main.c 25 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /**
  3. * eCryptfs: Linux filesystem encryption layer
  4. *
  5. * Copyright (C) 1997-2003 Erez Zadok
  6. * Copyright (C) 2001-2003 Stony Brook University
  7. * Copyright (C) 2004-2007 International Business Machines Corp.
  8. * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>
  9. * Michael C. Thompson <mcthomps@us.ibm.com>
  10. * Tyler Hicks <code@tyhicks.com>
  11. */
  12. #include <linux/dcache.h>
  13. #include <linux/file.h>
  14. #include <linux/module.h>
  15. #include <linux/namei.h>
  16. #include <linux/skbuff.h>
  17. #include <linux/mount.h>
  18. #include <linux/pagemap.h>
  19. #include <linux/key.h>
  20. #include <linux/parser.h>
  21. #include <linux/fs_stack.h>
  22. #include <linux/slab.h>
  23. #include <linux/magic.h>
  24. #include "ecryptfs_kernel.h"
  25. /**
  26. * Module parameter that defines the ecryptfs_verbosity level.
  27. */
  28. int ecryptfs_verbosity = 0;
  29. module_param(ecryptfs_verbosity, int, 0);
  30. MODULE_PARM_DESC(ecryptfs_verbosity,
  31. "Initial verbosity level (0 or 1; defaults to "
  32. "0, which is Quiet)");
  33. /**
  34. * Module parameter that defines the number of message buffer elements
  35. */
  36. unsigned int ecryptfs_message_buf_len = ECRYPTFS_DEFAULT_MSG_CTX_ELEMS;
  37. module_param(ecryptfs_message_buf_len, uint, 0);
  38. MODULE_PARM_DESC(ecryptfs_message_buf_len,
  39. "Number of message buffer elements");
  40. /**
  41. * Module parameter that defines the maximum guaranteed amount of time to wait
  42. * for a response from ecryptfsd. The actual sleep time will be, more than
  43. * likely, a small amount greater than this specified value, but only less if
  44. * the message successfully arrives.
  45. */
  46. signed long ecryptfs_message_wait_timeout = ECRYPTFS_MAX_MSG_CTX_TTL / HZ;
  47. module_param(ecryptfs_message_wait_timeout, long, 0);
  48. MODULE_PARM_DESC(ecryptfs_message_wait_timeout,
  49. "Maximum number of seconds that an operation will "
  50. "sleep while waiting for a message response from "
  51. "userspace");
  52. /**
  53. * Module parameter that is an estimate of the maximum number of users
  54. * that will be concurrently using eCryptfs. Set this to the right
  55. * value to balance performance and memory use.
  56. */
  57. unsigned int ecryptfs_number_of_users = ECRYPTFS_DEFAULT_NUM_USERS;
  58. module_param(ecryptfs_number_of_users, uint, 0);
  59. MODULE_PARM_DESC(ecryptfs_number_of_users, "An estimate of the number of "
  60. "concurrent users of eCryptfs");
  61. void __ecryptfs_printk(const char *fmt, ...)
  62. {
  63. va_list args;
  64. va_start(args, fmt);
  65. if (fmt[1] == '7') { /* KERN_DEBUG */
  66. if (ecryptfs_verbosity >= 1)
  67. vprintk(fmt, args);
  68. } else
  69. vprintk(fmt, args);
  70. va_end(args);
  71. }
  72. /**
  73. * ecryptfs_init_lower_file
  74. * @ecryptfs_dentry: Fully initialized eCryptfs dentry object, with
  75. * the lower dentry and the lower mount set
  76. *
  77. * eCryptfs only ever keeps a single open file for every lower
  78. * inode. All I/O operations to the lower inode occur through that
  79. * file. When the first eCryptfs dentry that interposes with the first
  80. * lower dentry for that inode is created, this function creates the
  81. * lower file struct and associates it with the eCryptfs
  82. * inode. When all eCryptfs files associated with the inode are released, the
  83. * file is closed.
  84. *
  85. * The lower file will be opened with read/write permissions, if
  86. * possible. Otherwise, it is opened read-only.
  87. *
  88. * This function does nothing if a lower file is already
  89. * associated with the eCryptfs inode.
