Eric Lee / linux-smarc-t335x-v3.2

Download as
Browse Code ยป

Commit 764355487ea220fdc2faf128d577d7f679b91f97

Authored by John Johansen
Committed by Tyler Hicks
1 parent 99b373ff2d
Exists in master and in 4 other branches v3.2_AM335xPSP_04.06.00.11, v3.2_NEWT335xPSP_04.06.00.11, v3.2_SBC_SMARTMEN, v3.2_SMARCT335xPSP_04.06.00.11

Ecryptfs: Add mount option to check uid of device being mounted = expect uid 

Close a TOCTOU race for mounts done via ecryptfs-mount-private.  The mount
source (device) can be raced when the ownership test is done in userspace.
Provide Ecryptfs a means to force the uid check at mount time.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Cc: <stable@kernel.org>
Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>

Showing 1 changed file with 21 additions and 2 deletions Inline Diff

1 /** 1 /**
2 * eCryptfs: Linux filesystem encryption layer 2 * eCryptfs: Linux filesystem encryption layer
3 * 3 *
4 * Copyright (C) 1997-2003 Erez Zadok 4 * Copyright (C) 1997-2003 Erez Zadok
5 * Copyright (C) 2001-2003 Stony Brook University 5 * Copyright (C) 2001-2003 Stony Brook University
6 * Copyright (C) 2004-2007 International Business Machines Corp. 6 * Copyright (C) 2004-2007 International Business Machines Corp.
7 * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com> 7 * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>
8 * Michael C. Thompson <mcthomps@us.ibm.com> 8 * Michael C. Thompson <mcthomps@us.ibm.com>
9 * Tyler Hicks <tyhicks@ou.edu> 9 * Tyler Hicks <tyhicks@ou.edu>
10 * 10 *
11 * This program is free software; you can redistribute it and/or 11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License as 12 * modify it under the terms of the GNU General Public License as
13 * published by the Free Software Foundation; either version 2 of the 13 * published by the Free Software Foundation; either version 2 of the
14 * License, or (at your option) any later version. 14 * License, or (at your option) any later version.
15 * 15 *
16 * This program is distributed in the hope that it will be useful, but 16 * This program is distributed in the hope that it will be useful, but
17 * WITHOUT ANY WARRANTY; without even the implied warranty of 17 * WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
19 * General Public License for more details. 19 * General Public License for more details.
20 * 20 *
21 * You should have received a copy of the GNU General Public License 21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software 22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
24 * 02111-1307, USA. 24 * 02111-1307, USA.
25 */ 25 */
26 26
27 #include <linux/dcache.h> 27 #include <linux/dcache.h>
28 #include <linux/file.h> 28 #include <linux/file.h>
29 #include <linux/module.h> 29 #include <linux/module.h>
30 #include <linux/namei.h> 30 #include <linux/namei.h>
31 #include <linux/skbuff.h> 31 #include <linux/skbuff.h>
32 #include <linux/crypto.h> 32 #include <linux/crypto.h>
33 #include <linux/mount.h> 33 #include <linux/mount.h>
34 #include <linux/pagemap.h> 34 #include <linux/pagemap.h>
35 #include <linux/key.h> 35 #include <linux/key.h>
36 #include <linux/parser.h> 36 #include <linux/parser.h>
37 #include <linux/fs_stack.h> 37 #include <linux/fs_stack.h>
38 #include <linux/slab.h> 38 #include <linux/slab.h>
39 #include <linux/magic.h> 39 #include <linux/magic.h>
40 #include "ecryptfs_kernel.h" 40 #include "ecryptfs_kernel.h"
41 41
42 /** 42 /**
43 * Module parameter that defines the ecryptfs_verbosity level. 43 * Module parameter that defines the ecryptfs_verbosity level.
44 */ 44 */
45 int ecryptfs_verbosity = 0; 45 int ecryptfs_verbosity = 0;
46 46
47 module_param(ecryptfs_verbosity, int, 0); 47 module_param(ecryptfs_verbosity, int, 0);
48 MODULE_PARM_DESC(ecryptfs_verbosity, 48 MODULE_PARM_DESC(ecryptfs_verbosity,
49 "Initial verbosity level (0 or 1; defaults to " 49 "Initial verbosity level (0 or 1; defaults to "
50 "0, which is Quiet)"); 50 "0, which is Quiet)");
51 51
52 /** 52 /**
53 * Module parameter that defines the number of message buffer elements 53 * Module parameter that defines the number of message buffer elements
54 */ 54 */
55 unsigned int ecryptfs_message_buf_len = ECRYPTFS_DEFAULT_MSG_CTX_ELEMS; 55 unsigned int ecryptfs_message_buf_len = ECRYPTFS_DEFAULT_MSG_CTX_ELEMS;
56 56
57 module_param(ecryptfs_message_buf_len, uint, 0); 57 module_param(ecryptfs_message_buf_len, uint, 0);
58 MODULE_PARM_DESC(ecryptfs_message_buf_len, 58 MODULE_PARM_DESC(ecryptfs_message_buf_len,
59 "Number of message buffer elements"); 59 "Number of message buffer elements");
60 60
61 /** 61 /**
62 * Module parameter that defines the maximum guaranteed amount of time to wait 62 * Module parameter that defines the maximum guaranteed amount of time to wait
63 * for a response from ecryptfsd. The actual sleep time will be, more than 63 * for a response from ecryptfsd. The actual sleep time will be, more than
64 * likely, a small amount greater than this specified value, but only less if 64 * likely, a small amount greater than this specified value, but only less if
65 * the message successfully arrives. 65 * the message successfully arrives.
66 */ 66 */
67 signed long ecryptfs_message_wait_timeout = ECRYPTFS_MAX_MSG_CTX_TTL / HZ; 67 signed long ecryptfs_message_wait_timeout = ECRYPTFS_MAX_MSG_CTX_TTL / HZ;
68 68
69 module_param(ecryptfs_message_wait_timeout, long, 0); 69 module_param(ecryptfs_message_wait_timeout, long, 0);
70 MODULE_PARM_DESC(ecryptfs_message_wait_timeout, 70 MODULE_PARM_DESC(ecryptfs_message_wait_timeout,
71 "Maximum number of seconds that an operation will " 71 "Maximum number of seconds that an operation will "
72 "sleep while waiting for a message response from " 72 "sleep while waiting for a message response from "
73 "userspace"); 73 "userspace");
74 74
75 /** 75 /**
76 * Module parameter that is an estimate of the maximum number of users 76 * Module parameter that is an estimate of the maximum number of users
77 * that will be concurrently using eCryptfs. Set this to the right 77 * that will be concurrently using eCryptfs. Set this to the right
78 * value to balance performance and memory use. 78 * value to balance performance and memory use.
79 */ 79 */
80 unsigned int ecryptfs_number_of_users = ECRYPTFS_DEFAULT_NUM_USERS; 80 unsigned int ecryptfs_number_of_users = ECRYPTFS_DEFAULT_NUM_USERS;
81 81
82 module_param(ecryptfs_number_of_users, uint, 0); 82 module_param(ecryptfs_number_of_users, uint, 0);
83 MODULE_PARM_DESC(ecryptfs_number_of_users, "An estimate of the number of " 83 MODULE_PARM_DESC(ecryptfs_number_of_users, "An estimate of the number of "
84 "concurrent users of eCryptfs"); 84 "concurrent users of eCryptfs");
85 85
86 void __ecryptfs_printk(const char *fmt, ...) 86 void __ecryptfs_printk(const char *fmt, ...)
87 { 87 {
88 va_list args; 88 va_list args;
89 va_start(args, fmt); 89 va_start(args, fmt);
90 if (fmt[1] == '7') { /* KERN_DEBUG */ 90 if (fmt[1] == '7') { /* KERN_DEBUG */
91 if (ecryptfs_verbosity >= 1) 91 if (ecryptfs_verbosity >= 1)
92 vprintk(fmt, args); 92 vprintk(fmt, args);
93 } else 93 } else
94 vprintk(fmt, args); 94 vprintk(fmt, args);
95 va_end(args); 95 va_end(args);
96 } 96 }
97 97
98 /** 98 /**
99 * ecryptfs_init_lower_file 99 * ecryptfs_init_lower_file
100 * @ecryptfs_dentry: Fully initialized eCryptfs dentry object, with 100 * @ecryptfs_dentry: Fully initialized eCryptfs dentry object, with
101 * the lower dentry and the lower mount set 101 * the lower dentry and the lower mount set
102 * 102 *
103 * eCryptfs only ever keeps a single open file for every lower 103 * eCryptfs only ever keeps a single open file for every lower
104 * inode. All I/O operations to the lower inode occur through that 104 * inode. All I/O operations to the lower inode occur through that
105 * file. When the first eCryptfs dentry that interposes with the first 105 * file. When the first eCryptfs dentry that interposes with the first
106 * lower dentry for that inode is created, this function creates the 106 * lower dentry for that inode is created, this function creates the
107 * lower file struct and associates it with the eCryptfs 107 * lower file struct and associates it with the eCryptfs
108 * inode. When all eCryptfs files associated with the inode are released, the 108 * inode. When all eCryptfs files associated with the inode are released, the
109 * file is closed. 109 * file is closed.
