mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-24 09:50:04 +00:00
![Eric Biggers](/assets/img/avatar_default.png)
Rename fscrypt_decrypt_page() to fscrypt_decrypt_pagecache_blocks() and redefine its behavior to decrypt all filesystem blocks in the given region of the given page, rather than assuming that the region consists of just one filesystem block. Also remove the 'inode' and 'lblk_num' parameters, since they can be retrieved from the page as it's already assumed to be a pagecache page. This is in preparation for allowing encryption on ext4 filesystems with blocksize != PAGE_SIZE. This is based on work by Chandan Rajendra. Reviewed-by: Chandan Rajendra <chandan@linux.ibm.com> Signed-off-by: Eric Biggers <ebiggers@google.com>
731 lines
23 KiB
C
731 lines
23 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* fscrypt.h: declarations for per-file encryption
|
|
*
|
|
* Filesystems that implement per-file encryption must include this header
|
|
* file.
|
|
*
|
|
* Copyright (C) 2015, Google, Inc.
|
|
*
|
|
* Written by Michael Halcrow, 2015.
|
|
* Modified by Jaegeuk Kim, 2015.
|
|
*/
|
|
#ifndef _LINUX_FSCRYPT_H
|
|
#define _LINUX_FSCRYPT_H
|
|
|
|
#include <linux/fs.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/slab.h>
|
|
|
|
#define FS_CRYPTO_BLOCK_SIZE 16
|
|
|
|
struct fscrypt_ctx;
|
|
struct fscrypt_info;
|
|
|
|
struct fscrypt_str {
|
|
unsigned char *name;
|
|
u32 len;
|
|
};
|
|
|
|
struct fscrypt_name {
|
|
const struct qstr *usr_fname;
|
|
struct fscrypt_str disk_name;
|
|
u32 hash;
|
|
u32 minor_hash;
|
|
struct fscrypt_str crypto_buf;
|
|
bool is_ciphertext_name;
|
|
};
|
|
|
|
#define FSTR_INIT(n, l) { .name = n, .len = l }
|
|
#define FSTR_TO_QSTR(f) QSTR_INIT((f)->name, (f)->len)
|
|
#define fname_name(p) ((p)->disk_name.name)
|
|
#define fname_len(p) ((p)->disk_name.len)
|
|
|
|
/* Maximum value for the third parameter of fscrypt_operations.set_context(). */
|
|
#define FSCRYPT_SET_CONTEXT_MAX_SIZE 28
|
|
|
|
#ifdef CONFIG_FS_ENCRYPTION
|
|
/*
|
|
* fscrypt superblock flags
|
|
*/
|
|
#define FS_CFLG_OWN_PAGES (1U << 1)
|
|
|
|
/*
|
|
* crypto operations for filesystems
|
|
*/
|
|
struct fscrypt_operations {
|
|
unsigned int flags;
|
|
const char *key_prefix;
|
|
int (*get_context)(struct inode *, void *, size_t);
|
|
int (*set_context)(struct inode *, const void *, size_t, void *);
|
|
bool (*dummy_context)(struct inode *);
|
|
bool (*empty_dir)(struct inode *);
|
|
unsigned int max_namelen;
|
|
};
|
|
|
|
/* Decryption work */
|
|
struct fscrypt_ctx {
|
|
union {
|
|
struct {
|
|
struct bio *bio;
|
|
struct work_struct work;
|
|
};
|
|
struct list_head free_list; /* Free list */
|
|
};
|
|
u8 flags; /* Flags */
|
|
};
|
|
|
|
static inline bool fscrypt_has_encryption_key(const struct inode *inode)
|
|
{
|
|
/* pairs with cmpxchg_release() in fscrypt_get_encryption_info() */
|
|
return READ_ONCE(inode->i_crypt_info) != NULL;
|
|
}
|
|
|
|
static inline bool fscrypt_dummy_context_enabled(struct inode *inode)
|
|
{
|
|
return inode->i_sb->s_cop->dummy_context &&
|
|
inode->i_sb->s_cop->dummy_context(inode);
|
|
}
|
|
|
|
/*
|
|
* When d_splice_alias() moves a directory's encrypted alias to its decrypted
|
|
* alias as a result of the encryption key being added, DCACHE_ENCRYPTED_NAME
|
|
* must be cleared. Note that we don't have to support arbitrary moves of this
|
|
* flag because fscrypt doesn't allow encrypted aliases to be the source or
|
|
* target of a rename().
