linux/fs/ecryptfs/inode.c
<<
>>
Prefs
   1/**
   2 * eCryptfs: Linux filesystem encryption layer
   3 *
   4 * Copyright (C) 1997-2004 Erez Zadok
   5 * Copyright (C) 2001-2004 Stony Brook University
   6 * Copyright (C) 2004-2007 International Business Machines Corp.
   7 *   Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>
   8 *              Michael C. Thompsion <mcthomps@us.ibm.com>
   9 *
  10 * This program is free software; you can redistribute it and/or
  11 * modify it under the terms of the GNU General Public License as
  12 * published by the Free Software Foundation; either version 2 of the
  13 * License, or (at your option) any later version.
  14 *
  15 * This program is distributed in the hope that it will be useful, but
  16 * WITHOUT ANY WARRANTY; without even the implied warranty of
  17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  18 * General Public License for more details.
  19 *
  20 * You should have received a copy of the GNU General Public License
  21 * along with this program; if not, write to the Free Software
  22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
  23 * 02111-1307, USA.
  24 */
  25
  26#include <linux/file.h>
  27#include <linux/vmalloc.h>
  28#include <linux/pagemap.h>
  29#include <linux/dcache.h>
  30#include <linux/namei.h>
  31#include <linux/mount.h>
  32#include <linux/crypto.h>
  33#include <linux/fs_stack.h>
  34#include <linux/slab.h>
  35#include <linux/xattr.h>
  36#include <asm/unaligned.h>
  37#include "ecryptfs_kernel.h"
  38
  39static struct dentry *lock_parent(struct dentry *dentry)
  40{
  41        struct dentry *dir;
  42
  43        dir = dget_parent(dentry);
  44        mutex_lock_nested(&(dir->d_inode->i_mutex), I_MUTEX_PARENT);
  45        return dir;
  46}
  47
  48static void unlock_dir(struct dentry *dir)
  49{
  50        mutex_unlock(&dir->d_inode->i_mutex);
  51        dput(dir);
  52}
  53
  54static int ecryptfs_inode_test(struct inode *inode, void *lower_inode)
  55{
  56        if (ecryptfs_inode_to_lower(inode) == (struct inode *)lower_inode)
  57                return 1;
  58        return 0;
  59}
  60
  61static int ecryptfs_inode_set(struct inode *inode, void *opaque)
  62{
  63        struct inode *lower_inode = opaque;
  64
  65        ecryptfs_set_inode_lower(inode, lower_inode);
  66        fsstack_copy_attr_all(inode, lower_inode);
  67        /* i_size will be overwritten for encrypted regular files */
  68        fsstack_copy_inode_size(inode, lower_inode);
  69        inode->i_ino = lower_inode->i_ino;
  70        inode->i_version++;
  71        inode->i_mapping->a_ops = &ecryptfs_aops;
  72        inode->i_mapping->backing_dev_info = inode->i_sb->s_bdi;
  73
  74        if (S_ISLNK(inode->i_mode))
  75                inode->i_op = &ecryptfs_symlink_iops;
  76        else if (S_ISDIR(inode->i_mode))
  77                inode->i_op = &ecryptfs_dir_iops;
  78        else
  79                inode->i_op = &ecryptfs_main_iops;
  80
  81        if (S_ISDIR(inode->i_mode))
  82                inode->i_fop = &ecryptfs_dir_fops;
  83        else if (special_file(inode->i_mode))
  84                init_special_inode(inode, inode->i_mode, inode->i_rdev);
  85        else
  86                inode->i_fop = &ecryptfs_main_fops;
  87
  88        return 0;
  89}
  90
  91static struct inode *__ecryptfs_get_inode(struct inode *lower_inode,
  92                                          struct super_block *sb)
  93{
  94        struct inode *inode;
  95
  96        if (lower_inode->i_sb != ecryptfs_superblock_to_lower(sb))
  97                return ERR_PTR(-EXDEV);
  98        if (!igrab(lower_inode))
  99                return ERR_PTR(-ESTALE);
 100        inode = iget5_locked(sb, (unsigned long)lower_inode,
 101                             ecryptfs_inode_test, ecryptfs_inode_set,
 102                             lower_inode);
 103        if (!inode) {
 104                iput(lower_inode);
 105                return ERR_PTR(-EACCES);
 106        }
 107        if (!(inode->i_state & I_NEW))
 108                iput(lower_inode);
 109
 110        return inode;
 111}
 112
 113struct inode *ecryptfs_get_inode(struct inode *lower_inode,
 114                                 struct super_block *sb)
 115{
 116        struct inode *inode = __ecryptfs_get_inode(lower_inode, sb);
 117
 118        if (!IS_ERR(inode) && (inode->i_state & I_NEW))
 119                unlock_new_inode(inode);
 120
 121        return inode;
 122}
 123
 124/**
 125 * ecryptfs_interpose
 126 * @lower_dentry: Existing dentry in the lower filesystem
 127 * @dentry: ecryptfs' dentry
 128 * @sb: ecryptfs's super_block
 129 *
 130 * Interposes upper and lower dentries.