110 * 110 *
111 * The lower file will be opened with read/write permissions, if 111 * The lower file will be opened with read/write permissions, if
112 * possible. Otherwise, it is opened read-only. 112 * possible. Otherwise, it is opened read-only.
113 * 113 *
114 * This function does nothing if a lower file is already 114 * This function does nothing if a lower file is already
115 * associated with the eCryptfs inode. 115 * associated with the eCryptfs inode.
116 * 116 *
117 * Returns zero on success; non-zero otherwise 117 * Returns zero on success; non-zero otherwise
118 */ 118 */
119 static int ecryptfs_init_lower_file(struct dentry *dentry, 119 static int ecryptfs_init_lower_file(struct dentry *dentry,
120 struct file **lower_file) 120 struct file **lower_file)
121 { 121 {
122 const struct cred *cred = current_cred(); 122 const struct cred *cred = current_cred();
123 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry); 123 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
124 struct vfsmount *lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry); 124 struct vfsmount *lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry);
125 int rc; 125 int rc;
126 126
127 rc = ecryptfs_privileged_open(lower_file, lower_dentry, lower_mnt, 127 rc = ecryptfs_privileged_open(lower_file, lower_dentry, lower_mnt,
128 cred); 128 cred);
129 if (rc) { 129 if (rc) {
130 printk(KERN_ERR "Error opening lower file " 130 printk(KERN_ERR "Error opening lower file "
131 "for lower_dentry [0x%p] and lower_mnt [0x%p]; " 131 "for lower_dentry [0x%p] and lower_mnt [0x%p]; "
132 "rc = [%d]\n", lower_dentry, lower_mnt, rc); 132 "rc = [%d]\n", lower_dentry, lower_mnt, rc);
133 (*lower_file) = NULL; 133 (*lower_file) = NULL;
134 } 134 }
135 return rc; 135 return rc;
136 } 136 }
137 137
138 int ecryptfs_get_lower_file(struct dentry *dentry, struct inode *inode) 138 int ecryptfs_get_lower_file(struct dentry *dentry, struct inode *inode)
139 { 139 {
140 struct ecryptfs_inode_info *inode_info; 140 struct ecryptfs_inode_info *inode_info;
141 int count, rc = 0; 141 int count, rc = 0;
142 142
143 inode_info = ecryptfs_inode_to_private(inode); 143 inode_info = ecryptfs_inode_to_private(inode);
144 mutex_lock(&inode_info->lower_file_mutex); 144 mutex_lock(&inode_info->lower_file_mutex);
145 count = atomic_inc_return(&inode_info->lower_file_count); 145 count = atomic_inc_return(&inode_info->lower_file_count);
146 if (WARN_ON_ONCE(count < 1)) 146 if (WARN_ON_ONCE(count < 1))
147 rc = -EINVAL; 147 rc = -EINVAL;
148 else if (count == 1) { 148 else if (count == 1) {
149 rc = ecryptfs_init_lower_file(dentry, 149 rc = ecryptfs_init_lower_file(dentry,
150 &inode_info->lower_file); 150 &inode_info->lower_file);
151 if (rc) 151 if (rc)
152 atomic_set(&inode_info->lower_file_count, 0); 152 atomic_set(&inode_info->lower_file_count, 0);
153 } 153 }
154 mutex_unlock(&inode_info->lower_file_mutex); 154 mutex_unlock(&inode_info->lower_file_mutex);
155 return rc; 155 return rc;
156 } 156 }
157 157
158 void ecryptfs_put_lower_file(struct inode *inode) 158 void ecryptfs_put_lower_file(struct inode *inode)
159 { 159 {
160 struct ecryptfs_inode_info *inode_info; 160 struct ecryptfs_inode_info *inode_info;
161 161
162 inode_info = ecryptfs_inode_to_private(inode); 162 inode_info = ecryptfs_inode_to_private(inode);
163 if (atomic_dec_and_mutex_lock(&inode_info->lower_file_count, 163 if (atomic_dec_and_mutex_lock(&inode_info->lower_file_count,
164 &inode_info->lower_file_mutex)) { 164 &inode_info->lower_file_mutex)) {
165 fput(inode_info->lower_file); 165 fput(inode_info->lower_file);
166 inode_info->lower_file = NULL; 166 inode_info->lower_file = NULL;
167 mutex_unlock(&inode_info->lower_file_mutex); 167 mutex_unlock(&inode_info->lower_file_mutex);
168 } 168 }
169 } 169 }
170 170
171 enum { ecryptfs_opt_sig, ecryptfs_opt_ecryptfs_sig, 171 enum { ecryptfs_opt_sig, ecryptfs_opt_ecryptfs_sig,
172 ecryptfs_opt_cipher, ecryptfs_opt_ecryptfs_cipher, 172 ecryptfs_opt_cipher, ecryptfs_opt_ecryptfs_cipher,
173 ecryptfs_opt_ecryptfs_key_bytes, 173 ecryptfs_opt_ecryptfs_key_bytes,
174 ecryptfs_opt_passthrough, ecryptfs_opt_xattr_metadata, 174 ecryptfs_opt_passthrough, ecryptfs_opt_xattr_metadata,
175 ecryptfs_opt_encrypted_view, ecryptfs_opt_fnek_sig, 175 ecryptfs_opt_encrypted_view, ecryptfs_opt_fnek_sig,
176 ecryptfs_opt_fn_cipher, ecryptfs_opt_fn_cipher_key_bytes, 176 ecryptfs_opt_fn_cipher, ecryptfs_opt_fn_cipher_key_bytes,
177 ecryptfs_opt_unlink_sigs, ecryptfs_opt_mount_auth_tok_only, 177 ecryptfs_opt_unlink_sigs, ecryptfs_opt_mount_auth_tok_only,
178 ecryptfs_opt_check_dev_ruid,
178 ecryptfs_opt_err }; 179 ecryptfs_opt_err };
179 180
180 static const match_table_t tokens = { 181 static const match_table_t tokens = {
181 {ecryptfs_opt_sig, "sig=%s"}, 182 {ecryptfs_opt_sig, "sig=%s"},
182 {ecryptfs_opt_ecryptfs_sig, "ecryptfs_sig=%s"}, 183 {ecryptfs_opt_ecryptfs_sig, "ecryptfs_sig=%s"},
183 {ecryptfs_opt_cipher, "cipher=%s"}, 184 {ecryptfs_opt_cipher, "cipher=%s"},
184 {ecryptfs_opt_ecryptfs_cipher, "ecryptfs_cipher=%s"}, 185 {ecryptfs_opt_ecryptfs_cipher, "ecryptfs_cipher=%s"},
185 {ecryptfs_opt_ecryptfs_key_bytes, "ecryptfs_key_bytes=%u"}, 186 {ecryptfs_opt_ecryptfs_key_bytes, "ecryptfs_key_bytes=%u"},
186 {ecryptfs_opt_passthrough, "ecryptfs_passthrough"}, 187 {ecryptfs_opt_passthrough, "ecryptfs_passthrough"},
187 {ecryptfs_opt_xattr_metadata, "ecryptfs_xattr_metadata"}, 188 {ecryptfs_opt_xattr_metadata, "ecryptfs_xattr_metadata"},
188 {ecryptfs_opt_encrypted_view, "ecryptfs_encrypted_view"}, 189 {ecryptfs_opt_encrypted_view, "ecryptfs_encrypted_view"},
189 {ecryptfs_opt_fnek_sig, "ecryptfs_fnek_sig=%s"}, 190 {ecryptfs_opt_fnek_sig, "ecryptfs_fnek_sig=%s"},
190 {ecryptfs_opt_fn_cipher, "ecryptfs_fn_cipher=%s"}, 191 {ecryptfs_opt_fn_cipher, "ecryptfs_fn_cipher=%s"},
191 {ecryptfs_opt_fn_cipher_key_bytes, "ecryptfs_fn_key_bytes=%u"}, 192 {ecryptfs_opt_fn_cipher_key_bytes, "ecryptfs_fn_key_bytes=%u"},
192 {ecryptfs_opt_unlink_sigs, "ecryptfs_unlink_sigs"}, 193 {ecryptfs_opt_unlink_sigs, "ecryptfs_unlink_sigs"},
