enable.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * Ioctl to enable verity on a file
  4. *
  5. * Copyright 2019 Google LLC
  6. */
  7. #include "fsverity_private.h"
  8. #include <crypto/hash.h>
  9. #include <linux/backing-dev.h>
  10. #include <linux/mount.h>
  11. #include <linux/pagemap.h>
  12. #include <linux/sched/signal.h>
  13. #include <linux/uaccess.h>
  14. /*
  15. * Read a file data page for Merkle tree construction. Do aggressive readahead,
  16. * since we're sequentially reading the entire file.
  17. */
  18. static struct page *read_file_data_page(struct file *filp, pgoff_t index,
  19. struct file_ra_state *ra,
  20. unsigned long remaining_pages)
  21. {
  22. struct page *page;
  23. page = find_get_page_flags(filp->f_mapping, index, FGP_ACCESSED);
  24. if (!page || !PageUptodate(page)) {
  25. if (page)
  26. put_page(page);
  27. else
  28. page_cache_sync_readahead(filp->f_mapping, ra, filp,
  29. index, remaining_pages);
  30. page = read_mapping_page(filp->f_mapping, index, NULL);
  31. if (IS_ERR(page))
  32. return page;
  33. }
  34. if (PageReadahead(page))
  35. page_cache_async_readahead(filp->f_mapping, ra, filp, page,
  36. index, remaining_pages);
  37. return page;
  38. }
  39. static int build_merkle_tree_level(struct file *filp, unsigned int level,
  40. u64 num_blocks_to_hash,
  41. const struct merkle_tree_params *params,
  42. u8 *pending_hashes,
  43. struct ahash_request *req)
  44. {
  45. struct inode *inode = file_inode(filp);
  46. const struct fsverity_operations *vops = inode->i_sb->s_vop;
  47. struct file_ra_state ra = { 0 };
  48. unsigned int pending_size = 0;
  49. u64 dst_block_num;
  50. u64 i;
  51. int err;
  52. if (WARN_ON(params->block_size != PAGE_SIZE)) /* checked earlier too */
  53. return -EINVAL;
  54. if (level < params->num_levels) {
  55. dst_block_num = params->level_start[level];
  56. } else {
  57. if (WARN_ON(num_blocks_to_hash != 1))
  58. return -EINVAL;
  59. dst_block_num = 0; /* unused */
  60. }
  61. file_ra_state_init(&ra, filp->f_mapping);
  62. for (i = 0; i < num_blocks_to_hash; i++) {
  63. struct page *src_page;
  64. if ((pgoff_t)i % 10000 == 0 || i + 1 == num_blocks_to_hash)
  65. pr_debug("Hashing block %llu of %llu for level %u\n",
  66. i + 1, num_blocks_to_hash, level);
  67. if (level == 0) {
  68. /* Leaf: hashing a data block */
  69. src_page = read_file_data_page(filp, i, &ra,
  70. num_blocks_to_hash - i);
  71. if (IS_ERR(src_page)) {
  72. err = PTR_ERR(src_page);
  73. fsverity_err(inode,
  74. "Error %d reading data page %llu",
  75. err, i);
  76. return err;
  77. }
  78. } else {
  79. unsigned long num_ra_pages =
  80. min_t(unsigned long, num_blocks_to_hash - i,
  81. inode->i_sb->s_bdi->io_pages);
  82. /* Non-leaf: hashing hash block from level below */
  83. src_page = vops->read_merkle_tree_page(inode,
  84. params->level_start[level - 1] + i,
  85. num_ra_pages);
  86. if (IS_ERR(src_page)) {
  87. err = PTR_ERR(src_page);
  88. fsverity_err(inode,
  89. "Error %d reading Merkle tree page %llu",
  90. err, params->level_start[level - 1] + i);
  91. return err;
  92. }
  93. }
  94. err = fsverity_hash_page(params, inode, req, src_page,
  95. &pending_hashes[pending_size]);
  96. put_page(src_page);
  97. if (err)
  98. return err;
  99. pending_size += params->digest_size;
  100. if (level == params->num_levels) /* Root hash? */
  101. return 0;
  102. if (pending_size + params->digest_size > params->block_size ||
  103. i + 1 == num_blocks_to_hash) {
  104. /* Flush the pending hash block */
  105. memset(&pending_hashes[pending_size], 0,
  106. params->block_size - pending_size);
  107. err = vops->write_merkle_tree_block(inode,
  108. pending_hashes,
  109. dst_block_num,
  110. params->log_blocksize);
  111. if (err) {
  112. fsverity_err(inode,
  113. "Error %d writing Merkle tree block %llu",
  114. err, dst_block_num);
  115. return err;
  116. }
  117. dst_block_num++;
  118. pending_size = 0;
  119. }
  120. if (fatal_signal_pending(current))
  121. return -EINTR;
  122. cond_resched();
  123. }
  124. return 0;
  125. }
  126. /*
  127. * Build the Merkle tree for the given file using the given parameters, and
  128. * return the root hash in @root_hash.
  129. *
  130. * The tree is written to a filesystem-specific location as determined by the
  131. * ->write_merkle_tree_block() method. However, the blocks that comprise the
  132. * tree are the same for all filesystems.