 131 *
 132 * Returns zero on success; non-zero otherwise
 133 */
 134static int ecryptfs_interpose(struct dentry *lower_dentry,
 135                              struct dentry *dentry, struct super_block *sb)
 136{
 137        struct inode *inode = ecryptfs_get_inode(lower_dentry->d_inode, sb);
 138
 139        if (IS_ERR(inode))
 140                return PTR_ERR(inode);
 141        d_instantiate(dentry, inode);
 142
 143        return 0;
 144}
 145
 146static int ecryptfs_do_unlink(struct inode *dir, struct dentry *dentry,
 147                              struct inode *inode)
 148{
 149        struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
 150        struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
 151        struct dentry *lower_dir_dentry;
 152        int rc;
 153
 154        dget(lower_dentry);
 155        lower_dir_dentry = lock_parent(lower_dentry);
 156        rc = vfs_unlink(lower_dir_inode, lower_dentry, NULL);
 157        if (rc) {
 158                printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
 159                goto out_unlock;
 160        }
 161        fsstack_copy_attr_times(dir, lower_dir_inode);
 162        set_nlink(inode, ecryptfs_inode_to_lower(inode)->i_nlink);
 163        inode->i_ctime = dir->i_ctime;
 164        d_drop(dentry);
 165out_unlock:
 166        unlock_dir(lower_dir_dentry);
 167        dput(lower_dentry);
 168        return rc;
 169}
 170
 171/**
 172 * ecryptfs_do_create
 173 * @directory_inode: inode of the new file's dentry's parent in ecryptfs
 174 * @ecryptfs_dentry: New file's dentry in ecryptfs
 175 * @mode: The mode of the new file
 176 * @nd: nameidata of ecryptfs' parent's dentry & vfsmount
 177 *
 178 * Creates the underlying file and the eCryptfs inode which will link to
 179 * it. It will also update the eCryptfs directory inode to mimic the
 180 * stat of the lower directory inode.
 181 *
 182 * Returns the new eCryptfs inode on success; an ERR_PTR on error condition
 183 */
 184static struct inode *
 185ecryptfs_do_create(struct inode *directory_inode,
 186                   struct dentry *ecryptfs_dentry, umode_t mode)
 187{
 188        int rc;
 189        struct dentry *lower_dentry;
 190        struct dentry *lower_dir_dentry;
 191        struct inode *inode;
 192
 193        lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
 194        lower_dir_dentry = lock_parent(lower_dentry);
 195        if (IS_ERR(lower_dir_dentry)) {
 196                ecryptfs_printk(KERN_ERR, "Error locking directory of "
 197                                "dentry\n");
 198                inode = ERR_CAST(lower_dir_dentry);
 199                goto out;
 200        }
 201        rc = vfs_create(lower_dir_dentry->d_inode, lower_dentry, mode, true);
 202        if (rc) {
 203                printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
 204                       "rc = [%d]\n", __func__, rc);
 205                inode = ERR_PTR(rc);
 206                goto out_lock;
 207        }
 208        inode = __ecryptfs_get_inode(lower_dentry->d_inode,
 209                                     directory_inode->i_sb);
 210        if (IS_ERR(inode)) {
 211                vfs_unlink(lower_dir_dentry->d_inode, lower_dentry, NULL);
 212                goto out_lock;
 213        }
 214        fsstack_copy_attr_times(directory_inode, lower_dir_dentry->d_inode);
 215        fsstack_copy_inode_size(directory_inode, lower_dir_dentry->d_inode);
 216out_lock:
 217        unlock_dir(lower_dir_dentry);
 218out:
 219        return inode;
 220}
 221
 222/**
 223 * ecryptfs_initialize_file
 224 *
 225 * Cause the file to be changed from a basic empty file to an ecryptfs
 226 * file with a header and first data page.
 227 *
 228 * Returns zero on success
 229 */
 230int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry,
 231                             struct inode *ecryptfs_inode)
 232{
 233        struct ecryptfs_crypt_stat *crypt_stat =
 234                &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
 235        int rc = 0;
 236
 237        if (S_ISDIR(ecryptfs_inode->i_mode)) {
 238                ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
 239                crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
 240                goto out;
 241        }
 242        ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n");
 243        rc = ecryptfs_new_file_context(ecryptfs_inode);
 244        if (rc) {
 245                ecryptfs_printk(KERN_ERR, "Error creating new file "
 246                                "context; rc = [%d]\n", rc);
 247                goto out;
 248        }
 249        rc = ecryptfs_get_lower_file(ecryptfs_dentry, ecryptfs_inode);
 250        if (rc) {
 251                printk(KERN_ERR "%s: Error attempting to initialize "
 252                        "the lower file for the dentry with name "
 253                        "[%s]; rc = [%d]\n", __func__,
 254                        ecryptfs_dentry->d_name.name, rc);
 255                goto out;
 256        }
 257        rc = ecryptfs_write_metadata(ecryptfs_dentry, ecryptfs_inode);
 258        if (rc)
 259                printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
 260        ecryptfs_put_lower_file(ecryptfs_inode);
 261out:
 262        return rc;
 263}
 264
 265/**
 266 * ecryptfs_create
 267 * @dir: The inode of the directory in which to create the file.
 268 * @dentry: The eCryptfs dentry
 269 * @mode: The mode of the new file.
 270 *
 271 * Creates a new file.
