file.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /**
  3. * eCryptfs: Linux filesystem encryption layer
  4. *
  5. * Copyright (C) 1997-2004 Erez Zadok
  6. * Copyright (C) 2001-2004 Stony Brook University
  7. * Copyright (C) 2004-2007 International Business Machines Corp.
  8. * Author(s): Michael A. Halcrow <mhalcrow@us.ibm.com>
  9. * Michael C. Thompson <mcthomps@us.ibm.com>
  10. */
  11. #include <linux/file.h>
  12. #include <linux/poll.h>
  13. #include <linux/slab.h>
  14. #include <linux/mount.h>
  15. #include <linux/pagemap.h>
  16. #include <linux/security.h>
  17. #include <linux/compat.h>
  18. #include <linux/fs_stack.h>
  19. #include "ecryptfs_kernel.h"
  20. /**
  21. * ecryptfs_read_update_atime
  22. *
  23. * generic_file_read updates the atime of upper layer inode. But, it
  24. * doesn't give us a chance to update the atime of the lower layer
  25. * inode. This function is a wrapper to generic_file_read. It
  26. * updates the atime of the lower level inode if generic_file_read
  27. * returns without any errors. This is to be used only for file reads.
  28. * The function to be used for directory reads is ecryptfs_read.
  29. */
  30. static ssize_t ecryptfs_read_update_atime(struct kiocb *iocb,
  31. struct iov_iter *to)
  32. {
  33. ssize_t rc;
  34. struct path *path;
  35. struct file *file = iocb->ki_filp;
  36. rc = generic_file_read_iter(iocb, to);
  37. if (rc >= 0) {
  38. path = ecryptfs_dentry_to_lower_path(file->f_path.dentry);
  39. touch_atime(path);
  40. }
  41. return rc;
  42. }
  43. struct ecryptfs_getdents_callback {
  44. struct dir_context ctx;
  45. struct dir_context *caller;
  46. struct super_block *sb;
  47. int filldir_called;
  48. int entries_written;
  49. };
  50. /* Inspired by generic filldir in fs/readdir.c */
  51. static int
  52. ecryptfs_filldir(struct dir_context *ctx, const char *lower_name,
  53. int lower_namelen, loff_t offset, u64 ino, unsigned int d_type)
  54. {
  55. struct ecryptfs_getdents_callback *buf =
  56. container_of(ctx, struct ecryptfs_getdents_callback, ctx);
  57. size_t name_size;
  58. char *name;
  59. int rc;
  60. buf->filldir_called++;
  61. rc = ecryptfs_decode_and_decrypt_filename(&name, &name_size,
  62. buf->sb, lower_name,
  63. lower_namelen);
  64. if (rc) {
  65. if (rc != -EINVAL) {
  66. ecryptfs_printk(KERN_DEBUG,
  67. "%s: Error attempting to decode and decrypt filename [%s]; rc = [%d]\n",
  68. __func__, lower_name, rc);
  69. return rc;
  70. }
  71. /* Mask -EINVAL errors as these are most likely due a plaintext
  72. * filename present in the lower filesystem despite filename
  73. * encryption being enabled. One unavoidable example would be
  74. * the "lost+found" dentry in the root directory of an Ext4
  75. * filesystem.
