2 * eCryptfs: Linux filesystem encryption layer
4 * Copyright (C) 1997-2003 Erez Zadok
5 * Copyright (C) 2001-2003 Stony Brook University
6 * Copyright (C) 2004-2007 International Business Machines Corp.
7 * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>
8 * Michael C. Thompson <mcthomps@us.ibm.com>
9 * Tyler Hicks <tyhicks@ou.edu>
11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License as
13 * published by the Free Software Foundation; either version 2 of the
14 * License, or (at your option) any later version.
16 * This program is distributed in the hope that it will be useful, but
17 * WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
19 * General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, write to the Free Software
23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
27 #include <linux/dcache.h>
28 #include <linux/file.h>
29 #include <linux/module.h>
30 #include <linux/namei.h>
31 #include <linux/skbuff.h>
32 #include <linux/crypto.h>
33 #include <linux/mount.h>
34 #include <linux/pagemap.h>
35 #include <linux/key.h>
36 #include <linux/parser.h>
37 #include <linux/fs_stack.h>
38 #include <linux/slab.h>
39 #include <linux/magic.h>
40 #include "ecryptfs_kernel.h"
43 * Module parameter that defines the ecryptfs_verbosity level.
45 int ecryptfs_verbosity
= 0;
47 module_param(ecryptfs_verbosity
, int, 0);
48 MODULE_PARM_DESC(ecryptfs_verbosity
,
49 "Initial verbosity level (0 or 1; defaults to "
50 "0, which is Quiet)");
53 * Module parameter that defines the number of message buffer elements
55 unsigned int ecryptfs_message_buf_len
= ECRYPTFS_DEFAULT_MSG_CTX_ELEMS
;
57 module_param(ecryptfs_message_buf_len
, uint
, 0);
58 MODULE_PARM_DESC(ecryptfs_message_buf_len
,
59 "Number of message buffer elements");
62 * Module parameter that defines the maximum guaranteed amount of time to wait
63 * for a response from ecryptfsd. The actual sleep time will be, more than
64 * likely, a small amount greater than this specified value, but only less if
65 * the message successfully arrives.
67 signed long ecryptfs_message_wait_timeout
= ECRYPTFS_MAX_MSG_CTX_TTL
/ HZ
;
69 module_param(ecryptfs_message_wait_timeout
, long, 0);
70 MODULE_PARM_DESC(ecryptfs_message_wait_timeout
,
71 "Maximum number of seconds that an operation will "
72 "sleep while waiting for a message response from "
76 * Module parameter that is an estimate of the maximum number of users
77 * that will be concurrently using eCryptfs. Set this to the right
78 * value to balance performance and memory use.
80 unsigned int ecryptfs_number_of_users
= ECRYPTFS_DEFAULT_NUM_USERS
;
82 module_param(ecryptfs_number_of_users
, uint
, 0);
83 MODULE_PARM_DESC(ecryptfs_number_of_users
, "An estimate of the number of "
84 "concurrent users of eCryptfs");
86 void __ecryptfs_printk(const char *fmt
, ...)
90 if (fmt
[1] == '7') { /* KERN_DEBUG */
91 if (ecryptfs_verbosity
>= 1)
99 * ecryptfs_init_lower_file
100 * @ecryptfs_dentry: Fully initialized eCryptfs dentry object, with
101 * the lower dentry and the lower mount set
103 * eCryptfs only ever keeps a single open file for every lower
104 * inode. All I/O operations to the lower inode occur through that
105 * file. When the first eCryptfs dentry that interposes with the first
106 * lower dentry for that inode is created, this function creates the
107 * lower file struct and associates it with the eCryptfs
108 * inode. When all eCryptfs files associated with the inode are released, the
111 * The lower file will be opened with read/write permissions, if
112 * possible. Otherwise, it is opened read-only.
114 * This function does nothing if a lower file is already
115 * associated with the eCryptfs inode.