 272 *
 273 * Returns zero on success; non-zero on error condition
 274 */
 275static int
 276ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry,
 277                umode_t mode, bool excl)
 278{
 279        struct inode *ecryptfs_inode;
 280        int rc;
 281
 282        ecryptfs_inode = ecryptfs_do_create(directory_inode, ecryptfs_dentry,
 283                                            mode);
 284        if (unlikely(IS_ERR(ecryptfs_inode))) {
 285                ecryptfs_printk(KERN_WARNING, "Failed to create file in"
 286                                "lower filesystem\n");
 287                rc = PTR_ERR(ecryptfs_inode);
 288                goto out;
 289        }
 290        /* At this point, a file exists on "disk"; we need to make sure
 291         * that this on disk file is prepared to be an ecryptfs file */
 292        rc = ecryptfs_initialize_file(ecryptfs_dentry, ecryptfs_inode);
 293        if (rc) {
 294                ecryptfs_do_unlink(directory_inode, ecryptfs_dentry,
 295                                   ecryptfs_inode);
 296                make_bad_inode(ecryptfs_inode);
 297                unlock_new_inode(ecryptfs_inode);
 298                iput(ecryptfs_inode);
 299                goto out;
 300        }
 301        unlock_new_inode(ecryptfs_inode);
 302        d_instantiate(ecryptfs_dentry, ecryptfs_inode);
 303out:
 304        return rc;
 305}
 306
 307static int ecryptfs_i_size_read(struct dentry *dentry, struct inode *inode)
 308{
 309        struct ecryptfs_crypt_stat *crypt_stat;
 310        int rc;
 311
 312        rc = ecryptfs_get_lower_file(dentry, inode);
 313        if (rc) {
 314                printk(KERN_ERR "%s: Error attempting to initialize "
 315                        "the lower file for the dentry with name "
 316                        "[%s]; rc = [%d]\n", __func__,
 317                        dentry->d_name.name, rc);
 318                return rc;
 319        }
 320
 321        crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
 322        /* TODO: lock for crypt_stat comparison */
 323        if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
 324                ecryptfs_set_default_sizes(crypt_stat);
 325
 326        rc = ecryptfs_read_and_validate_header_region(inode);
 327        ecryptfs_put_lower_file(inode);
 328        if (rc) {
 329                rc = ecryptfs_read_and_validate_xattr_region(dentry, inode);
 330                if (!rc)
 331                        crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
 332        }
 333
 334        /* Must return 0 to allow non-eCryptfs files to be looked up, too */
 335        return 0;
 336}
 337
 338/**
 339 * ecryptfs_lookup_interpose - Dentry interposition for a lookup
 340 */
 341static int ecryptfs_lookup_interpose(struct dentry *dentry,
 342                                     struct dentry *lower_dentry,
 343                                     struct inode *dir_inode)
 344{
 345        struct inode *inode, *lower_inode = lower_dentry->d_inode;
 346        struct ecryptfs_dentry_info *dentry_info;
 347        struct vfsmount *lower_mnt;
 348        int rc = 0;
 349
 350        dentry_info = kmem_cache_alloc(ecryptfs_dentry_info_cache, GFP_KERNEL);
 351        if (!dentry_info) {
 352                printk(KERN_ERR "%s: Out of memory whilst attempting "
 353                       "to allocate ecryptfs_dentry_info struct\n",
 354                        __func__);
 355                dput(lower_dentry);
 356                return -ENOMEM;
 357        }
 358
 359        lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
 360        fsstack_copy_attr_atime(dir_inode, lower_dentry->d_parent->d_inode);
 361        BUG_ON(!d_count(lower_dentry));
 362
 363        ecryptfs_set_dentry_private(dentry, dentry_info);
 364        dentry_info->lower_path.mnt = lower_mnt;
 365        dentry_info->lower_path.dentry = lower_dentry;
 366
 367        if (!lower_dentry->d_inode) {
 368                /* We want to add because we couldn't find in lower */
 369                d_add(dentry, NULL);
 370                return 0;
 371        }
 372        inode = __ecryptfs_get_inode(lower_inode, dir_inode->i_sb);
 373        if (IS_ERR(inode)) {
 374                printk(KERN_ERR "%s: Error interposing; rc = [%ld]\n",
 375                       __func__, PTR_ERR(inode));
 376                return PTR_ERR(inode);
 377        }
 378        if (S_ISREG(inode->i_mode)) {
 379                rc = ecryptfs_i_size_read(dentry, inode);
 380                if (rc) {
 381                        make_bad_inode(inode);
 382                        return rc;
 383                }
 384        }
 385
 386        if (inode->i_state & I_NEW)
 387                unlock_new_inode(inode);
 388        d_add(dentry, inode);
 389
 390        return rc;
 391}
 392
 393/**
 394 * ecryptfs_lookup
 395 * @ecryptfs_dir_inode: The eCryptfs directory inode
 396 * @ecryptfs_dentry: The eCryptfs dentry that we are looking up
 397 * @ecryptfs_nd: nameidata; may be NULL
 398 *
 399 * Find a file on disk. If the file does not exist, then we'll add it to the
 400 * dentry cache and continue on to read it from the disk.