  133. */
  134. static int build_merkle_tree(struct file *filp,
  135. const struct merkle_tree_params *params,
  136. u8 *root_hash)
  137. {
  138. struct inode *inode = file_inode(filp);
  139. u8 *pending_hashes;
  140. struct ahash_request *req;
  141. u64 blocks;
  142. unsigned int level;
  143. int err = -ENOMEM;
  144. if (inode->i_size == 0) {
  145. /* Empty file is a special case; root hash is all 0's */
  146. memset(root_hash, 0, params->digest_size);
  147. return 0;
  148. }
  149. /* This allocation never fails, since it's mempool-backed. */
  150. req = fsverity_alloc_hash_request(params->hash_alg, GFP_KERNEL);
  151. pending_hashes = kmalloc(params->block_size, GFP_KERNEL);
  152. if (!pending_hashes)
  153. goto out;
  154. /*
  155. * Build each level of the Merkle tree, starting at the leaf level
  156. * (level 0) and ascending to the root node (level 'num_levels - 1').
  157. * Then at the end (level 'num_levels'), calculate the root hash.
  158. */
  159. blocks = ((u64)inode->i_size + params->block_size - 1) >>
  160. params->log_blocksize;
  161. for (level = 0; level <= params->num_levels; level++) {
  162. err = build_merkle_tree_level(filp, level, blocks, params,
  163. pending_hashes, req);
  164. if (err)
  165. goto out;
  166. blocks = (blocks + params->hashes_per_block - 1) >>
  167. params->log_arity;
  168. }
  169. memcpy(root_hash, pending_hashes, params->digest_size);
  170. err = 0;
  171. out:
  172. kfree(pending_hashes);
  173. fsverity_free_hash_request(params->hash_alg, req);
  174. return err;
  175. }
  176. static int enable_verity(struct file *filp,
  177. const struct fsverity_enable_arg *arg)
  178. {
  179. struct inode *inode = file_inode(filp);
  180. const struct fsverity_operations *vops = inode->i_sb->s_vop;
  181. struct merkle_tree_params params = { };
  182. struct fsverity_descriptor *desc;
  183. size_t desc_size = sizeof(*desc) + arg->sig_size;
  184. struct fsverity_info *vi;
  185. int err;
  186. /* Start initializing the fsverity_descriptor */
  187. desc = kzalloc(desc_size, GFP_KERNEL);
  188. if (!desc)
  189. return -ENOMEM;
  190. desc->version = 1;
  191. desc->hash_algorithm = arg->hash_algorithm;
  192. desc->log_blocksize = ilog2(arg->block_size);
  193. /* Get the salt if the user provided one */
  194. if (arg->salt_size &&
  195. copy_from_user(desc->salt, u64_to_user_ptr(arg->salt_ptr),
  196. arg->salt_size)) {
  197. err = -EFAULT;
  198. goto out;
  199. }
  200. desc->salt_size = arg->salt_size;
  201. /* Get the signature if the user provided one */
  202. if (arg->sig_size &&
  203. copy_from_user(desc->signature, u64_to_user_ptr(arg->sig_ptr),
  204. arg->sig_size)) {
  205. err = -EFAULT;
  206. goto out;
  207. }
  208. desc->sig_size = cpu_to_le32(arg->sig_size);
  209. desc->data_size = cpu_to_le64(inode->i_size);
  210. /* Prepare the Merkle tree parameters */
  211. err = fsverity_init_merkle_tree_params(&params, inode,
  212. arg->hash_algorithm,
  213. desc->log_blocksize,
  214. desc->salt, desc->salt_size);
  215. if (err)
  216. goto out;
  217. /*
  218. * Start enabling verity on this file, serialized by the inode lock.
  219. * Fail if verity is already enabled or is already being enabled.
  220. */
  221. inode_lock(inode);
  222. if (IS_VERITY(inode))
  223. err = -EEXIST;
  224. else
  225. err = vops->begin_enable_verity(filp);
  226. inode_unlock(inode);
  227. if (err)
  228. goto out;
  229. /*
  230. * Build the Merkle tree. Don't hold the inode lock during this, since
  231. * on huge files this may take a very long time and we don't want to
  232. * force unrelated syscalls like chown() to block forever. We don't
  233. * need the inode lock here because deny_write_access() already prevents
  234. * the file from being written to or truncated, and we still serialize
  235. * ->begin_enable_verity() and ->end_enable_verity() using the inode
  236. * lock and only allow one process to be here at a time on a given file.
  237. */
  238. pr_debug("Building Merkle tree...\n");
  239. BUILD_BUG_ON(sizeof(desc->root_hash) < FS_VERITY_MAX_DIGEST_SIZE);
  240. err = build_merkle_tree(filp, &params, desc->root_hash);
  241. if (err) {
  242. fsverity_err(inode, "Error %d building Merkle tree", err);
  243. goto rollback;
  244. }
  245. pr_debug("Done building Merkle tree. Root hash is %s:%*phN\n",
  246. params.hash_alg->name, params.digest_size, desc->root_hash);
  247. /*
  248. * Create the fsverity_info. Don't bother trying to save work by
  249. * reusing the merkle_tree_params from above. Instead, just create the
  250. * fsverity_info from the fsverity_descriptor as if it were just loaded
  251. * from disk. This is simpler, and it serves as an extra check that the
  252. * metadata we're writing is valid before actually enabling verity.