117 * Returns zero on success; non-zero otherwise
119 static int ecryptfs_init_lower_file(struct dentry
*dentry
,
120 struct file
**lower_file
)
122 const struct cred
*cred
= current_cred();
123 struct dentry
*lower_dentry
= ecryptfs_dentry_to_lower(dentry
);
124 struct vfsmount
*lower_mnt
= ecryptfs_dentry_to_lower_mnt(dentry
);
127 rc
= ecryptfs_privileged_open(lower_file
, lower_dentry
, lower_mnt
,
130 printk(KERN_ERR
"Error opening lower file "
131 "for lower_dentry [0x%p] and lower_mnt [0x%p]; "
132 "rc = [%d]\n", lower_dentry
, lower_mnt
, rc
);
133 (*lower_file
) = NULL
;
138 int ecryptfs_get_lower_file(struct dentry
*dentry
)
140 struct ecryptfs_inode_info
*inode_info
=
141 ecryptfs_inode_to_private(dentry
->d_inode
);
144 mutex_lock(&inode_info
->lower_file_mutex
);
145 count
= atomic_inc_return(&inode_info
->lower_file_count
);
146 if (WARN_ON_ONCE(count
< 1))
148 else if (count
== 1) {
149 rc
= ecryptfs_init_lower_file(dentry
,
150 &inode_info
->lower_file
);
152 atomic_set(&inode_info
->lower_file_count
, 0);
154 mutex_unlock(&inode_info
->lower_file_mutex
);
158 void ecryptfs_put_lower_file(struct inode
*inode
)
160 struct ecryptfs_inode_info
*inode_info
;
162 inode_info
= ecryptfs_inode_to_private(inode
);
163 if (atomic_dec_and_mutex_lock(&inode_info
->lower_file_count
,
164 &inode_info
->lower_file_mutex
)) {
165 fput(inode_info
->lower_file
);
166 inode_info
->lower_file
= NULL
;
167 mutex_unlock(&inode_info
->lower_file_mutex
);
171 static struct inode
*ecryptfs_get_inode(struct inode
*lower_inode
,
172 struct super_block
*sb
)
177 if (lower_inode
->i_sb
!= ecryptfs_superblock_to_lower(sb
)) {
181 if (!igrab(lower_inode
)) {
185 inode
= iget5_locked(sb
, (unsigned long)lower_inode
,
186 ecryptfs_inode_test
, ecryptfs_inode_set
,
193 if (inode
->i_state
& I_NEW
)
194 unlock_new_inode(inode
);
197 if (S_ISLNK(lower_inode
->i_mode
))
198 inode
->i_op
= &ecryptfs_symlink_iops
;
199 else if (S_ISDIR(lower_inode
->i_mode
))
200 inode
->i_op
= &ecryptfs_dir_iops
;
201 if (S_ISDIR(lower_inode
->i_mode
))
202 inode
->i_fop
= &ecryptfs_dir_fops
;
203 if (special_file(lower_inode
->i_mode
))
204 init_special_inode(inode
, lower_inode
->i_mode
,
205 lower_inode
->i_rdev
);
206 fsstack_copy_attr_all(inode
, lower_inode
);
207 /* This size will be overwritten for real files w/ headers and
209 fsstack_copy_inode_size(inode
, lower_inode
);
217 * @lower_dentry: Existing dentry in the lower filesystem
218 * @dentry: ecryptfs' dentry
219 * @sb: ecryptfs's super_block
220 * @flags: flags to govern behavior of interpose procedure
222 * Interposes upper and lower dentries.