 401 */
 402static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
 403                                      struct dentry *ecryptfs_dentry,
 404                                      unsigned int flags)
 405{
 406        char *encrypted_and_encoded_name = NULL;
 407        size_t encrypted_and_encoded_name_size;
 408        struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
 409        struct dentry *lower_dir_dentry, *lower_dentry;
 410        int rc = 0;
 411
 412        lower_dir_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry->d_parent);
 413        mutex_lock(&lower_dir_dentry->d_inode->i_mutex);
 414        lower_dentry = lookup_one_len(ecryptfs_dentry->d_name.name,
 415                                      lower_dir_dentry,
 416                                      ecryptfs_dentry->d_name.len);
 417        mutex_unlock(&lower_dir_dentry->d_inode->i_mutex);
 418        if (IS_ERR(lower_dentry)) {
 419                rc = PTR_ERR(lower_dentry);
 420                ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned "
 421                                "[%d] on lower_dentry = [%s]\n", __func__, rc,
 422                                ecryptfs_dentry->d_name.name);
 423                goto out;
 424        }
 425        if (lower_dentry->d_inode)
 426                goto interpose;
 427        mount_crypt_stat = &ecryptfs_superblock_to_private(
 428                                ecryptfs_dentry->d_sb)->mount_crypt_stat;
 429        if (!(mount_crypt_stat
 430            && (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)))
 431                goto interpose;
 432        dput(lower_dentry);
 433        rc = ecryptfs_encrypt_and_encode_filename(
 434                &encrypted_and_encoded_name, &encrypted_and_encoded_name_size,
 435                NULL, mount_crypt_stat, ecryptfs_dentry->d_name.name,
 436                ecryptfs_dentry->d_name.len);
 437        if (rc) {
 438                printk(KERN_ERR "%s: Error attempting to encrypt and encode "
 439                       "filename; rc = [%d]\n", __func__, rc);
 440                goto out;
 441        }
 442        mutex_lock(&lower_dir_dentry->d_inode->i_mutex);
 443        lower_dentry = lookup_one_len(encrypted_and_encoded_name,
 444                                      lower_dir_dentry,
 445                                      encrypted_and_encoded_name_size);
 446        mutex_unlock(&lower_dir_dentry->d_inode->i_mutex);
 447        if (IS_ERR(lower_dentry)) {
 448                rc = PTR_ERR(lower_dentry);
 449                ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned "
 450                                "[%d] on lower_dentry = [%s]\n", __func__, rc,
 451                                encrypted_and_encoded_name);
 452                goto out;
 453        }
 454interpose:
 455        rc = ecryptfs_lookup_interpose(ecryptfs_dentry, lower_dentry,
 456                                       ecryptfs_dir_inode);
 457out:
 458        kfree(encrypted_and_encoded_name);
 459        return ERR_PTR(rc);
 460}
 461
 462static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir,
 463                         struct dentry *new_dentry)
 464{
 465        struct dentry *lower_old_dentry;
 466        struct dentry *lower_new_dentry;
 467        struct dentry *lower_dir_dentry;
 468        u64 file_size_save;
 469        int rc;
 470
 471        file_size_save = i_size_read(old_dentry->d_inode);
 472        lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
 473        lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
 474        dget(lower_old_dentry);
 475        dget(lower_new_dentry);
 476        lower_dir_dentry = lock_parent(lower_new_dentry);
 477        rc = vfs_link(lower_old_dentry, lower_dir_dentry->d_inode,
 478                      lower_new_dentry, NULL);
 479        if (rc || !lower_new_dentry->d_inode)
 480                goto out_lock;
 481        rc = ecryptfs_interpose(lower_new_dentry, new_dentry, dir->i_sb);
 482        if (rc)
 483                goto out_lock;
 484        fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
 485        fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
 486        set_nlink(old_dentry->d_inode,
 487                  ecryptfs_inode_to_lower(old_dentry->d_inode)->i_nlink);
 488        i_size_write(new_dentry->d_inode, file_size_save);
 489out_lock:
 490        unlock_dir(lower_dir_dentry);
 491        dput(lower_new_dentry);
 492        dput(lower_old_dentry);
 493        return rc;
 494}
 495
 496static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
 497{
 498        return ecryptfs_do_unlink(dir, dentry, dentry->d_inode);
 499}
 500
 501static int ecryptfs_symlink(struct inode *dir, struct dentry *dentry,
 502                            const char *symname)
 503{
 504        int rc;
 505        struct dentry *lower_dentry;
 506        struct dentry *lower_dir_dentry;
 507        char *encoded_symname;
 508        size_t encoded_symlen;
 509        struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
 510
 511        lower_dentry = ecryptfs_dentry_to_lower(dentry);
 512        dget(lower_dentry);
 513        lower_dir_dentry = lock_parent(lower_dentry);
 514        mount_crypt_stat = &ecryptfs_superblock_to_private(
 515                dir->i_sb)->mount_crypt_stat;
 516        rc = ecryptfs_encrypt_and_encode_filename(&encoded_symname,
 517                                                  &encoded_symlen,
 518                                                  NULL,
 519                                                  mount_crypt_stat, symname,
 520                                                  strlen(symname));
 521        if (rc)
 522                goto out_lock;
 523        rc = vfs_symlink(lower_dir_dentry->d_inode, lower_dentry,
 524                         encoded_symname);
 525        kfree(encoded_symname);
 526        if (rc || !lower_dentry->d_inode)
 527                goto out_lock;
 528        rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
 529        if (rc)
 530                goto out_lock;
 531        fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
 532        fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
 533out_lock:
 534        unlock_dir(lower_dir_dentry);
 535        dput(lower_dentry);
 536        if (!dentry->d_inode)
 537                d_drop(dentry);
 538        return rc;
 539}
 540
 541static int ecryptfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
 542{
 543        int rc;
 544        struct dentry *lower_dentry;
 545        struct dentry *lower_dir_dentry;
 546
 547        lower_dentry = ecryptfs_dentry_to_lower(dentry);
 548        lower_dir_dentry = lock_parent(lower_dentry);
 549        rc = vfs_mkdir(lower_dir_dentry->d_inode, lower_dentry, mode);
 550        if (rc || !lower_dentry->d_inode)
 551                goto out;
 552        rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
 553        if (rc)
 554                goto out;
 555        fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
 556        fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
 557        set_nlink(dir, lower_dir_dentry->d_inode->i_nlink);