  253. */
  254. vi = fsverity_create_info(inode, desc, desc_size);
  255. if (IS_ERR(vi)) {
  256. err = PTR_ERR(vi);
  257. goto rollback;
  258. }
  259. if (arg->sig_size)
  260. pr_debug("Storing a %u-byte PKCS#7 signature alongside the file\n",
  261. arg->sig_size);
  262. /*
  263. * Tell the filesystem to finish enabling verity on the file.
  264. * Serialized with ->begin_enable_verity() by the inode lock.
  265. */
  266. inode_lock(inode);
  267. err = vops->end_enable_verity(filp, desc, desc_size, params.tree_size);
  268. inode_unlock(inode);
  269. if (err) {
  270. fsverity_err(inode, "%ps() failed with err %d",
  271. vops->end_enable_verity, err);
  272. fsverity_free_info(vi);
  273. } else if (WARN_ON(!IS_VERITY(inode))) {
  274. err = -EINVAL;
  275. fsverity_free_info(vi);
  276. } else {
  277. /* Successfully enabled verity */
  278. /*
  279. * Readers can start using ->i_verity_info immediately, so it
  280. * can't be rolled back once set. So don't set it until just
  281. * after the filesystem has successfully enabled verity.
  282. */
  283. fsverity_set_info(inode, vi);
  284. }
  285. out:
  286. kfree(params.hashstate);
  287. kfree(desc);
  288. return err;
  289. rollback:
  290. inode_lock(inode);
  291. (void)vops->end_enable_verity(filp, NULL, 0, params.tree_size);
  292. inode_unlock(inode);
  293. goto out;
  294. }
  295. /**
  296. * fsverity_ioctl_enable() - enable verity on a file
  297. * @filp: file to enable verity on
  298. * @uarg: user pointer to fsverity_enable_arg
  299. *
  300. * Enable fs-verity on a file. See the "FS_IOC_ENABLE_VERITY" section of
  301. * Documentation/filesystems/fsverity.rst for the documentation.
  302. *
  303. * Return: 0 on success, -errno on failure
  304. */
  305. int fsverity_ioctl_enable(struct file *filp, const void __user *uarg)
  306. {
  307. struct inode *inode = file_inode(filp);
  308. struct fsverity_enable_arg arg;
  309. int err;
  310. if (copy_from_user(&arg, uarg, sizeof(arg)))
  311. return -EFAULT;
  312. if (arg.version != 1)
  313. return -EINVAL;
  314. if (arg.__reserved1 ||
  315. memchr_inv(arg.__reserved2, 0, sizeof(arg.__reserved2)))
  316. return -EINVAL;
  317. if (arg.block_size != PAGE_SIZE)
  318. return -EINVAL;
  319. if (arg.salt_size > sizeof_field(struct fsverity_descriptor, salt))
  320. return -EMSGSIZE;
  321. if (arg.sig_size > FS_VERITY_MAX_SIGNATURE_SIZE)
  322. return -EMSGSIZE;
  323. /*
  324. * Require a regular file with write access. But the actual fd must
  325. * still be readonly so that we can lock out all writers. This is
  326. * needed to guarantee that no writable fds exist to the file once it
  327. * has verity enabled, and to stabilize the data being hashed.
  328. */
  329. err = inode_permission(inode, MAY_WRITE);
  330. if (err)
  331. return err;
  332. if (IS_APPEND(inode))
  333. return -EPERM;
  334. if (S_ISDIR(inode->i_mode))
  335. return -EISDIR;
  336. if (!S_ISREG(inode->i_mode))
  337. return -EINVAL;
  338. err = mnt_want_write_file(filp);
  339. if (err) /* -EROFS */
  340. return err;
  341. err = deny_write_access(filp);
  342. if (err) /* -ETXTBSY */
  343. goto out_drop_write;
  344. err = enable_verity(filp, &arg);
  345. if (err)
  346. goto out_allow_write_access;
  347. /*
  348. * Some pages of the file may have been evicted from pagecache after
  349. * being used in the Merkle tree construction, then read into pagecache
  350. * again by another process reading from the file concurrently. Since
  351. * these pages didn't undergo verification against the file digest which
  352. * fs-verity now claims to be enforcing, we have to wipe the pagecache
  353. * to ensure that all future reads are verified.
  354. */
  355. filemap_write_and_wait(inode->i_mapping);
  356. invalidate_inode_pages2(inode->i_mapping);
  357. /*
  358. * allow_write_access() is needed to pair with deny_write_access().
  359. * Regardless, the filesystem won't allow writing to verity files.
  360. */
  361. out_allow_write_access:
  362. allow_write_access(filp);
  363. out_drop_write:
  364. mnt_drop_write_file(filp);
  365. return err;
  366. }
  367. EXPORT_SYMBOL_GPL(fsverity_ioctl_enable);