193 {ecryptfs_opt_mount_auth_tok_only, "ecryptfs_mount_auth_tok_only"}, 194 {ecryptfs_opt_mount_auth_tok_only, "ecryptfs_mount_auth_tok_only"},
195 {ecryptfs_opt_check_dev_ruid, "ecryptfs_check_dev_ruid"},
194 {ecryptfs_opt_err, NULL} 196 {ecryptfs_opt_err, NULL}
195 }; 197 };
196 198
197 static int ecryptfs_init_global_auth_toks( 199 static int ecryptfs_init_global_auth_toks(
198 struct ecryptfs_mount_crypt_stat *mount_crypt_stat) 200 struct ecryptfs_mount_crypt_stat *mount_crypt_stat)
199 { 201 {
200 struct ecryptfs_global_auth_tok *global_auth_tok; 202 struct ecryptfs_global_auth_tok *global_auth_tok;
201 struct ecryptfs_auth_tok *auth_tok; 203 struct ecryptfs_auth_tok *auth_tok;
202 int rc = 0; 204 int rc = 0;
203 205
204 list_for_each_entry(global_auth_tok, 206 list_for_each_entry(global_auth_tok,
205 &mount_crypt_stat->global_auth_tok_list, 207 &mount_crypt_stat->global_auth_tok_list,
206 mount_crypt_stat_list) { 208 mount_crypt_stat_list) {
207 rc = ecryptfs_keyring_auth_tok_for_sig( 209 rc = ecryptfs_keyring_auth_tok_for_sig(
208 &global_auth_tok->global_auth_tok_key, &auth_tok, 210 &global_auth_tok->global_auth_tok_key, &auth_tok,
209 global_auth_tok->sig); 211 global_auth_tok->sig);
210 if (rc) { 212 if (rc) {
211 printk(KERN_ERR "Could not find valid key in user " 213 printk(KERN_ERR "Could not find valid key in user "
212 "session keyring for sig specified in mount " 214 "session keyring for sig specified in mount "
213 "option: [%s]\n", global_auth_tok->sig); 215 "option: [%s]\n", global_auth_tok->sig);
214 global_auth_tok->flags |= ECRYPTFS_AUTH_TOK_INVALID; 216 global_auth_tok->flags |= ECRYPTFS_AUTH_TOK_INVALID;
215 goto out; 217 goto out;
216 } else { 218 } else {
217 global_auth_tok->flags &= ~ECRYPTFS_AUTH_TOK_INVALID; 219 global_auth_tok->flags &= ~ECRYPTFS_AUTH_TOK_INVALID;
218 up_write(&(global_auth_tok->global_auth_tok_key)->sem); 220 up_write(&(global_auth_tok->global_auth_tok_key)->sem);
219 } 221 }
220 } 222 }
221 out: 223 out:
222 return rc; 224 return rc;
223 } 225 }
224 226
225 static void ecryptfs_init_mount_crypt_stat( 227 static void ecryptfs_init_mount_crypt_stat(
226 struct ecryptfs_mount_crypt_stat *mount_crypt_stat) 228 struct ecryptfs_mount_crypt_stat *mount_crypt_stat)
227 { 229 {
228 memset((void *)mount_crypt_stat, 0, 230 memset((void *)mount_crypt_stat, 0,
229 sizeof(struct ecryptfs_mount_crypt_stat)); 231 sizeof(struct ecryptfs_mount_crypt_stat));
230 INIT_LIST_HEAD(&mount_crypt_stat->global_auth_tok_list); 232 INIT_LIST_HEAD(&mount_crypt_stat->global_auth_tok_list);
231 mutex_init(&mount_crypt_stat->global_auth_tok_list_mutex); 233 mutex_init(&mount_crypt_stat->global_auth_tok_list_mutex);
232 mount_crypt_stat->flags |= ECRYPTFS_MOUNT_CRYPT_STAT_INITIALIZED; 234 mount_crypt_stat->flags |= ECRYPTFS_MOUNT_CRYPT_STAT_INITIALIZED;
233 } 235 }
234 236
235 /** 237 /**
236 * ecryptfs_parse_options 238 * ecryptfs_parse_options
237 * @sb: The ecryptfs super block 239 * @sb: The ecryptfs super block
238 * @options: The options passed to the kernel 240 * @options: The options passed to the kernel
241 * @check_ruid: set to 1 if device uid should be checked against the ruid
239 * 242 *
240 * Parse mount options: 243 * Parse mount options:
241 * debug=N - ecryptfs_verbosity level for debug output 244 * debug=N - ecryptfs_verbosity level for debug output
242 * sig=XXX - description(signature) of the key to use 245 * sig=XXX - description(signature) of the key to use
243 * 246 *
244 * Returns the dentry object of the lower-level (lower/interposed) 247 * Returns the dentry object of the lower-level (lower/interposed)
245 * directory; We want to mount our stackable file system on top of 248 * directory; We want to mount our stackable file system on top of
246 * that lower directory. 249 * that lower directory.
247 * 250 *
248 * The signature of the key to use must be the description of a key 251 * The signature of the key to use must be the description of a key
249 * already in the keyring. Mounting will fail if the key can not be 252 * already in the keyring. Mounting will fail if the key can not be
250 * found. 253 * found.
251 * 254 *
252 * Returns zero on success; non-zero on error 255 * Returns zero on success; non-zero on error
253 */ 256 */
254 static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options) 257 static int ecryptfs_parse_options(struct ecryptfs_sb_info *sbi, char *options,
258 uid_t *check_ruid)
255 { 259 {
256 char *p; 260 char *p;
257 int rc = 0; 261 int rc = 0;
258 int sig_set = 0; 262 int sig_set = 0;
259 int cipher_name_set = 0; 263 int cipher_name_set = 0;
260 int fn_cipher_name_set = 0; 264 int fn_cipher_name_set = 0;
261 int cipher_key_bytes; 265 int cipher_key_bytes;
262 int cipher_key_bytes_set = 0; 266 int cipher_key_bytes_set = 0;
263 int fn_cipher_key_bytes; 267 int fn_cipher_key_bytes;
264 int fn_cipher_key_bytes_set = 0; 268 int fn_cipher_key_bytes_set = 0;
265 struct ecryptfs_mount_crypt_stat *mount_crypt_stat = 269 struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
266 &sbi->mount_crypt_stat; 270 &sbi->mount_crypt_stat;
267 substring_t args[MAX_OPT_ARGS]; 271 substring_t args[MAX_OPT_ARGS];
268 int token; 272 int token;
269 char *sig_src; 273 char *sig_src;
270 char *cipher_name_dst; 274 char *cipher_name_dst;
271 char *cipher_name_src; 275 char *cipher_name_src;
272 char *fn_cipher_name_dst; 276 char *fn_cipher_name_dst;
273 char *fn_cipher_name_src; 277 char *fn_cipher_name_src;
274 char *fnek_dst; 278 char *fnek_dst;
275 char *fnek_src; 279 char *fnek_src;
276 char *cipher_key_bytes_src; 280 char *cipher_key_bytes_src;
277 char *fn_cipher_key_bytes_src; 281 char *fn_cipher_key_bytes_src;
278 282
283 *check_ruid = 0;
284
279 if (!options) { 285 if (!options) {
280 rc = -EINVAL; 286 rc = -EINVAL;
281 goto out; 287 goto out;
282 } 288 }
283 ecryptfs_init_mount_crypt_stat(mount_crypt_stat); 289 ecryptfs_init_mount_crypt_stat(mount_crypt_stat);