 558out:
 559        unlock_dir(lower_dir_dentry);
 560        if (!dentry->d_inode)
 561                d_drop(dentry);
 562        return rc;
 563}
 564
 565static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry)
 566{
 567        struct dentry *lower_dentry;
 568        struct dentry *lower_dir_dentry;
 569        int rc;
 570
 571        lower_dentry = ecryptfs_dentry_to_lower(dentry);
 572        dget(dentry);
 573        lower_dir_dentry = lock_parent(lower_dentry);
 574        dget(lower_dentry);
 575        rc = vfs_rmdir(lower_dir_dentry->d_inode, lower_dentry);
 576        dput(lower_dentry);
 577        if (!rc && dentry->d_inode)
 578                clear_nlink(dentry->d_inode);
 579        fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
 580        set_nlink(dir, lower_dir_dentry->d_inode->i_nlink);
 581        unlock_dir(lower_dir_dentry);
 582        if (!rc)
 583                d_drop(dentry);
 584        dput(dentry);
 585        return rc;
 586}
 587
 588static int
 589ecryptfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
 590{
 591        int rc;
 592        struct dentry *lower_dentry;
 593        struct dentry *lower_dir_dentry;
 594
 595        lower_dentry = ecryptfs_dentry_to_lower(dentry);
 596        lower_dir_dentry = lock_parent(lower_dentry);
 597        rc = vfs_mknod(lower_dir_dentry->d_inode, lower_dentry, mode, dev);
 598        if (rc || !lower_dentry->d_inode)
 599                goto out;
 600        rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
 601        if (rc)
 602                goto out;
 603        fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
 604        fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
 605out:
 606        unlock_dir(lower_dir_dentry);
 607        if (!dentry->d_inode)
 608                d_drop(dentry);
 609        return rc;
 610}
 611
 612static int
 613ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 614                struct inode *new_dir, struct dentry *new_dentry)
 615{
 616        int rc;
 617        struct dentry *lower_old_dentry;
 618        struct dentry *lower_new_dentry;
 619        struct dentry *lower_old_dir_dentry;
 620        struct dentry *lower_new_dir_dentry;
 621        struct dentry *trap = NULL;
 622        struct inode *target_inode;
 623
 624        lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
 625        lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
 626        dget(lower_old_dentry);
 627        dget(lower_new_dentry);
 628        lower_old_dir_dentry = dget_parent(lower_old_dentry);
 629        lower_new_dir_dentry = dget_parent(lower_new_dentry);
 630        target_inode = new_dentry->d_inode;
 631        trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
 632        /* source should not be ancestor of target */
 633        if (trap == lower_old_dentry) {
 634                rc = -EINVAL;
 635                goto out_lock;
 636        }
 637        /* target should not be ancestor of source */
 638        if (trap == lower_new_dentry) {
 639                rc = -ENOTEMPTY;
 640                goto out_lock;
 641        }
 642        rc = vfs_rename(lower_old_dir_dentry->d_inode, lower_old_dentry,
 643                        lower_new_dir_dentry->d_inode, lower_new_dentry,
 644                        NULL, 0);
 645        if (rc)
 646                goto out_lock;
 647        if (target_inode)
 648                fsstack_copy_attr_all(target_inode,
 649                                      ecryptfs_inode_to_lower(target_inode));
 650        fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode);
 651        if (new_dir != old_dir)
 652                fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
 653out_lock:
 654        unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
 655        dput(lower_new_dir_dentry);
 656        dput(lower_old_dir_dentry);
 657        dput(lower_new_dentry);
 658        dput(lower_old_dentry);
 659        return rc;
 660}
 661
 662static char *ecryptfs_readlink_lower(struct dentry *dentry, size_t *bufsiz)
 663{
 664        struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
 665        char *lower_buf;
 666        char *buf;
 667        mm_segment_t old_fs;
 668        int rc;
 669
 670        lower_buf = kmalloc(PATH_MAX, GFP_KERNEL);
 671        if (!lower_buf)
 672                return ERR_PTR(-ENOMEM);
 673        old_fs = get_fs();
 674        set_fs(get_ds());
 675        rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
 676                                                   (char __user *)lower_buf,
 677                                                   PATH_MAX);
 678        set_fs(old_fs);
 679        if (rc < 0)
 680                goto out;
 681        rc = ecryptfs_decode_and_decrypt_filename(&buf, bufsiz, dentry->d_sb,
 682                                                  lower_buf, rc);
 683out:
 684        kfree(lower_buf);
 685        return rc ? ERR_PTR(rc) : buf;
 686}
 687
 688static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
 689{
 690        size_t len;
 691        char *buf = ecryptfs_readlink_lower(dentry, &len);
 692        if (IS_ERR(buf))
 693                goto out;
 694        fsstack_copy_attr_atime(dentry->d_inode,
 695                                ecryptfs_dentry_to_lower(dentry)->d_inode);
 696        buf[len] = '\0';
 697out:
 698        nd_set_link(nd, buf);
 699        return NULL;
 700}
 701
 702/**
 703 * upper_size_to_lower_size
 704 * @crypt_stat: Crypt_stat associated with file
 705 * @upper_size: Size of the upper file
 706 *
 707 * Calculate the required size of the lower file based on the
 708 * specified size of the upper file. This calculation is based on the
 709 * number of headers in the underlying file and the extent size.
 710 *
 711 * Returns Calculated size of the lower file.
 712 */
 713static loff_t
 714upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat,
 715                         loff_t upper_size)
 716{
 717        loff_t lower_size;
 718
 719        lower_size = ecryptfs_lower_header_size(crypt_stat);
 720        if (upper_size != 0) {
 721                loff_t num_extents;
 722
 723                num_extents = upper_size >> crypt_stat->extent_shift;
 724                if (upper_size & ~crypt_stat->extent_mask)
 725                        num_extents++;
 726                lower_size += (num_extents * crypt_stat->extent_size);
 727        }
 728        return lower_size;
 729}
 730
 731/**
 732 * truncate_upper
 733 * @dentry: The ecryptfs layer dentry
 734 * @ia: Address of the ecryptfs inode's attributes
 735 * @lower_ia: Address of the lower inode's attributes
 736 *
 737 * Function to handle truncations modifying the size of the file. Note
 738 * that the file sizes are interpolated. When expanding, we are simply
 739 * writing strings of 0's out. When truncating, we truncate the upper
 740 * inode and update the lower_ia according to the page index
 741 * interpolations. If ATTR_SIZE is set in lower_ia->ia_valid upon return,
 742 * the caller must use lower_ia in a call to notify_change() to perform
 743 * the truncation of the lower inode.
