fs/crypto/hooks.c

   1 /*
   2  * fs/crypto/hooks.c
   3  *
   4  * Encryption hooks for higher-level filesystem operations.
   5  */
   6
   7 #include <linux/ratelimit.h>
   8 #include "fscrypt_private.h"
   9
  10 /**
  11  * fscrypt_file_open - prepare to open a possibly-encrypted regular file
  12  * @inode: the inode being opened
  13  * @filp: the struct file being set up
  14  *
  15  * Currently, an encrypted regular file can only be opened if its encryption key
  16  * is available; access to the raw encrypted contents is not supported.
  17  * Therefore, we first set up the inode's encryption key (if not already done)
  18  * and return an error if it's unavailable.
  19  *
  20  * We also verify that if the parent directory (from the path via which the file
  21  * is being opened) is encrypted, then the inode being opened uses the same
  22  * encryption policy.  This is needed as part of the enforcement that all files
  23  * in an encrypted directory tree use the same encryption policy, as a
  24  * protection against certain types of offline attacks.  Note that this check is
  25  * needed even when opening an *unencrypted* file, since it's forbidden to have
  26  * an unencrypted file in an encrypted directory.
  27  *
  28  * Return: 0 on success, -ENOKEY if the key is missing, or another -errno code
  29  */
  30 int fscrypt_file_open(struct inode *inode, struct file *filp)
  31 {
  32         int err;
  33         struct dentry *dir;
  34
  35         err = fscrypt_require_key(inode);
  36         if (err)
  37                 return err;
  38
  39         dir = dget_parent(file_dentry(filp));
  40         if (IS_ENCRYPTED(d_inode(dir)) &&
  41             !fscrypt_has_permitted_context(d_inode(dir), inode)) {
  42                 pr_warn_ratelimited("fscrypt: inconsistent encryption contexts: %lu/%lu",
  43                                     d_inode(dir)->i_ino, inode->i_ino);
  44                 err = -EPERM;
  45         }
  46         dput(dir);
  47         return err;
  48 }
  49 EXPORT_SYMBOL_GPL(fscrypt_file_open);
  50
  51 int __fscrypt_prepare_link(struct inode *inode, struct inode *dir)
  52 {
  53         int err;
  54
  55         err = fscrypt_require_key(dir);
  56         if (err)
  57                 return err;
  58
  59         if (!fscrypt_has_permitted_context(dir, inode))
  60                 return -EPERM;
  61
  62         return 0;
  63 }
  64 EXPORT_SYMBOL_GPL(__fscrypt_prepare_link);
  65
  66 int __fscrypt_prepare_rename(struct inode *old_dir, struct dentry *old_dentry,
  67                              struct inode *new_dir, struct dentry *new_dentry,
  68                              unsigned int flags)
  69 {
  70         int err;
  71
  72         err = fscrypt_require_key(old_dir);
  73         if (err)
  74                 return err;
  75
  76         err = fscrypt_require_key(new_dir);
  77         if (err)
  78                 return err;
  79
  80         if (old_dir != new_dir) {
  81                 if (IS_ENCRYPTED(new_dir) &&
  82                     !fscrypt_has_permitted_context(new_dir,
  83                                                    d_inode(old_dentry)))
  84                         return -EPERM;
  85
  86                 if ((flags & RENAME_EXCHANGE) &&
  87                     IS_ENCRYPTED(old_dir) &&
  88                     !fscrypt_has_permitted_context(old_dir,
  89                                                    d_inode(new_dentry)))
  90                         return -EPERM;
  91         }
  92         return 0;
  93 }
  94 EXPORT_SYMBOL_GPL(__fscrypt_prepare_rename);
  95
  96 int __fscrypt_prepare_lookup(struct inode *dir, struct dentry *dentry)
  97 {
  98         int err = fscrypt_get_encryption_info(dir);
  99
 100         if (err)
 101                 return err;
 102
 103         if (fscrypt_has_encryption_key(dir)) {
 104                 spin_lock(&dentry->d_lock);
 105                 dentry->d_flags |= DCACHE_ENCRYPTED_WITH_KEY;
 106                 spin_unlock(&dentry->d_lock);
 107         }
 108
 109         d_set_d_op(dentry, &fscrypt_d_ops);
 110         return 0;
 111 }
 112 EXPORT_SYMBOL_GPL(__fscrypt_prepare_lookup);
 113
 114 int __fscrypt_prepare_symlink(struct inode *dir, unsigned int len,
 115                               unsigned int max_len,
 116                               struct fscrypt_str *disk_link)
 117 {
 118         int err;
 119
 120         /*
 121          * To calculate the size of the encrypted symlink target we need to know
 122          * the amount of NUL padding, which is determined by the flags set in
 123          * the encryption policy which will be inherited from the directory.
 124          * The easiest way to get access to this is to just load the directory's
 125          * fscrypt_info, since we'll need it to create the dir_entry anyway.
 126          *
 127          * Note: in test_dummy_encryption mode, @dir may be unencrypted.
 128          */
 129         err = fscrypt_get_encryption_info(dir);
 130         if (err)
 131                 return err;
 132         if (!fscrypt_has_encryption_key(dir))
 133                 return -ENOKEY;
 134
 135         /*
 136          * Calculate the size of the encrypted symlink and verify it won't
 137          * exceed max_len.  Note that for historical reasons, encrypted symlink
 138          * targets are prefixed with the ciphertext length, despite this
 139          * actually being redundant with i_size.  This decreases by 2 bytes the
 140          * longest symlink target we can accept.