|
|
*/
|
|
static inline void fscrypt_handle_d_move(struct dentry *dentry)
|
|
{
|
|
dentry->d_flags &= ~DCACHE_ENCRYPTED_NAME;
|
|
}
|
|
|
|
/* crypto.c */
|
|
extern void fscrypt_enqueue_decrypt_work(struct work_struct *);
|
|
extern struct fscrypt_ctx *fscrypt_get_ctx(gfp_t);
|
|
extern void fscrypt_release_ctx(struct fscrypt_ctx *);
|
|
|
|
extern struct page *fscrypt_encrypt_pagecache_blocks(struct page *page,
|
|
unsigned int len,
|
|
unsigned int offs,
|
|
gfp_t gfp_flags);
|
|
extern int fscrypt_encrypt_block_inplace(const struct inode *inode,
|
|
struct page *page, unsigned int len,
|
|
unsigned int offs, u64 lblk_num,
|
|
gfp_t gfp_flags);
|
|
|
|
extern int fscrypt_decrypt_pagecache_blocks(struct page *page, unsigned int len,
|
|
unsigned int offs);
|
|
extern int fscrypt_decrypt_block_inplace(const struct inode *inode,
|
|
struct page *page, unsigned int len,
|
|
unsigned int offs, u64 lblk_num);
|
|
|
|
static inline bool fscrypt_is_bounce_page(struct page *page)
|
|
{
|
|
return page->mapping == NULL;
|
|
}
|
|
|
|
static inline struct page *fscrypt_pagecache_page(struct page *bounce_page)
|
|
{
|
|
return (struct page *)page_private(bounce_page);
|
|
}
|
|
|
|
extern void fscrypt_free_bounce_page(struct page *bounce_page);
|
|
|
|
/* policy.c */
|
|
extern int fscrypt_ioctl_set_policy(struct file *, const void __user *);
|
|
extern int fscrypt_ioctl_get_policy(struct file *, void __user *);
|
|
extern int fscrypt_has_permitted_context(struct inode *, struct inode *);
|
|
extern int fscrypt_inherit_context(struct inode *, struct inode *,
|
|
void *, bool);
|
|
/* keyinfo.c */
|
|
extern int fscrypt_get_encryption_info(struct inode *);
|
|
extern void fscrypt_put_encryption_info(struct inode *);
|
|
extern void fscrypt_free_inode(struct inode *);
|
|
|
|
/* fname.c */
|
|
extern int fscrypt_setup_filename(struct inode *, const struct qstr *,
|
|
int lookup, struct fscrypt_name *);
|
|
|
|
static inline void fscrypt_free_filename(struct fscrypt_name *fname)
|
|
{
|
|
kfree(fname->crypto_buf.name);
|
|
}
|
|
|
|
extern int fscrypt_fname_alloc_buffer(const struct inode *, u32,
|
|
struct fscrypt_str *);
|
|
extern void fscrypt_fname_free_buffer(struct fscrypt_str *);
|
|
extern int fscrypt_fname_disk_to_usr(struct inode *, u32, u32,
|
|
const struct fscrypt_str *, struct fscrypt_str *);
|
|
|
|
#define FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE 32
|
|
|
|
/* Extracts the second-to-last ciphertext block; see explanation below */
|
|
#define FSCRYPT_FNAME_DIGEST(name, len) \
|
|
((name) + round_down((len) - FS_CRYPTO_BLOCK_SIZE - 1, \
|
|
FS_CRYPTO_BLOCK_SIZE))
|
|
|
|
#define FSCRYPT_FNAME_DIGEST_SIZE FS_CRYPTO_BLOCK_SIZE
|
|
|
|
/**
|
|
* fscrypt_digested_name - alternate identifier for an on-disk filename
|
|
*
|
|
* When userspace lists an encrypted directory without access to the key,
|
|
* filenames whose ciphertext is longer than FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE
|
|
* bytes are shown in this abbreviated form (base64-encoded) rather than as the
|
|
* full ciphertext (base64-encoded). This is necessary to allow supporting
|
|
* filenames up to NAME_MAX bytes, since base64 encoding expands the length.