  90. *
  91. * Returns zero on success; non-zero otherwise
  92. */
  93. static int ecryptfs_init_lower_file(struct dentry *dentry,
  94. struct file **lower_file)
  95. {
  96. const struct cred *cred = current_cred();
  97. struct path *path = ecryptfs_dentry_to_lower_path(dentry);
  98. int rc;
  99. rc = ecryptfs_privileged_open(lower_file, path->dentry, path->mnt,
  100. cred);
  101. if (rc) {
  102. printk(KERN_ERR "Error opening lower file "
  103. "for lower_dentry [0x%p] and lower_mnt [0x%p]; "
  104. "rc = [%d]\n", path->dentry, path->mnt, rc);
  105. (*lower_file) = NULL;
  106. }
  107. return rc;
  108. }
  109. int ecryptfs_get_lower_file(struct dentry *dentry, struct inode *inode)
  110. {
  111. struct ecryptfs_inode_info *inode_info;
  112. int count, rc = 0;
  113. inode_info = ecryptfs_inode_to_private(inode);
  114. mutex_lock(&inode_info->lower_file_mutex);
  115. count = atomic_inc_return(&inode_info->lower_file_count);
  116. if (WARN_ON_ONCE(count < 1))
  117. rc = -EINVAL;
  118. else if (count == 1) {
  119. rc = ecryptfs_init_lower_file(dentry,
  120. &inode_info->lower_file);
  121. if (rc)
  122. atomic_set(&inode_info->lower_file_count, 0);
  123. }
  124. mutex_unlock(&inode_info->lower_file_mutex);
  125. return rc;
  126. }
  127. void ecryptfs_put_lower_file(struct inode *inode)
  128. {
  129. struct ecryptfs_inode_info *inode_info;
  130. inode_info = ecryptfs_inode_to_private(inode);
  131. if (atomic_dec_and_mutex_lock(&inode_info->lower_file_count,
  132. &inode_info->lower_file_mutex)) {
  133. filemap_write_and_wait(inode->i_mapping);
  134. fput(inode_info->lower_file);
  135. inode_info->lower_file = NULL;
  136. mutex_unlock(&inode_info->lower_file_mutex);
  137. }
  138. }
  139. enum { ecryptfs_opt_sig, ecryptfs_opt_ecryptfs_sig,
  140. ecryptfs_opt_cipher, ecryptfs_opt_ecryptfs_cipher,
  141. ecryptfs_opt_ecryptfs_key_bytes,
  142. ecryptfs_opt_passthrough, ecryptfs_opt_xattr_metadata,
  143. ecryptfs_opt_encrypted_view, ecryptfs_opt_fnek_sig,
  144. ecryptfs_opt_fn_cipher, ecryptfs_opt_fn_cipher_key_bytes,
  145. ecryptfs_opt_unlink_sigs, ecryptfs_opt_mount_auth_tok_only,
  146. ecryptfs_opt_check_dev_ruid,
  147. ecryptfs_opt_err };
  148. static const match_table_t tokens = {
  149. {ecryptfs_opt_sig, "sig=%s"},
  150. {ecryptfs_opt_ecryptfs_sig, "ecryptfs_sig=%s"},
  151. {ecryptfs_opt_cipher, "cipher=%s"},
  152. {ecryptfs_opt_ecryptfs_cipher, "ecryptfs_cipher=%s"},
  153. {ecryptfs_opt_ecryptfs_key_bytes, "ecryptfs_key_bytes=%u"},
  154. {ecryptfs_opt_passthrough, "ecryptfs_passthrough"},
  155. {ecryptfs_opt_xattr_metadata, "ecryptfs_xattr_metadata"},
  156. {ecryptfs_opt_encrypted_view, "ecryptfs_encrypted_view"},
  157. {ecryptfs_opt_fnek_sig, "ecryptfs_fnek_sig=%s"},
  158. {ecryptfs_opt_fn_cipher, "ecryptfs_fn_cipher=%s"},
  159. {ecryptfs_opt_fn_cipher_key_bytes, "ecryptfs_fn_key_bytes=%u"},
  160. {ecryptfs_opt_unlink_sigs, "ecryptfs_unlink_sigs"},
  161. {ecryptfs_opt_mount_auth_tok_only, "ecryptfs_mount_auth_tok_only"},
  162. {ecryptfs_opt_check_dev_ruid, "ecryptfs_check_dev_ruid"},
  163. {ecryptfs_opt_err, NULL}
  164. };
  165. static int ecryptfs_init_global_auth_toks(
  166. struct ecryptfs_mount_crypt_stat *mount_crypt_stat)
  167. {
  168. struct ecryptfs_global_auth_tok *global_auth_tok;
  169. struct ecryptfs_auth_tok *auth_tok;
  170. int rc = 0;
  171. list_for_each_entry(global_auth_tok,
  172. &mount_crypt_stat->global_auth_tok_list,
  173. mount_crypt_stat_list) {
  174. rc = ecryptfs_keyring_auth_tok_for_sig(
  175. &global_auth_tok->global_auth_tok_key, &auth_tok,
  176. global_auth_tok->sig);
  177. if (rc) {
  178. printk(KERN_ERR "Could not find valid key in user "
  179. "session keyring for sig specified in mount "
  180. "option: [%s]\n", global_auth_tok->sig);
  181. global_auth_tok->flags |= ECRYPTFS_AUTH_TOK_INVALID;
  182. goto out;
  183. } else {
