2 * eCryptfs: Linux filesystem encryption layer
4 * Copyright (C) 1997-2004 Erez Zadok
5 * Copyright (C) 2001-2004 Stony Brook University
6 * Copyright (C) 2004-2007 International Business Machines Corp.
7 * Author(s): Michael A. Halcrow <mhalcrow@us.ibm.com>
8 * Michael C. Thompson <mcthomps@us.ibm.com>
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License as
12 * published by the Free Software Foundation; either version 2 of the
13 * License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
26 #include <linux/file.h>
27 #include <linux/poll.h>
28 #include <linux/mount.h>
29 #include <linux/pagemap.h>
30 #include <linux/security.h>
31 #include <linux/smp_lock.h>
32 #include <linux/compat.h>
33 #include <linux/fs_stack.h>
34 #include "ecryptfs_kernel.h"
38 * @file: File we are seeking in
39 * @offset: The offset to seek to
40 * @origin: 2 - offset from i_size; 1 - offset from f_pos
42 * Returns the position we have seeked to, or negative on error
44 static loff_t
ecryptfs_llseek(struct file
*file
, loff_t offset
, int origin
)
49 int expanding_file
= 0;
50 struct inode
*inode
= file
->f_mapping
->host
;
52 /* If our offset is past the end of our file, we're going to
53 * need to grow it so we have a valid length of 0's */
57 new_end_pos
+= i_size_read(inode
);
61 new_end_pos
+= file
->f_pos
;
62 if (new_end_pos
> i_size_read(inode
)) {
63 ecryptfs_printk(KERN_DEBUG
, "new_end_pos(=[0x%.16x]) "
64 "> i_size_read(inode)(=[0x%.16x])\n",
65 new_end_pos
, i_size_read(inode
));
70 if (new_end_pos
> i_size_read(inode
)) {
71 ecryptfs_printk(KERN_DEBUG
, "new_end_pos(=[0x%.16x]) "
72 "> i_size_read(inode)(=[0x%.16x])\n",
73 new_end_pos
, i_size_read(inode
));
77 ecryptfs_printk(KERN_DEBUG
, "new_end_pos = [0x%.16x]\n", new_end_pos
);
79 rc
= ecryptfs_truncate(file
->f_path
.dentry
, new_end_pos
);
82 ecryptfs_printk(KERN_ERR
, "Error on attempt to "
83 "truncate to (higher) offset [0x%.16x];"
84 " rc = [%d]\n", new_end_pos
, rc
);
88 rv
= generic_file_llseek(file
, offset
, origin
);
94 * ecryptfs_read_update_atime
96 * generic_file_read updates the atime of upper layer inode. But, it
97 * doesn't give us a chance to update the atime of the lower layer
98 * inode. This function is a wrapper to generic_file_read. It
99 * updates the atime of the lower level inode if generic_file_read
100 * returns without any errors. This is to be used only for file reads.
101 * The function to be used for directory reads is ecryptfs_read.
