Blame view
fs/verity/open.c
10.1 KB
fd2d1acfc fs-verity: add th... |
1 2 |
// SPDX-License-Identifier: GPL-2.0 /* |
c864727cb fs-verity: remove... |
3 |
* Opening fs-verity files |
fd2d1acfc fs-verity: add th... |
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 |
* * Copyright 2019 Google LLC */ #include "fsverity_private.h" #include <linux/slab.h> static struct kmem_cache *fsverity_info_cachep; /** * fsverity_init_merkle_tree_params() - initialize Merkle tree parameters * @params: the parameters struct to initialize * @inode: the inode for which the Merkle tree is being built * @hash_algorithm: number of hash algorithm to use * @log_blocksize: log base 2 of block size to use * @salt: pointer to salt (optional) * @salt_size: size of salt, possibly 0 * * Validate the hash algorithm and block size, then compute the tree topology * (num levels, num blocks in each level, etc.) and initialize @params. * * Return: 0 on success, -errno on failure */ int fsverity_init_merkle_tree_params(struct merkle_tree_params *params, const struct inode *inode, unsigned int hash_algorithm, unsigned int log_blocksize, const u8 *salt, size_t salt_size) { |
439bea104 fs-verity: use me... |
34 |
struct fsverity_hash_alg *hash_alg; |
fd2d1acfc fs-verity: add th... |
35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 |
int err; u64 blocks; u64 offset; int level; memset(params, 0, sizeof(*params)); hash_alg = fsverity_get_hash_alg(inode, hash_algorithm); if (IS_ERR(hash_alg)) return PTR_ERR(hash_alg); params->hash_alg = hash_alg; params->digest_size = hash_alg->digest_size; params->hashstate = fsverity_prepare_hash_state(hash_alg, salt, salt_size); if (IS_ERR(params->hashstate)) { err = PTR_ERR(params->hashstate); params->hashstate = NULL; fsverity_err(inode, "Error %d preparing hash state", err); goto out_err; } if (log_blocksize != PAGE_SHIFT) { fsverity_warn(inode, "Unsupported log_blocksize: %u", log_blocksize); err = -EINVAL; goto out_err; } params->log_blocksize = log_blocksize; params->block_size = 1 << log_blocksize; if (WARN_ON(!is_power_of_2(params->digest_size))) { err = -EINVAL; goto out_err; } if (params->block_size < 2 * params->digest_size) { fsverity_warn(inode, "Merkle tree block size (%u) too small for hash algorithm \"%s\"", params->block_size, hash_alg->name); err = -EINVAL; goto out_err; } params->log_arity = params->log_blocksize - ilog2(params->digest_size); params->hashes_per_block = 1 << params->log_arity; pr_debug("Merkle tree uses %s with %u-byte blocks (%u hashes/block), salt=%*phN ", hash_alg->name, params->block_size, params->hashes_per_block, (int)salt_size, salt); /* * Compute the number of levels in the Merkle tree and create a map from * level to the starting block of that level. Level 'num_levels - 1' is * the root and is stored first. Level 0 is the level directly "above" * the data blocks and is stored last. */ /* Compute number of levels and the number of blocks in each level */ blocks = (inode->i_size + params->block_size - 1) >> log_blocksize; pr_debug("Data is %lld bytes (%llu blocks) ", inode->i_size, blocks); while (blocks > 1) { if (params->num_levels >= FS_VERITY_MAX_LEVELS) { fsverity_err(inode, "Too many levels in Merkle tree"); err = -EINVAL; goto out_err; } blocks = (blocks + params->hashes_per_block - 1) >> params->log_arity; /* temporarily using level_start[] to store blocks in level */ params->level_start[params->num_levels++] = blocks; } |
fd39073db fs-verity: implem... |
107 |
params->level0_blocks = params->level_start[0]; |
fd2d1acfc fs-verity: add th... |
108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 |
/* Compute the starting block of each level */ offset = 0; for (level = (int)params->num_levels - 1; level >= 0; level--) { blocks = params->level_start[level]; params->level_start[level] = offset; pr_debug("Level %d is %llu blocks starting at index %llu ", level, blocks, offset); offset += blocks; } params->tree_size = offset << log_blocksize; return 0; out_err: kfree(params->hashstate); memset(params, 0, sizeof(*params)); return err; } |