  184. global_auth_tok->flags &= ~ECRYPTFS_AUTH_TOK_INVALID;
  185. up_write(&(global_auth_tok->global_auth_tok_key)->sem);
  186. }
  187. }
  188. out:
  189. return rc;
  190. }
  191. static void ecryptfs_init_mount_crypt_stat(
  192. struct ecryptfs_mount_crypt_stat *mount_crypt_stat)
  193. {
  194. memset((void *)mount_crypt_stat, 0,
  195. sizeof(struct ecryptfs_mount_crypt_stat));
  196. INIT_LIST_HEAD(&mount_crypt_stat->global_auth_tok_list);
  197. mutex_init(&mount_crypt_stat->global_auth_tok_list_mutex);
  198. mount_crypt_stat->flags |= ECRYPTFS_MOUNT_CRYPT_STAT_INITIALIZED;
  199. }
  200. /**
  201. * ecryptfs_parse_options
  202. * @sb: The ecryptfs super block
  203. * @options: The options passed to the kernel
  204. * @check_ruid: set to 1 if device uid should be checked against the ruid
  205. *
  206. * Parse mount options:
  207. * debug=N - ecryptfs_verbosity level for debug output
  208. * sig=XXX - description(signature) of the key to use
  209. *
  210. * Returns the dentry object of the lower-level (lower/interposed)
  211. * directory; We want to mount our stackable file system on top of
  212. * that lower directory.
  213. *
  214. * The signature of the key to use must be the description of a key
  215. * already in the keyring. Mounting will fail if the key can not be
  216. * found.
  217. *
  218. * Returns zero on success; non-zero on error
  219. */
  220. static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options,
  221. uid_t *check_ruid)
  222. {
  223. char *p;
  224. int rc = 0;
  225. int sig_set = 0;
  226. int cipher_name_set = 0;
  227. int fn_cipher_name_set = 0;
  228. int cipher_key_bytes;
  229. int cipher_key_bytes_set = 0;
  230. int fn_cipher_key_bytes;
  231. int fn_cipher_key_bytes_set = 0;
  232. struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
  233. &sbi->mount_crypt_stat;
  234. substring_t args[MAX_OPT_ARGS];
  235. int token;
  236. char *sig_src;
  237. char *cipher_name_dst;
  238. char *cipher_name_src;
  239. char *fn_cipher_name_dst;
  240. char *fn_cipher_name_src;
  241. char *fnek_dst;
  242. char *fnek_src;
  243. char *cipher_key_bytes_src;
  244. char *fn_cipher_key_bytes_src;
  245. u8 cipher_code;
  246. *check_ruid = 0;
  247. if (!options) {
  248. rc = -EINVAL;
  249. goto out;
  250. }
  251. ecryptfs_init_mount_crypt_stat(mount_crypt_stat);
  252. while ((p = strsep(&options, ",")) != NULL) {
  253. if (!*p)
  254. continue;
  255. token = match_token(p, tokens, args);
  256. switch (token) {
  257. case ecryptfs_opt_sig:
  258. case ecryptfs_opt_ecryptfs_sig:
  259. sig_src = args[0].from;
  260. rc = ecryptfs_add_global_auth_tok(mount_crypt_stat,
  261. sig_src, 0);
  262. if (rc) {
  263. printk(KERN_ERR "Error attempting to register "
  264. "global sig; rc = [%d]\n", rc);
  265. goto out;
  266. }
  267. sig_set = 1;
  268. break;
  269. case ecryptfs_opt_cipher:
  270. case ecryptfs_opt_ecryptfs_cipher:
  271. cipher_name_src = args[0].from;
  272. cipher_name_dst =
  273. mount_crypt_stat->
  274. global_default_cipher_name;
  275. strncpy(cipher_name_dst, cipher_name_src,
  276. ECRYPTFS_MAX_CIPHER_NAME_SIZE);
  277. cipher_name_dst[ECRYPTFS_MAX_CIPHER_NAME_SIZE] = '\0';
  278. cipher_name_set = 1;
  279. break;
  280. case ecryptfs_opt_ecryptfs_key_bytes:
  281. cipher_key_bytes_src = args[0].from;
  282. cipher_key_bytes =
  283. (int)simple_strtol(cipher_key_bytes_src,
  284. &cipher_key_bytes_src, 0);
  285. mount_crypt_stat->global_default_cipher_key_size =
  286. cipher_key_bytes;
  287. cipher_key_bytes_set = 1;
  288. break;
  289. case ecryptfs_opt_passthrough:
  290. mount_crypt_stat->flags |=
  291. ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED;
  292. break;
  293. case ecryptfs_opt_xattr_metadata:
  294. mount_crypt_stat->flags |=
  295. ECRYPTFS_XATTR_METADATA_ENABLED;
  296. break;
  297. case ecryptfs_opt_encrypted_view:
  298. mount_crypt_stat->flags |=
  299. ECRYPTFS_XATTR_METADATA_ENABLED;
  300. mount_crypt_stat->flags |=
  301. ECRYPTFS_ENCRYPTED_VIEW_ENABLED;
  302. break;
  303. case ecryptfs_opt_fnek_sig:
  304. fnek_src = args[0].from;
  305. fnek_dst =
  306. mount_crypt_stat->global_default_fnek_sig;
  307. strncpy(fnek_dst, fnek_src, ECRYPTFS_SIG_SIZE_HEX);
  308. mount_crypt_stat->global_default_fnek_sig[
  309. ECRYPTFS_SIG_SIZE_HEX] = '\0';
  310. rc = ecryptfs_add_global_auth_tok(
  311. mount_crypt_stat,
  312. mount_crypt_stat->global_default_fnek_sig,
  313. ECRYPTFS_AUTH_TOK_FNEK);
  314. if (rc) {
  315. printk(KERN_ERR "Error attempting to register "
  316. "global fnek sig [%s]; rc = [%d]\n",
  317. mount_crypt_stat->global_default_fnek_sig,
  318. rc);
  319. goto out;
  320. }
  321. mount_crypt_stat->flags |=
  322. (ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES
  323. | ECRYPTFS_GLOBAL_ENCFN_USE_MOUNT_FNEK);
  324. break;
  325. case ecryptfs_opt_fn_cipher:
  326. fn_cipher_name_src = args[0].from;
  327. fn_cipher_name_dst =
  328. mount_crypt_stat->global_default_fn_cipher_name;
  329. strncpy(fn_cipher_name_dst, fn_cipher_name_src,
  330. ECRYPTFS_MAX_CIPHER_NAME_SIZE);
  331. mount_crypt_stat->global_default_fn_cipher_name[
  332. ECRYPTFS_MAX_CIPHER_NAME_SIZE] = '\0';
  333. fn_cipher_name_set = 1;
  334. break;
  335. case ecryptfs_opt_fn_cipher_key_bytes:
  336. fn_cipher_key_bytes_src = args[0].from;
  337. fn_cipher_key_bytes =
  338. (int)simple_strtol(fn_cipher_key_bytes_src,
  339. &fn_cipher_key_bytes_src, 0);
  340. mount_crypt_stat->global_default_fn_cipher_key_bytes =
  341. fn_cipher_key_bytes;
  342. fn_cipher_key_bytes_set = 1;
  343. break;
  344. case ecryptfs_opt_unlink_sigs:
  345. mount_crypt_stat->flags |= ECRYPTFS_UNLINK_SIGS;
  346. break;
  347. case ecryptfs_opt_mount_auth_tok_only:
  348. mount_crypt_stat->flags |=
  349. ECRYPTFS_GLOBAL_MOUNT_AUTH_TOK_ONLY;
  350. break;
  351. case ecryptfs_opt_check_dev_ruid:
  352. *check_ruid = 1;
  353. break;
  354. case ecryptfs_opt_err:
  355. default:
  356. printk(KERN_WARNING
  357. "%s: eCryptfs: unrecognized option [%s]\n",
  358. __func__, p);
  359. }
  360. }
  361. if (!sig_set) {
  362. rc = -EINVAL;
  363. ecryptfs_printk(KERN_ERR, "You must supply at least one valid "
  364. "auth tok signature as a mount "
  365. "parameter; see the eCryptfs README\n");
  366. goto out;
  367. }
  368. if (!cipher_name_set) {
  369. int cipher_name_len = strlen(ECRYPTFS_DEFAULT_CIPHER);
  370. BUG_ON(cipher_name_len > ECRYPTFS_MAX_CIPHER_NAME_SIZE);
  371. strcpy(mount_crypt_stat->global_default_cipher_name,
  372. ECRYPTFS_DEFAULT_CIPHER);
  373. }
  374. if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
  375. && !fn_cipher_name_set)
  376. strcpy(mount_crypt_stat->global_default_fn_cipher_name,
  377. mount_crypt_stat->global_default_cipher_name);
  378. if (!cipher_key_bytes_set)
  379. mount_crypt_stat->global_default_cipher_key_size = 0;
  380. if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
  381. && !fn_cipher_key_bytes_set)
  382. mount_crypt_stat->global_default_fn_cipher_key_bytes =
  383. mount_crypt_stat->global_default_cipher_key_size;
  384. cipher_code = ecryptfs_code_for_cipher_string(
  385. mount_crypt_stat->global_default_cipher_name,
  386. mount_crypt_stat->global_default_cipher_key_size);
  387. if (!cipher_code) {
  388. ecryptfs_printk(KERN_ERR,
  389. "eCryptfs doesn't support cipher: %s\n",
  390. mount_crypt_stat->global_default_cipher_name);
  391. rc = -EINVAL;
  392. goto out;
  393. }
  394. mutex_lock(&key_tfm_list_mutex);
  395. if (!ecryptfs_tfm_exists(mount_crypt_stat->global_default_cipher_name,
  396. NULL)) {
  397. rc = ecryptfs_add_new_key_tfm(
  398. NULL, mount_crypt_stat->global_default_cipher_name,
  399. mount_crypt_stat->global_default_cipher_key_size);
  400. if (rc) {