  76. */
  77. return 0;
  78. }
  79. buf->caller->pos = buf->ctx.pos;
  80. rc = !dir_emit(buf->caller, name, name_size, ino, d_type);
  81. kfree(name);
  82. if (!rc)
  83. buf->entries_written++;
  84. return rc;
  85. }
  86. /**
  87. * ecryptfs_readdir
  88. * @file: The eCryptfs directory file
  89. * @ctx: The actor to feed the entries to
  90. */
  91. static int ecryptfs_readdir(struct file *file, struct dir_context *ctx)
  92. {
  93. int rc;
  94. struct file *lower_file;
  95. struct inode *inode = file_inode(file);
  96. struct ecryptfs_getdents_callback buf = {
  97. .ctx.actor = ecryptfs_filldir,
  98. .caller = ctx,
  99. .sb = inode->i_sb,
  100. };
  101. lower_file = ecryptfs_file_to_lower(file);
  102. rc = iterate_dir(lower_file, &buf.ctx);
  103. ctx->pos = buf.ctx.pos;
  104. if (rc < 0)
  105. goto out;
  106. if (buf.filldir_called && !buf.entries_written)
  107. goto out;
  108. if (rc >= 0)
  109. fsstack_copy_attr_atime(inode,
  110. file_inode(lower_file));
  111. out:
  112. return rc;
  113. }
  114. struct kmem_cache *ecryptfs_file_info_cache;
  115. static int read_or_initialize_metadata(struct dentry *dentry)
  116. {
  117. struct inode *inode = d_inode(dentry);
  118. struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
  119. struct ecryptfs_crypt_stat *crypt_stat;
  120. int rc;
  121. crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
  122. mount_crypt_stat = &ecryptfs_superblock_to_private(
  123. inode->i_sb)->mount_crypt_stat;
  124. mutex_lock(&crypt_stat->cs_mutex);
  125. if (crypt_stat->flags & ECRYPTFS_POLICY_APPLIED &&
  126. crypt_stat->flags & ECRYPTFS_KEY_VALID) {
  127. rc = 0;
  128. goto out;
  129. }
  130. rc = ecryptfs_read_metadata(dentry);
  131. if (!rc)
  132. goto out;
  133. if (mount_crypt_stat->flags & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED) {
  134. crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
  135. | ECRYPTFS_ENCRYPTED);
  136. rc = 0;
  137. goto out;
  138. }
  139. if (!(mount_crypt_stat->flags & ECRYPTFS_XATTR_METADATA_ENABLED) &&
  140. !i_size_read(ecryptfs_inode_to_lower(inode))) {
  141. rc = ecryptfs_initialize_file(dentry, inode);
  142. if (!rc)
  143. goto out;
  144. }
  145. rc = -EIO;
  146. out:
  147. mutex_unlock(&crypt_stat->cs_mutex);
  148. return rc;
  149. }
  150. static int ecryptfs_mmap(struct file *file, struct vm_area_struct *vma)
  151. {
  152. struct file *lower_file = ecryptfs_file_to_lower(file);
  153. /*
  154. * Don't allow mmap on top of file systems that don't support it
  155. * natively. If FILESYSTEM_MAX_STACK_DEPTH > 2 or ecryptfs
  156. * allows recursive mounting, this will need to be extended.
  157. */
  158. if (!lower_file->f_op->mmap)
  159. return -ENODEV;
  160. return generic_file_mmap(file, vma);
  161. }
  162. /**
  163. * ecryptfs_open
  164. * @inode: inode specifying file to open
  165. * @file: Structure to return filled in
  166. *
  167. * Opens the file specified by inode.
  168. *
  169. * Returns zero on success; non-zero otherwise
  170. */
  171. static int ecryptfs_open(struct inode *inode, struct file *file)
  172. {
  173. int rc = 0;
  174. struct ecryptfs_crypt_stat *crypt_stat = NULL;
  175. struct dentry *ecryptfs_dentry = file->f_path.dentry;
  176. /* Private value of ecryptfs_dentry allocated in
  177. * ecryptfs_lookup() */
  178. struct ecryptfs_file_info *file_info;
  179. /* Released in ecryptfs_release or end of function if failure */
  180. file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
