratelimited("%s: Can't handle casefolded directory.\n",
93 __func__);
94 return ERR_PTR(error: -EREMOTE);
95 }
96
97 if (!igrab(lower_inode))
98 return ERR_PTR(error: -ESTALE);
99 inode = iget5_locked(sb, (unsigned long)lower_inode,
100 test: ecryptfs_inode_test, set: ecryptfs_inode_set,
101 lower_inode);
102 if (!inode) {
103 iput(lower_inode);
104 return ERR_PTR(error: -EACCES);
105 }
106 if (!(inode_state_read_once(inode) & I_NEW))
107 iput(lower_inode);
108
109 return inode;
110}
111
112struct inode *ecryptfs_get_inode(struct inode *lower_inode,
113 struct super_block *sb)
114{
115 struct inode *inode = __ecryptfs_get_inode(lower_inode, sb);
116
117 if (!IS_ERR(ptr: inode) && (inode_state_read_once(inode) & I_NEW))
118 unlock_new_inode(inode);
119
120 return inode;
121}
122
123/**
124 * ecryptfs_interpose
125 * @lower_dentry: Existing dentry in the lower filesystem
126 * @dentry: ecryptfs' dentry
127 * @sb: ecryptfs's super_block
128 *
129 * Interposes upper and lower dentries.
130 *
131 * Returns zero on success; non-zero otherwise
132 */
133static int ecryptfs_interpose(struct dentry *lower_dentry,
134 struct dentry *dentry, struct super_block *sb)
135{
136 struct inode *inode = ecryptfs_get_inode(lower_inode: d_inode(dentry: lower_dentry), sb);
137
138 if (IS_ERR(ptr: inode))
139 return PTR_ERR(ptr: inode);
140 d_instantiate(dentry, inode);
141
142 return 0;
143}
144
145static int ecryptfs_do_unlink(struct inode *dir, struct dentry *dentry,
146 struct inode *inode)
147{
148 struct dentry *lower_dentry;
149 struct inode *lower_dir;
150 int rc;
151
152 lower_dentry = ecryptfs_start_removing_dentry(dentry);
153 if (IS_ERR(ptr: lower_dentry))
154 return PTR_ERR(ptr: lower_dentry);
155
156 lower_dir = lower_dentry->d_parent->d_inode;
157 rc = vfs_unlink(&nop_mnt_idmap, lower_dir, lower_dentry, NULL);
158 if (rc) {
159 printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
160 goto out_unlock;
161 }
162 fsstack_copy_attr_times(dest: dir, src: lower_dir);
163 set_nlink(inode, nlink: ecryptfs_inode_to_lower(inode)->i_nlink);
164 inode_set_ctime_to_ts(inode, ts: inode_get_ctime(inode: dir));
165out_unlock:
166 end_removing(child: lower_dentry);
167 if (!rc)
168 d_drop(dentry);
169 return rc;
170}
171
172/**
173 * ecryptfs_do_create
174 * @directory_inode: inode of the new file's dentry's parent in ecryptfs
175 * @ecryptfs_dentry: New file's dentry in ecryptfs
176 * @mode: The mode of the new file
177 *
178 * Creates the underlying file and the eCryptfs inode which will link to
179 * it. It will also update the eCryptfs directory inode to mimic the
180 * stat of the lower directory inode.
181 *
182 * Returns the new eCryptfs inode on success; an ERR_PTR on error condition
183 */
184static struct inode *
185ecryptfs_do_create(struct inode *directory_inode,
186 struct dentry *ecryptfs_dentry, umode_t mode)
187{
188 int rc;
189 struct dentry *lower_dentry;
190 struct inode *lower_dir;
191 struct inode *inode;
192
193 lower_dentry = ecryptfs_start_creating_dentry(dentry: ecryptfs_dentry);
194 if (IS_ERR(ptr: lower_dentry))
195 return ERR_CAST(ptr: lower_dentry);
196 lower_dir = lower_dentry->d_parent->d_inode;
197 rc = vfs_create(&nop_mnt_idmap, lower_dentry, mode, NULL);
198 if (rc) {
199 printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
200 "rc = [%d]\n", __func__, rc);
201 inode = ERR_PTR(error: rc);
202 goto out_lock;
203 }
204 inode = __ecryptfs_get_inode(lower_inode: d_inode(dentry: lower_dentry),
205 sb: directory_inode->i_sb);
206 if (IS_ERR(ptr: inode)) {
207 vfs_unlink(&nop_mnt_idmap, lower_dir, lower_dentry, NULL);
208 goto out_lock;
209 }
210 fsstack_copy_attr_times(dest: directory_inode, src: lower_dir);
211 fsstack_copy_inode_size(dst: directory_inode, src: lower_dir);
212out_lock:
213 end_creating(child: lower_dentry);
214 return inode;
215}
216
217/*
218 * ecryptfs_initialize_file
219 *
220 * Cause the file to be changed from a basic empty file to an ecryptfs
221 * file with a header and first data page.