  401. printk(KERN_ERR "Error attempting to initialize "
  402. "cipher with name = [%s] and key size = [%td]; "
  403. "rc = [%d]\n",
  404. mount_crypt_stat->global_default_cipher_name,
  405. mount_crypt_stat->global_default_cipher_key_size,
  406. rc);
  407. rc = -EINVAL;
  408. mutex_unlock(&key_tfm_list_mutex);
  409. goto out;
  410. }
  411. }
  412. if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
  413. && !ecryptfs_tfm_exists(
  414. mount_crypt_stat->global_default_fn_cipher_name, NULL)) {
  415. rc = ecryptfs_add_new_key_tfm(
  416. NULL, mount_crypt_stat->global_default_fn_cipher_name,
  417. mount_crypt_stat->global_default_fn_cipher_key_bytes);
  418. if (rc) {
  419. printk(KERN_ERR "Error attempting to initialize "
  420. "cipher with name = [%s] and key size = [%td]; "
  421. "rc = [%d]\n",
  422. mount_crypt_stat->global_default_fn_cipher_name,
  423. mount_crypt_stat->global_default_fn_cipher_key_bytes,
  424. rc);
  425. rc = -EINVAL;
  426. mutex_unlock(&key_tfm_list_mutex);
  427. goto out;
  428. }
  429. }
  430. mutex_unlock(&key_tfm_list_mutex);
  431. rc = ecryptfs_init_global_auth_toks(mount_crypt_stat);
  432. if (rc)
  433. printk(KERN_WARNING "One or more global auth toks could not "
  434. "properly register; rc = [%d]\n", rc);
  435. out:
  436. return rc;
  437. }
  438. struct kmem_cache *ecryptfs_sb_info_cache;
  439. static struct file_system_type ecryptfs_fs_type;
  440. /**
  441. * ecryptfs_get_sb
  442. * @fs_type
  443. * @flags
  444. * @dev_name: The path to mount over
  445. * @raw_data: The options passed into the kernel
  446. */
  447. static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags,
  448. const char *dev_name, void *raw_data)
  449. {
  450. struct super_block *s;
  451. struct ecryptfs_sb_info *sbi;
  452. struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
  453. struct ecryptfs_dentry_info *root_info;
  454. const char *err = "Getting sb failed";
  455. struct inode *inode;
  456. struct path path;
  457. uid_t check_ruid;
  458. int rc;
  459. sbi = kmem_cache_zalloc(ecryptfs_sb_info_cache, GFP_KERNEL);
  460. if (!sbi) {
  461. rc = -ENOMEM;
  462. goto out;
  463. }
  464. if (!dev_name) {
  465. rc = -EINVAL;
  466. err = "Device name cannot be null";
  467. goto out;
  468. }
  469. rc = ecryptfs_parse_options(sbi, raw_data, &check_ruid);
  470. if (rc) {
  471. err = "Error parsing options";
  472. goto out;
  473. }
  474. mount_crypt_stat = &sbi->mount_crypt_stat;
  475. s = sget(fs_type, NULL, set_anon_super, flags, NULL);
  476. if (IS_ERR(s)) {
  477. rc = PTR_ERR(s);
  478. goto out;
  479. }
  480. rc = super_setup_bdi(s);
  481. if (rc)
  482. goto out1;
  483. ecryptfs_set_superblock_private(s, sbi);
  484. /* ->kill_sb() will take care of sbi after that point */
  485. sbi = NULL;
  486. s->s_op = &ecryptfs_sops;
  487. s->s_xattr = ecryptfs_xattr_handlers;
  488. s->s_d_op = &ecryptfs_dops;
  489. err = "Reading sb failed";
  490. rc = kern_path(dev_name, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &path);
  491. if (rc) {
  492. ecryptfs_printk(KERN_WARNING, "kern_path() failed\n");
  493. goto out1;
  494. }
  495. if (path.dentry->d_sb->s_type == &ecryptfs_fs_type) {
  496. rc = -EINVAL;
  497. printk(KERN_ERR "Mount on filesystem of type "
  498. "eCryptfs explicitly disallowed due to "
  499. "known incompatibilities\n");
  500. goto out_free;
  501. }
  502. if (check_ruid && !uid_eq(d_inode(path.dentry)->i_uid, current_uid())) {
  503. rc = -EPERM;
  504. printk(KERN_ERR "Mount of device (uid: %d) not owned by "
  505. "requested user (uid: %d)\n",
  506. i_uid_read(d_inode(path.dentry)),
  507. from_kuid(&init_user_ns, current_uid()));
  508. goto out_free;
  509. }
  510. ecryptfs_set_superblock_lower(s, path.dentry->d_sb);
  511. /**
  512. * Set the POSIX ACL flag based on whether they're enabled in the lower
  513. * mount.