432434c9f fs-verity: suppor... |
128 |
/* |
5fe13f59f fs-verity: rename... |
129 |
* Compute the file digest by hashing the fsverity_descriptor excluding the |
432434c9f fs-verity: suppor... |
130 131 |
* signature and with the sig_size field set to 0. */ |
5fe13f59f fs-verity: rename... |
132 133 134 |
static int compute_file_digest(struct fsverity_hash_alg *hash_alg, struct fsverity_descriptor *desc, u8 *file_digest) |
fd2d1acfc fs-verity: add th... |
135 |
{ |
432434c9f fs-verity: suppor... |
136 137 138 139 |
__le32 sig_size = desc->sig_size; int err; desc->sig_size = 0; |
5fe13f59f fs-verity: rename... |
140 |
err = fsverity_hash_buffer(hash_alg, desc, sizeof(*desc), file_digest); |
432434c9f fs-verity: suppor... |
141 142 143 |
desc->sig_size = sig_size; return err; |
fd2d1acfc fs-verity: add th... |
144 145 146 147 |
} /* * Validate the given fsverity_descriptor and create a new fsverity_info from |
432434c9f fs-verity: suppor... |
148 |
* it. The signature (if present) is also checked. |
fd2d1acfc fs-verity: add th... |
149 150 |
*/ struct fsverity_info *fsverity_create_info(const struct inode *inode, |
432434c9f fs-verity: suppor... |
151 |
void *_desc, size_t desc_size) |
fd2d1acfc fs-verity: add th... |
152 |
{ |
432434c9f fs-verity: suppor... |
153 |
struct fsverity_descriptor *desc = _desc; |
fd2d1acfc fs-verity: add th... |
154 155 156 157 158 159 160 161 162 163 164 165 166 167 |
struct fsverity_info *vi; int err; if (desc_size < sizeof(*desc)) { fsverity_err(inode, "Unrecognized descriptor size: %zu bytes", desc_size); return ERR_PTR(-EINVAL); } if (desc->version != 1) { fsverity_err(inode, "Unrecognized descriptor version: %u", desc->version); return ERR_PTR(-EINVAL); } |
432434c9f fs-verity: suppor... |
168 |
if (memchr_inv(desc->__reserved, 0, sizeof(desc->__reserved))) { |
fd2d1acfc fs-verity: add th... |
169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 |
fsverity_err(inode, "Reserved bits set in descriptor"); return ERR_PTR(-EINVAL); } if (desc->salt_size > sizeof(desc->salt)) { fsverity_err(inode, "Invalid salt_size: %u", desc->salt_size); return ERR_PTR(-EINVAL); } if (le64_to_cpu(desc->data_size) != inode->i_size) { fsverity_err(inode, "Wrong data_size: %llu (desc) != %lld (inode)", le64_to_cpu(desc->data_size), inode->i_size); return ERR_PTR(-EINVAL); } vi = kmem_cache_zalloc(fsverity_info_cachep, GFP_KERNEL); if (!vi) return ERR_PTR(-ENOMEM); vi->inode = inode; err = fsverity_init_merkle_tree_params(&vi->tree_params, inode, desc->hash_algorithm, desc->log_blocksize, desc->salt, desc->salt_size); if (err) { fsverity_err(inode, "Error %d initializing Merkle tree parameters", err); goto out; } memcpy(vi->root_hash, desc->root_hash, vi->tree_params.digest_size); |
5fe13f59f fs-verity: rename... |
202 203 |
err = compute_file_digest(vi->tree_params.hash_alg, desc, vi->file_digest); |
fd2d1acfc fs-verity: add th... |
204 |
if (err) { |
5fe13f59f fs-verity: rename... |
205 |
fsverity_err(inode, "Error %d computing file digest", err); |
fd2d1acfc fs-verity: add th... |
206 207 |
goto out; } |
5fe13f59f fs-verity: rename... |
208 209 |
pr_debug("Computed file digest: %s:%*phN ", |
fd2d1acfc fs-verity: add th... |
210 |
vi->tree_params.hash_alg->name, |
5fe13f59f fs-verity: rename... |
211 |
vi->tree_params.digest_size, vi->file_digest); |
432434c9f fs-verity: suppor... |
212 213 |
err = fsverity_verify_signature(vi, desc, desc_size); |
fd2d1acfc fs-verity: add th... |
214 215 216 217 218 219 220 221 222 223 224 |
out: if (err) { fsverity_free_info(vi); vi = ERR_PTR(err); } return vi; } void fsverity_set_info(struct inode *inode, struct fsverity_info *vi) { /* |
f3db0bed4 fs-verity: use sm... |
225 226 227 228 |
* Multiple tasks may race to set ->i_verity_info, so use * cmpxchg_release(). This pairs with the smp_load_acquire() in * fsverity_get_info(). I.e., here we publish ->i_verity_info with a * RELEASE barrier so that other tasks can ACQUIRE it. |
fd2d1acfc fs-verity: add th... |
229 |
*/ |
f3db0bed4 fs-verity: use sm... |
230 231 |