284 while ((p = strsep(&options, ",")) != NULL) { 290 while ((p = strsep(&options, ",")) != NULL) {
285 if (!*p) 291 if (!*p)
286 continue; 292 continue;
287 token = match_token(p, tokens, args); 293 token = match_token(p, tokens, args);
288 switch (token) { 294 switch (token) {
289 case ecryptfs_opt_sig: 295 case ecryptfs_opt_sig:
290 case ecryptfs_opt_ecryptfs_sig: 296 case ecryptfs_opt_ecryptfs_sig:
291 sig_src = args[0].from; 297 sig_src = args[0].from;
292 rc = ecryptfs_add_global_auth_tok(mount_crypt_stat, 298 rc = ecryptfs_add_global_auth_tok(mount_crypt_stat,
293 sig_src, 0); 299 sig_src, 0);
294 if (rc) { 300 if (rc) {
295 printk(KERN_ERR "Error attempting to register " 301 printk(KERN_ERR "Error attempting to register "
296 "global sig; rc = [%d]\n", rc); 302 "global sig; rc = [%d]\n", rc);
297 goto out; 303 goto out;
298 } 304 }
299 sig_set = 1; 305 sig_set = 1;
300 break; 306 break;
301 case ecryptfs_opt_cipher: 307 case ecryptfs_opt_cipher:
302 case ecryptfs_opt_ecryptfs_cipher: 308 case ecryptfs_opt_ecryptfs_cipher:
303 cipher_name_src = args[0].from; 309 cipher_name_src = args[0].from;
304 cipher_name_dst = 310 cipher_name_dst =
305 mount_crypt_stat-> 311 mount_crypt_stat->
306 global_default_cipher_name; 312 global_default_cipher_name;
307 strncpy(cipher_name_dst, cipher_name_src, 313 strncpy(cipher_name_dst, cipher_name_src,
308 ECRYPTFS_MAX_CIPHER_NAME_SIZE); 314 ECRYPTFS_MAX_CIPHER_NAME_SIZE);
309 cipher_name_dst[ECRYPTFS_MAX_CIPHER_NAME_SIZE] = '\0'; 315 cipher_name_dst[ECRYPTFS_MAX_CIPHER_NAME_SIZE] = '\0';
310 cipher_name_set = 1; 316 cipher_name_set = 1;
311 break; 317 break;
312 case ecryptfs_opt_ecryptfs_key_bytes: 318 case ecryptfs_opt_ecryptfs_key_bytes:
313 cipher_key_bytes_src = args[0].from; 319 cipher_key_bytes_src = args[0].from;
314 cipher_key_bytes = 320 cipher_key_bytes =
315 (int)simple_strtol(cipher_key_bytes_src, 321 (int)simple_strtol(cipher_key_bytes_src,
316 &cipher_key_bytes_src, 0); 322 &cipher_key_bytes_src, 0);
317 mount_crypt_stat->global_default_cipher_key_size = 323 mount_crypt_stat->global_default_cipher_key_size =
318 cipher_key_bytes; 324 cipher_key_bytes;
319 cipher_key_bytes_set = 1; 325 cipher_key_bytes_set = 1;
320 break; 326 break;
321 case ecryptfs_opt_passthrough: 327 case ecryptfs_opt_passthrough:
322 mount_crypt_stat->flags |= 328 mount_crypt_stat->flags |=
323 ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED; 329 ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED;
324 break; 330 break;
325 case ecryptfs_opt_xattr_metadata: 331 case ecryptfs_opt_xattr_metadata:
326 mount_crypt_stat->flags |= 332 mount_crypt_stat->flags |=
327 ECRYPTFS_XATTR_METADATA_ENABLED; 333 ECRYPTFS_XATTR_METADATA_ENABLED;
328 break; 334 break;
329 case ecryptfs_opt_encrypted_view: 335 case ecryptfs_opt_encrypted_view:
330 mount_crypt_stat->flags |= 336 mount_crypt_stat->flags |=
331 ECRYPTFS_XATTR_METADATA_ENABLED; 337 ECRYPTFS_XATTR_METADATA_ENABLED;
332 mount_crypt_stat->flags |= 338 mount_crypt_stat->flags |=
333 ECRYPTFS_ENCRYPTED_VIEW_ENABLED; 339 ECRYPTFS_ENCRYPTED_VIEW_ENABLED;
334 break; 340 break;
335 case ecryptfs_opt_fnek_sig: 341 case ecryptfs_opt_fnek_sig:
336 fnek_src = args[0].from; 342 fnek_src = args[0].from;
337 fnek_dst = 343 fnek_dst =
338 mount_crypt_stat->global_default_fnek_sig; 344 mount_crypt_stat->global_default_fnek_sig;
339 strncpy(fnek_dst, fnek_src, ECRYPTFS_SIG_SIZE_HEX); 345 strncpy(fnek_dst, fnek_src, ECRYPTFS_SIG_SIZE_HEX);
340 mount_crypt_stat->global_default_fnek_sig[ 346 mount_crypt_stat->global_default_fnek_sig[
341 ECRYPTFS_SIG_SIZE_HEX] = '\0'; 347 ECRYPTFS_SIG_SIZE_HEX] = '\0';
342 rc = ecryptfs_add_global_auth_tok( 348 rc = ecryptfs_add_global_auth_tok(
343 mount_crypt_stat, 349 mount_crypt_stat,
344 mount_crypt_stat->global_default_fnek_sig, 350 mount_crypt_stat->global_default_fnek_sig,
345 ECRYPTFS_AUTH_TOK_FNEK); 351 ECRYPTFS_AUTH_TOK_FNEK);
346 if (rc) { 352 if (rc) {
347 printk(KERN_ERR "Error attempting to register " 353 printk(KERN_ERR "Error attempting to register "
348 "global fnek sig [%s]; rc = [%d]\n", 354 "global fnek sig [%s]; rc = [%d]\n",
349 mount_crypt_stat->global_default_fnek_sig, 355 mount_crypt_stat->global_default_fnek_sig,
350 rc); 356 rc);
351 goto out; 357 goto out;
352 } 358 }
353 mount_crypt_stat->flags |= 359 mount_crypt_stat->flags |=
354 (ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES 360 (ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES
355 | ECRYPTFS_GLOBAL_ENCFN_USE_MOUNT_FNEK); 361 | ECRYPTFS_GLOBAL_ENCFN_USE_MOUNT_FNEK);
356 break; 362 break;
357 case ecryptfs_opt_fn_cipher: 363 case ecryptfs_opt_fn_cipher:
358 fn_cipher_name_src = args[0].from; 364 fn_cipher_name_src = args[0].from;
359 fn_cipher_name_dst = 365 fn_cipher_name_dst =
360 mount_crypt_stat->global_default_fn_cipher_name; 366 mount_crypt_stat->global_default_fn_cipher_name;
361 strncpy(fn_cipher_name_dst, fn_cipher_name_src, 367 strncpy(fn_cipher_name_dst, fn_cipher_name_src,
362 ECRYPTFS_MAX_CIPHER_NAME_SIZE); 368 ECRYPTFS_MAX_CIPHER_NAME_SIZE);
363 mount_crypt_stat->global_default_fn_cipher_name[ 369 mount_crypt_stat->global_default_fn_cipher_name[
364 ECRYPTFS_MAX_CIPHER_NAME_SIZE] = '\0'; 370 ECRYPTFS_MAX_CIPHER_NAME_SIZE] = '\0';
365 fn_cipher_name_set = 1; 371 fn_cipher_name_set = 1;
366 break; 372 break;
367 case ecryptfs_opt_fn_cipher_key_bytes: 373 case ecryptfs_opt_fn_cipher_key_bytes:
368 fn_cipher_key_bytes_src = args[0].from; 374 fn_cipher_key_bytes_src = args[0].from;
369 fn_cipher_key_bytes = 375 fn_cipher_key_bytes =
370 (int)simple_strtol(fn_cipher_key_bytes_src, 376 (int)simple_strtol(fn_cipher_key_bytes_src,
371 &fn_cipher_key_bytes_src, 0); 377 &fn_cipher_key_bytes_src, 0);
372 mount_crypt_stat->global_default_fn_cipher_key_bytes = 378 mount_crypt_stat->global_default_fn_cipher_key_bytes =
373 fn_cipher_key_bytes; 379 fn_cipher_key_bytes;
374 fn_cipher_key_bytes_set = 1; 380 fn_cipher_key_bytes_set = 1;
375 break; 381 break;
376 case ecryptfs_opt_unlink_sigs: 382 case ecryptfs_opt_unlink_sigs:
377 mount_crypt_stat->flags |= ECRYPTFS_UNLINK_SIGS; 383 mount_crypt_stat->flags |= ECRYPTFS_UNLINK_SIGS;
378 break; 384 break;
379 case ecryptfs_opt_mount_auth_tok_only: 385 case ecryptfs_opt_mount_auth_tok_only:
380 mount_crypt_stat->flags |= 386 mount_crypt_stat->flags |=
381 ECRYPTFS_GLOBAL_MOUNT_AUTH_TOK_ONLY; 387 ECRYPTFS_GLOBAL_MOUNT_AUTH_TOK_ONLY;
382 break; 388 break;
389 case ecryptfs_opt_check_dev_ruid:
390 *check_ruid = 1;
391 break;
383 case ecryptfs_opt_err: 392 case ecryptfs_opt_err:
384 default: 393 default:
385 printk(KERN_WARNING 394 printk(KERN_WARNING
386 "%s: eCryptfs: unrecognized option [%s]\n", 395 "%s: eCryptfs: unrecognized option [%s]\n",
387 __func__, p); 396 __func__, p);
388 } 397 }
389 } 398 }
390 if (!sig_set) { 399 if (!sig_set) {
391 rc = -EINVAL; 400 rc = -EINVAL;
392 ecryptfs_printk(KERN_ERR, "You must supply at least one valid " 401 ecryptfs_printk(KERN_ERR, "You must supply at least one valid "
393 "auth tok signature as a mount " 402 "auth tok signature as a mount "
394 "parameter; see the eCryptfs README\n"); 403 "parameter; see the eCryptfs README\n");
395 goto out; 404 goto out;
396 } 405 }
397 if (!cipher_name_set) { 406 if (!cipher_name_set) {
398 int cipher_name_len = strlen(ECRYPTFS_DEFAULT_CIPHER); 407 int cipher_name_len = strlen(ECRYPTFS_DEFAULT_CIPHER);
399 408
400 BUG_ON(cipher_name_len >= ECRYPTFS_MAX_CIPHER_NAME_SIZE); 409 BUG_ON(cipher_name_len >= ECRYPTFS_MAX_CIPHER_NAME_SIZE);
401 strcpy(mount_crypt_stat->global_default_cipher_name, 410 strcpy(mount_crypt_stat->global_default_cipher_name,
402 ECRYPTFS_DEFAULT_CIPHER); 411 ECRYPTFS_DEFAULT_CIPHER);
403 } 412 }
404 if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) 413 if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
405 && !fn_cipher_name_set) 414 && !fn_cipher_name_set)
406 strcpy(mount_crypt_stat->global_default_fn_cipher_name, 415 strcpy(mount_crypt_stat->global_default_fn_cipher_name,
407 mount_crypt_stat->global_default_cipher_name); 416 mount_crypt_stat->global_default_cipher_name);
408 if (!cipher_key_bytes_set) 417 if (!cipher_key_bytes_set)
409 mount_crypt_stat->global_default_cipher_key_size = 0; 418 mount_crypt_stat->global_default_cipher_key_size = 0;
410 if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) 419 if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
411 && !fn_cipher_key_bytes_set) 420 && !fn_cipher_key_bytes_set)
412 mount_crypt_stat->global_default_fn_cipher_key_bytes = 421 mount_crypt_stat->global_default_fn_cipher_key_bytes =
413 mount_crypt_stat->global_default_cipher_key_size; 422 mount_crypt_stat->global_default_cipher_key_size;
414 mutex_lock(&key_tfm_list_mutex); 423 mutex_lock(&key_tfm_list_mutex);
415 if (!ecryptfs_tfm_exists(mount_crypt_stat->global_default_cipher_name, 424 if (!ecryptfs_tfm_exists(mount_crypt_stat->global_default_cipher_name,
416 NULL)) { 425 NULL)) {
417 rc = ecryptfs_add_new_key_tfm( 426 rc = ecryptfs_add_new_key_tfm(
418 NULL, mount_crypt_stat->global_default_cipher_name, 427 NULL, mount_crypt_stat->global_default_cipher_name,
419 mount_crypt_stat->global_default_cipher_key_size); 428 mount_crypt_stat->global_default_cipher_key_size);
420 if (rc) { 429 if (rc) {
421 printk(KERN_ERR "Error attempting to initialize " 430 printk(KERN_ERR "Error attempting to initialize "
422 "cipher with name = [%s] and key size = [%td]; " 431 "cipher with name = [%s] and key size = [%td]; "
423 "rc = [%d]\n", 432 "rc = [%d]\n",
424 mount_crypt_stat->global_default_cipher_name, 433 mount_crypt_stat->global_default_cipher_name,
425 mount_crypt_stat->global_default_cipher_key_size, 434 mount_crypt_stat->global_default_cipher_key_size,
426 rc); 435 rc);
427 rc = -EINVAL; 436 rc = -EINVAL;
428 mutex_unlock(&key_tfm_list_mutex); 437 mutex_unlock(&key_tfm_list_mutex);
429 goto out; 438 goto out;
430 } 439 }
431 } 440 }
432 if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) 441 if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
433 && !ecryptfs_tfm_exists( 442 && !ecryptfs_tfm_exists(
434 mount_crypt_stat->global_default_fn_cipher_name, NULL)) { 443 mount_crypt_stat->global_default_fn_cipher_name, NULL)) {
435 rc = ecryptfs_add_new_key_tfm( 444 rc = ecryptfs_add_new_key_tfm(
436 NULL, mount_crypt_stat->global_default_fn_cipher_name, 445 NULL, mount_crypt_stat->global_default_fn_cipher_name,
437 mount_crypt_stat->global_default_fn_cipher_key_bytes); 446 mount_crypt_stat->global_default_fn_cipher_key_bytes);
438 if (rc) { 447 if (rc) {
439 printk(KERN_ERR "Error attempting to initialize " 448 printk(KERN_ERR "Error attempting to initialize "
440 "cipher with name = [%s] and key size = [%td]; " 449 "cipher with name = [%s] and key size = [%td]; "
441 "rc = [%d]\n", 450 "rc = [%d]\n",
442 mount_crypt_stat->global_default_fn_cipher_name, 451 mount_crypt_stat->global_default_fn_cipher_name,
443 mount_crypt_stat->global_default_fn_cipher_key_bytes, 452 mount_crypt_stat->global_default_fn_cipher_key_bytes,
444 rc); 453 rc);
445 rc = -EINVAL; 454 rc = -EINVAL;
446 mutex_unlock(&key_tfm_list_mutex); 455 mutex_unlock(&key_tfm_list_mutex);
447 goto out; 456 goto out;
448 } 457 }
449 } 458 }
450 mutex_unlock(&key_tfm_list_mutex); 459 mutex_unlock(&key_tfm_list_mutex);
451 rc = ecryptfs_init_global_auth_toks(mount_crypt_stat); 460 rc = ecryptfs_init_global_auth_toks(mount_crypt_stat);
452 if (rc) 461 if (rc)
453 printk(KERN_WARNING "One or more global auth toks could not " 462 printk(KERN_WARNING "One or more global auth toks could not "
454 "properly register; rc = [%d]\n", rc); 463 "properly register; rc = [%d]\n", rc);
455 out: 464 out:
456 return rc; 465 return rc;
457 } 466 }
458 467
459 struct kmem_cache *ecryptfs_sb_info_cache; 468 struct kmem_cache *ecryptfs_sb_info_cache;
460 static struct file_system_type ecryptfs_fs_type; 469 static struct file_system_type ecryptfs_fs_type;
461 470
462 /** 471 /**
463 * ecryptfs_get_sb 472 * ecryptfs_get_sb
464 * @fs_type 473 * @fs_type
465 * @flags 474 * @flags
466 * @dev_name: The path to mount over 475 * @dev_name: The path to mount over