222 *
223 * Returns zero on success
224 */
225int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry,
226 struct inode *ecryptfs_inode)
227{
228 struct ecryptfs_crypt_stat *crypt_stat =
229 &ecryptfs_inode_to_private(inode: ecryptfs_inode)->crypt_stat;
230 int rc = 0;
231
232 if (S_ISDIR(ecryptfs_inode->i_mode)) {
233 ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
234 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
235 goto out;
236 }
237 ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n");
238 rc = ecryptfs_new_file_context(ecryptfs_inode);
239 if (rc) {
240 ecryptfs_printk(KERN_ERR, "Error creating new file "
241 "context; rc = [%d]\n", rc);
242 goto out;
243 }
244 rc = ecryptfs_get_lower_file(dentry: ecryptfs_dentry, inode: ecryptfs_inode);
245 if (rc) {
246 printk(KERN_ERR "%s: Error attempting to initialize "
247 "the lower file for the dentry with name "
248 "[%pd]; rc = [%d]\n", __func__,
249 ecryptfs_dentry, rc);
250 goto out;
251 }
252 rc = ecryptfs_write_metadata(ecryptfs_dentry, ecryptfs_inode);
253 if (rc)
254 printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
255 ecryptfs_put_lower_file(inode: ecryptfs_inode);
256out:
257 return rc;
258}
259
260/*
261 * ecryptfs_create
262 * @mode: The mode of the new file.
263 *
264 * Creates a new file.
265 *
266 * Returns zero on success; non-zero on error condition
267 */
268static int
269ecryptfs_create(struct mnt_idmap *idmap,
270 struct inode *directory_inode, struct dentry *ecryptfs_dentry,
271 umode_t mode, bool excl)
272{
273 struct inode *ecryptfs_inode;
274 int rc;
275
276 ecryptfs_inode = ecryptfs_do_create(directory_inode, ecryptfs_dentry,
277 mode);
278 if (IS_ERR(ptr: ecryptfs_inode)) {
279 ecryptfs_printk(KERN_WARNING, "Failed to create file in"
280 "lower filesystem\n");
281 rc = PTR_ERR(ptr: ecryptfs_inode);
282 goto out;
283 }
284 /* At this point, a file exists on "disk"; we need to make sure
285 * that this on disk file is prepared to be an ecryptfs file */
286 rc = ecryptfs_initialize_file(ecryptfs_dentry, ecryptfs_inode);
287 if (rc) {
288 ecryptfs_do_unlink(dir: directory_inode, dentry: ecryptfs_dentry,
289 inode: ecryptfs_inode);
290 iget_failed(ecryptfs_inode);
291 goto out;
292 }
293 d_instantiate_new(ecryptfs_dentry, ecryptfs_inode);
294out:
295 return rc;
296}
297
298static int ecryptfs_i_size_read(struct dentry *dentry, struct inode *inode)
299{
300 struct ecryptfs_crypt_stat *crypt_stat;
301 int rc;
302
303 rc = ecryptfs_get_lower_file(dentry, inode);
304 if (rc) {
305 printk(KERN_ERR "%s: Error attempting to initialize "
306 "the lower file for the dentry with name "
307 "[%pd]; rc = [%d]\n", __func__,
308 dentry, rc);
309 return rc;
310 }
311
312 crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
313 /* TODO: lock for crypt_stat comparison */
314 if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
315 ecryptfs_set_default_sizes(crypt_stat);
316
317 rc = ecryptfs_read_and_validate_header_region(inode);
318 ecryptfs_put_lower_file(inode);
319 if (rc) {
320 rc = ecryptfs_read_and_validate_xattr_region(dentry, inode);
321 if (!rc)
322 crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
323 }
324
325 /* Must return 0 to allow non-eCryptfs files to be looked up, too */
326 return 0;
327}
328
329/*
330 * ecryptfs_lookup_interpose - Dentry interposition for a lookup
331 */
332static struct dentry *ecryptfs_lookup_interpose(struct dentry *dentry,
333 struct dentry *lower_dentry)
334{
335 struct dentry *lower_parent = ecryptfs_dentry_to_lower(dentry: dentry->d_parent);
336 struct inode *inode, *lower_inode;
337 int rc = 0;
338
339 fsstack_copy_attr_atime(dest: d_inode(dentry: dentry->d_parent),
340 src: d_inode(dentry: lower_parent));
341 BUG_ON(!d_count(lower_dentry));
342
343 ecryptfs_set_dentry_lower(dentry, lower_dentry);
344
345 /*
346 * negative dentry can go positive under us here - its parent is not
347 * locked. That's OK and that could happen just as we return from
348 * ecryptfs_lookup() anyway. Just need to be careful and fetch
349 * ->d_inode only once - it's not stable here.
350 */
351 lower_inode = READ_ONCE(lower_dentry->d_inode);
352
353 if (!lower_inode) {
354 /* We want to add because we couldn't find in lower */
355 d_add(dentry, NULL);
356 return NULL;
357 }
358 inode = __ecryptfs_get_inode(lower_inode, sb: dentry->d_sb);
359 if (IS_ERR(ptr: inode)) {
360 printk(KERN_ERR "%s: Error interposing; rc = [%ld]\n",
361 __func__, PTR_ERR(inode));
362 return ERR_CAST(ptr: inode);
363 }
364 if (S_ISREG(inode->i_mode)) {
365 rc = ecryptfs_i_size_read(dentry, inode);
366 if (rc) {
367 make_bad_inode(inode);
368 return ERR_PTR(error: rc);
369 }
370 }
371
372 if (inode_state_read_once(inode) & I_NEW)
373 unlock_new_inode(inode);
374 return d_splice_alias(inode, dentry);
375}
376
377/**
378 * ecryptfs_lookup
379 * @ecryptfs_dir_inode: The eCryptfs directory inode
380 * @ecryptfs_dentry: The eCryptfs dentry that we are looking up
381 * @flags: lookup flags
382 *
383 * Find a file on disk. If the file does not exist, then we'll add it to the
384 * dentry cache and continue on to read it from the disk.