 744 *
 745 * Returns zero on success; non-zero otherwise
 746 */
 747static int truncate_upper(struct dentry *dentry, struct iattr *ia,
 748                          struct iattr *lower_ia)
 749{
 750        int rc = 0;
 751        struct inode *inode = dentry->d_inode;
 752        struct ecryptfs_crypt_stat *crypt_stat;
 753        loff_t i_size = i_size_read(inode);
 754        loff_t lower_size_before_truncate;
 755        loff_t lower_size_after_truncate;
 756
 757        if (unlikely((ia->ia_size == i_size))) {
 758                lower_ia->ia_valid &= ~ATTR_SIZE;
 759                return 0;
 760        }
 761        rc = ecryptfs_get_lower_file(dentry, inode);
 762        if (rc)
 763                return rc;
 764        crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
 765        /* Switch on growing or shrinking file */
 766        if (ia->ia_size > i_size) {
 767                char zero[] = { 0x00 };
 768
 769                lower_ia->ia_valid &= ~ATTR_SIZE;
 770                /* Write a single 0 at the last position of the file;
 771                 * this triggers code that will fill in 0's throughout
 772                 * the intermediate portion of the previous end of the
 773                 * file and the new and of the file */
 774                rc = ecryptfs_write(inode, zero,
 775                                    (ia->ia_size - 1), 1);
 776        } else { /* ia->ia_size < i_size_read(inode) */
 777                /* We're chopping off all the pages down to the page
 778                 * in which ia->ia_size is located. Fill in the end of
 779                 * that page from (ia->ia_size & ~PAGE_CACHE_MASK) to
 780                 * PAGE_CACHE_SIZE with zeros. */
 781                size_t num_zeros = (PAGE_CACHE_SIZE
 782                                    - (ia->ia_size & ~PAGE_CACHE_MASK));
 783
 784                if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
 785                        truncate_setsize(inode, ia->ia_size);
 786                        lower_ia->ia_size = ia->ia_size;
 787                        lower_ia->ia_valid |= ATTR_SIZE;
 788                        goto out;
 789                }
 790                if (num_zeros) {
 791                        char *zeros_virt;
 792
 793                        zeros_virt = kzalloc(num_zeros, GFP_KERNEL);
 794                        if (!zeros_virt) {
 795                                rc = -ENOMEM;
 796                                goto out;
 797                        }
 798                        rc = ecryptfs_write(inode, zeros_virt,
 799                                            ia->ia_size, num_zeros);
 800                        kfree(zeros_virt);
 801                        if (rc) {
 802                                printk(KERN_ERR "Error attempting to zero out "
 803                                       "the remainder of the end page on "
 804                                       "reducing truncate; rc = [%d]\n", rc);
 805                                goto out;
 806                        }
 807                }
 808                truncate_setsize(inode, ia->ia_size);
 809                rc = ecryptfs_write_inode_size_to_metadata(inode);
 810                if (rc) {
 811                        printk(KERN_ERR "Problem with "
 812                               "ecryptfs_write_inode_size_to_metadata; "
 813                               "rc = [%d]\n", rc);
 814                        goto out;
 815                }
 816                /* We are reducing the size of the ecryptfs file, and need to
 817                 * know if we need to reduce the size of the lower file. */
 818                lower_size_before_truncate =
 819                    upper_size_to_lower_size(crypt_stat, i_size);
 820                lower_size_after_truncate =
 821                    upper_size_to_lower_size(crypt_stat, ia->ia_size);
 822                if (lower_size_after_truncate < lower_size_before_truncate) {
 823                        lower_ia->ia_size = lower_size_after_truncate;
 824                        lower_ia->ia_valid |= ATTR_SIZE;
 825                } else
 826                        lower_ia->ia_valid &= ~ATTR_SIZE;
 827        }
 828out:
 829        ecryptfs_put_lower_file(inode);
 830        return rc;
 831}
 832
 833static int ecryptfs_inode_newsize_ok(struct inode *inode, loff_t offset)
 834{
 835        struct ecryptfs_crypt_stat *crypt_stat;
 836        loff_t lower_oldsize, lower_newsize;
 837
 838        crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
 839        lower_oldsize = upper_size_to_lower_size(crypt_stat,
 840                                                 i_size_read(inode));
 841        lower_newsize = upper_size_to_lower_size(crypt_stat, offset);
 842        if (lower_newsize > lower_oldsize) {
 843                /*
 844                 * The eCryptfs inode and the new *lower* size are mixed here
 845                 * because we may not have the lower i_mutex held and/or it may
 846                 * not be appropriate to call inode_newsize_ok() with inodes
 847                 * from other filesystems.
 848                 */
 849                return inode_newsize_ok(inode, lower_newsize);
 850        }
 851
 852        return 0;
 853}
 854
 855/**
 856 * ecryptfs_truncate
 857 * @dentry: The ecryptfs layer dentry
 858 * @new_length: The length to expand the file to
 859 *
 860 * Simple function that handles the truncation of an eCryptfs inode and
 861 * its corresponding lower inode.