  181. ecryptfs_set_file_private(file, file_info);
  182. if (!file_info) {
  183. ecryptfs_printk(KERN_ERR,
  184. "Error attempting to allocate memory\n");
  185. rc = -ENOMEM;
  186. goto out;
  187. }
  188. crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
  189. mutex_lock(&crypt_stat->cs_mutex);
  190. if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)) {
  191. ecryptfs_printk(KERN_DEBUG, "Setting flags for stat...\n");
  192. /* Policy code enabled in future release */
  193. crypt_stat->flags |= (ECRYPTFS_POLICY_APPLIED
  194. | ECRYPTFS_ENCRYPTED);
  195. }
  196. mutex_unlock(&crypt_stat->cs_mutex);
  197. rc = ecryptfs_get_lower_file(ecryptfs_dentry, inode);
  198. if (rc) {
  199. printk(KERN_ERR "%s: Error attempting to initialize "
  200. "the lower file for the dentry with name "
  201. "[%pd]; rc = [%d]\n", __func__,
  202. ecryptfs_dentry, rc);
  203. goto out_free;
  204. }
  205. if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_ACCMODE)
  206. == O_RDONLY && (file->f_flags & O_ACCMODE) != O_RDONLY) {
  207. rc = -EPERM;
  208. printk(KERN_WARNING "%s: Lower file is RO; eCryptfs "
  209. "file must hence be opened RO\n", __func__);
  210. goto out_put;
  211. }
  212. ecryptfs_set_file_lower(
  213. file, ecryptfs_inode_to_private(inode)->lower_file);
  214. rc = read_or_initialize_metadata(ecryptfs_dentry);
  215. if (rc)
  216. goto out_put;
  217. ecryptfs_printk(KERN_DEBUG, "inode w/ addr = [0x%p], i_ino = "
  218. "[0x%.16lx] size: [0x%.16llx]\n", inode, inode->i_ino,
  219. (unsigned long long)i_size_read(inode));
  220. goto out;
  221. out_put:
  222. ecryptfs_put_lower_file(inode);
  223. out_free:
  224. kmem_cache_free(ecryptfs_file_info_cache,
  225. ecryptfs_file_to_private(file));
  226. out:
  227. return rc;
  228. }
  229. /**
  230. * ecryptfs_dir_open
  231. * @inode: inode specifying file to open
  232. * @file: Structure to return filled in
  233. *
  234. * Opens the file specified by inode.
  235. *
  236. * Returns zero on success; non-zero otherwise
  237. */
  238. static int ecryptfs_dir_open(struct inode *inode, struct file *file)
  239. {
  240. struct dentry *ecryptfs_dentry = file->f_path.dentry;
  241. /* Private value of ecryptfs_dentry allocated in
  242. * ecryptfs_lookup() */
  243. struct ecryptfs_file_info *file_info;
  244. struct file *lower_file;
  245. /* Released in ecryptfs_release or end of function if failure */
  246. file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
  247. ecryptfs_set_file_private(file, file_info);
  248. if (unlikely(!file_info)) {
  249. ecryptfs_printk(KERN_ERR,
  250. "Error attempting to allocate memory\n");
  251. return -ENOMEM;
  252. }
  253. lower_file = dentry_open(ecryptfs_dentry_to_lower_path(ecryptfs_dentry),
  254. file->f_flags, current_cred());
  255. if (IS_ERR(lower_file)) {
  256. printk(KERN_ERR "%s: Error attempting to initialize "
  257. "the lower file for the dentry with name "
  258. "[%pd]; rc = [%ld]\n", __func__,
  259. ecryptfs_dentry, PTR_ERR(lower_file));
  260. kmem_cache_free(ecryptfs_file_info_cache, file_info);
  261. return PTR_ERR(lower_file);
  262. }
  263. ecryptfs_set_file_lower(file, lower_file);
  264. return 0;
  265. }
  266. static int ecryptfs_flush(struct file *file, fl_owner_t td)
  267. {
  268. struct file *lower_file = ecryptfs_file_to_lower(file);
  269. if (lower_file->f_op->flush) {
  270. filemap_write_and_wait(file->f_mapping);
  271. return lower_file->f_op->flush(lower_file, td);
  272. }
  273. return 0;
  274. }