224 * Returns zero on success; non-zero otherwise
226 int ecryptfs_interpose(struct dentry
*lower_dentry
, struct dentry
*dentry
,
227 struct super_block
*sb
, u32 flags
)
229 struct inode
*lower_inode
= lower_dentry
->d_inode
;
230 struct inode
*inode
= ecryptfs_get_inode(lower_inode
, sb
);
232 return PTR_ERR(inode
);
233 if (flags
& ECRYPTFS_INTERPOSE_FLAG_D_ADD
)
234 d_add(dentry
, inode
);
236 d_instantiate(dentry
, inode
);
240 enum { ecryptfs_opt_sig
, ecryptfs_opt_ecryptfs_sig
,
241 ecryptfs_opt_cipher
, ecryptfs_opt_ecryptfs_cipher
,
242 ecryptfs_opt_ecryptfs_key_bytes
,
243 ecryptfs_opt_passthrough
, ecryptfs_opt_xattr_metadata
,
244 ecryptfs_opt_encrypted_view
, ecryptfs_opt_fnek_sig
,
245 ecryptfs_opt_fn_cipher
, ecryptfs_opt_fn_cipher_key_bytes
,
246 ecryptfs_opt_unlink_sigs
, ecryptfs_opt_mount_auth_tok_only
,
249 static const match_table_t tokens
= {
250 {ecryptfs_opt_sig
, "sig=%s"},
251 {ecryptfs_opt_ecryptfs_sig
, "ecryptfs_sig=%s"},
252 {ecryptfs_opt_cipher
, "cipher=%s"},
253 {ecryptfs_opt_ecryptfs_cipher
, "ecryptfs_cipher=%s"},
254 {ecryptfs_opt_ecryptfs_key_bytes
, "ecryptfs_key_bytes=%u"},
255 {ecryptfs_opt_passthrough
, "ecryptfs_passthrough"},
256 {ecryptfs_opt_xattr_metadata
, "ecryptfs_xattr_metadata"},
257 {ecryptfs_opt_encrypted_view
, "ecryptfs_encrypted_view"},
258 {ecryptfs_opt_fnek_sig
, "ecryptfs_fnek_sig=%s"},
259 {ecryptfs_opt_fn_cipher
, "ecryptfs_fn_cipher=%s"},
260 {ecryptfs_opt_fn_cipher_key_bytes
, "ecryptfs_fn_key_bytes=%u"},
261 {ecryptfs_opt_unlink_sigs
, "ecryptfs_unlink_sigs"},
262 {ecryptfs_opt_mount_auth_tok_only
, "ecryptfs_mount_auth_tok_only"},
263 {ecryptfs_opt_err
, NULL
}
266 static int ecryptfs_init_global_auth_toks(
267 struct ecryptfs_mount_crypt_stat
*mount_crypt_stat
)
269 struct ecryptfs_global_auth_tok
*global_auth_tok
;
270 struct ecryptfs_auth_tok
*auth_tok
;
273 list_for_each_entry(global_auth_tok
,
274 &mount_crypt_stat
->global_auth_tok_list
,
275 mount_crypt_stat_list
) {
276 rc
= ecryptfs_keyring_auth_tok_for_sig(
277 &global_auth_tok
->global_auth_tok_key
, &auth_tok
,
278 global_auth_tok
->sig
);
280 printk(KERN_ERR
"Could not find valid key in user "
281 "session keyring for sig specified in mount "
282 "option: [%s]\n", global_auth_tok
->sig
);
283 global_auth_tok
->flags
|= ECRYPTFS_AUTH_TOK_INVALID
;
286 global_auth_tok
->flags
&= ~ECRYPTFS_AUTH_TOK_INVALID
;
287 up_write(&(global_auth_tok
->global_auth_tok_key
)->sem
);
294 static void ecryptfs_init_mount_crypt_stat(
295 struct ecryptfs_mount_crypt_stat
*mount_crypt_stat
)
297 memset((void *)mount_crypt_stat
, 0,
298 sizeof(struct ecryptfs_mount_crypt_stat
));
299 INIT_LIST_HEAD(&mount_crypt_stat
->global_auth_tok_list
);
300 mutex_init(&mount_crypt_stat
->global_auth_tok_list_mutex
);
301 mount_crypt_stat
->flags
|= ECRYPTFS_MOUNT_CRYPT_STAT_INITIALIZED
;
305 * ecryptfs_parse_options
306 * @sb: The ecryptfs super block
307 * @options: The options passed to the kernel
309 * Parse mount options:
310 * debug=N - ecryptfs_verbosity level for debug output
311 * sig=XXX - description(signature) of the key to use
313 * Returns the dentry object of the lower-level (lower/interposed)
314 * directory; We want to mount our stackable file system on top of
315 * that lower directory.