467 * @raw_data: The options passed into the kernel 476 * @raw_data: The options passed into the kernel
468 */ 477 */
469 static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags, 478 static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags,
470 const char *dev_name, void *raw_data) 479 const char *dev_name, void *raw_data)
471 { 480 {
472 struct super_block *s; 481 struct super_block *s;
473 struct ecryptfs_sb_info *sbi; 482 struct ecryptfs_sb_info *sbi;
474 struct ecryptfs_dentry_info *root_info; 483 struct ecryptfs_dentry_info *root_info;
475 const char *err = "Getting sb failed"; 484 const char *err = "Getting sb failed";
476 struct inode *inode; 485 struct inode *inode;
477 struct path path; 486 struct path path;
487 uid_t check_ruid;
478 int rc; 488 int rc;
479 489
480 sbi = kmem_cache_zalloc(ecryptfs_sb_info_cache, GFP_KERNEL); 490 sbi = kmem_cache_zalloc(ecryptfs_sb_info_cache, GFP_KERNEL);
481 if (!sbi) { 491 if (!sbi) {
482 rc = -ENOMEM; 492 rc = -ENOMEM;
483 goto out; 493 goto out;
484 } 494 }
485 495
486 rc = ecryptfs_parse_options(sbi, raw_data); 496 rc = ecryptfs_parse_options(sbi, raw_data, &check_ruid);
487 if (rc) { 497 if (rc) {
488 err = "Error parsing options"; 498 err = "Error parsing options";
489 goto out; 499 goto out;
490 } 500 }
491 501
492 s = sget(fs_type, NULL, set_anon_super, NULL); 502 s = sget(fs_type, NULL, set_anon_super, NULL);
493 if (IS_ERR(s)) { 503 if (IS_ERR(s)) {
494 rc = PTR_ERR(s); 504 rc = PTR_ERR(s);
495 goto out; 505 goto out;
496 } 506 }
497 507
498 s->s_flags = flags; 508 s->s_flags = flags;
499 rc = bdi_setup_and_register(&sbi->bdi, "ecryptfs", BDI_CAP_MAP_COPY); 509 rc = bdi_setup_and_register(&sbi->bdi, "ecryptfs", BDI_CAP_MAP_COPY);
500 if (rc) 510 if (rc)
501 goto out1; 511 goto out1;
502 512
503 ecryptfs_set_superblock_private(s, sbi); 513 ecryptfs_set_superblock_private(s, sbi);
504 s->s_bdi = &sbi->bdi; 514 s->s_bdi = &sbi->bdi;
505 515
506 /* ->kill_sb() will take care of sbi after that point */ 516 /* ->kill_sb() will take care of sbi after that point */
507 sbi = NULL; 517 sbi = NULL;
508 s->s_op = &ecryptfs_sops; 518 s->s_op = &ecryptfs_sops;
509 s->s_d_op = &ecryptfs_dops; 519 s->s_d_op = &ecryptfs_dops;
510 520
511 err = "Reading sb failed"; 521 err = "Reading sb failed";
512 rc = kern_path(dev_name, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &path); 522 rc = kern_path(dev_name, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &path);
513 if (rc) { 523 if (rc) {
514 ecryptfs_printk(KERN_WARNING, "kern_path() failed\n"); 524 ecryptfs_printk(KERN_WARNING, "kern_path() failed\n");
515 goto out1; 525 goto out1;
516 } 526 }
517 if (path.dentry->d_sb->s_type == &ecryptfs_fs_type) { 527 if (path.dentry->d_sb->s_type == &ecryptfs_fs_type) {
518 rc = -EINVAL; 528 rc = -EINVAL;
519 printk(KERN_ERR "Mount on filesystem of type " 529 printk(KERN_ERR "Mount on filesystem of type "
520 "eCryptfs explicitly disallowed due to " 530 "eCryptfs explicitly disallowed due to "
521 "known incompatibilities\n"); 531 "known incompatibilities\n");
522 goto out_free; 532 goto out_free;
523 } 533 }
534
535 if (check_ruid && path.dentry->d_inode->i_uid != current_uid()) {
536 rc = -EPERM;
537 printk(KERN_ERR "Mount of device (uid: %d) not owned by "
538 "requested user (uid: %d)\n",
539 path.dentry->d_inode->i_uid, current_uid());
540 goto out_free;
541 }
542
524 ecryptfs_set_superblock_lower(s, path.dentry->d_sb); 543 ecryptfs_set_superblock_lower(s, path.dentry->d_sb);
525 s->s_maxbytes = path.dentry->d_sb->s_maxbytes; 544 s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
526 s->s_blocksize = path.dentry->d_sb->s_blocksize; 545 s->s_blocksize = path.dentry->d_sb->s_blocksize;
527 s->s_magic = ECRYPTFS_SUPER_MAGIC; 546 s->s_magic = ECRYPTFS_SUPER_MAGIC;
528 547
529 inode = ecryptfs_get_inode(path.dentry->d_inode, s); 548 inode = ecryptfs_get_inode(path.dentry->d_inode, s);
530 rc = PTR_ERR(inode); 549 rc = PTR_ERR(inode);
531 if (IS_ERR(inode)) 550 if (IS_ERR(inode))
532 goto out_free; 551 goto out_free;
533 552
534 s->s_root = d_alloc_root(inode); 553 s->s_root = d_alloc_root(inode);
535 if (!s->s_root) { 554 if (!s->s_root) {
536 iput(inode); 555 iput(inode);
537 rc = -ENOMEM; 556 rc = -ENOMEM;
538 goto out_free; 557 goto out_free;
539 } 558 }
540 559
541 rc = -ENOMEM; 560 rc = -ENOMEM;
542 root_info = kmem_cache_zalloc(ecryptfs_dentry_info_cache, GFP_KERNEL); 561 root_info = kmem_cache_zalloc(ecryptfs_dentry_info_cache, GFP_KERNEL);
543 if (!root_info) 562 if (!root_info)
544 goto out_free; 563 goto out_free;
545 564
546 /* ->kill_sb() will take care of root_info */ 565 /* ->kill_sb() will take care of root_info */
547 ecryptfs_set_dentry_private(s->s_root, root_info); 566 ecryptfs_set_dentry_private(s->s_root, root_info);
548 ecryptfs_set_dentry_lower(s->s_root, path.dentry); 567 ecryptfs_set_dentry_lower(s->s_root, path.dentry);
549 ecryptfs_set_dentry_lower_mnt(s->s_root, path.mnt); 568 ecryptfs_set_dentry_lower_mnt(s->s_root, path.mnt);
550 569
551 s->s_flags |= MS_ACTIVE; 570 s->s_flags |= MS_ACTIVE;
552 return dget(s->s_root); 571 return dget(s->s_root);
553 572
554 out_free: 573 out_free:
555 path_put(&path); 574 path_put(&path);
556 out1: 575 out1:
557 deactivate_locked_super(s); 576 deactivate_locked_super(s);
558 out: 577 out:
559 if (sbi) { 578 if (sbi) {
560 ecryptfs_destroy_mount_crypt_stat(&sbi->mount_crypt_stat); 579 ecryptfs_destroy_mount_crypt_stat(&sbi->mount_crypt_stat);
561 kmem_cache_free(ecryptfs_sb_info_cache, sbi); 580 kmem_cache_free(ecryptfs_sb_info_cache, sbi);
562 } 581 }
563 printk(KERN_ERR "%s; rc = [%d]\n", err, rc); 582 printk(KERN_ERR "%s; rc = [%d]\n", err, rc);
564 return ERR_PTR(rc); 583 return ERR_PTR(rc);
565 } 584 }
566 585
567 /** 586 /**
568 * ecryptfs_kill_block_super 587 * ecryptfs_kill_block_super
569 * @sb: The ecryptfs super block 588 * @sb: The ecryptfs super block
570 * 589 *
571 * Used to bring the superblock down and free the private data. 590 * Used to bring the superblock down and free the private data.