  275. static int ecryptfs_release(struct inode *inode, struct file *file)
  276. {
  277. ecryptfs_put_lower_file(inode);
  278. kmem_cache_free(ecryptfs_file_info_cache,
  279. ecryptfs_file_to_private(file));
  280. return 0;
  281. }
  282. static int ecryptfs_dir_release(struct inode *inode, struct file *file)
  283. {
  284. fput(ecryptfs_file_to_lower(file));
  285. kmem_cache_free(ecryptfs_file_info_cache,
  286. ecryptfs_file_to_private(file));
  287. return 0;
  288. }
  289. static loff_t ecryptfs_dir_llseek(struct file *file, loff_t offset, int whence)
  290. {
  291. return vfs_llseek(ecryptfs_file_to_lower(file), offset, whence);
  292. }
  293. static int
  294. ecryptfs_fsync(struct file *file, loff_t start, loff_t end, int datasync)
  295. {
  296. int rc;
  297. rc = file_write_and_wait(file);
  298. if (rc)
  299. return rc;
  300. return vfs_fsync(ecryptfs_file_to_lower(file), datasync);
  301. }
  302. static int ecryptfs_fasync(int fd, struct file *file, int flag)
  303. {
  304. int rc = 0;
  305. struct file *lower_file = NULL;
  306. lower_file = ecryptfs_file_to_lower(file);
  307. if (lower_file->f_op->fasync)
  308. rc = lower_file->f_op->fasync(fd, lower_file, flag);
  309. return rc;
  310. }
  311. static long
  312. ecryptfs_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
  313. {
  314. struct file *lower_file = ecryptfs_file_to_lower(file);
  315. long rc = -ENOTTY;
  316. if (!lower_file->f_op->unlocked_ioctl)
  317. return rc;
  318. switch (cmd) {
  319. case FITRIM:
  320. case FS_IOC_GETFLAGS:
  321. case FS_IOC_SETFLAGS:
  322. case FS_IOC_GETVERSION:
  323. case FS_IOC_SETVERSION:
  324. rc = lower_file->f_op->unlocked_ioctl(lower_file, cmd, arg);
  325. fsstack_copy_attr_all(file_inode(file), file_inode(lower_file));
  326. return rc;
  327. default:
  328. return rc;
  329. }
  330. }
  331. #ifdef CONFIG_COMPAT
  332. static long
  333. ecryptfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
  334. {
  335. struct file *lower_file = ecryptfs_file_to_lower(file);
  336. long rc = -ENOIOCTLCMD;
  337. if (!lower_file->f_op->compat_ioctl)
  338. return rc;
  339. switch (cmd) {
  340. case FITRIM:
  341. case FS_IOC32_GETFLAGS:
  342. case FS_IOC32_SETFLAGS:
  343. case FS_IOC32_GETVERSION:
  344. case FS_IOC32_SETVERSION:
  345. rc = lower_file->f_op->compat_ioctl(lower_file, cmd, arg);
  346. fsstack_copy_attr_all(file_inode(file), file_inode(lower_file));
  347. return rc;
  348. default:
  349. return rc;
  350. }
  351. }
  352. #endif
  353. const struct file_operations ecryptfs_dir_fops = {
  354. .iterate_shared = ecryptfs_readdir,
  355. .read = generic_read_dir,
  356. .unlocked_ioctl = ecryptfs_unlocked_ioctl,
  357. #ifdef CONFIG_COMPAT
  358. .compat_ioctl = ecryptfs_compat_ioctl,
  359. #endif
  360. .open = ecryptfs_dir_open,
  361. .release = ecryptfs_dir_release,
  362. .fsync = ecryptfs_fsync,
  363. .llseek = ecryptfs_dir_llseek,
  364. };
  365. const struct file_operations ecryptfs_main_fops = {
  366. .llseek = generic_file_llseek,
  367. .read_iter = ecryptfs_read_update_atime,
  368. .write_iter = generic_file_write_iter,
  369. .unlocked_ioctl = ecryptfs_unlocked_ioctl,
  370. #ifdef CONFIG_COMPAT
  371. .compat_ioctl = ecryptfs_compat_ioctl,
  372. #endif
  373. .mmap = ecryptfs_mmap,
  374. .open = ecryptfs_open,
  375. .flush = ecryptfs_flush,
  376. .release = ecryptfs_release,
  377. .fsync = ecryptfs_fsync,
  378. .fasync = ecryptfs_fasync,
  379. .splice_read = generic_file_splice_read,
  380. };