317 * The signature of the key to use must be the description of a key
318 * already in the keyring. Mounting will fail if the key can not be
321 * Returns zero on success; non-zero on error
323 static int ecryptfs_parse_options(struct ecryptfs_sb_info
*sbi
, char *options
)
328 int cipher_name_set
= 0;
329 int fn_cipher_name_set
= 0;
330 int cipher_key_bytes
;
331 int cipher_key_bytes_set
= 0;
332 int fn_cipher_key_bytes
;
333 int fn_cipher_key_bytes_set
= 0;
334 struct ecryptfs_mount_crypt_stat
*mount_crypt_stat
=
335 &sbi
->mount_crypt_stat
;
336 substring_t args
[MAX_OPT_ARGS
];
339 char *cipher_name_dst
;
340 char *cipher_name_src
;
341 char *fn_cipher_name_dst
;
342 char *fn_cipher_name_src
;
345 char *cipher_key_bytes_src
;
346 char *fn_cipher_key_bytes_src
;
352 ecryptfs_init_mount_crypt_stat(mount_crypt_stat
);
353 while ((p
= strsep(&options
, ",")) != NULL
) {
356 token
= match_token(p
, tokens
, args
);
358 case ecryptfs_opt_sig
:
359 case ecryptfs_opt_ecryptfs_sig
:
360 sig_src
= args
[0].from
;
361 rc
= ecryptfs_add_global_auth_tok(mount_crypt_stat
,
364 printk(KERN_ERR
"Error attempting to register "
365 "global sig; rc = [%d]\n", rc
);
370 case ecryptfs_opt_cipher
:
371 case ecryptfs_opt_ecryptfs_cipher
:
372 cipher_name_src
= args
[0].from
;
375 global_default_cipher_name
;
376 strncpy(cipher_name_dst
, cipher_name_src
,
377 ECRYPTFS_MAX_CIPHER_NAME_SIZE
);
378 cipher_name_dst
[ECRYPTFS_MAX_CIPHER_NAME_SIZE
] = '\0';
381 case ecryptfs_opt_ecryptfs_key_bytes
:
382 cipher_key_bytes_src
= args
[0].from
;
384 (int)simple_strtol(cipher_key_bytes_src
,
385 &cipher_key_bytes_src
, 0);
386 mount_crypt_stat
->global_default_cipher_key_size
=
388 cipher_key_bytes_set
= 1;
390 case ecryptfs_opt_passthrough
:
391 mount_crypt_stat
->flags
|=
392 ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED
;
394 case ecryptfs_opt_xattr_metadata
:
395 mount_crypt_stat
->flags
|=
396 ECRYPTFS_XATTR_METADATA_ENABLED
;
398 case ecryptfs_opt_encrypted_view
:
399 mount_crypt_stat
->flags
|=
400 ECRYPTFS_XATTR_METADATA_ENABLED
;
401 mount_crypt_stat
->flags
|=
402 ECRYPTFS_ENCRYPTED_VIEW_ENABLED
;
404 case ecryptfs_opt_fnek_sig
:
405 fnek_src
= args
[0].from
;
407 mount_crypt_stat
->global_default_fnek_sig
;
408 strncpy(fnek_dst
, fnek_src
, ECRYPTFS_SIG_SIZE_HEX
);
409 mount_crypt_stat
->global_default_fnek_sig
[
410 ECRYPTFS_SIG_SIZE_HEX
] = '\0';
411 rc
= ecryptfs_add_global_auth_tok(
413 mount_crypt_stat
->global_default_fnek_sig
,
414 ECRYPTFS_AUTH_TOK_FNEK
);
416 printk(KERN_ERR
"Error attempting to register "
417 "global fnek sig [%s]; rc = [%d]\n",
418 mount_crypt_stat
->global_default_fnek_sig
,
422 mount_crypt_stat
->flags
|=
423 (ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES
424 | ECRYPTFS_GLOBAL_ENCFN_USE_MOUNT_FNEK
);