  514. */
  515. s->s_flags = flags & ~SB_POSIXACL;
  516. s->s_flags |= path.dentry->d_sb->s_flags & SB_POSIXACL;
  517. /**
  518. * Force a read-only eCryptfs mount when:
  519. * 1) The lower mount is ro
  520. * 2) The ecryptfs_encrypted_view mount option is specified
  521. */
  522. if (sb_rdonly(path.dentry->d_sb) || mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
  523. s->s_flags |= SB_RDONLY;
  524. s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
  525. s->s_blocksize = path.dentry->d_sb->s_blocksize;
  526. s->s_magic = ECRYPTFS_SUPER_MAGIC;
  527. s->s_stack_depth = path.dentry->d_sb->s_stack_depth + 1;
  528. rc = -EINVAL;
  529. if (s->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
  530. pr_err("eCryptfs: maximum fs stacking depth exceeded\n");
  531. goto out_free;
  532. }
  533. inode = ecryptfs_get_inode(d_inode(path.dentry), s);
  534. rc = PTR_ERR(inode);
  535. if (IS_ERR(inode))
  536. goto out_free;
  537. s->s_root = d_make_root(inode);
  538. if (!s->s_root) {
  539. rc = -ENOMEM;
  540. goto out_free;
  541. }
  542. rc = -ENOMEM;
  543. root_info = kmem_cache_zalloc(ecryptfs_dentry_info_cache, GFP_KERNEL);
  544. if (!root_info)
  545. goto out_free;
  546. /* ->kill_sb() will take care of root_info */
  547. ecryptfs_set_dentry_private(s->s_root, root_info);
  548. root_info->lower_path = path;
  549. s->s_flags |= SB_ACTIVE;
  550. return dget(s->s_root);
  551. out_free:
  552. path_put(&path);
  553. out1:
  554. deactivate_locked_super(s);
  555. out:
  556. if (sbi) {
  557. ecryptfs_destroy_mount_crypt_stat(&sbi->mount_crypt_stat);
  558. kmem_cache_free(ecryptfs_sb_info_cache, sbi);
  559. }
  560. printk(KERN_ERR "%s; rc = [%d]\n", err, rc);
  561. return ERR_PTR(rc);
  562. }
  563. /**
  564. * ecryptfs_kill_block_super
  565. * @sb: The ecryptfs super block
  566. *
  567. * Used to bring the superblock down and free the private data.