|
|
*
|
|
* To make it possible for filesystems to still find the correct directory entry
|
|
* despite not knowing the full on-disk name, we encode any filesystem-specific
|
|
* 'hash' and/or 'minor_hash' which the filesystem may need for its lookups,
|
|
* followed by the second-to-last ciphertext block of the filename. Due to the
|
|
* use of the CBC-CTS encryption mode, the second-to-last ciphertext block
|
|
* depends on the full plaintext. (Note that ciphertext stealing causes the
|
|
* last two blocks to appear "flipped".) This makes accidental collisions very
|
|
* unlikely: just a 1 in 2^128 chance for two filenames to collide even if they
|
|
* share the same filesystem-specific hashes.
|
|
*
|
|
* However, this scheme isn't immune to intentional collisions, which can be
|
|
* created by anyone able to create arbitrary plaintext filenames and view them
|
|
* without the key. Making the "digest" be a real cryptographic hash like
|
|
* SHA-256 over the full ciphertext would prevent this, although it would be
|
|
* less efficient and harder to implement, especially since the filesystem would
|
|
* need to calculate it for each directory entry examined during a search.
|
|
*/
|
|
struct fscrypt_digested_name {
|
|
u32 hash;
|
|
u32 minor_hash;
|
|
u8 digest[FSCRYPT_FNAME_DIGEST_SIZE];
|
|
};
|
|
|
|
/**
|
|
* fscrypt_match_name() - test whether the given name matches a directory entry
|
|
* @fname: the name being searched for
|
|
* @de_name: the name from the directory entry
|
|
* @de_name_len: the length of @de_name in bytes
|
|
*
|
|
* Normally @fname->disk_name will be set, and in that case we simply compare
|
|
* that to the name stored in the directory entry. The only exception is that
|
|
* if we don't have the key for an encrypted directory and a filename in it is
|
|
* very long, then we won't have the full disk_name and we'll instead need to
|
|
* match against the fscrypt_digested_name.
|
|
*
|
|
* Return: %true if the name matches, otherwise %false.
|
|
*/
|
|
static inline bool fscrypt_match_name(const struct fscrypt_name *fname,
|
|
const u8 *de_name, u32 de_name_len)
|
|
{
|
|
if (unlikely(!fname->disk_name.name)) {
|
|
const struct fscrypt_digested_name *n =
|
|
(const void *)fname->crypto_buf.name;
|
|
if (WARN_ON_ONCE(fname->usr_fname->name[0] != '_'))
|
|
return false;
|
|
if (de_name_len <= FSCRYPT_FNAME_MAX_UNDIGESTED_SIZE)
|
|
return false;
|
|
return !memcmp(FSCRYPT_FNAME_DIGEST(de_name, de_name_len),
|
|
n->digest, FSCRYPT_FNAME_DIGEST_SIZE);
|
|
}
|
|
|
|
if (de_name_len != fname->disk_name.len)
|
|
return false;
|
|
return !memcmp(de_name, fname->disk_name.name, fname->disk_name.len);
|
|
}
|
|
|
|
/* bio.c */
|
|
extern void fscrypt_decrypt_bio(struct bio *);
|
|
extern void fscrypt_enqueue_decrypt_bio(struct fscrypt_ctx *ctx,
|
|
struct bio *bio);
|
|
extern int fscrypt_zeroout_range(const struct inode *, pgoff_t, sector_t,
|
|
unsigned int);
|
|
|
|
/* hooks.c */
|
|
extern int fscrypt_file_open(struct inode *inode, struct file *filp);
|
|
extern int __fscrypt_prepare_link(struct inode *inode, struct inode *dir,
|
|
struct dentry *dentry);
|
|
extern int __fscrypt_prepare_rename(struct inode *old_dir,
|
|
struct dentry *old_dentry,
|
|
struct inode *new_dir,
|
|
struct dentry *new_dentry,
|
|
unsigned int flags);
|
|
extern int __fscrypt_prepare_lookup(struct inode *dir, struct dentry *dentry,
|
|
struct fscrypt_name *fname);
|
|
extern int __fscrypt_prepare_symlink(struct inode *dir, unsigned int len,
|
|
unsigned int max_len,
|
|
struct fscrypt_str *disk_link);
|
|
extern int __fscrypt_encrypt_symlink(struct inode *inode, const char *target,
|
|
unsigned int len,
|
|
struct fscrypt_str *disk_link);
|
|
extern const char *fscrypt_get_symlink(struct inode *inode, const void *caddr,
|
|
unsigned int max_size,
|
|