426 case ecryptfs_opt_fn_cipher
:
427 fn_cipher_name_src
= args
[0].from
;
429 mount_crypt_stat
->global_default_fn_cipher_name
;
430 strncpy(fn_cipher_name_dst
, fn_cipher_name_src
,
431 ECRYPTFS_MAX_CIPHER_NAME_SIZE
);
432 mount_crypt_stat
->global_default_fn_cipher_name
[
433 ECRYPTFS_MAX_CIPHER_NAME_SIZE
] = '\0';
434 fn_cipher_name_set
= 1;
436 case ecryptfs_opt_fn_cipher_key_bytes
:
437 fn_cipher_key_bytes_src
= args
[0].from
;
438 fn_cipher_key_bytes
=
439 (int)simple_strtol(fn_cipher_key_bytes_src
,
440 &fn_cipher_key_bytes_src
, 0);
441 mount_crypt_stat
->global_default_fn_cipher_key_bytes
=
443 fn_cipher_key_bytes_set
= 1;
445 case ecryptfs_opt_unlink_sigs
:
446 mount_crypt_stat
->flags
|= ECRYPTFS_UNLINK_SIGS
;
448 case ecryptfs_opt_mount_auth_tok_only
:
449 mount_crypt_stat
->flags
|=
450 ECRYPTFS_GLOBAL_MOUNT_AUTH_TOK_ONLY
;
452 case ecryptfs_opt_err
:
455 "%s: eCryptfs: unrecognized option [%s]\n",
461 ecryptfs_printk(KERN_ERR
, "You must supply at least one valid "
462 "auth tok signature as a mount "
463 "parameter; see the eCryptfs README\n");
466 if (!cipher_name_set
) {
467 int cipher_name_len
= strlen(ECRYPTFS_DEFAULT_CIPHER
);
469 BUG_ON(cipher_name_len
>= ECRYPTFS_MAX_CIPHER_NAME_SIZE
);
470 strcpy(mount_crypt_stat
->global_default_cipher_name
,
471 ECRYPTFS_DEFAULT_CIPHER
);
473 if ((mount_crypt_stat
->flags
& ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES
)
474 && !fn_cipher_name_set
)
475 strcpy(mount_crypt_stat
->global_default_fn_cipher_name
,
476 mount_crypt_stat
->global_default_cipher_name
);
477 if (!cipher_key_bytes_set
)
478 mount_crypt_stat
->global_default_cipher_key_size
= 0;
479 if ((mount_crypt_stat
->flags
& ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES
)
480 && !fn_cipher_key_bytes_set
)
481 mount_crypt_stat
->global_default_fn_cipher_key_bytes
=
482 mount_crypt_stat
->global_default_cipher_key_size
;
483 mutex_lock(&key_tfm_list_mutex
);
484 if (!ecryptfs_tfm_exists(mount_crypt_stat
->global_default_cipher_name
,
486 rc
= ecryptfs_add_new_key_tfm(
487 NULL
, mount_crypt_stat
->global_default_cipher_name
,
488 mount_crypt_stat
->global_default_cipher_key_size
);
490 printk(KERN_ERR
"Error attempting to initialize "
491 "cipher with name = [%s] and key size = [%td]; "
493 mount_crypt_stat
->global_default_cipher_name
,
494 mount_crypt_stat
->global_default_cipher_key_size
,
497 mutex_unlock(&key_tfm_list_mutex
);
501 if ((mount_crypt_stat
->flags
& ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES
)
502 && !ecryptfs_tfm_exists(
503 mount_crypt_stat
->global_default_fn_cipher_name
, NULL
)) {
504 rc
= ecryptfs_add_new_key_tfm(
505 NULL
, mount_crypt_stat
->global_default_fn_cipher_name
,
506 mount_crypt_stat
->global_default_fn_cipher_key_bytes
);
508 printk(KERN_ERR