  568. */
  569. static void ecryptfs_kill_block_super(struct super_block *sb)
  570. {
  571. struct ecryptfs_sb_info *sb_info = ecryptfs_superblock_to_private(sb);
  572. kill_anon_super(sb);
  573. if (!sb_info)
  574. return;
  575. ecryptfs_destroy_mount_crypt_stat(&sb_info->mount_crypt_stat);
  576. kmem_cache_free(ecryptfs_sb_info_cache, sb_info);
  577. }
  578. static struct file_system_type ecryptfs_fs_type = {
  579. .owner = THIS_MODULE,
  580. .name = "ecryptfs",
  581. .mount = ecryptfs_mount,
  582. .kill_sb = ecryptfs_kill_block_super,
  583. .fs_flags = 0
  584. };
  585. MODULE_ALIAS_FS("ecryptfs");
  586. /**
  587. * inode_info_init_once
  588. *
  589. * Initializes the ecryptfs_inode_info_cache when it is created
  590. */
  591. static void
  592. inode_info_init_once(void *vptr)
  593. {
  594. struct ecryptfs_inode_info *ei = (struct ecryptfs_inode_info *)vptr;
  595. inode_init_once(&ei->vfs_inode);
  596. }
  597. static struct ecryptfs_cache_info {
  598. struct kmem_cache **cache;
  599. const char *name;
  600. size_t size;
  601. slab_flags_t flags;
  602. void (*ctor)(void *obj);
  603. } ecryptfs_cache_infos[] = {
  604. {
  605. .cache = &ecryptfs_auth_tok_list_item_cache,
  606. .name = "ecryptfs_auth_tok_list_item",
  607. .size = sizeof(struct ecryptfs_auth_tok_list_item),
  608. },
  609. {
  610. .cache = &ecryptfs_file_info_cache,
  611. .name = "ecryptfs_file_cache",
  612. .size = sizeof(struct ecryptfs_file_info),
  613. },
  614. {
  615. .cache = &ecryptfs_dentry_info_cache,
  616. .name = "ecryptfs_dentry_info_cache",
  617. .size = sizeof(struct ecryptfs_dentry_info),
  618. },
  619. {
  620. .cache = &ecryptfs_inode_info_cache,
  621. .name = "ecryptfs_inode_cache",
  622. .size = sizeof(struct ecryptfs_inode_info),
  623. .flags = SLAB_ACCOUNT,
  624. .ctor = inode_info_init_once,
  625. },
  626. {
  627. .cache = &ecryptfs_sb_info_cache,
  628. .name = "ecryptfs_sb_cache",
  629. .size = sizeof(struct ecryptfs_sb_info),
  630. },
  631. {
  632. .cache = &ecryptfs_header_cache,
  633. .name = "ecryptfs_headers",
  634. .size = PAGE_SIZE,
  635. },
  636. {
  637. .cache = &ecryptfs_xattr_cache,
  638. .name = "ecryptfs_xattr_cache",
  639. .size = PAGE_SIZE,
  640. },
  641. {
  642. .cache = &ecryptfs_key_record_cache,
  643. .name = "ecryptfs_key_record_cache",
  644. .size = sizeof(struct ecryptfs_key_record),
  645. },
  646. {
  647. .cache = &ecryptfs_key_sig_cache,
  648. .name = "ecryptfs_key_sig_cache",
  649. .size = sizeof(struct ecryptfs_key_sig),
  650. },
  651. {
  652. .cache = &ecryptfs_global_auth_tok_cache,
  653. .name = "ecryptfs_global_auth_tok_cache",
  654. .size = sizeof(struct ecryptfs_global_auth_tok),
  655. },
  656. {
  657. .cache = &ecryptfs_key_tfm_cache,
  658. .name = "ecryptfs_key_tfm_cache",
  659. .size = sizeof(struct ecryptfs_key_tfm),
  660. },
  661. };
  662. static void ecryptfs_free_kmem_caches(void)
  663. {
  664. int i;
  665. /*
  666. * Make sure all delayed rcu free inodes are flushed before we
  667. * destroy cache.
  668. */
  669. rcu_barrier();
  670. for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) {
  671. struct ecryptfs_cache_info *info;
  672. info = &ecryptfs_cache_infos[i];
  673. kmem_cache_destroy(*(info->cache));
  674. }
  675. }
  676. /**
  677. * ecryptfs_init_kmem_caches
  678. *
  679. * Returns zero on success; non-zero otherwise
  680. */
  681. static int ecryptfs_init_kmem_caches(void)
  682. {
  683. int i;
  684. for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) {
  685. struct ecryptfs_cache_info *info;
  686. info = &ecryptfs_cache_infos[i];
  687. *(info->cache) = kmem_cache_create(info->name, info->size, 0,
  688. SLAB_HWCACHE_ALIGN | info->flags, info->ctor);
  689. if (!*(info->cache)) {
  690. ecryptfs_free_kmem_caches();
  691. ecryptfs_printk(KERN_WARNING, "%s: "
  692. "kmem_cache_create failed\n",
  693. info->name);
  694. return -ENOMEM;
  695. }
  696. }
  697. return 0;
  698. }