struct delayed_call *done);
|
|
static inline void fscrypt_set_ops(struct super_block *sb,
|
|
const struct fscrypt_operations *s_cop)
|
|
{
|
|
sb->s_cop = s_cop;
|
|
}
|
|
#else /* !CONFIG_FS_ENCRYPTION */
|
|
|
|
static inline bool fscrypt_has_encryption_key(const struct inode *inode)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static inline bool fscrypt_dummy_context_enabled(struct inode *inode)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static inline void fscrypt_handle_d_move(struct dentry *dentry)
|
|
{
|
|
}
|
|
|
|
/* crypto.c */
|
|
static inline void fscrypt_enqueue_decrypt_work(struct work_struct *work)
|
|
{
|
|
}
|
|
|
|
static inline struct fscrypt_ctx *fscrypt_get_ctx(gfp_t gfp_flags)
|
|
{
|
|
return ERR_PTR(-EOPNOTSUPP);
|
|
}
|
|
|
|
static inline void fscrypt_release_ctx(struct fscrypt_ctx *ctx)
|
|
{
|
|
return;
|
|
}
|
|
|
|
static inline struct page *fscrypt_encrypt_pagecache_blocks(struct page *page,
|
|
unsigned int len,
|
|
unsigned int offs,
|
|
gfp_t gfp_flags)
|
|
{
|
|
return ERR_PTR(-EOPNOTSUPP);
|
|
}
|
|
|
|
static inline int fscrypt_encrypt_block_inplace(const struct inode *inode,
|
|
struct page *page,
|
|
unsigned int len,
|
|
unsigned int offs, u64 lblk_num,
|
|
gfp_t gfp_flags)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int fscrypt_decrypt_pagecache_blocks(struct page *page,
|
|
unsigned int len,
|
|
unsigned int offs)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int fscrypt_decrypt_block_inplace(const struct inode *inode,
|
|
struct page *page,
|
|
unsigned int len,
|
|
unsigned int offs, u64 lblk_num)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline bool fscrypt_is_bounce_page(struct page *page)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static inline struct page *fscrypt_pagecache_page(struct page *bounce_page)
|
|
{
|
|
WARN_ON_ONCE(1);
|
|
return ERR_PTR(-EINVAL);
|
|
}
|
|
|
|
static inline void fscrypt_free_bounce_page(struct page *bounce_page)
|
|
{
|
|
}
|
|
|
|
/* policy.c */
|
|
static inline int fscrypt_ioctl_set_policy(struct file *filp,
|
|
const void __user *arg)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int fscrypt_ioctl_get_policy(struct file *filp, void __user *arg)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int fscrypt_has_permitted_context(struct inode *parent,
|
|
struct inode *child)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline int fscrypt_inherit_context(struct inode *parent,
|
|
struct inode *child,
|
|
void *fs_data, bool preload)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
/* keyinfo.c */
|
|
static inline int fscrypt_get_encryption_info(struct inode *inode)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline void fscrypt_put_encryption_info(struct inode *inode)
|
|
{
|
|
return;
|
|
}
|
|
|
|
static inline void fscrypt_free_inode(struct inode *inode)
|
|
{
|
|
}
|
|
|
|
/* fname.c */
|
|
static inline int fscrypt_setup_filename(struct inode *dir,
|
|
const struct qstr *iname,
|
|
int lookup, struct fscrypt_name *fname)
|
|
{
|
|
if (IS_ENCRYPTED(dir))
|
|
return -EOPNOTSUPP;
|
|
|
|
memset(fname, 0, sizeof(*fname));
|
|
fname->usr_fname = iname;
|
|
fname->disk_name.name = (unsigned char *)iname->name;
|
|
fname->disk_name.len = iname->len;
|
|
return 0;
|
|
}
|
|
|
|
static inline void fscrypt_free_filename(struct fscrypt_name *fname)
|
|
{
|
|
return;
|
|
}
|
|
|
|
static inline int fscrypt_fname_alloc_buffer(const struct inode *inode,
|
|
u32 max_encrypted_len,
|
|
struct fscrypt_str *crypto_str)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline void fscrypt_fname_free_buffer(struct fscrypt_str *crypto_str)
|
|
{
|
|
return;
|
|
}
|
|
|
|
static inline int fscrypt_fname_disk_to_usr(struct inode *inode,
|
|
u32 hash, u32 minor_hash,
|
|
const struct fscrypt_str *iname,
|
|