385 */
386static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
387 struct dentry *ecryptfs_dentry,
388 unsigned int flags)
389{
390 char *encrypted_and_encoded_name = NULL;
391 struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
392 struct dentry *lower_dir_dentry, *lower_dentry;
393 struct qstr qname = QSTR_INIT(ecryptfs_dentry->d_name.name,
394 ecryptfs_dentry->d_name.len);
395 struct dentry *res;
396 int rc = 0;
397
398 lower_dir_dentry = ecryptfs_dentry_to_lower(dentry: ecryptfs_dentry->d_parent);
399
400 mount_crypt_stat = &ecryptfs_superblock_to_private(
401 sb: ecryptfs_dentry->d_sb)->mount_crypt_stat;
402 if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
403 size_t len = qname.len;
404 rc = ecryptfs_encrypt_and_encode_filename(
405 encoded_name: &encrypted_and_encoded_name, encoded_name_size: &len,
406 mount_crypt_stat, name: qname.name, name_size: len);
407 if (rc) {
408 printk(KERN_ERR "%s: Error attempting to encrypt and encode "
409 "filename; rc = [%d]\n", __func__, rc);
410 return ERR_PTR(error: rc);
411 }
412 qname.name = encrypted_and_encoded_name;
413 qname.len = len;
414 }
415
416 lower_dentry = lookup_noperm_unlocked(&qname, lower_dir_dentry);
417 if (IS_ERR(ptr: lower_dentry)) {
418 ecryptfs_printk(KERN_DEBUG, "%s: lookup_noperm() returned "
419 "[%ld] on lower_dentry = [%s]\n", __func__,
420 PTR_ERR(lower_dentry),
421 qname.name);
422 res = ERR_CAST(ptr: lower_dentry);
423 } else {
424 res = ecryptfs_lookup_interpose(dentry: ecryptfs_dentry, lower_dentry);
425 }
426 kfree(objp: encrypted_and_encoded_name);
427 return res;
428}
429
430static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir,
431 struct dentry *new_dentry)
432{
433 struct dentry *lower_old_dentry;
434 struct dentry *lower_new_dentry;
435 struct inode *lower_dir;
436 u64 file_size_save;
437 int rc;
438
439 file_size_save = i_size_read(inode: d_inode(dentry: old_dentry));
440 lower_old_dentry = ecryptfs_dentry_to_lower(dentry: old_dentry);
441 lower_new_dentry = ecryptfs_start_creating_dentry(dentry: new_dentry);
442 if (IS_ERR(ptr: lower_new_dentry))
443 return PTR_ERR(ptr: lower_new_dentry);
444 lower_dir = lower_new_dentry->d_parent->d_inode;
445 rc = vfs_link(lower_old_dentry, &nop_mnt_idmap, lower_dir,
446 lower_new_dentry, NULL);
447 if (rc || d_really_is_negative(dentry: lower_new_dentry))
448 goto out_lock;
449 rc = ecryptfs_interpose(lower_dentry: lower_new_dentry, dentry: new_dentry, sb: dir->i_sb);
450 if (rc)
451 goto out_lock;
452 fsstack_copy_attr_times(dest: dir, src: lower_dir);
453 fsstack_copy_inode_size(dst: dir, src: lower_dir);
454 set_nlink(inode: d_inode(dentry: old_dentry),
455 nlink: ecryptfs_inode_to_lower(inode: d_inode(dentry: old_dentry))->i_nlink);
456 i_size_write(inode: d_inode(dentry: new_dentry), i_size: file_size_save);
457out_lock:
458 end_creating(child: lower_new_dentry);
459 return rc;
460}
461
462static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
463{
464 return ecryptfs_do_unlink(dir, dentry, inode: d_inode(dentry));
465}
466
467static int ecryptfs_symlink(struct mnt_idmap *idmap,
468 struct inode *dir, struct dentry *dentry,
469 const char *symname)
470{
471 int rc;
472 struct dentry *lower_dentry;
473 struct inode *lower_dir;
474 char *encoded_symname;
475 size_t encoded_symlen;
476 struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
477
478 lower_dentry = ecryptfs_start_creating_dentry(dentry);
479 if (IS_ERR(ptr: lower_dentry))
480 return PTR_ERR(ptr: lower_dentry);
481 lower_dir = lower_dentry->d_parent->d_inode;
482
483 mount_crypt_stat = &ecryptfs_superblock_to_private(
484 sb: dir->i_sb)->mount_crypt_stat;
485 rc = ecryptfs_encrypt_and_encode_filename(encoded_name: &encoded_symname,
486 encoded_name_size: &encoded_symlen,
487 mount_crypt_stat, name: symname,
488 strlen(symname));
489 if (rc)
490 goto out_lock;
491 rc = vfs_symlink(&nop_mnt_idmap, lower_dir, lower_dentry,
492 encoded_symname, NULL);
493 kfree(objp: encoded_symname);
494 if (rc || d_really_is_negative(dentry: lower_dentry))
495 goto out_lock;
496 rc = ecryptfs_interpose(lower_dentry, dentry, sb: dir->i_sb);
497 if (rc)
498 goto out_lock;
499 fsstack_copy_attr_times(dest: dir, src: lower_dir);
500 fsstack_copy_inode_size(dst: dir, src: lower_dir);
501out_lock:
502 end_creating(child: lower_dentry);
503 if (d_really_is_negative(dentry))
504 d_drop(dentry);
505 return rc;
506}
507
508static struct dentry *ecryptfs_mkdir(struct mnt_idmap *idmap, struct inode *dir,
509 struct dentry *dentry, umode_t mode)
510{
511 int rc;
512 struct dentry *lower_dentry;
513 struct dentry *lower_dir_dentry;
514 struct inode *lower_dir;
515
516 lower_dentry = ecryptfs_start_creating_dentry(dentry);
517 if (IS_ERR(ptr: lower_dentry))
518 return lower_dentry;
519 lower_dir_dentry = dget(dentry: lower_dentry->d_parent);
520 lower_dir = lower_dir_dentry->d_inode;
521 lower_dentry = vfs_mkdir(&nop_mnt_idmap, lower_dir,
522 lower_dentry, mode, NULL);
523 rc = PTR_ERR(ptr: lower_dentry);
524 if (IS_ERR(ptr: lower_dentry))
525 goto out;