 141          *
 142          * We could recover 1 byte by not counting a null terminator, but
 143          * counting it (even though it is meaningless for ciphertext) is simpler
 144          * for now since filesystems will assume it is there and subtract it.
 145          */
 146         if (!fscrypt_fname_encrypted_size(dir, len,
 147                                           max_len - sizeof(struct fscrypt_symlink_data),
 148                                           &disk_link->len))
 149                 return -ENAMETOOLONG;
 150         disk_link->len += sizeof(struct fscrypt_symlink_data);
 151
 152         disk_link->name = NULL;
 153         return 0;
 154 }
 155 EXPORT_SYMBOL_GPL(__fscrypt_prepare_symlink);
 156
 157 int __fscrypt_encrypt_symlink(struct inode *inode, const char *target,
 158                               unsigned int len, struct fscrypt_str *disk_link)
 159 {
 160         int err;
 161         struct qstr iname = QSTR_INIT(target, len);
 162         struct fscrypt_symlink_data *sd;
 163         unsigned int ciphertext_len;
 164
 165         err = fscrypt_require_key(inode);
 166         if (err)
 167                 return err;
 168
 169         if (disk_link->name) {
 170                 /* filesystem-provided buffer */
 171                 sd = (struct fscrypt_symlink_data *)disk_link->name;
 172         } else {
 173                 sd = kmalloc(disk_link->len, GFP_NOFS);
 174                 if (!sd)
 175                         return -ENOMEM;
 176         }
 177         ciphertext_len = disk_link->len - sizeof(*sd);
 178         sd->len = cpu_to_le16(ciphertext_len);
 179
 180         err = fname_encrypt(inode, &iname, sd->encrypted_path, ciphertext_len);
 181         if (err) {
 182                 if (!disk_link->name)
 183                         kfree(sd);
 184                 return err;
 185         }
 186         /*
 187          * Null-terminating the ciphertext doesn't make sense, but we still
 188          * count the null terminator in the length, so we might as well
 189          * initialize it just in case the filesystem writes it out.
 190          */
 191         sd->encrypted_path[ciphertext_len] = '\0';
 192
 193         if (!disk_link->name)
 194                 disk_link->name = (unsigned char *)sd;
 195         return 0;
 196 }
 197 EXPORT_SYMBOL_GPL(__fscrypt_encrypt_symlink);
 198
 199 /**
 200  * fscrypt_get_symlink - get the target of an encrypted symlink
 201  * @inode: the symlink inode
 202  * @caddr: the on-disk contents of the symlink
 203  * @max_size: size of @caddr buffer
 204  * @done: if successful, will be set up to free the returned target
 205  *
 206  * If the symlink's encryption key is available, we decrypt its target.
 207  * Otherwise, we encode its target for presentation.
 208  *
 209  * This may sleep, so the filesystem must have dropped out of RCU mode already.
 210  *
 211  * Return: the presentable symlink target or an ERR_PTR()
 212  */
 213 const char *fscrypt_get_symlink(struct inode *inode, const void *caddr,
 214                                 unsigned int max_size,
 215                                 struct delayed_call *done)
 216 {
 217         const struct fscrypt_symlink_data *sd;
 218         struct fscrypt_str cstr, pstr;
 219         int err;
 220
 221         /* This is for encrypted symlinks only */
 222         if (WARN_ON(!IS_ENCRYPTED(inode)))
 223                 return ERR_PTR(-EINVAL);
 224
 225         /*
 226          * Try to set up the symlink's encryption key, but we can continue
 227          * regardless of whether the key is available or not.
 228          */
 229         err = fscrypt_get_encryption_info(inode);
 230         if (err)
 231                 return ERR_PTR(err);
 232
 233         /*
 234          * For historical reasons, encrypted symlink targets are prefixed with
 235          * the ciphertext length, even though this is redundant with i_size.
 236          */
 237
 238         if (max_size < sizeof(*sd))
 239                 return ERR_PTR(-EUCLEAN);
 240         sd = caddr;
 241         cstr.name = (unsigned char *)sd->encrypted_path;
 242         cstr.len = le16_to_cpu(sd->len);
 243
 244         if (cstr.len == 0)
 245                 return ERR_PTR(-EUCLEAN);
 246
 247         if (cstr.len + sizeof(*sd) - 1 > max_size)
 248                 return ERR_PTR(-EUCLEAN);
 249
 250         err = fscrypt_fname_alloc_buffer(inode, cstr.len, &pstr);
 251         if (err)
 252                 return ERR_PTR(err);
 253
 254         err = fscrypt_fname_disk_to_usr(inode, 0, 0, &cstr, &pstr);
 255         if (err)
 256                 goto err_kfree;
 257
 258         err = -EUCLEAN;
 259         if (pstr.name[0] == '\0')
 260                 goto err_kfree;
 261
 262         pstr.name[pstr.len] = '\0';
 263         set_delayed_call(done, kfree_link, pstr.name);
 264         return pstr.name;
 265
 266 err_kfree:
 267         kfree(pstr.name);
 268         return ERR_PTR(err);
 269 }
 270 EXPORT_SYMBOL_GPL(fscrypt_get_symlink);