struct fscrypt_str *oname)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline bool fscrypt_match_name(const struct fscrypt_name *fname,
|
|
const u8 *de_name, u32 de_name_len)
|
|
{
|
|
/* Encryption support disabled; use standard comparison */
|
|
if (de_name_len != fname->disk_name.len)
|
|
return false;
|
|
return !memcmp(de_name, fname->disk_name.name, fname->disk_name.len);
|
|
}
|
|
|
|
/* bio.c */
|
|
static inline void fscrypt_decrypt_bio(struct bio *bio)
|
|
{
|
|
}
|
|
|
|
static inline void fscrypt_enqueue_decrypt_bio(struct fscrypt_ctx *ctx,
|
|
struct bio *bio)
|
|
{
|
|
}
|
|
|
|
static inline int fscrypt_zeroout_range(const struct inode *inode, pgoff_t lblk,
|
|
sector_t pblk, unsigned int len)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
/* hooks.c */
|
|
|
|
static inline int fscrypt_file_open(struct inode *inode, struct file *filp)
|
|
{
|
|
if (IS_ENCRYPTED(inode))
|
|
return -EOPNOTSUPP;
|
|
return 0;
|
|
}
|
|
|
|
static inline int __fscrypt_prepare_link(struct inode *inode, struct inode *dir,
|
|
struct dentry *dentry)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int __fscrypt_prepare_rename(struct inode *old_dir,
|
|
struct dentry *old_dentry,
|
|
struct inode *new_dir,
|
|
struct dentry *new_dentry,
|
|
unsigned int flags)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int __fscrypt_prepare_lookup(struct inode *dir,
|
|
struct dentry *dentry,
|
|
struct fscrypt_name *fname)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline int __fscrypt_prepare_symlink(struct inode *dir,
|
|
unsigned int len,
|
|
unsigned int max_len,
|
|
struct fscrypt_str *disk_link)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
|
|
static inline int __fscrypt_encrypt_symlink(struct inode *inode,
|
|
const char *target,
|
|
unsigned int len,
|
|
struct fscrypt_str *disk_link)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static inline const char *fscrypt_get_symlink(struct inode *inode,
|
|
const void *caddr,
|
|
unsigned int max_size,
|
|
struct delayed_call *done)
|
|
{
|
|
return ERR_PTR(-EOPNOTSUPP);
|
|
}
|
|
|
|
static inline void fscrypt_set_ops(struct super_block *sb,
|
|
const struct fscrypt_operations *s_cop)
|
|
{
|
|
}
|
|
|
|
#endif /* !CONFIG_FS_ENCRYPTION */
|
|
|
|
/**
|
|
* fscrypt_require_key - require an inode's encryption key
|
|
* @inode: the inode we need the key for
|
|
*
|
|
* If the inode is encrypted, set up its encryption key if not already done.
|
|
* Then require that the key be present and return -ENOKEY otherwise.
|
|
*
|
|
* No locks are needed, and the key will live as long as the struct inode --- so
|
|
* it won't go away from under you.
|
|
*
|
|
* Return: 0 on success, -ENOKEY if the key is missing, or another -errno code
|
|
* if a problem occurred while setting up the encryption key.
|
|
*/
|
|
static inline int fscrypt_require_key(struct inode *inode)
|
|
{
|
|
if (IS_ENCRYPTED(inode)) {
|
|
int err = fscrypt_get_encryption_info(inode);
|
|
|
|
if (err)
|
|
return err;
|
|
if (!fscrypt_has_encryption_key(inode))
|
|
return -ENOKEY;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* fscrypt_prepare_link - prepare to link an inode into a possibly-encrypted directory
|
|
* @old_dentry: an existing dentry for the inode being linked
|
|
* @dir: the target directory
|
|
* @dentry: negative dentry for the target filename
|
|
*
|
|
* A new link can only be added to an encrypted directory if the directory's
|
|
* encryption key is available --- since otherwise we'd have no way to encrypt
|
|
* the filename. Therefore, we first set up the directory's encryption key (if
|
|
* not already done) and return an error if it's unavailable.
|
|
*
|
|
* We also verify that the link will not violate the constraint that all files
|
|
* in an encrypted directory tree use the same encryption policy.