526 rc = 0;
527 if (d_unhashed(dentry: lower_dentry))
528 goto out;
529 rc = ecryptfs_interpose(lower_dentry, dentry, sb: dir->i_sb);
530 if (rc)
531 goto out;
532 fsstack_copy_attr_times(dest: dir, src: lower_dir);
533 fsstack_copy_inode_size(dst: dir, src: lower_dir);
534 set_nlink(inode: dir, nlink: lower_dir->i_nlink);
535out:
536 dput(lower_dir_dentry);
537 end_creating(child: lower_dentry);
538 if (d_really_is_negative(dentry))
539 d_drop(dentry);
540 return ERR_PTR(error: rc);
541}
542
543static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry)
544{
545 struct dentry *lower_dentry;
546 struct inode *lower_dir;
547 int rc;
548
549 lower_dentry = ecryptfs_start_removing_dentry(dentry);
550 if (IS_ERR(ptr: lower_dentry))
551 return PTR_ERR(ptr: lower_dentry);
552 lower_dir = lower_dentry->d_parent->d_inode;
553
554 rc = vfs_rmdir(&nop_mnt_idmap, lower_dir, lower_dentry, NULL);
555 if (!rc) {
556 clear_nlink(inode: d_inode(dentry));
557 fsstack_copy_attr_times(dest: dir, src: lower_dir);
558 set_nlink(inode: dir, nlink: lower_dir->i_nlink);
559 }
560 end_removing(child: lower_dentry);
561 if (!rc)
562 d_drop(dentry);
563 return rc;
564}
565
566static int
567ecryptfs_mknod(struct mnt_idmap *idmap, struct inode *dir,
568 struct dentry *dentry, umode_t mode, dev_t dev)
569{
570 int rc;
571 struct dentry *lower_dentry;
572 struct inode *lower_dir;
573
574 lower_dentry = ecryptfs_start_creating_dentry(dentry);
575 if (IS_ERR(ptr: lower_dentry))
576 return PTR_ERR(ptr: lower_dentry);
577 lower_dir = lower_dentry->d_parent->d_inode;
578
579 rc = vfs_mknod(&nop_mnt_idmap, lower_dir, lower_dentry, mode, dev, NULL);
580 if (rc || d_really_is_negative(dentry: lower_dentry))
581 goto out;
582 rc = ecryptfs_interpose(lower_dentry, dentry, sb: dir->i_sb);
583 if (rc)
584 goto out;
585 fsstack_copy_attr_times(dest: dir, src: lower_dir);
586 fsstack_copy_inode_size(dst: dir, src: lower_dir);
587out:
588 end_creating(child: lower_dentry);
589 if (d_really_is_negative(dentry))
590 d_drop(dentry);
591 return rc;
592}
593
594static int
595ecryptfs_rename(struct mnt_idmap *idmap, struct inode *old_dir,
596 struct dentry *old_dentry, struct inode *new_dir,
597 struct dentry *new_dentry, unsigned int flags)
598{
599 int rc;
600 struct dentry *lower_old_dentry;
601 struct dentry *lower_new_dentry;
602 struct dentry *lower_old_dir_dentry;
603 struct dentry *lower_new_dir_dentry;
604 struct inode *target_inode;
605 struct renamedata rd = {};
606
607 if (flags)
608 return -EINVAL;
609
610 lower_old_dir_dentry = ecryptfs_dentry_to_lower(dentry: old_dentry->d_parent);
611 lower_new_dir_dentry = ecryptfs_dentry_to_lower(dentry: new_dentry->d_parent);
612
613 lower_old_dentry = ecryptfs_dentry_to_lower(dentry: old_dentry);
614 lower_new_dentry = ecryptfs_dentry_to_lower(dentry: new_dentry);
615
616 target_inode = d_inode(dentry: new_dentry);
617
618 rd.mnt_idmap = &nop_mnt_idmap;
619 rd.old_parent = lower_old_dir_dentry;
620 rd.new_parent = lower_new_dir_dentry;
621 rc = start_renaming_two_dentries(rd: &rd, old_dentry: lower_old_dentry, new_dentry: lower_new_dentry);
622 if (rc)
623 return rc;
624
625 rc = vfs_rename(&rd);
626 if (rc)
627 goto out_lock;
628 if (target_inode)
629 fsstack_copy_attr_all(dest: target_inode,
630 src: ecryptfs_inode_to_lower(inode: target_inode));
631 fsstack_copy_attr_all(dest: new_dir, src: d_inode(dentry: lower_new_dir_dentry));
632 if (new_dir != old_dir)
633 fsstack_copy_attr_all(dest: old_dir, src: d_inode(dentry: lower_old_dir_dentry));
634out_lock:
635 end_renaming(rd: &rd);
636 return rc;
637}
638
639static char *ecryptfs_readlink_lower(struct dentry *dentry, size_t *bufsiz)
640{
641 DEFINE_DELAYED_CALL(done);
642 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
643 const char *link;
644 char *buf;
645 int rc;
646
647 link = vfs_get_link(lower_dentry, &done);
648 if (IS_ERR(ptr: link))
649 return ERR_CAST(ptr: link);
650
651 rc = ecryptfs_decode_and_decrypt_filename(decrypted_name: &buf, decrypted_name_size: bufsiz, sb: dentry->d_sb,
652 name: link, strlen(link));
653 do_delayed_call(call: &done);
654 if (rc)
655 return ERR_PTR(error: rc);
656
657 return buf;
658}
659
660static const char *ecryptfs_get_link(struct dentry *dentry,
661 struct inode *inode,
662 struct delayed_call *done)
663{
664 size_t len;
665 char *buf;
666
667 if (!dentry)
668 return ERR_PTR(error: -ECHILD);
669
670 buf = ecryptfs_readlink_lower(dentry, bufsiz: &len);
671 if (IS_ERR(ptr: buf))
672 return buf;
673 fsstack_copy_attr_atime(dest: d_inode(dentry),
674 src: d_inode(dentry: ecryptfs_dentry_to_lower(dentry)));
675 buf[len] = '\0';
676 set_delayed_call(call: done, fn: kfree_link, arg: buf);
677 return buf;
678}
679
680/**
681 * upper_size_to_lower_size
682 * @crypt_stat: Crypt_stat associated with file
683 * @upper_size: Size of the upper file
684 *
685 * Calculate the required size of the lower file based on the
686 * specified size of the upper file. This calculation is based on the
687 * number of headers in the underlying file and the extent size.