103 static ssize_t
ecryptfs_read_update_atime(struct kiocb
*iocb
,
104 const struct iovec
*iov
,
105 unsigned long nr_segs
, loff_t pos
)
108 struct dentry
*lower_dentry
;
109 struct vfsmount
*lower_vfsmount
;
110 struct file
*file
= iocb
->ki_filp
;
112 rc
= generic_file_aio_read(iocb
, iov
, nr_segs
, pos
);
114 * Even though this is a async interface, we need to wait
115 * for IO to finish to update atime
117 if (-EIOCBQUEUED
== rc
)
118 rc
= wait_on_sync_kiocb(iocb
);
120 lower_dentry
= ecryptfs_dentry_to_lower(file
->f_path
.dentry
);
121 lower_vfsmount
= ecryptfs_dentry_to_lower_mnt(file
->f_path
.dentry
);
122 touch_atime(lower_vfsmount
, lower_dentry
);
127 struct ecryptfs_getdents_callback
{
129 struct dentry
*dentry
;
136 /* Inspired by generic filldir in fs/readir.c */
138 ecryptfs_filldir(void *dirent
, const char *name
, int namelen
, loff_t offset
,
139 u64 ino
, unsigned int d_type
)
141 struct ecryptfs_crypt_stat
*crypt_stat
;
142 struct ecryptfs_getdents_callback
*buf
=
143 (struct ecryptfs_getdents_callback
*)dirent
;
148 crypt_stat
= ecryptfs_dentry_to_private(buf
->dentry
)->crypt_stat
;
149 buf
->filldir_called
++;
150 decoded_length
= ecryptfs_decode_filename(crypt_stat
, name
, namelen
,
152 if (decoded_length
< 0) {
156 rc
= buf
->filldir(buf
->dirent
, decoded_name
, decoded_length
, offset
,
160 buf
->entries_written
++;
167 * @file: The ecryptfs file struct
168 * @dirent: Directory entry
169 * @filldir: The filldir callback function
171 static int ecryptfs_readdir(struct file
*file
, void *dirent
, filldir_t filldir
)
174 struct file
*lower_file
;
176 struct ecryptfs_getdents_callback buf
;
178 lower_file
= ecryptfs_file_to_lower(file
);
179 lower_file
->f_pos
= file
->f_pos
;
180 inode
= file
->f_path
.dentry
->d_inode
;
181 memset(&buf
, 0, sizeof(buf
));
183 buf
.dentry
= file
->f_path
.dentry
;
184 buf
.filldir
= filldir
;
186 buf
.filldir_called
= 0;
187 buf
.entries_written
= 0;
189 rc
= vfs_readdir(lower_file
, ecryptfs_filldir
, (void *)&buf
);
192 if (buf
.filldir_called
&& !buf
.entries_written
)
194 file
->f_pos
= lower_file
->f_pos
;
196 fsstack_copy_attr_atime(inode
, lower_file
->f_path
.dentry
->d_inode
);
200 struct kmem_cache
*ecryptfs_file_info_cache
;
202 int ecryptfs_open_lower_file(struct file
**lower_file
,
203 struct dentry
*lower_dentry
,
204 struct vfsmount
*lower_mnt
, int flags
)
208 flags
|= O_LARGEFILE
;
211 *lower_file
= dentry_open(lower_dentry
, lower_mnt
, flags
);
212 if (IS_ERR(*lower_file
)) {
213 printk(KERN_ERR
"Error opening lower file for lower_dentry "
214 "[0x%p], lower_mnt [0x%p], and flags [0x%x]\n",
215 lower_dentry
, lower_mnt
, flags
);
216 rc
= PTR_ERR(*lower_file
);
224 int ecryptfs_close_lower_file(struct file
*lower_file
)
232 * @inode: inode speciying file to open
233 * @file: Structure to return filled in
235 * Opens the file specified by inode.
237 * Returns zero on success; non-zero otherwise
239 static int ecryptfs_open(struct inode
*inode
, struct file
*file
)
242 struct ecryptfs_crypt_stat
*crypt_stat
= NULL
;
243 struct ecryptfs_mount_crypt_stat
*mount_crypt_stat
;
244 struct dentry
*ecryptfs_dentry
= file
->f_path
.dentry
;
245 /* Private value of ecryptfs_dentry allocated in