|
|
*
|
|
* Return: 0 on success, -ENOKEY if the directory's encryption key is missing,
|
|
* -EXDEV if the link would result in an inconsistent encryption policy, or
|
|
* another -errno code.
|
|
*/
|
|
static inline int fscrypt_prepare_link(struct dentry *old_dentry,
|
|
struct inode *dir,
|
|
struct dentry *dentry)
|
|
{
|
|
if (IS_ENCRYPTED(dir))
|
|
return __fscrypt_prepare_link(d_inode(old_dentry), dir, dentry);
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* fscrypt_prepare_rename - prepare for a rename between possibly-encrypted directories
|
|
* @old_dir: source directory
|
|
* @old_dentry: dentry for source file
|
|
* @new_dir: target directory
|
|
* @new_dentry: dentry for target location (may be negative unless exchanging)
|
|
* @flags: rename flags (we care at least about %RENAME_EXCHANGE)
|
|
*
|
|
* Prepare for ->rename() where the source and/or target directories may be
|
|
* encrypted. A new link can only be added to an encrypted directory if the
|
|
* directory's encryption key is available --- since otherwise we'd have no way
|
|
* to encrypt the filename. A rename to an existing name, on the other hand,
|
|
* *is* cryptographically possible without the key. However, we take the more
|
|
* conservative approach and just forbid all no-key renames.
|
|
*
|
|
* We also verify that the rename will not violate the constraint that all files
|
|
* in an encrypted directory tree use the same encryption policy.
|
|
*
|
|
* Return: 0 on success, -ENOKEY if an encryption key is missing, -EXDEV if the
|
|
* rename would cause inconsistent encryption policies, or another -errno code.
|
|
*/
|
|
static inline int fscrypt_prepare_rename(struct inode *old_dir,
|
|
struct dentry *old_dentry,
|
|
struct inode *new_dir,
|
|
struct dentry *new_dentry,
|
|
unsigned int flags)
|
|
{
|
|
if (IS_ENCRYPTED(old_dir) || IS_ENCRYPTED(new_dir))
|
|
return __fscrypt_prepare_rename(old_dir, old_dentry,
|
|
new_dir, new_dentry, flags);
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* fscrypt_prepare_lookup - prepare to lookup a name in a possibly-encrypted directory
|
|
* @dir: directory being searched
|
|
* @dentry: filename being looked up
|
|
* @fname: (output) the name to use to search the on-disk directory
|
|
*
|
|
* Prepare for ->lookup() in a directory which may be encrypted by determining
|
|
* the name that will actually be used to search the directory on-disk. Lookups
|
|
* can be done with or without the directory's encryption key; without the key,
|
|
* filenames are presented in encrypted form. Therefore, we'll try to set up
|
|
* the directory's encryption key, but even without it the lookup can continue.
|
|
*
|
|
* This also installs a custom ->d_revalidate() method which will invalidate the
|
|
* dentry if it was created without the key and the key is later added.
|
|
*
|
|
* Return: 0 on success; -ENOENT if key is unavailable but the filename isn't a
|
|
* correctly formed encoded ciphertext name, so a negative dentry should be
|
|
* created; or another -errno code.
|
|
*/
|
|
static inline int fscrypt_prepare_lookup(struct inode *dir,
|
|
struct dentry *dentry,
|
|
struct fscrypt_name *fname)
|
|
{
|
|
if (IS_ENCRYPTED(dir))
|
|
return __fscrypt_prepare_lookup(dir, dentry, fname);
|
|
|
|
memset(fname, 0, sizeof(*fname));
|
|
fname->usr_fname = &dentry->d_name;
|
|
fname->disk_name.name = (unsigned char *)dentry->d_name.name;
|
|
fname->disk_name.len = dentry->d_name.len;
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* fscrypt_prepare_setattr - prepare to change a possibly-encrypted inode's attributes
|
|
* @dentry: dentry through which the inode is being changed
|
|
* @attr: attributes to change
|
|
*
|
|
* Prepare for ->setattr() on a possibly-encrypted inode. On an encrypted file,
|
|
* most attribute changes are allowed even without the encryption key. However,
|
|
* without the encryption key we do have to forbid truncates. This is needed
|
|
* because the size being truncated to may not be a multiple of the filesystem
|
|
* block size, and in that case we'd have to decrypt the final block, zero the
|
|
* portion past i_size, and re-encrypt it. (We *could* allow truncating to a
|
|
* filesystem block boundary, but it's simpler to just forbid all truncates ---
|
|
* and we already forbid all other contents modifications without the key.)