688 *
689 * Returns Calculated size of the lower file.
690 */
691static loff_t
692upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat,
693 loff_t upper_size)
694{
695 loff_t lower_size;
696
697 lower_size = ecryptfs_lower_header_size(crypt_stat);
698 if (upper_size != 0) {
699 loff_t num_extents;
700
701 num_extents = upper_size >> crypt_stat->extent_shift;
702 if (upper_size & ~crypt_stat->extent_mask)
703 num_extents++;
704 lower_size += (num_extents * crypt_stat->extent_size);
705 }
706 return lower_size;
707}
708
709/**
710 * truncate_upper
711 * @dentry: The ecryptfs layer dentry
712 * @ia: Address of the ecryptfs inode's attributes
713 * @lower_ia: Address of the lower inode's attributes
714 *
715 * Function to handle truncations modifying the size of the file. Note
716 * that the file sizes are interpolated. When expanding, we are simply
717 * writing strings of 0's out. When truncating, we truncate the upper
718 * inode and update the lower_ia according to the page index
719 * interpolations. If ATTR_SIZE is set in lower_ia->ia_valid upon return,
720 * the caller must use lower_ia in a call to notify_change() to perform
721 * the truncation of the lower inode.
722 *
723 * Returns zero on success; non-zero otherwise
724 */
725static int truncate_upper(struct dentry *dentry, struct iattr *ia,
726 struct iattr *lower_ia)
727{
728 int rc = 0;
729 struct inode *inode = d_inode(dentry);
730 struct ecryptfs_crypt_stat *crypt_stat;
731 loff_t i_size = i_size_read(inode);
732 loff_t lower_size_before_truncate;
733 loff_t lower_size_after_truncate;
734
735 if (unlikely((ia->ia_size == i_size))) {
736 lower_ia->ia_valid &= ~ATTR_SIZE;
737 return 0;
738 }
739 rc = ecryptfs_get_lower_file(dentry, inode);
740 if (rc)
741 return rc;
742 crypt_stat = &ecryptfs_inode_to_private(inode: d_inode(dentry))->crypt_stat;
743 /* Switch on growing or shrinking file */
744 if (ia->ia_size > i_size) {
745 char zero[] = { 0x00 };
746
747 lower_ia->ia_valid &= ~ATTR_SIZE;
748 /* Write a single 0 at the last position of the file;
749 * this triggers code that will fill in 0's throughout
750 * the intermediate portion of the previous end of the
751 * file and the new and of the file */
752 rc = ecryptfs_write(inode, data: zero,
753 offset: (ia->ia_size - 1), size: 1);
754 } else { /* ia->ia_size < i_size_read(inode) */
755 /* We're chopping off all the pages down to the page
756 * in which ia->ia_size is located. Fill in the end of
757 * that page from (ia->ia_size & ~PAGE_MASK) to
758 * PAGE_SIZE with zeros. */
759 size_t num_zeros = (PAGE_SIZE
760 - (ia->ia_size & ~PAGE_MASK));
761
762 if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
763 truncate_setsize(inode, newsize: ia->ia_size);
764 lower_ia->ia_size = ia->ia_size;
765 lower_ia->ia_valid |= ATTR_SIZE;
766 goto out;
767 }
768 if (num_zeros) {
769 char *zeros_virt;
770
771 zeros_virt = kzalloc(num_zeros, GFP_KERNEL);
772 if (!zeros_virt) {
773 rc = -ENOMEM;
774 goto out;
775 }
776 rc = ecryptfs_write(inode, data: zeros_virt,
777 offset: ia->ia_size, size: num_zeros);
778 kfree(objp: zeros_virt);
779 if (rc) {
780 printk(KERN_ERR "Error attempting to zero out "
781 "the remainder of the end page on "
782 "reducing truncate; rc = [%d]\n", rc);
783 goto out;
784 }
785 }
786 truncate_setsize(inode, newsize: ia->ia_size);
787 rc = ecryptfs_write_inode_size_to_metadata(ecryptfs_inode: inode);
788 if (rc) {
789 printk(KERN_ERR "Problem with "
790 "ecryptfs_write_inode_size_to_metadata; "
791 "rc = [%d]\n", rc);
792 goto out;
793 }
794 /* We are reducing the size of the ecryptfs file, and need to
795 * know if we need to reduce the size of the lower file. */
796 lower_size_before_truncate =
797 upper_size_to_lower_size(crypt_stat, upper_size: i_size);
798 lower_size_after_truncate =
799 upper_size_to_lower_size(crypt_stat, upper_size: ia->ia_size);
800 if (lower_size_after_truncate < lower_size_before_truncate) {
801 lower_ia->ia_size = lower_size_after_truncate;
802 lower_ia->ia_valid |= ATTR_SIZE;
803 } else
804 lower_ia->ia_valid &= ~ATTR_SIZE;
805 }
806out:
807 ecryptfs_put_lower_file(inode);
808 return rc;
809}
810
811static int ecryptfs_inode_newsize_ok(struct inode *inode, loff_t offset)
812{
813 struct ecryptfs_crypt_stat *crypt_stat;
814 loff_t lower_oldsize, lower_newsize;
815
816 crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
817 lower_oldsize = upper_size_to_lower_size(crypt_stat,
818 upper_size: i_size_read(inode));
819 lower_newsize = upper_size_to_lower_size(crypt_stat, upper_size: offset);
820 if (lower_newsize > lower_oldsize) {
821 /*
822 * The eCryptfs inode and the new *lower* size are mixed here
823 * because we may not have the lower i_mutex held and/or it may
824 * not be appropriate to call inode_newsize_ok() with inodes
825 * from other filesystems.