246 * ecryptfs_lookup() */
247 struct dentry
*lower_dentry
= ecryptfs_dentry_to_lower(ecryptfs_dentry
);
248 struct inode
*lower_inode
= NULL
;
249 struct file
*lower_file
= NULL
;
250 struct vfsmount
*lower_mnt
;
251 struct ecryptfs_file_info
*file_info
;
254 mount_crypt_stat
= &ecryptfs_superblock_to_private(
255 ecryptfs_dentry
->d_sb
)->mount_crypt_stat
;
256 if ((mount_crypt_stat
->flags
& ECRYPTFS_ENCRYPTED_VIEW_ENABLED
)
257 && ((file
->f_flags
& O_WRONLY
) || (file
->f_flags
& O_RDWR
)
258 || (file
->f_flags
& O_CREAT
) || (file
->f_flags
& O_TRUNC
)
259 || (file
->f_flags
& O_APPEND
))) {
260 printk(KERN_WARNING
"Mount has encrypted view enabled; "
261 "files may only be read\n");
265 /* Released in ecryptfs_release or end of function if failure */
266 file_info
= kmem_cache_zalloc(ecryptfs_file_info_cache
, GFP_KERNEL
);
267 ecryptfs_set_file_private(file
, file_info
);
269 ecryptfs_printk(KERN_ERR
,
270 "Error attempting to allocate memory\n");
274 lower_dentry
= ecryptfs_dentry_to_lower(ecryptfs_dentry
);
275 crypt_stat
= &ecryptfs_inode_to_private(inode
)->crypt_stat
;
276 mutex_lock(&crypt_stat
->cs_mutex
);
277 if (!(crypt_stat
->flags
& ECRYPTFS_POLICY_APPLIED
)) {
278 ecryptfs_printk(KERN_DEBUG
, "Setting flags for stat...\n");
279 /* Policy code enabled in future release */
280 crypt_stat
->flags
|= ECRYPTFS_POLICY_APPLIED
;
281 crypt_stat
->flags
|= ECRYPTFS_ENCRYPTED
;
283 mutex_unlock(&crypt_stat
->cs_mutex
);
284 lower_flags
= file
->f_flags
;
285 if ((lower_flags
& O_ACCMODE
) == O_WRONLY
)
286 lower_flags
= (lower_flags
& O_ACCMODE
) | O_RDWR
;
287 if (file
->f_flags
& O_APPEND
)
288 lower_flags
&= ~O_APPEND
;
289 lower_mnt
= ecryptfs_dentry_to_lower_mnt(ecryptfs_dentry
);
290 /* Corresponding fput() in ecryptfs_release() */
291 if ((rc
= ecryptfs_open_lower_file(&lower_file
, lower_dentry
, lower_mnt
,
293 ecryptfs_printk(KERN_ERR
, "Error opening lower file\n");
296 ecryptfs_set_file_lower(file
, lower_file
);
297 /* Isn't this check the same as the one in lookup? */
298 lower_inode
= lower_dentry
->d_inode
;
299 if (S_ISDIR(ecryptfs_dentry
->d_inode
->i_mode
)) {
300 ecryptfs_printk(KERN_DEBUG
, "This is a directory\n");
301 crypt_stat
->flags
&= ~(ECRYPTFS_ENCRYPTED
);
305 mutex_lock(&crypt_stat
->cs_mutex
);
306 if (!(crypt_stat
->flags
& ECRYPTFS_POLICY_APPLIED
)
307 || !(crypt_stat
->flags
& ECRYPTFS_KEY_VALID
)) {
308 rc
= ecryptfs_read_metadata(ecryptfs_dentry
, lower_file
);
310 ecryptfs_printk(KERN_DEBUG
,
311 "Valid headers not found\n");
312 if (!(mount_crypt_stat
->flags
313 & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED
)) {
315 printk(KERN_WARNING
"Attempt to read file that "
316 "is not in a valid eCryptfs format, "
317 "and plaintext passthrough mode is not "
318 "enabled; returning -EIO\n");
319 mutex_unlock(&crypt_stat
->cs_mutex
);
323 crypt_stat
->flags
&= ~(ECRYPTFS_ENCRYPTED
);
324 mutex_unlock(&crypt_stat
->cs_mutex
);
328 mutex_unlock(&crypt_stat
->cs_mutex
);
329 ecryptfs_printk(KERN_DEBUG
, "inode w/ addr = [0x%p], i_ino = [0x%.16x] "
330 "size: [0x%.16x]\n", inode
, inode
->i_ino
,
332 ecryptfs_set_file_lower(file
, lower_file
);
337 kmem_cache_free(ecryptfs_file_info_cache
,
