2 * eCryptfs: Linux filesystem encryption layer
4 * Copyright (C) 1997-2004 Erez Zadok
5 * Copyright (C) 2001-2004 Stony Brook University
6 * Copyright (C) 2004-2007 International Business Machines Corp.
7 * Author(s): Michael A. Halcrow <mhalcrow@us.ibm.com>
8 * Michael C. Thompson <mcthomps@us.ibm.com>
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License as
12 * published by the Free Software Foundation; either version 2 of the
13 * License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
26 #include <linux/file.h>
27 #include <linux/poll.h>
28 #include <linux/slab.h>
29 #include <linux/mount.h>
30 #include <linux/pagemap.h>
31 #include <linux/security.h>
32 #include <linux/compat.h>
33 #include <linux/fs_stack.h>
34 #include "ecryptfs_kernel.h"
37 * ecryptfs_read_update_atime
39 * generic_file_read updates the atime of upper layer inode. But, it
40 * doesn't give us a chance to update the atime of the lower layer
41 * inode. This function is a wrapper to generic_file_read. It
42 * updates the atime of the lower level inode if generic_file_read
43 * returns without any errors. This is to be used only for file reads.
44 * The function to be used for directory reads is ecryptfs_read.
46 static ssize_t
ecryptfs_read_update_atime(struct kiocb
*iocb
,
51 struct file
*file
= iocb
->ki_filp
;
53 rc
= generic_file_read_iter(iocb
, to
);
55 path
= ecryptfs_dentry_to_lower_path(file
->f_path
.dentry
);
61 struct ecryptfs_getdents_callback
{
62 struct dir_context ctx
;
63 struct dir_context
*caller
;
64 struct super_block
*sb
;
69 /* Inspired by generic filldir in fs/readdir.c */
71 ecryptfs_filldir(struct dir_context
*ctx
, const char *lower_name
,
72 int lower_namelen
, loff_t offset
, u64 ino
, unsigned int d_type
)
74 struct ecryptfs_getdents_callback
*buf
=
75 container_of(ctx
, struct ecryptfs_getdents_callback
, ctx
);
80 buf
->filldir_called
++;
81 rc
= ecryptfs_decode_and_decrypt_filename(&name
, &name_size
,
86 ecryptfs_printk(KERN_DEBUG
,
87 "%s: Error attempting to decode and decrypt filename [%s]; rc = [%d]\n",
88 __func__
, lower_name
, rc
);
92 /* Mask -EINVAL errors as these are most likely due a plaintext
93 * filename present in the lower filesystem despite filename
94 * encryption being enabled. One unavoidable example would be
95 * the "lost+found" dentry in the root directory of an Ext4
101 buf
->caller
->pos
= buf
->ctx
.pos
;
102 rc
= !dir_emit(buf
->caller
, name
, name_size
, ino
, d_type
);
105 buf
->entries_written
++;
112 * @file: The eCryptfs directory file
113 * @ctx: The actor to feed the entries to
115 static int ecryptfs_readdir(struct file
*file
, struct dir_context
*ctx
)
118 struct file
*lower_file
;
119 struct inode
*inode
= file_inode(file
);
120 struct ecryptfs_getdents_callback buf
= {
121 .ctx
.actor
= ecryptfs_filldir
,
125 lower_file
= ecryptfs_file_to_lower(file
);
126 rc
= iterate_dir(lower_file
, &buf
.ctx
);
127 ctx
->pos
= buf
.ctx
.pos
;
130 if (buf
.filldir_called
&& !buf
.entries_written
)
133 fsstack_copy_attr_atime(inode
,
134 file_inode(lower_file
));
139 struct kmem_cache
*ecryptfs_file_info_cache
;
141 static int read_or_initialize_metadata(struct dentry
*dentry
)
143 struct inode
*inode
= d_inode(dentry
);
144 struct ecryptfs_mount_crypt_stat
*mount_crypt_stat
;
145 struct ecryptfs_crypt_stat
*crypt_stat
;
148 crypt_stat
= &ecryptfs_inode_to_private(inode
)->crypt_stat
;
149 mount_crypt_stat
= &ecryptfs_superblock_to_private(
150 inode
->i_sb
)->mount_crypt_stat
;
151 mutex_lock(&crypt_stat
->cs_mutex
);
153 if (crypt_stat
->flags
& ECRYPTFS_POLICY_APPLIED
&&
154 crypt_stat
->flags
& ECRYPTFS_KEY_VALID
) {
159 rc
= ecryptfs_read_metadata(dentry
);
163 if (mount_crypt_stat
->flags
& ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED
) {
164 crypt_stat
->flags
&= ~(ECRYPTFS_I_SIZE_INITIALIZED
165 | ECRYPTFS_ENCRYPTED
);
170 if (!(mount_crypt_stat
->flags
& ECRYPTFS_XATTR_METADATA_ENABLED
) &&
171 !i_size_read(ecryptfs_inode_to_lower(inode
))) {
172 rc
= ecryptfs_initialize_file(dentry
, inode
);
179 mutex_unlock(&crypt_stat
->cs_mutex
);
183 static int ecryptfs_mmap(struct file
*file
, struct vm_area_struct
*vma
)
185 struct file
*lower_file
= ecryptfs_file_to_lower(file
);
187 * Don't allow mmap on top of file systems that don't support it
188 * natively. If FILESYSTEM_MAX_STACK_DEPTH > 2 or ecryptfs
189 * allows recursive mounting, this will need to be extended.