826 */
827 return inode_newsize_ok(inode, offset: lower_newsize);
828 }
829
830 return 0;
831}
832
833/**
834 * ecryptfs_truncate
835 * @dentry: The ecryptfs layer dentry
836 * @new_length: The length to expand the file to
837 *
838 * Simple function that handles the truncation of an eCryptfs inode and
839 * its corresponding lower inode.
840 *
841 * Returns zero on success; non-zero otherwise
842 */
843int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
844{
845 struct iattr ia = { .ia_valid = ATTR_SIZE, .ia_size = new_length };
846 struct iattr lower_ia = { .ia_valid = 0 };
847 int rc;
848
849 rc = ecryptfs_inode_newsize_ok(inode: d_inode(dentry), offset: new_length);
850 if (rc)
851 return rc;
852
853 rc = truncate_upper(dentry, ia: &ia, lower_ia: &lower_ia);
854 if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
855 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
856
857 inode_lock(inode: d_inode(dentry: lower_dentry));
858 rc = notify_change(&nop_mnt_idmap, lower_dentry,
859 &lower_ia, NULL);
860 inode_unlock(inode: d_inode(dentry: lower_dentry));
861 }
862 return rc;
863}
864
865static int
866ecryptfs_permission(struct mnt_idmap *idmap, struct inode *inode,
867 int mask)
868{
869 return inode_permission(&nop_mnt_idmap,
870 ecryptfs_inode_to_lower(inode), mask);
871}
872
873/**
874 * ecryptfs_setattr
875 * @idmap: idmap of the target mount
876 * @dentry: dentry handle to the inode to modify
877 * @ia: Structure with flags of what to change and values
878 *
879 * Updates the metadata of an inode. If the update is to the size
880 * i.e. truncation, then ecryptfs_truncate will handle the size modification
881 * of both the ecryptfs inode and the lower inode.
882 *
883 * All other metadata changes will be passed right to the lower filesystem,
884 * and we will just update our inode to look like the lower.
885 */
886static int ecryptfs_setattr(struct mnt_idmap *idmap,
887 struct dentry *dentry, struct iattr *ia)
888{
889 int rc = 0;
890 struct dentry *lower_dentry;
891 struct iattr lower_ia;
892 struct inode *inode;
893 struct inode *lower_inode;
894 struct ecryptfs_crypt_stat *crypt_stat;
895
896 crypt_stat = &ecryptfs_inode_to_private(inode: d_inode(dentry))->crypt_stat;
897 if (!(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED))
898 ecryptfs_init_crypt_stat(crypt_stat);
899 inode = d_inode(dentry);
900 lower_inode = ecryptfs_inode_to_lower(inode);
901 lower_dentry = ecryptfs_dentry_to_lower(dentry);
902 mutex_lock(&crypt_stat->cs_mutex);
903 if (d_is_dir(dentry))
904 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
905 else if (d_is_reg(dentry)
906 && (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)
907 || !(crypt_stat->flags & ECRYPTFS_KEY_VALID))) {
908 struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
909
910 mount_crypt_stat = &ecryptfs_superblock_to_private(
911 sb: dentry->d_sb)->mount_crypt_stat;
912 rc = ecryptfs_get_lower_file(dentry, inode);
913 if (rc) {
914 mutex_unlock(lock: &crypt_stat->cs_mutex);
915 goto out;
916 }
917 rc = ecryptfs_read_metadata(ecryptfs_dentry: dentry);
918 ecryptfs_put_lower_file(inode);
919 if (rc) {
920 if (!(mount_crypt_stat->flags
921 & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
922 rc = -EIO;
923 printk(KERN_WARNING "Either the lower file "
924 "is not in a valid eCryptfs format, "
925 "or the key could not be retrieved. "
926 "Plaintext passthrough mode is not "
927 "enabled; returning -EIO\n");
928 mutex_unlock(lock: &crypt_stat->cs_mutex);
929 goto out;
930 }
931 rc = 0;
932 crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
933 | ECRYPTFS_ENCRYPTED);
934 }
935 }
936 mutex_unlock(lock: &crypt_stat->cs_mutex);
937
938 rc = setattr_prepare(&nop_mnt_idmap, dentry, ia);
939 if (rc)
940 goto out;
941 if (ia->ia_valid & ATTR_SIZE) {
942 rc = ecryptfs_inode_newsize_ok(inode, offset: ia->ia_size);
943 if (rc)
944 goto out;
945 }
946
947 memcpy(&lower_ia, ia, sizeof(lower_ia));
948 if (ia->ia_valid & ATTR_FILE)
949 lower_ia.ia_file = ecryptfs_file_to_lower(file: ia->ia_file);
950 if (ia->ia_valid & ATTR_SIZE) {
951 rc = truncate_upper(dentry, ia, lower_ia: &lower_ia);
952 if (rc < 0)
953 goto out;
954 }
955
956 /*
957 * mode change is for clearing setuid/setgid bits. Allow lower fs
958 * to interpret this in its own way.