"Error attempting to initialize "
509 "cipher with name = [%s] and key size = [%td]; "
511 mount_crypt_stat
->global_default_fn_cipher_name
,
512 mount_crypt_stat
->global_default_fn_cipher_key_bytes
,
515 mutex_unlock(&key_tfm_list_mutex
);
519 mutex_unlock(&key_tfm_list_mutex
);
520 rc
= ecryptfs_init_global_auth_toks(mount_crypt_stat
);
522 printk(KERN_WARNING
"One or more global auth toks could not "
523 "properly register; rc = [%d]\n", rc
);
528 struct kmem_cache
*ecryptfs_sb_info_cache
;
529 static struct file_system_type ecryptfs_fs_type
;
535 * @dev_name: The path to mount over
536 * @raw_data: The options passed into the kernel
538 static struct dentry
*ecryptfs_mount(struct file_system_type
*fs_type
, int flags
,
539 const char *dev_name
, void *raw_data
)
541 struct super_block
*s
;
542 struct ecryptfs_sb_info
*sbi
;
543 struct ecryptfs_dentry_info
*root_info
;
544 const char *err
= "Getting sb failed";
549 sbi
= kmem_cache_zalloc(ecryptfs_sb_info_cache
, GFP_KERNEL
);
555 rc
= ecryptfs_parse_options(sbi
, raw_data
);
557 err
= "Error parsing options";
561 s
= sget(fs_type
, NULL
, set_anon_super
, NULL
);
568 rc
= bdi_setup_and_register(&sbi
->bdi
, "ecryptfs", BDI_CAP_MAP_COPY
);
572 ecryptfs_set_superblock_private(s
, sbi
);
573 s
->s_bdi
= &sbi
->bdi
;
575 /* ->kill_sb() will take care of sbi after that point */
577 s
->s_op
= &ecryptfs_sops
;
578 s
->s_d_op
= &ecryptfs_dops
;
580 err
= "Reading sb failed";
581 rc
= kern_path(dev_name
, LOOKUP_FOLLOW
| LOOKUP_DIRECTORY
, &path
);
583 ecryptfs_printk(KERN_WARNING
, "kern_path() failed\n");
586 if (path
.dentry
->d_sb
->s_type
== &ecryptfs_fs_type
) {
588 printk(KERN_ERR
"Mount on filesystem of type "
589 "eCryptfs explicitly disallowed due to "
590 "known incompatibilities\n");
593 ecryptfs_set_superblock_lower(s
, path
.dentry
->d_sb
);
594 s
->s_maxbytes
= path
.dentry
->d_sb
->s_maxbytes
;
595 s
->s_blocksize
= path
.dentry
->d_sb
->s_blocksize
;
596 s
->s_magic
= ECRYPTFS_SUPER_MAGIC
;
598 inode
= ecryptfs_get_inode(path
.dentry
->d_inode
, s
);
603 s
->s_root
= d_alloc_root(inode
);
611 root_info
= kmem_cache_zalloc(ecryptfs_dentry_info_cache
, GFP_KERNEL
);
615 /* ->kill_sb() will take care of root_info */
616 ecryptfs_set_dentry_private(s
->s_root
, root_info
);
617 ecryptfs_set_dentry_lower(s
->s_root
, path
.dentry
);
618 ecryptfs_set_dentry_lower_mnt(s
->s_root
, path
.mnt
);
620 s
->s_flags
|= MS_ACTIVE
;
621 return dget(s
->s_root
);
626 deactivate_locked_super(s
);
629 ecryptfs_destroy_mount_crypt_stat(&sbi
->mount_crypt_stat
);
630 kmem_cache_free(ecryptfs_sb_info_cache
, sbi
);
632 printk(KERN_ERR
"%s; rc = [%d]\n", err
, rc
);
637 * ecryptfs_kill_block_super
638 * @sb: The ecryptfs super block
640 * Used to bring the superblock down and free the private data.