572 */ 591 */
573 static void ecryptfs_kill_block_super(struct super_block *sb) 592 static void ecryptfs_kill_block_super(struct super_block *sb)
574 { 593 {
575 struct ecryptfs_sb_info *sb_info = ecryptfs_superblock_to_private(sb); 594 struct ecryptfs_sb_info *sb_info = ecryptfs_superblock_to_private(sb);
576 kill_anon_super(sb); 595 kill_anon_super(sb);
577 if (!sb_info) 596 if (!sb_info)
578 return; 597 return;
579 ecryptfs_destroy_mount_crypt_stat(&sb_info->mount_crypt_stat); 598 ecryptfs_destroy_mount_crypt_stat(&sb_info->mount_crypt_stat);
580 bdi_destroy(&sb_info->bdi); 599 bdi_destroy(&sb_info->bdi);
581 kmem_cache_free(ecryptfs_sb_info_cache, sb_info); 600 kmem_cache_free(ecryptfs_sb_info_cache, sb_info);
582 } 601 }
583 602
584 static struct file_system_type ecryptfs_fs_type = { 603 static struct file_system_type ecryptfs_fs_type = {
585 .owner = THIS_MODULE, 604 .owner = THIS_MODULE,
586 .name = "ecryptfs", 605 .name = "ecryptfs",
587 .mount = ecryptfs_mount, 606 .mount = ecryptfs_mount,
588 .kill_sb = ecryptfs_kill_block_super, 607 .kill_sb = ecryptfs_kill_block_super,
589 .fs_flags = 0 608 .fs_flags = 0
590 }; 609 };
591 610
592 /** 611 /**
593 * inode_info_init_once 612 * inode_info_init_once
594 * 613 *
595 * Initializes the ecryptfs_inode_info_cache when it is created 614 * Initializes the ecryptfs_inode_info_cache when it is created
596 */ 615 */
597 static void 616 static void
598 inode_info_init_once(void *vptr) 617 inode_info_init_once(void *vptr)
599 { 618 {
600 struct ecryptfs_inode_info *ei = (struct ecryptfs_inode_info *)vptr; 619 struct ecryptfs_inode_info *ei = (struct ecryptfs_inode_info *)vptr;
601 620
602 inode_init_once(&ei->vfs_inode); 621 inode_init_once(&ei->vfs_inode);
603 } 622 }
604 623
605 static struct ecryptfs_cache_info { 624 static struct ecryptfs_cache_info {
606 struct kmem_cache **cache; 625 struct kmem_cache **cache;
607 const char *name; 626 const char *name;
608 size_t size; 627 size_t size;
609 void (*ctor)(void *obj); 628 void (*ctor)(void *obj);
610 } ecryptfs_cache_infos[] = { 629 } ecryptfs_cache_infos[] = {
611 { 630 {
612 .cache = &ecryptfs_auth_tok_list_item_cache, 631 .cache = &ecryptfs_auth_tok_list_item_cache,
613 .name = "ecryptfs_auth_tok_list_item", 632 .name = "ecryptfs_auth_tok_list_item",
614 .size = sizeof(struct ecryptfs_auth_tok_list_item), 633 .size = sizeof(struct ecryptfs_auth_tok_list_item),
615 }, 634 },
616 { 635 {
617 .cache = &ecryptfs_file_info_cache, 636 .cache = &ecryptfs_file_info_cache,
618 .name = "ecryptfs_file_cache", 637 .name = "ecryptfs_file_cache",
619 .size = sizeof(struct ecryptfs_file_info), 638 .size = sizeof(struct ecryptfs_file_info),
620 }, 639 },
621 { 640 {
622 .cache = &ecryptfs_dentry_info_cache, 641 .cache = &ecryptfs_dentry_info_cache,
623 .name = "ecryptfs_dentry_info_cache", 642 .name = "ecryptfs_dentry_info_cache",
624 .size = sizeof(struct ecryptfs_dentry_info), 643 .size = sizeof(struct ecryptfs_dentry_info),
625 }, 644 },
626 { 645 {
627 .cache = &ecryptfs_inode_info_cache, 646 .cache = &ecryptfs_inode_info_cache,
628 .name = "ecryptfs_inode_cache", 647 .name = "ecryptfs_inode_cache",
629 .size = sizeof(struct ecryptfs_inode_info), 648 .size = sizeof(struct ecryptfs_inode_info),
630 .ctor = inode_info_init_once, 649 .ctor = inode_info_init_once,
631 }, 650 },
632 { 651 {
633 .cache = &ecryptfs_sb_info_cache, 652 .cache = &ecryptfs_sb_info_cache,
634 .name = "ecryptfs_sb_cache", 653 .name = "ecryptfs_sb_cache",
635 .size = sizeof(struct ecryptfs_sb_info), 654 .size = sizeof(struct ecryptfs_sb_info),
636 }, 655 },
637 { 656 {
638 .cache = &ecryptfs_header_cache, 657 .cache = &ecryptfs_header_cache,
639 .name = "ecryptfs_headers", 658 .name = "ecryptfs_headers",
640 .size = PAGE_CACHE_SIZE, 659 .size = PAGE_CACHE_SIZE,
641 }, 660 },
642 { 661 {
643 .cache = &ecryptfs_xattr_cache, 662 .cache = &ecryptfs_xattr_cache,
644 .name = "ecryptfs_xattr_cache", 663 .name = "ecryptfs_xattr_cache",
645 .size = PAGE_CACHE_SIZE, 664 .size = PAGE_CACHE_SIZE,
646 }, 665 },
647 { 666 {
648 .cache = &ecryptfs_key_record_cache, 667 .cache = &ecryptfs_key_record_cache,
649 .name = "ecryptfs_key_record_cache", 668 .name = "ecryptfs_key_record_cache",
650 .size = sizeof(struct ecryptfs_key_record), 669 .size = sizeof(struct ecryptfs_key_record),
651 }, 670 },
652 { 671 {
653 .cache = &ecryptfs_key_sig_cache, 672 .cache = &ecryptfs_key_sig_cache,
654 .name = "ecryptfs_key_sig_cache", 673 .name = "ecryptfs_key_sig_cache",
655 .size = sizeof(struct ecryptfs_key_sig), 674 .size = sizeof(struct ecryptfs_key_sig),
656 }, 675 },
657 { 676 {
658 .cache = &ecryptfs_global_auth_tok_cache, 677 .cache = &ecryptfs_global_auth_tok_cache,
659 .name = "ecryptfs_global_auth_tok_cache", 678 .name = "ecryptfs_global_auth_tok_cache",
660 .size = sizeof(struct ecryptfs_global_auth_tok), 679 .size = sizeof(struct ecryptfs_global_auth_tok),
661 }, 680 },
662 { 681 {
663 .cache = &ecryptfs_key_tfm_cache, 682 .cache = &ecryptfs_key_tfm_cache,
664 .name = "ecryptfs_key_tfm_cache", 683 .name = "ecryptfs_key_tfm_cache",
665 .size = sizeof(struct ecryptfs_key_tfm), 684 .size = sizeof(struct ecryptfs_key_tfm),
666 }, 685 },
667 { 686 {
668 .cache = &ecryptfs_open_req_cache, 687 .cache = &ecryptfs_open_req_cache,
669 .name = "ecryptfs_open_req_cache", 688 .name = "ecryptfs_open_req_cache",
670 .size = sizeof(struct ecryptfs_open_req), 689 .size = sizeof(struct ecryptfs_open_req),
671 }, 690 },
672 }; 691 };
673 692
674 static void ecryptfs_free_kmem_caches(void) 693 static void ecryptfs_free_kmem_caches(void)
675 { 694 {
676 int i; 695 int i;
677 696
678 for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) { 697 for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) {
679 struct ecryptfs_cache_info *info; 698 struct ecryptfs_cache_info *info;
680 699
681 info = &ecryptfs_cache_infos[i]; 700 info = &ecryptfs_cache_infos[i];
682 if (*(info->cache)) 701 if (*(info->cache))
683 kmem_cache_destroy(*(info->cache)); 702 kmem_cache_destroy(*(info->cache));
684 } 703 }
685 } 704 }
686 705
687 /** 706 /**
688 * ecryptfs_init_kmem_caches 707 * ecryptfs_init_kmem_caches
689 * 708 *
690 * Returns zero on success; non-zero otherwise 709 * Returns zero on success; non-zero otherwise
691 */ 710 */
692 static int ecryptfs_init_kmem_caches(void) 711 static int ecryptfs_init_kmem_caches(void)
693 { 712 {
694 int i; 713 int i;
695 714
696 for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) { 715 for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) {
697 struct ecryptfs_cache_info *info; 716 struct ecryptfs_cache_info *info;
698 717
699 info = &ecryptfs_cache_infos[i]; 718 info = &ecryptfs_cache_infos[i];
700 *(info->cache) = kmem_cache_create(info->name, info->size, 719 *(info->cache) = kmem_cache_create(info->name, info->size,
701 0, SLAB_HWCACHE_ALIGN, info->ctor); 720 0, SLAB_HWCACHE_ALIGN, info->ctor);
702 if (!*(info->cache)) { 721 if (!*(info->cache)) {
703 ecryptfs_free_kmem_caches(); 722 ecryptfs_free_kmem_caches();
704 ecryptfs_printk(KERN_WARNING, "%s: " 723 ecryptfs_printk(KERN_WARNING, "%s: "
705 "kmem_cache_create failed\n", 724 "kmem_cache_create failed\n",
706 info->name); 725 info->name);
707 return -ENOMEM; 726 return -ENOMEM;
708 } 727 }
709 } 728 }
710 return 0; 729 return 0;
711 } 730 }
712 731
713 static struct kobject *ecryptfs_kobj; 732 static struct kobject *ecryptfs_kobj;