 862 *
 863 * Returns zero on success; non-zero otherwise
 864 */
 865int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
 866{
 867        struct iattr ia = { .ia_valid = ATTR_SIZE, .ia_size = new_length };
 868        struct iattr lower_ia = { .ia_valid = 0 };
 869        int rc;
 870
 871        rc = ecryptfs_inode_newsize_ok(dentry->d_inode, new_length);
 872        if (rc)
 873                return rc;
 874
 875        rc = truncate_upper(dentry, &ia, &lower_ia);
 876        if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
 877                struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
 878
 879                mutex_lock(&lower_dentry->d_inode->i_mutex);
 880                rc = notify_change(lower_dentry, &lower_ia, NULL);
 881                mutex_unlock(&lower_dentry->d_inode->i_mutex);
 882        }
 883        return rc;
 884}
 885
 886static int
 887ecryptfs_permission(struct inode *inode, int mask)
 888{
 889        return inode_permission(ecryptfs_inode_to_lower(inode), mask);
 890}
 891
 892/**
 893 * ecryptfs_setattr
 894 * @dentry: dentry handle to the inode to modify
 895 * @ia: Structure with flags of what to change and values
 896 *
 897 * Updates the metadata of an inode. If the update is to the size
 898 * i.e. truncation, then ecryptfs_truncate will handle the size modification
 899 * of both the ecryptfs inode and the lower inode.
 900 *
 901 * All other metadata changes will be passed right to the lower filesystem,
 902 * and we will just update our inode to look like the lower.
 903 */
 904static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
 905{
 906        int rc = 0;
 907        struct dentry *lower_dentry;
 908        struct iattr lower_ia;
 909        struct inode *inode;
 910        struct inode *lower_inode;
 911        struct ecryptfs_crypt_stat *crypt_stat;
 912
 913        crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
 914        if (!(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED))
 915                ecryptfs_init_crypt_stat(crypt_stat);
 916        inode = dentry->d_inode;
 917        lower_inode = ecryptfs_inode_to_lower(inode);
 918        lower_dentry = ecryptfs_dentry_to_lower(dentry);
 919        mutex_lock(&crypt_stat->cs_mutex);
 920        if (S_ISDIR(dentry->d_inode->i_mode))
 921                crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
 922        else if (S_ISREG(dentry->d_inode->i_mode)
 923                 && (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)
 924                     || !(crypt_stat->flags & ECRYPTFS_KEY_VALID))) {
 925                struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
 926
 927                mount_crypt_stat = &ecryptfs_superblock_to_private(
 928                        dentry->d_sb)->mount_crypt_stat;
 929                rc = ecryptfs_get_lower_file(dentry, inode);
 930                if (rc) {
 931                        mutex_unlock(&crypt_stat->cs_mutex);
 932                        goto out;
 933                }
 934                rc = ecryptfs_read_metadata(dentry);
 935                ecryptfs_put_lower_file(inode);
 936                if (rc) {
 937                        if (!(mount_crypt_stat->flags
 938                              & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
 939                                rc = -EIO;
 940                                printk(KERN_WARNING "Either the lower file "
 941                                       "is not in a valid eCryptfs format, "
 942                                       "or the key could not be retrieved. "
 943                                       "Plaintext passthrough mode is not "
 944                                       "enabled; returning -EIO\n");
 945                                mutex_unlock(&crypt_stat->cs_mutex);
 946                                goto out;
 947                        }
 948                        rc = 0;
 949                        crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
 950                                               | ECRYPTFS_ENCRYPTED);
 951                }
 952        }
 953        mutex_unlock(&crypt_stat->cs_mutex);
 954
 955        rc = inode_change_ok(inode, ia);
 956        if (rc)
 957                goto out;
 958        if (ia->ia_valid & ATTR_SIZE) {
 959                rc = ecryptfs_inode_newsize_ok(inode, ia->ia_size);
 960                if (rc)
 961                        goto out;
 962        }
 963
 964        memcpy(&lower_ia, ia, sizeof(lower_ia));
 965        if (ia->ia_valid & ATTR_FILE)
 966                lower_ia.ia_file = ecryptfs_file_to_lower(ia->ia_file);
 967        if (ia->ia_valid & ATTR_SIZE) {
 968                rc = truncate_upper(dentry, ia, &lower_ia);
 969                if (rc < 0)
 970                        goto out;
 971        }
 972
 973        /*
 974         * mode change is for clearing setuid/setgid bits. Allow lower fs
 975         * to interpret this in its own way.