191 if (!lower_file
->f_op
->mmap
)
193 return generic_file_mmap(file
, vma
);
198 * @inode: inode specifying file to open
199 * @file: Structure to return filled in
201 * Opens the file specified by inode.
203 * Returns zero on success; non-zero otherwise
205 static int ecryptfs_open(struct inode
*inode
, struct file
*file
)
208 struct ecryptfs_crypt_stat
*crypt_stat
= NULL
;
209 struct dentry
*ecryptfs_dentry
= file
->f_path
.dentry
;
210 /* Private value of ecryptfs_dentry allocated in
211 * ecryptfs_lookup() */
212 struct ecryptfs_file_info
*file_info
;
214 /* Released in ecryptfs_release or end of function if failure */
215 file_info
= kmem_cache_zalloc(ecryptfs_file_info_cache
, GFP_KERNEL
);
216 ecryptfs_set_file_private(file
, file_info
);
218 ecryptfs_printk(KERN_ERR
,
219 "Error attempting to allocate memory\n");
223 crypt_stat
= &ecryptfs_inode_to_private(inode
)->crypt_stat
;
224 mutex_lock(&crypt_stat
->cs_mutex
);
225 if (!(crypt_stat
->flags
& ECRYPTFS_POLICY_APPLIED
)) {
226 ecryptfs_printk(KERN_DEBUG
, "Setting flags for stat...\n");
227 /* Policy code enabled in future release */
228 crypt_stat
->flags
|= (ECRYPTFS_POLICY_APPLIED
229 | ECRYPTFS_ENCRYPTED
);
231 mutex_unlock(&crypt_stat
->cs_mutex
);
232 rc
= ecryptfs_get_lower_file(ecryptfs_dentry
, inode
);
234 printk(KERN_ERR
"%s: Error attempting to initialize "
235 "the lower file for the dentry with name "
236 "[%pd]; rc = [%d]\n", __func__
,
237 ecryptfs_dentry
, rc
);
240 if ((ecryptfs_inode_to_private(inode
)->lower_file
->f_flags
& O_ACCMODE
)
241 == O_RDONLY
&& (file
->f_flags
& O_ACCMODE
) != O_RDONLY
) {
243 printk(KERN_WARNING
"%s: Lower file is RO; eCryptfs "
244 "file must hence be opened RO\n", __func__
);
247 ecryptfs_set_file_lower(
248 file
, ecryptfs_inode_to_private(inode
)->lower_file
);
249 rc
= read_or_initialize_metadata(ecryptfs_dentry
);
252 ecryptfs_printk(KERN_DEBUG
, "inode w/ addr = [0x%p], i_ino = "
253 "[0x%.16lx] size: [0x%.16llx]\n", inode
, inode
->i_ino
,
254 (unsigned long long)i_size_read(inode
));
257 ecryptfs_put_lower_file(inode
);
259 kmem_cache_free(ecryptfs_file_info_cache
,
260 ecryptfs_file_to_private(file
));
267 * @inode: inode specifying file to open
268 * @file: Structure to return filled in
270 * Opens the file specified by inode.