714 733
715 static ssize_t version_show(struct kobject *kobj, 734 static ssize_t version_show(struct kobject *kobj,
716 struct kobj_attribute *attr, char *buff) 735 struct kobj_attribute *attr, char *buff)
717 { 736 {
718 return snprintf(buff, PAGE_SIZE, "%d\n", ECRYPTFS_VERSIONING_MASK); 737 return snprintf(buff, PAGE_SIZE, "%d\n", ECRYPTFS_VERSIONING_MASK);
719 } 738 }
720 739
721 static struct kobj_attribute version_attr = __ATTR_RO(version); 740 static struct kobj_attribute version_attr = __ATTR_RO(version);
722 741
723 static struct attribute *attributes[] = { 742 static struct attribute *attributes[] = {
724 &version_attr.attr, 743 &version_attr.attr,
725 NULL, 744 NULL,
726 }; 745 };
727 746
728 static struct attribute_group attr_group = { 747 static struct attribute_group attr_group = {
729 .attrs = attributes, 748 .attrs = attributes,
730 }; 749 };
731 750
732 static int do_sysfs_registration(void) 751 static int do_sysfs_registration(void)
733 { 752 {
734 int rc; 753 int rc;
735 754
736 ecryptfs_kobj = kobject_create_and_add("ecryptfs", fs_kobj); 755 ecryptfs_kobj = kobject_create_and_add("ecryptfs", fs_kobj);
737 if (!ecryptfs_kobj) { 756 if (!ecryptfs_kobj) {
738 printk(KERN_ERR "Unable to create ecryptfs kset\n"); 757 printk(KERN_ERR "Unable to create ecryptfs kset\n");
739 rc = -ENOMEM; 758 rc = -ENOMEM;
740 goto out; 759 goto out;
741 } 760 }
742 rc = sysfs_create_group(ecryptfs_kobj, &attr_group); 761 rc = sysfs_create_group(ecryptfs_kobj, &attr_group);
743 if (rc) { 762 if (rc) {
744 printk(KERN_ERR 763 printk(KERN_ERR
745 "Unable to create ecryptfs version attributes\n"); 764 "Unable to create ecryptfs version attributes\n");
746 kobject_put(ecryptfs_kobj); 765 kobject_put(ecryptfs_kobj);
747 } 766 }
748 out: 767 out:
749 return rc; 768 return rc;
750 } 769 }
751 770
752 static void do_sysfs_unregistration(void) 771 static void do_sysfs_unregistration(void)
753 { 772 {
754 sysfs_remove_group(ecryptfs_kobj, &attr_group); 773 sysfs_remove_group(ecryptfs_kobj, &attr_group);
755 kobject_put(ecryptfs_kobj); 774 kobject_put(ecryptfs_kobj);
756 } 775 }
757 776
758 static int __init ecryptfs_init(void) 777 static int __init ecryptfs_init(void)
759 { 778 {
760 int rc; 779 int rc;
761 780
762 if (ECRYPTFS_DEFAULT_EXTENT_SIZE > PAGE_CACHE_SIZE) { 781 if (ECRYPTFS_DEFAULT_EXTENT_SIZE > PAGE_CACHE_SIZE) {
763 rc = -EINVAL; 782 rc = -EINVAL;
764 ecryptfs_printk(KERN_ERR, "The eCryptfs extent size is " 783 ecryptfs_printk(KERN_ERR, "The eCryptfs extent size is "
765 "larger than the host's page size, and so " 784 "larger than the host's page size, and so "
766 "eCryptfs cannot run on this system. The " 785 "eCryptfs cannot run on this system. The "
767 "default eCryptfs extent size is [%u] bytes; " 786 "default eCryptfs extent size is [%u] bytes; "
768 "the page size is [%lu] bytes.\n", 787 "the page size is [%lu] bytes.\n",
769 ECRYPTFS_DEFAULT_EXTENT_SIZE, 788 ECRYPTFS_DEFAULT_EXTENT_SIZE,
770 (unsigned long)PAGE_CACHE_SIZE); 789 (unsigned long)PAGE_CACHE_SIZE);
771 goto out; 790 goto out;
772 } 791 }
773 rc = ecryptfs_init_kmem_caches(); 792 rc = ecryptfs_init_kmem_caches();
774 if (rc) { 793 if (rc) {
775 printk(KERN_ERR 794 printk(KERN_ERR
776 "Failed to allocate one or more kmem_cache objects\n"); 795 "Failed to allocate one or more kmem_cache objects\n");
777 goto out; 796 goto out;
778 } 797 }
779 rc = register_filesystem(&ecryptfs_fs_type); 798 rc = register_filesystem(&ecryptfs_fs_type);
780 if (rc) { 799 if (rc) {
781 printk(KERN_ERR "Failed to register filesystem\n"); 800 printk(KERN_ERR "Failed to register filesystem\n");
782 goto out_free_kmem_caches; 801 goto out_free_kmem_caches;
783 } 802 }
784 rc = do_sysfs_registration(); 803 rc = do_sysfs_registration();
785 if (rc) { 804 if (rc) {
786 printk(KERN_ERR "sysfs registration failed\n"); 805 printk(KERN_ERR "sysfs registration failed\n");
787 goto out_unregister_filesystem; 806 goto out_unregister_filesystem;
788 } 807 }
789 rc = ecryptfs_init_kthread(); 808 rc = ecryptfs_init_kthread();
790 if (rc) { 809 if (rc) {
791 printk(KERN_ERR "%s: kthread initialization failed; " 810 printk(KERN_ERR "%s: kthread initialization failed; "
792 "rc = [%d]\n", __func__, rc); 811 "rc = [%d]\n", __func__, rc);
793 goto out_do_sysfs_unregistration; 812 goto out_do_sysfs_unregistration;
794 } 813 }
795 rc = ecryptfs_init_messaging(); 814 rc = ecryptfs_init_messaging();
796 if (rc) { 815 if (rc) {
797 printk(KERN_ERR "Failure occurred while attempting to " 816 printk(KERN_ERR "Failure occurred while attempting to "
798 "initialize the communications channel to " 817 "initialize the communications channel to "
799 "ecryptfsd\n"); 818 "ecryptfsd\n");
800 goto out_destroy_kthread; 819 goto out_destroy_kthread;
801 } 820 }
802 rc = ecryptfs_init_crypto(); 821 rc = ecryptfs_init_crypto();
803 if (rc) { 822 if (rc) {
804 printk(KERN_ERR "Failure whilst attempting to init crypto; " 823 printk(KERN_ERR "Failure whilst attempting to init crypto; "
805 "rc = [%d]\n", rc); 824 "rc = [%d]\n", rc);
806 goto out_release_messaging; 825 goto out_release_messaging;
807 } 826 }
808 if (ecryptfs_verbosity > 0) 827 if (ecryptfs_verbosity > 0)
809 printk(KERN_CRIT "eCryptfs verbosity set to %d. Secret values " 828 printk(KERN_CRIT "eCryptfs verbosity set to %d. Secret values "
810 "will be written to the syslog!\n", ecryptfs_verbosity); 829 "will be written to the syslog!\n", ecryptfs_verbosity);
811 830
812 goto out; 831 goto out;
813 out_release_messaging: 832 out_release_messaging:
814 ecryptfs_release_messaging(); 833 ecryptfs_release_messaging();
815 out_destroy_kthread: 834 out_destroy_kthread:
816 ecryptfs_destroy_kthread(); 835 ecryptfs_destroy_kthread();
817 out_do_sysfs_unregistration: 836 out_do_sysfs_unregistration:
818 do_sysfs_unregistration(); 837 do_sysfs_unregistration();
819 out_unregister_filesystem: 838 out_unregister_filesystem:
820 unregister_filesystem(&ecryptfs_fs_type); 839 unregister_filesystem(&ecryptfs_fs_type);
821 out_free_kmem_caches: 840 out_free_kmem_caches:
822 ecryptfs_free_kmem_caches(); 841 ecryptfs_free_kmem_caches();
823 out: 842 out:
824 return rc; 843 return rc;
825 } 844 }
826 845
827 static void __exit ecryptfs_exit(void) 846 static void __exit ecryptfs_exit(void)
828 { 847 {
829 int rc; 848 int rc;
830 849
831 rc = ecryptfs_destroy_crypto(); 850 rc = ecryptfs_destroy_crypto();
832 if (rc) 851 if (rc)
833 printk(KERN_ERR "Failure whilst attempting to destroy crypto; " 852 printk(KERN_ERR "Failure whilst attempting to destroy crypto; "
834 "rc = [%d]\n", rc); 853 "rc = [%d]\n", rc);
835 ecryptfs_release_messaging(); 854 ecryptfs_release_messaging();
836 ecryptfs_destroy_kthread(); 855 ecryptfs_destroy_kthread();
837 do_sysfs_unregistration(); 856 do_sysfs_unregistration();
838 unregister_filesystem(&ecryptfs_fs_type); 857 unregister_filesystem(&ecryptfs_fs_type);
839 ecryptfs_free_kmem_caches(); 858 ecryptfs_free_kmem_caches();
840 } 859 }
841 860
842 MODULE_AUTHOR("Michael A. Halcrow <mhalcrow@us.ibm.com>"); 861 MODULE_AUTHOR("Michael A. Halcrow <mhalcrow@us.ibm.com>");
843 MODULE_DESCRIPTION("eCryptfs"); 862 MODULE_DESCRIPTION("eCryptfs");
844 863
845 MODULE_LICENSE("GPL"); 864 MODULE_LICENSE("GPL");
846 865
847 module_init(ecryptfs_init) 866 module_init(ecryptfs_init)
848 module_exit(ecryptfs_exit) 867 module_exit(ecryptfs_exit)
849 868