  699. static struct kobject *ecryptfs_kobj;
  700. static ssize_t version_show(struct kobject *kobj,
  701. struct kobj_attribute *attr, char *buff)
  702. {
  703. return snprintf(buff, PAGE_SIZE, "%d\n", ECRYPTFS_VERSIONING_MASK);
  704. }
  705. static struct kobj_attribute version_attr = __ATTR_RO(version);
  706. static struct attribute *attributes[] = {
  707. &version_attr.attr,
  708. NULL,
  709. };
  710. static const struct attribute_group attr_group = {
  711. .attrs = attributes,
  712. };
  713. static int do_sysfs_registration(void)
  714. {
  715. int rc;
  716. ecryptfs_kobj = kobject_create_and_add("ecryptfs", fs_kobj);
  717. if (!ecryptfs_kobj) {
  718. printk(KERN_ERR "Unable to create ecryptfs kset\n");
  719. rc = -ENOMEM;
  720. goto out;
  721. }
  722. rc = sysfs_create_group(ecryptfs_kobj, &attr_group);
  723. if (rc) {
  724. printk(KERN_ERR
  725. "Unable to create ecryptfs version attributes\n");
  726. kobject_put(ecryptfs_kobj);
  727. }
  728. out:
  729. return rc;
  730. }
  731. static void do_sysfs_unregistration(void)
  732. {
  733. sysfs_remove_group(ecryptfs_kobj, &attr_group);
  734. kobject_put(ecryptfs_kobj);
  735. }
  736. static int __init ecryptfs_init(void)
  737. {
  738. int rc;
  739. if (ECRYPTFS_DEFAULT_EXTENT_SIZE > PAGE_SIZE) {
  740. rc = -EINVAL;
  741. ecryptfs_printk(KERN_ERR, "The eCryptfs extent size is "
  742. "larger than the host's page size, and so "
  743. "eCryptfs cannot run on this system. The "
  744. "default eCryptfs extent size is [%u] bytes; "
  745. "the page size is [%lu] bytes.\n",
  746. ECRYPTFS_DEFAULT_EXTENT_SIZE,
  747. (unsigned long)PAGE_SIZE);
  748. goto out;
  749. }
  750. rc = ecryptfs_init_kmem_caches();
  751. if (rc) {
  752. printk(KERN_ERR
  753. "Failed to allocate one or more kmem_cache objects\n");
  754. goto out;
  755. }
  756. rc = do_sysfs_registration();
  757. if (rc) {
  758. printk(KERN_ERR "sysfs registration failed\n");
  759. goto out_free_kmem_caches;
  760. }
  761. rc = ecryptfs_init_kthread();
  762. if (rc) {
  763. printk(KERN_ERR "%s: kthread initialization failed; "
  764. "rc = [%d]\n", __func__, rc);
  765. goto out_do_sysfs_unregistration;
  766. }
  767. rc = ecryptfs_init_messaging();
  768. if (rc) {
  769. printk(KERN_ERR "Failure occurred while attempting to "
  770. "initialize the communications channel to "
  771. "ecryptfsd\n");
  772. goto out_destroy_kthread;
  773. }
  774. rc = ecryptfs_init_crypto();
  775. if (rc) {
  776. printk(KERN_ERR "Failure whilst attempting to init crypto; "
  777. "rc = [%d]\n", rc);
  778. goto out_release_messaging;
  779. }
  780. rc = register_filesystem(&ecryptfs_fs_type);
  781. if (rc) {
  782. printk(KERN_ERR "Failed to register filesystem\n");
  783. goto out_destroy_crypto;
  784. }
  785. if (ecryptfs_verbosity > 0)
  786. printk(KERN_CRIT "eCryptfs verbosity set to %d. Secret values "
  787. "will be written to the syslog!\n", ecryptfs_verbosity);
  788. goto out;
  789. out_destroy_crypto:
  790. ecryptfs_destroy_crypto();
  791. out_release_messaging:
  792. ecryptfs_release_messaging();
  793. out_destroy_kthread:
  794. ecryptfs_destroy_kthread();
  795. out_do_sysfs_unregistration:
  796. do_sysfs_unregistration();
  797. out_free_kmem_caches:
  798. ecryptfs_free_kmem_caches();
  799. out:
  800. return rc;
  801. }
  802. static void __exit ecryptfs_exit(void)
  803. {
  804. int rc;
  805. rc = ecryptfs_destroy_crypto();
  806. if (rc)
  807. printk(KERN_ERR "Failure whilst attempting to destroy crypto; "
  808. "rc = [%d]\n", rc);
  809. ecryptfs_release_messaging();
  810. ecryptfs_destroy_kthread();
  811. do_sysfs_unregistration();
  812. unregister_filesystem(&ecryptfs_fs_type);
  813. ecryptfs_free_kmem_caches();
  814. }
  815. MODULE_AUTHOR("Michael A. Halcrow <mhalcrow@us.ibm.com>");
  816. MODULE_DESCRIPTION("eCryptfs");
  817. MODULE_LICENSE("GPL");
  818. MODULE_IMPORT_NS(ANDROID_GKI_VFS_EXPORT_ONLY);
  819. module_init(ecryptfs_init)
  820. module_exit(ecryptfs_exit)