 976         */
 977        if (lower_ia.ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
 978                lower_ia.ia_valid &= ~ATTR_MODE;
 979
 980        mutex_lock(&lower_dentry->d_inode->i_mutex);
 981        rc = notify_change(lower_dentry, &lower_ia, NULL);
 982        mutex_unlock(&lower_dentry->d_inode->i_mutex);
 983out:
 984        fsstack_copy_attr_all(inode, lower_inode);
 985        return rc;
 986}
 987
 988static int ecryptfs_getattr_link(struct vfsmount *mnt, struct dentry *dentry,
 989                                 struct kstat *stat)
 990{
 991        struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
 992        int rc = 0;
 993
 994        mount_crypt_stat = &ecryptfs_superblock_to_private(
 995                                                dentry->d_sb)->mount_crypt_stat;
 996        generic_fillattr(dentry->d_inode, stat);
 997        if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
 998                char *target;
 999                size_t targetsiz;
1000
1001                target = ecryptfs_readlink_lower(dentry, &targetsiz);
1002                if (!IS_ERR(target)) {
1003                        kfree(target);
1004                        stat->size = targetsiz;
1005                } else {
1006                        rc = PTR_ERR(target);
1007                }
1008        }
1009        return rc;
1010}
1011
1012static int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
1013                            struct kstat *stat)
1014{
1015        struct kstat lower_stat;
1016        int rc;
1017
1018        rc = vfs_getattr(ecryptfs_dentry_to_lower_path(dentry), &lower_stat);
1019        if (!rc) {
1020                fsstack_copy_attr_all(dentry->d_inode,
1021                                      ecryptfs_inode_to_lower(dentry->d_inode));
1022                generic_fillattr(dentry->d_inode, stat);
1023                stat->blocks = lower_stat.blocks;
1024        }
1025        return rc;
1026}
1027
1028int
1029ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
1030                  size_t size, int flags)
1031{
1032        int rc = 0;
1033        struct dentry *lower_dentry;
1034
1035        lower_dentry = ecryptfs_dentry_to_lower(dentry);
1036        if (!lower_dentry->d_inode->i_op->setxattr) {
1037                rc = -EOPNOTSUPP;
1038                goto out;
1039        }
1040
1041        rc = vfs_setxattr(lower_dentry, name, value, size, flags);
1042        if (!rc)
1043                fsstack_copy_attr_all(dentry->d_inode, lower_dentry->d_inode);
1044out:
1045        return rc;
1046}
1047
1048ssize_t
1049ecryptfs_getxattr_lower(struct dentry *lower_dentry, const char *name,
1050                        void *value, size_t size)
1051{
1052        int rc = 0;
1053
1054        if (!lower_dentry->d_inode->i_op->getxattr) {
1055                rc = -EOPNOTSUPP;
1056                goto out;
1057        }
1058        mutex_lock(&lower_dentry->d_inode->i_mutex);
1059        rc = lower_dentry->d_inode->i_op->getxattr(lower_dentry, name, value,
1060                                                   size);
1061        mutex_unlock(&lower_dentry->d_inode->i_mutex);
1062out:
1063        return rc;
1064}
1065
1066static ssize_t
1067ecryptfs_getxattr(struct dentry *dentry, const char *name, void *value,
1068                  size_t size)
1069{
1070        return ecryptfs_getxattr_lower(ecryptfs_dentry_to_lower(dentry), name,
1071                                       value, size);
1072}
1073
1074static ssize_t
1075ecryptfs_listxattr(struct dentry *dentry, char *list, size_t size)
1076{
1077        int rc = 0;
1078        struct dentry *lower_dentry;
1079
1080        lower_dentry = ecryptfs_dentry_to_lower(dentry);
1081        if (!lower_dentry->d_inode->i_op->listxattr) {
1082                rc = -EOPNOTSUPP;
1083                goto out;
1084        }
1085        mutex_lock(&lower_dentry->d_inode->i_mutex);
1086        rc = lower_dentry->d_inode->i_op->listxattr(lower_dentry, list, size);
1087        mutex_unlock(&lower_dentry->d_inode->i_mutex);
1088out:
1089        return rc;
1090}
1091
1092static int ecryptfs_removexattr(struct dentry *dentry, const char *name)
1093{
1094        int rc = 0;
1095        struct dentry *lower_dentry;
1096
1097        lower_dentry = ecryptfs_dentry_to_lower(dentry);
1098        if (!lower_dentry->d_inode->i_op->removexattr) {
1099                rc = -EOPNOTSUPP;
1100                goto out;
1101        }
1102        mutex_lock(&lower_dentry->d_inode->i_mutex);
1103        rc = lower_dentry->d_inode->i_op->removexattr(lower_dentry, name);
1104        mutex_unlock(&lower_dentry->d_inode->i_mutex);
1105out:
1106        return rc;
1107}
1108
1109const struct inode_operations ecryptfs_symlink_iops = {
1110        .readlink = generic_readlink,
1111        .follow_link = ecryptfs_follow_link,
1112        .put_link = kfree_put_link,
1113        .permission = ecryptfs_permission,
1114        .setattr = ecryptfs_setattr,
1115        .getattr = ecryptfs_getattr_link,
1116        .setxattr = ecryptfs_setxattr,
1117        .getxattr = ecryptfs_getxattr,
1118        .listxattr = ecryptfs_listxattr,
1119        .removexattr = ecryptfs_removexattr
1120};
1121
1122const struct inode_operations ecryptfs_dir_iops = {
1123        .create = ecryptfs_create,
1124        .lookup = ecryptfs_lookup,
1125        .link = ecryptfs_link,
1126        .unlink = ecryptfs_unlink,
1127        .symlink = ecryptfs_symlink,
1128        .mkdir = ecryptfs_mkdir,
1129        .rmdir = ecryptfs_rmdir,
1130        .mknod = ecryptfs_mknod,
1131        .rename = ecryptfs_rename,
1132        .permission = ecryptfs_permission,
1133        .setattr = ecryptfs_setattr,
1134        .setxattr = ecryptfs_setxattr,
1135        .getxattr = ecryptfs_getxattr,
1136        .listxattr = ecryptfs_listxattr,
1137        .removexattr = ecryptfs_removexattr
1138};
1139
1140const struct inode_operations ecryptfs_main_iops = {
1141        .permission = ecryptfs_permission,
1142        .setattr = ecryptfs_setattr,
1143        .getattr = ecryptfs_getattr,
1144        .setxattr = ecryptfs_setxattr,
1145        .getxattr = ecryptfs_getxattr,
1146        .listxattr = ecryptfs_listxattr,
1147        .removexattr = ecryptfs_removexattr
1148};
1149