642 static void ecryptfs_kill_block_super(struct super_block
*sb
)
644 struct ecryptfs_sb_info
*sb_info
= ecryptfs_superblock_to_private(sb
);
648 ecryptfs_destroy_mount_crypt_stat(&sb_info
->mount_crypt_stat
);
649 bdi_destroy(&sb_info
->bdi
);
650 kmem_cache_free(ecryptfs_sb_info_cache
, sb_info
);
653 static struct file_system_type ecryptfs_fs_type
= {
654 .owner
= THIS_MODULE
,
656 .mount
= ecryptfs_mount
,
657 .kill_sb
= ecryptfs_kill_block_super
,
662 * inode_info_init_once
664 * Initializes the ecryptfs_inode_info_cache when it is created
667 inode_info_init_once(void *vptr
)
669 struct ecryptfs_inode_info
*ei
= (struct ecryptfs_inode_info
*)vptr
;
671 inode_init_once(&ei
->vfs_inode
);
674 static struct ecryptfs_cache_info
{
675 struct kmem_cache
**cache
;
678 void (*ctor
)(void *obj
);
679 } ecryptfs_cache_infos
[] = {
681 .cache
= &ecryptfs_auth_tok_list_item_cache
,
682 .name
= "ecryptfs_auth_tok_list_item",
683 .size
= sizeof(struct ecryptfs_auth_tok_list_item
),
686 .cache
= &ecryptfs_file_info_cache
,
687 .name
= "ecryptfs_file_cache",
688 .size
= sizeof(struct ecryptfs_file_info
),
691 .cache
= &ecryptfs_dentry_info_cache
,
692 .name
= "ecryptfs_dentry_info_cache",
693 .size
= sizeof(struct ecryptfs_dentry_info
),
696 .cache
= &ecryptfs_inode_info_cache
,
697 .name
= "ecryptfs_inode_cache",
698 .size
= sizeof(struct ecryptfs_inode_info
),
699 .ctor
= inode_info_init_once
,
702 .cache
= &ecryptfs_sb_info_cache
,
703 .name
= "ecryptfs_sb_cache",
704 .size
= sizeof(struct ecryptfs_sb_info
),
707 .cache
= &ecryptfs_header_cache_1
,
708 .name
= "ecryptfs_headers_1",
709 .size
= PAGE_CACHE_SIZE
,
712 .cache
= &ecryptfs_header_cache_2
,
713 .name
= "ecryptfs_headers_2",
714 .size
= PAGE_CACHE_SIZE
,
717 .cache
= &ecryptfs_xattr_cache
,
718 .name
= "ecryptfs_xattr_cache",
719 .size
= PAGE_CACHE_SIZE
,
722 .cache
= &ecryptfs_key_record_cache
,
723 .name
= "ecryptfs_key_record_cache",
724 .size
= sizeof(struct ecryptfs_key_record
),
727 .cache
= &ecryptfs_key_sig_cache
,
728 .name
= "ecryptfs_key_sig_cache",
729 .size
= sizeof(struct ecryptfs_key_sig
),
732 .cache
= &ecryptfs_global_auth_tok_cache
,
733 .name
= "ecryptfs_global_auth_tok_cache",
734 .size
= sizeof(struct ecryptfs_global_auth_tok
),
737 .cache
= &ecryptfs_key_tfm_cache
,
738 .name
= "ecryptfs_key_tfm_cache",
739 .size
= sizeof(struct ecryptfs_key_tfm
),
742 .cache
= &ecryptfs_open_req_cache
,
743 .name
= "ecryptfs_open_req_cache",
744 .size
= sizeof(struct ecryptfs_open_req
),
748 static void ecryptfs_free_kmem_caches(void)
752 for (i
= 0; i
< ARRAY_SIZE(ecryptfs_cache_infos
); i
++) {
753 struct ecryptfs_cache_info
*info
;
755 info
= &ecryptfs_cache_infos
[i
];
757 kmem_cache_destroy(*(info
->cache
));
762 * ecryptfs_init_kmem_caches
764 * Returns zero on success; non-zero otherwise
766 static int ecryptfs_init_kmem_caches(void)
770 for (i
= 0; i
< ARRAY_SIZE(ecryptfs_cache_infos
); i
++) {
771 struct ecryptfs_cache_info
*info
;
773 info
= &ecryptfs_cache_infos
[i
];
774 *(info
->cache
) = kmem_cache_create(info
->name
, info
->size
,
775 0, SLAB_HWCACHE_ALIGN
, info
->ctor
);
776 if (!*(info
->cache
)) {
777 ecryptfs_free_kmem_caches();