959 */
960 if (lower_ia.ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
961 lower_ia.ia_valid &= ~ATTR_MODE;
962
963 inode_lock(inode: d_inode(dentry: lower_dentry));
964 rc = notify_change(&nop_mnt_idmap, lower_dentry, &lower_ia, NULL);
965 inode_unlock(inode: d_inode(dentry: lower_dentry));
966out:
967 fsstack_copy_attr_all(dest: inode, src: lower_inode);
968 return rc;
969}
970
971static int ecryptfs_getattr_link(struct mnt_idmap *idmap,
972 const struct path *path, struct kstat *stat,
973 u32 request_mask, unsigned int flags)
974{
975 struct dentry *dentry = path->dentry;
976 struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
977 int rc = 0;
978
979 mount_crypt_stat = &ecryptfs_superblock_to_private(
980 sb: dentry->d_sb)->mount_crypt_stat;
981 generic_fillattr(&nop_mnt_idmap, request_mask, d_inode(dentry), stat);
982 if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
983 char *target;
984 size_t targetsiz;
985
986 target = ecryptfs_readlink_lower(dentry, bufsiz: &targetsiz);
987 if (!IS_ERR(ptr: target)) {
988 kfree(objp: target);
989 stat->size = targetsiz;
990 } else {
991 rc = PTR_ERR(ptr: target);
992 }
993 }
994 return rc;
995}
996
997static int ecryptfs_getattr(struct mnt_idmap *idmap,
998 const struct path *path, struct kstat *stat,
999 u32 request_mask, unsigned int flags)
1000{
1001 struct dentry *dentry = path->dentry;
1002 struct kstat lower_stat;
1003 struct path lower_path = ecryptfs_lower_path(dentry);
1004 int rc;
1005
1006 rc = vfs_getattr_nosec(&lower_path, &lower_stat, request_mask, flags);
1007 if (!rc) {
1008 fsstack_copy_attr_all(dest: d_inode(dentry),
1009 src: ecryptfs_inode_to_lower(inode: d_inode(dentry)));
1010 generic_fillattr(&nop_mnt_idmap, request_mask,
1011 d_inode(dentry), stat);
1012 stat->blocks = lower_stat.blocks;
1013 }
1014 return rc;
1015}
1016
1017int
1018ecryptfs_setxattr(struct dentry *dentry, struct inode *inode,
1019 const char *name, const void *value,
1020 size_t size, int flags)
1021{
1022 int rc;
1023 struct dentry *lower_dentry;
1024 struct inode *lower_inode;
1025
1026 lower_dentry = ecryptfs_dentry_to_lower(dentry);
1027 lower_inode = d_inode(dentry: lower_dentry);
1028 if (!(lower_inode->i_opflags & IOP_XATTR)) {
1029 rc = -EOPNOTSUPP;
1030 goto out;
1031 }
1032 inode_lock(inode: lower_inode);
1033 rc = __vfs_setxattr_locked(&nop_mnt_idmap, lower_dentry, name, value, size, flags, NULL);
1034 inode_unlock(inode: lower_inode);
1035 if (!rc && inode)
1036 fsstack_copy_attr_all(dest: inode, src: lower_inode);
1037out:
1038 return rc;
1039}
1040
1041ssize_t
1042ecryptfs_getxattr_lower(struct dentry *lower_dentry, struct inode *lower_inode,
1043 const char *name, void *value, size_t size)
1044{
1045 int rc;
1046
1047 if (!(lower_inode->i_opflags & IOP_XATTR)) {
1048 rc = -EOPNOTSUPP;
1049 goto out;
1050 }
1051 inode_lock(inode: lower_inode);
1052 rc = __vfs_getxattr(lower_dentry, lower_inode, name, value, size);
1053 inode_unlock(inode: lower_inode);
1054out:
1055 return rc;
1056}
1057
1058static ssize_t
1059ecryptfs_getxattr(struct dentry *dentry, struct inode *inode,
1060 const char *name, void *value, size_t size)
1061{
1062 return ecryptfs_getxattr_lower(lower_dentry: ecryptfs_dentry_to_lower(dentry),
1063 lower_inode: ecryptfs_inode_to_lower(inode),
1064 name, value, size);
1065}
1066
1067static ssize_t
1068ecryptfs_listxattr(struct dentry *dentry, char *list, size_t size)
1069{
1070 int rc = 0;
1071 struct dentry *lower_dentry;
1072
1073 lower_dentry = ecryptfs_dentry_to_lower(dentry);
1074 if (!d_inode(dentry: lower_dentry)->i_op->listxattr) {
1075 rc = -EOPNOTSUPP;
1076 goto out;
1077 }
1078 inode_lock(inode: d_inode(dentry: lower_dentry));
1079 rc = d_inode(dentry: lower_dentry)->i_op->listxattr(lower_dentry, list, size);
1080 inode_unlock(inode: d_inode(dentry: lower_dentry));
1081out:
1082 return rc;
1083}
1084
1085static int ecryptfs_removexattr(struct dentry *dentry, struct inode *inode,
1086 const char *name)
1087{
1088 int rc;
1089 struct dentry *lower_dentry;