272 * Returns zero on success; non-zero otherwise
274 static int ecryptfs_dir_open(struct inode
*inode
, struct file
*file
)
276 struct dentry
*ecryptfs_dentry
= file
->f_path
.dentry
;
277 /* Private value of ecryptfs_dentry allocated in
278 * ecryptfs_lookup() */
279 struct ecryptfs_file_info
*file_info
;
280 struct file
*lower_file
;
282 /* Released in ecryptfs_release or end of function if failure */
283 file_info
= kmem_cache_zalloc(ecryptfs_file_info_cache
, GFP_KERNEL
);
284 ecryptfs_set_file_private(file
, file_info
);
285 if (unlikely(!file_info
)) {
286 ecryptfs_printk(KERN_ERR
,
287 "Error attempting to allocate memory\n");
290 lower_file
= dentry_open(ecryptfs_dentry_to_lower_path(ecryptfs_dentry
),
291 file
->f_flags
, current_cred());
292 if (IS_ERR(lower_file
)) {
293 printk(KERN_ERR
"%s: Error attempting to initialize "
294 "the lower file for the dentry with name "
295 "[%pd]; rc = [%ld]\n", __func__
,
296 ecryptfs_dentry
, PTR_ERR(lower_file
));
297 kmem_cache_free(ecryptfs_file_info_cache
, file_info
);
298 return PTR_ERR(lower_file
);
300 ecryptfs_set_file_lower(file
, lower_file
);
304 static int ecryptfs_flush(struct file
*file
, fl_owner_t td
)
306 struct file
*lower_file
= ecryptfs_file_to_lower(file
);
308 if (lower_file
->f_op
->flush
) {
309 filemap_write_and_wait(file
->f_mapping
);
310 return lower_file
->f_op
->flush(lower_file
, td
);
316 static int ecryptfs_release(struct inode
*inode
, struct file
*file
)
318 ecryptfs_put_lower_file(inode
);
319 kmem_cache_free(ecryptfs_file_info_cache
,
320 ecryptfs_file_to_private(file
));
324 static int ecryptfs_dir_release(struct inode
*inode
, struct file
*file
)
326 fput(ecryptfs_file_to_lower(file
));
327 kmem_cache_free(ecryptfs_file_info_cache
,
328 ecryptfs_file_to_private(file
));
332 static loff_t
ecryptfs_dir_llseek(struct file
*file
, loff_t offset
, int whence
)
334 return vfs_llseek(ecryptfs_file_to_lower(file
), offset
, whence
);
338 ecryptfs_fsync(struct file
*file
, loff_t start
, loff_t end
, int datasync
)
342 rc
= file_write_and_wait(file
);
346 return vfs_fsync(ecryptfs_file_to_lower(file
), datasync
);
349 static int ecryptfs_fasync(int fd
, struct file
*file
, int flag
)
352 struct file
*lower_file
= NULL
;
354 lower_file
= ecryptfs_file_to_lower(file
);
355 if (lower_file
->f_op
->fasync
)
356 rc
= lower_file
->f_op
->fasync(fd
, lower_file
, flag
);
361 ecryptfs_unlocked_ioctl(struct file
*file
, unsigned int cmd
, unsigned long arg
)
363 struct file
*lower_file
= ecryptfs_file_to_lower(file
);
366 if (!lower_file
->f_op
->unlocked_ioctl
)
371 case FS_IOC_GETFLAGS
:
372 case FS_IOC_SETFLAGS
:
373 case FS_IOC_GETVERSION
:
374 case FS_IOC_SETVERSION
:
375 rc
= lower_file
->f_op
->unlocked_ioctl(lower_file
, cmd
, arg
);
376 fsstack_copy_attr_all(file_inode(file
), file_inode(lower_file
));
386 ecryptfs_compat_ioctl(struct file
*file
, unsigned int cmd
, unsigned long arg
)
388 struct file
*lower_file
= ecryptfs_file_to_lower(file
);
389 long rc
= -ENOIOCTLCMD
;
391 if (!lower_file
->f_op
->compat_ioctl
)
395 case FS_IOC32_GETFLAGS
:
396 case FS_IOC32_SETFLAGS
:
397 case FS_IOC32_GETVERSION
:
398 case FS_IOC32_SETVERSION
:
399 rc
= lower_file
->f_op
->compat_ioctl(lower_file
, cmd
, arg
);
400 fsstack_copy_attr_all(file_inode(file
), file_inode(lower_file
));
409 const struct file_operations ecryptfs_dir_fops
= {
410 .iterate_shared
= ecryptfs_readdir
,
411 .read
= generic_read_dir
,
412 .unlocked_ioctl
= ecryptfs_unlocked_ioctl
,
414 .compat_ioctl
= ecryptfs_compat_ioctl
,
416 .open
= ecryptfs_dir_open
,
417 .release
= ecryptfs_dir_release
,
418 .fsync
= ecryptfs_fsync
,
419 .llseek
= ecryptfs_dir_llseek
,
422 const struct file_operations ecryptfs_main_fops
= {
423 .llseek
= generic_file_llseek
,
424 .read_iter
= ecryptfs_read_update_atime
,
425 .write_iter
= generic_file_write_iter
,
426 .unlocked_ioctl
= ecryptfs_unlocked_ioctl
,
428 .compat_ioctl
= ecryptfs_compat_ioctl
,
430 .mmap
= ecryptfs_mmap
,
431 .open
= ecryptfs_open
,
432 .flush
= ecryptfs_flush
,
433 .release
= ecryptfs_release
,
434 .fsync
= ecryptfs_fsync
,
435 .fasync
= ecryptfs_fasync
,
436 .splice_read
= generic_file_splice_read
,