778 ecryptfs_printk(KERN_WARNING
, "%s: "
779 "kmem_cache_create failed\n",
787 static struct kobject
*ecryptfs_kobj
;
789 static ssize_t
version_show(struct kobject
*kobj
,
790 struct kobj_attribute
*attr
, char *buff
)
792 return snprintf(buff
, PAGE_SIZE
, "%d\n", ECRYPTFS_VERSIONING_MASK
);
795 static struct kobj_attribute version_attr
= __ATTR_RO(version
);
797 static struct attribute
*attributes
[] = {
802 static struct attribute_group attr_group
= {
806 static int do_sysfs_registration(void)
810 ecryptfs_kobj
= kobject_create_and_add("ecryptfs", fs_kobj
);
811 if (!ecryptfs_kobj
) {
812 printk(KERN_ERR
"Unable to create ecryptfs kset\n");
816 rc
= sysfs_create_group(ecryptfs_kobj
, &attr_group
);
819 "Unable to create ecryptfs version attributes\n");
820 kobject_put(ecryptfs_kobj
);
826 static void do_sysfs_unregistration(void)
828 sysfs_remove_group(ecryptfs_kobj
, &attr_group
);
829 kobject_put(ecryptfs_kobj
);
832 static int __init
ecryptfs_init(void)
836 if (ECRYPTFS_DEFAULT_EXTENT_SIZE
> PAGE_CACHE_SIZE
) {
838 ecryptfs_printk(KERN_ERR
, "The eCryptfs extent size is "
839 "larger than the host's page size, and so "
840 "eCryptfs cannot run on this system. The "
841 "default eCryptfs extent size is [%u] bytes; "
842 "the page size is [%lu] bytes.\n",
843 ECRYPTFS_DEFAULT_EXTENT_SIZE
,
844 (unsigned long)PAGE_CACHE_SIZE
);
847 rc
= ecryptfs_init_kmem_caches();
850 "Failed to allocate one or more kmem_cache objects\n");
853 rc
= register_filesystem(&ecryptfs_fs_type
);
855 printk(KERN_ERR
"Failed to register filesystem\n");
856 goto out_free_kmem_caches
;
858 rc
= do_sysfs_registration();
860 printk(KERN_ERR
"sysfs registration failed\n");
861 goto out_unregister_filesystem
;
863 rc
= ecryptfs_init_kthread();
865 printk(KERN_ERR
"%s: kthread initialization failed; "
866 "rc = [%d]\n", __func__
, rc
);
867 goto out_do_sysfs_unregistration
;
869 rc
= ecryptfs_init_messaging();
871 printk(KERN_ERR
"Failure occurred while attempting to "
872 "initialize the communications channel to "
874 goto out_destroy_kthread
;
876 rc
= ecryptfs_init_crypto();
878 printk(KERN_ERR
"Failure whilst attempting to init crypto; "
880 goto out_release_messaging
;
882 if (ecryptfs_verbosity
> 0)
883 printk(KERN_CRIT
"eCryptfs verbosity set to %d. Secret values "
884 "will be written to the syslog!\n", ecryptfs_verbosity
);
887 out_release_messaging
:
888 ecryptfs_release_messaging();
890 ecryptfs_destroy_kthread();
891 out_do_sysfs_unregistration
:
892 do_sysfs_unregistration();
893 out_unregister_filesystem
:
894 unregister_filesystem(&ecryptfs_fs_type
);
895 out_free_kmem_caches
:
896 ecryptfs_free_kmem_caches();
901 static void __exit
ecryptfs_exit(void)
905 rc
= ecryptfs_destroy_crypto();
907 printk(KERN_ERR
"Failure whilst attempting to destroy crypto; "
909 ecryptfs_release_messaging();
910 ecryptfs_destroy_kthread();
911 do_sysfs_unregistration();
912 unregister_filesystem(&ecryptfs_fs_type
);
913 ecryptfs_free_kmem_caches();
916 MODULE_AUTHOR("Michael A. Halcrow <mhalcrow@us.ibm.com>");
917 MODULE_DESCRIPTION("eCryptfs");
919 MODULE_LICENSE("GPL");
921 module_init(ecryptfs_init
)
922 module_exit(ecryptfs_exit
)