1090 struct inode *lower_inode;
1091
1092 lower_dentry = ecryptfs_dentry_to_lower(dentry);
1093 lower_inode = ecryptfs_inode_to_lower(inode);
1094 if (!(lower_inode->i_opflags & IOP_XATTR)) {
1095 rc = -EOPNOTSUPP;
1096 goto out;
1097 }
1098 inode_lock(inode: lower_inode);
1099 rc = __vfs_removexattr(&nop_mnt_idmap, lower_dentry, name);
1100 inode_unlock(inode: lower_inode);
1101out:
1102 return rc;
1103}
1104
1105static int ecryptfs_fileattr_get(struct dentry *dentry, struct file_kattr *fa)
1106{
1107 return vfs_fileattr_get(dentry: ecryptfs_dentry_to_lower(dentry), fa);
1108}
1109
1110static int ecryptfs_fileattr_set(struct mnt_idmap *idmap,
1111 struct dentry *dentry, struct file_kattr *fa)
1112{
1113 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
1114 int rc;
1115
1116 rc = vfs_fileattr_set(idmap: &nop_mnt_idmap, dentry: lower_dentry, fa);
1117 fsstack_copy_attr_all(dest: d_inode(dentry), src: d_inode(dentry: lower_dentry));
1118
1119 return rc;
1120}
1121
1122static struct posix_acl *ecryptfs_get_acl(struct mnt_idmap *idmap,
1123 struct dentry *dentry, int type)
1124{
1125 return vfs_get_acl(idmap, dentry: ecryptfs_dentry_to_lower(dentry),
1126 acl_name: posix_acl_xattr_name(type));
1127}
1128
1129static int ecryptfs_set_acl(struct mnt_idmap *idmap,
1130 struct dentry *dentry, struct posix_acl *acl,
1131 int type)
1132{
1133 int rc;
1134 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
1135 struct inode *lower_inode = d_inode(dentry: lower_dentry);
1136
1137 rc = vfs_set_acl(idmap: &nop_mnt_idmap, dentry: lower_dentry,
1138 acl_name: posix_acl_xattr_name(type), kacl: acl);
1139 if (!rc)
1140 fsstack_copy_attr_all(dest: d_inode(dentry), src: lower_inode);
1141 return rc;
1142}
1143
1144const struct inode_operations ecryptfs_symlink_iops = {
1145 .get_link = ecryptfs_get_link,
1146 .permission = ecryptfs_permission,
1147 .setattr = ecryptfs_setattr,
1148 .getattr = ecryptfs_getattr_link,
1149 .listxattr = ecryptfs_listxattr,
1150};
1151
1152const struct inode_operations ecryptfs_dir_iops = {
1153 .create = ecryptfs_create,
1154 .lookup = ecryptfs_lookup,
1155 .link = ecryptfs_link,
1156 .unlink = ecryptfs_unlink,
1157 .symlink = ecryptfs_symlink,
1158 .mkdir = ecryptfs_mkdir,
1159 .rmdir = ecryptfs_rmdir,
1160 .mknod = ecryptfs_mknod,
1161 .rename = ecryptfs_rename,
1162 .permission = ecryptfs_permission,
1163 .setattr = ecryptfs_setattr,
1164 .listxattr = ecryptfs_listxattr,
1165 .fileattr_get = ecryptfs_fileattr_get,
1166 .fileattr_set = ecryptfs_fileattr_set,
1167 .get_acl = ecryptfs_get_acl,
1168 .set_acl = ecryptfs_set_acl,
1169};
1170
1171const struct inode_operations ecryptfs_main_iops = {
1172 .permission = ecryptfs_permission,
1173 .setattr = ecryptfs_setattr,
1174 .getattr = ecryptfs_getattr,
1175 .listxattr = ecryptfs_listxattr,
1176 .fileattr_get = ecryptfs_fileattr_get,
1177 .fileattr_set = ecryptfs_fileattr_set,
1178 .get_acl = ecryptfs_get_acl,
1179 .set_acl = ecryptfs_set_acl,
1180};
1181
1182static int ecryptfs_xattr_get(const struct xattr_handler *handler,
1183 struct dentry *dentry, struct inode *inode,
1184 const char *name, void *buffer, size_t size)
1185{
1186 return ecryptfs_getxattr(dentry, inode, name, value: buffer, size);
1187}
1188
1189static int ecryptfs_xattr_set(const struct xattr_handler *handler,
1190 struct mnt_idmap *idmap,
1191 struct dentry *dentry, struct inode *inode,
1192 const char *name, const void *value, size_t size,
1193 int flags)
1194{
1195 if (value)
1196 return ecryptfs_setxattr(dentry, inode, name, value, size, flags);
1197 else {
1198 BUG_ON(flags != XATTR_REPLACE);
1199 return ecryptfs_removexattr(dentry, inode, name);
1200 }
1201}
1202
1203static const struct xattr_handler ecryptfs_xattr_handler = {
1204 .prefix = "", /* match anything */
1205 .get = ecryptfs_xattr_get,
1206 .set = ecryptfs_xattr_set,
1207};
1208
1209const struct xattr_handler * const ecryptfs_xattr_handlers[] = {
1210 &ecryptfs_xattr_handler,
1211 NULL
1212};
1213

source code of linux/fs/ecryptfs/inode.c