|
|
*
|
|
* Return: 0 on success, -ENOKEY if the key is missing, or another -errno code
|
|
* if a problem occurred while setting up the encryption key.
|
|
*/
|
|
static inline int fscrypt_prepare_setattr(struct dentry *dentry,
|
|
struct iattr *attr)
|
|
{
|
|
if (attr->ia_valid & ATTR_SIZE)
|
|
return fscrypt_require_key(d_inode(dentry));
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* fscrypt_prepare_symlink - prepare to create a possibly-encrypted symlink
|
|
* @dir: directory in which the symlink is being created
|
|
* @target: plaintext symlink target
|
|
* @len: length of @target excluding null terminator
|
|
* @max_len: space the filesystem has available to store the symlink target
|
|
* @disk_link: (out) the on-disk symlink target being prepared
|
|
*
|
|
* This function computes the size the symlink target will require on-disk,
|
|
* stores it in @disk_link->len, and validates it against @max_len. An
|
|
* encrypted symlink may be longer than the original.
|
|
*
|
|
* Additionally, @disk_link->name is set to @target if the symlink will be
|
|
* unencrypted, but left NULL if the symlink will be encrypted. For encrypted
|
|
* symlinks, the filesystem must call fscrypt_encrypt_symlink() to create the
|
|
* on-disk target later. (The reason for the two-step process is that some
|
|
* filesystems need to know the size of the symlink target before creating the
|
|
* inode, e.g. to determine whether it will be a "fast" or "slow" symlink.)
|
|
*
|
|
* Return: 0 on success, -ENAMETOOLONG if the symlink target is too long,
|
|
* -ENOKEY if the encryption key is missing, or another -errno code if a problem
|
|
* occurred while setting up the encryption key.
|
|
*/
|
|
static inline int fscrypt_prepare_symlink(struct inode *dir,
|
|
const char *target,
|
|
unsigned int len,
|
|
unsigned int max_len,
|
|
struct fscrypt_str *disk_link)
|
|
{
|
|
if (IS_ENCRYPTED(dir) || fscrypt_dummy_context_enabled(dir))
|
|
return __fscrypt_prepare_symlink(dir, len, max_len, disk_link);
|
|
|
|
disk_link->name = (unsigned char *)target;
|
|
disk_link->len = len + 1;
|
|
if (disk_link->len > max_len)
|
|
return -ENAMETOOLONG;
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* fscrypt_encrypt_symlink - encrypt the symlink target if needed
|
|
* @inode: symlink inode
|
|
* @target: plaintext symlink target
|
|
* @len: length of @target excluding null terminator
|
|
* @disk_link: (in/out) the on-disk symlink target being prepared
|
|
*
|
|
* If the symlink target needs to be encrypted, then this function encrypts it
|
|
* into @disk_link->name. fscrypt_prepare_symlink() must have been called
|
|
* previously to compute @disk_link->len. If the filesystem did not allocate a
|
|
* buffer for @disk_link->name after calling fscrypt_prepare_link(), then one
|
|
* will be kmalloc()'ed and the filesystem will be responsible for freeing it.
|
|
*
|
|
* Return: 0 on success, -errno on failure
|
|
*/
|
|
static inline int fscrypt_encrypt_symlink(struct inode *inode,
|
|
const char *target,
|
|
unsigned int len,
|
|
struct fscrypt_str *disk_link)
|
|
{
|
|
if (IS_ENCRYPTED(inode))
|
|
return __fscrypt_encrypt_symlink(inode, target, len, disk_link);
|
|
return 0;
|
|
}
|
|
|
|
/* If *pagep is a bounce page, free it and set *pagep to the pagecache page */
|
|
static inline void fscrypt_finalize_bounce_page(struct page **pagep)
|
|
{
|
|
struct page *page = *pagep;
|
|
|
|
if (fscrypt_is_bounce_page(page)) {
|
|
*pagep = fscrypt_pagecache_page(page);
|
|
fscrypt_free_bounce_page(page);
|
|
}
|
|
}
|
|
|
|
#endif /* _LINUX_FSCRYPT_H */
|