338 ecryptfs_file_to_private(file
));
343 static int ecryptfs_flush(struct file
*file
, fl_owner_t td
)
346 struct file
*lower_file
= NULL
;
348 lower_file
= ecryptfs_file_to_lower(file
);
349 if (lower_file
->f_op
&& lower_file
->f_op
->flush
)
350 rc
= lower_file
->f_op
->flush(lower_file
, td
);
354 static int ecryptfs_release(struct inode
*inode
, struct file
*file
)
356 struct file
*lower_file
= ecryptfs_file_to_lower(file
);
357 struct ecryptfs_file_info
*file_info
= ecryptfs_file_to_private(file
);
358 struct inode
*lower_inode
= ecryptfs_inode_to_lower(inode
);
361 if ((rc
= ecryptfs_close_lower_file(lower_file
))) {
362 printk(KERN_ERR
"Error closing lower_file\n");
365 inode
->i_blocks
= lower_inode
->i_blocks
;
366 kmem_cache_free(ecryptfs_file_info_cache
, file_info
);
372 ecryptfs_fsync(struct file
*file
, struct dentry
*dentry
, int datasync
)
374 struct file
*lower_file
= ecryptfs_file_to_lower(file
);
375 struct dentry
*lower_dentry
= ecryptfs_dentry_to_lower(dentry
);
376 struct inode
*lower_inode
= lower_dentry
->d_inode
;
379 if (lower_inode
->i_fop
->fsync
) {
380 mutex_lock(&lower_inode
->i_mutex
);
381 rc
= lower_inode
->i_fop
->fsync(lower_file
, lower_dentry
,
383 mutex_unlock(&lower_inode
->i_mutex
);
388 static int ecryptfs_fasync(int fd
, struct file
*file
, int flag
)
391 struct file
*lower_file
= NULL
;
393 lower_file
= ecryptfs_file_to_lower(file
);
394 if (lower_file
->f_op
&& lower_file
->f_op
->fasync
)
395 rc
= lower_file
->f_op
->fasync(fd
, lower_file
, flag
);
399 static ssize_t
ecryptfs_sendfile(struct file
*file
, loff_t
* ppos
,
400 size_t count
, read_actor_t actor
, void *target
)
402 struct file
*lower_file
= NULL
;
405 lower_file
= ecryptfs_file_to_lower(file
);
406 if (lower_file
->f_op
&& lower_file
->f_op
->sendfile
)
407 rc
= lower_file
->f_op
->sendfile(lower_file
, ppos
, count
,
413 static int ecryptfs_ioctl(struct inode
*inode
, struct file
*file
,
414 unsigned int cmd
, unsigned long arg
);
416 const struct file_operations ecryptfs_dir_fops
= {
417 .readdir
= ecryptfs_readdir
,
418 .ioctl
= ecryptfs_ioctl
,
419 .mmap
= generic_file_mmap
,
420 .open
= ecryptfs_open
,
421 .flush
= ecryptfs_flush
,
422 .release
= ecryptfs_release
,
423 .fsync
= ecryptfs_fsync
,
424 .fasync
= ecryptfs_fasync
,
425 .sendfile
= ecryptfs_sendfile
,
428 const struct file_operations ecryptfs_main_fops
= {
429 .llseek
= ecryptfs_llseek
,
430 .read
= do_sync_read
,
431 .aio_read
= ecryptfs_read_update_atime
,
432 .write
= do_sync_write
,
433 .aio_write
= generic_file_aio_write
,
434 .readdir
= ecryptfs_readdir
,
435 .ioctl
= ecryptfs_ioctl
,
436 .mmap
= generic_file_mmap
,
437 .open
= ecryptfs_open
,
438 .flush
= ecryptfs_flush
,
439 .release
= ecryptfs_release
,
440 .fsync
= ecryptfs_fsync
,
441 .fasync
= ecryptfs_fasync
,
442 .sendfile
= ecryptfs_sendfile
,
446 ecryptfs_ioctl(struct inode
*inode
, struct file
*file
, unsigned int cmd
,
450 struct file
*lower_file
= NULL
;
452 if (ecryptfs_file_to_private(file
))
453 lower_file
= ecryptfs_file_to_lower(file
);
454 if (lower_file
&& lower_file
->f_op
&& lower_file
->f_op
->ioctl
)
455 rc
= lower_file
->f_op
->ioctl(ecryptfs_inode_to_lower(inode
),
456 lower_file
, cmd
, arg
);