if (cmpxchg_release(&inode->i_verity_info, NULL, vi) != NULL) { /* Lost the race, so free the fsverity_info we allocated. */ |
fd2d1acfc fs-verity: add th... |
232 |
fsverity_free_info(vi); |
f3db0bed4 fs-verity: use sm... |
233 234 235 236 237 238 |
/* * Afterwards, the caller may access ->i_verity_info directly, * so make sure to ACQUIRE the winning fsverity_info. */ (void)fsverity_get_info(inode); } |
fd2d1acfc fs-verity: add th... |
239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 |
} void fsverity_free_info(struct fsverity_info *vi) { if (!vi) return; kfree(vi->tree_params.hashstate); kmem_cache_free(fsverity_info_cachep, vi); } /* Ensure the inode has an ->i_verity_info */ static int ensure_verity_info(struct inode *inode) { struct fsverity_info *vi = fsverity_get_info(inode); struct fsverity_descriptor *desc; int res; if (vi) return 0; res = inode->i_sb->s_vop->get_verity_descriptor(inode, NULL, 0); if (res < 0) { fsverity_err(inode, "Error %d getting verity descriptor size", res); return res; } if (res > FS_VERITY_MAX_DESCRIPTOR_SIZE) { fsverity_err(inode, "Verity descriptor is too large (%d bytes)", res); return -EMSGSIZE; } desc = kmalloc(res, GFP_KERNEL); if (!desc) return -ENOMEM; res = inode->i_sb->s_vop->get_verity_descriptor(inode, desc, res); if (res < 0) { fsverity_err(inode, "Error %d reading verity descriptor", res); goto out_free_desc; } vi = fsverity_create_info(inode, desc, res); if (IS_ERR(vi)) { res = PTR_ERR(vi); goto out_free_desc; } fsverity_set_info(inode, vi); res = 0; out_free_desc: kfree(desc); return res; } /** * fsverity_file_open() - prepare to open a verity file * @inode: the inode being opened * @filp: the struct file being set up * * When opening a verity file, deny the open if it is for writing. Otherwise, * set up the inode's ->i_verity_info if not already done. * * When combined with fscrypt, this must be called after fscrypt_file_open(). * Otherwise, we won't have the key set up to decrypt the verity metadata. * * Return: 0 on success, -errno on failure */ int fsverity_file_open(struct inode *inode, struct file *filp) { if (!IS_VERITY(inode)) return 0; if (filp->f_mode & FMODE_WRITE) { pr_debug("Denying opening verity file (ino %lu) for write ", inode->i_ino); return -EPERM; } return ensure_verity_info(inode); } EXPORT_SYMBOL_GPL(fsverity_file_open); /** |
c1d9b584e fs-verity: add th... |
322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 |
* fsverity_prepare_setattr() - prepare to change a verity inode's attributes * @dentry: dentry through which the inode is being changed * @attr: attributes to change * * Verity files are immutable, so deny truncates. This isn't covered by the * open-time check because sys_truncate() takes a path, not a file descriptor. * * Return: 0 on success, -errno on failure */ int fsverity_prepare_setattr(struct dentry *dentry, struct iattr *attr) { if (IS_VERITY(d_inode(dentry)) && (attr->ia_valid & ATTR_SIZE)) { pr_debug("Denying truncate of verity file (ino %lu) ", d_inode(dentry)->i_ino); return -EPERM; } return 0; } EXPORT_SYMBOL_GPL(fsverity_prepare_setattr); /** |
fd2d1acfc fs-verity: add th... |
344 |
* fsverity_cleanup_inode() - free the inode's verity info, if present |
6377a38bd fs-verity: fix al... |
345 |
* @inode: an inode being evicted |
fd2d1acfc fs-verity: add th... |
346 347 348 349 350 351 352 353 354 355 356 357 358 359 |
* * Filesystems must call this on inode eviction to free ->i_verity_info. */ void fsverity_cleanup_inode(struct inode *inode) { fsverity_free_info(inode->i_verity_info); inode->i_verity_info = NULL; } EXPORT_SYMBOL_GPL(fsverity_cleanup_inode); int __init fsverity_init_info_cache(void) { fsverity_info_cachep = KMEM_CACHE_USERCOPY(fsverity_info, SLAB_RECLAIM_ACCOUNT, |
5fe13f59f fs-verity: rename... |
360 |
file_digest); |
fd2d1acfc fs-verity: add th... |
361 362 363 364 |
if (!fsverity_info_cachep) return -ENOMEM; return 0; } |
8a1d0f9ca fs-verity: add da... |
365 366 367 368 369 370 |
void __init fsverity_exit_info_cache(void) { kmem_cache_destroy(fsverity_info_cachep); fsverity_info_cachep = NULL; } |