2 * eCryptfs: Linux filesystem encryption layer
4 * Copyright (C) 1997-2004 Erez Zadok
5 * Copyright (C) 2001-2004 Stony Brook University
6 * Copyright (C) 2004-2007 International Business Machines Corp.
7 * Author(s): Michael A. Halcrow <mhalcrow@us.ibm.com>
8 * Michael C. Thompson <mcthomps@us.ibm.com>
10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License as
12 * published by the Free Software Foundation; either version 2 of the
13 * License, or (at your option) any later version.
15 * This program is distributed in the hope that it will be useful, but
16 * WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
18 * General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
26 #include <linux/file.h>
27 #include <linux/poll.h>
28 #include <linux/mount.h>
29 #include <linux/pagemap.h>
30 #include <linux/security.h>
31 #include <linux/compat.h>
32 #include <linux/fs_stack.h>
33 #include <linux/smp_lock.h>
34 #include "ecryptfs_kernel.h"
37 * ecryptfs_read_update_atime
39 * generic_file_read updates the atime of upper layer inode. But, it
40 * doesn't give us a chance to update the atime of the lower layer
41 * inode. This function is a wrapper to generic_file_read. It
42 * updates the atime of the lower level inode if generic_file_read
43 * returns without any errors. This is to be used only for file reads.
44 * The function to be used for directory reads is ecryptfs_read.
46 static ssize_t
ecryptfs_read_update_atime(struct kiocb
*iocb
,
47 const struct iovec
*iov
,
48 unsigned long nr_segs
, loff_t pos
)
51 struct dentry
*lower_dentry
;
52 struct vfsmount
*lower_vfsmount
;
53 struct file
*file
= iocb
->ki_filp
;
55 rc
= generic_file_aio_read(iocb
, iov
, nr_segs
, pos
);
57 * Even though this is a async interface, we need to wait
58 * for IO to finish to update atime
60 if (-EIOCBQUEUED
== rc
)
61 rc
= wait_on_sync_kiocb(iocb
);
63 lower_dentry
= ecryptfs_dentry_to_lower(file
->f_path
.dentry
);
64 lower_vfsmount
= ecryptfs_dentry_to_lower_mnt(file
->f_path
.dentry
);
65 touch_atime(lower_vfsmount
, lower_dentry
);
70 struct ecryptfs_getdents_callback
{
72 struct dentry
*dentry
;
79 /* Inspired by generic filldir in fs/readir.c */
81 ecryptfs_filldir(void *dirent
, const char *name
, int namelen
, loff_t offset
,
82 u64 ino
, unsigned int d_type
)
84 struct ecryptfs_crypt_stat
*crypt_stat
;
85 struct ecryptfs_getdents_callback
*buf
=
86 (struct ecryptfs_getdents_callback
*)dirent
;
91 crypt_stat
= ecryptfs_dentry_to_private(buf
->dentry
)->crypt_stat
;
92 buf
->filldir_called
++;
93 decoded_length
= ecryptfs_decode_filename(crypt_stat
, name
, namelen
,
95 if (decoded_length
< 0) {
99 rc
= buf
->filldir(buf
->dirent
, decoded_name
, decoded_length
, offset
,
103 buf
->entries_written
++;
110 * @file: The ecryptfs file struct
111 * @dirent: Directory entry
112 * @filldir: The filldir callback function
114 static int ecryptfs_readdir(struct file
*file
, void *dirent
, filldir_t filldir
)
117 struct file
*lower_file
;
119 struct ecryptfs_getdents_callback buf
;
121 lower_file
= ecryptfs_file_to_lower(file
);
122 lower_file
->f_pos
= file
->f_pos
;
123 inode
= file
->f_path
.dentry
->d_inode
;
124 memset(&buf
, 0, sizeof(buf
));
126 buf
.dentry
= file
->f_path
.dentry
;
127 buf
.filldir
= filldir
;
129 buf
.filldir_called
= 0;
130 buf
.entries_written
= 0;
132 rc
= vfs_readdir(lower_file
, ecryptfs_filldir
, (void *)&buf
);
135 if (buf
.filldir_called
&& !buf
.entries_written
)
137 file
->f_pos
= lower_file
->f_pos
;
139 fsstack_copy_attr_atime(inode
, lower_file
->f_path
.dentry
->d_inode
);
143 struct kmem_cache
*ecryptfs_file_info_cache
;
147 * @inode: inode speciying file to open
148 * @file: Structure to return filled in
150 * Opens the file specified by inode.
152 * Returns zero on success; non-zero otherwise
154 static int ecryptfs_open(struct inode
*inode
, struct file
*file
)
157 struct ecryptfs_crypt_stat
*crypt_stat
= NULL
;
158 struct ecryptfs_mount_crypt_stat
*mount_crypt_stat
;
159 struct dentry
*ecryptfs_dentry
= file
->f_path
.dentry
;
160 /* Private value of ecryptfs_dentry allocated in
161 * ecryptfs_lookup() */
162 struct dentry
*lower_dentry
= ecryptfs_dentry_to_lower(ecryptfs_dentry
);
163 struct ecryptfs_file_info
*file_info
;
165 mount_crypt_stat
= &ecryptfs_superblock_to_private(
166 ecryptfs_dentry
->d_sb
)->mount_crypt_stat
;
167 if ((mount_crypt_stat
->flags
& ECRYPTFS_ENCRYPTED_VIEW_ENABLED
)
168 && ((file
->f_flags
& O_WRONLY
) || (file
->f_flags
& O_RDWR
)
169 || (file
->f_flags
& O_CREAT
) || (file
->f_flags
& O_TRUNC
)
170 || (file
->f_flags
& O_APPEND
))) {
171 printk(KERN_WARNING
"Mount has encrypted view enabled; "
172 "files may only be read\n");
176 /* Released in ecryptfs_release or end of function if failure */
177 file_info
= kmem_cache_zalloc(ecryptfs_file_info_cache
, GFP_KERNEL
);
178 ecryptfs_set_file_private(file
, file_info
);
180 ecryptfs_printk(KERN_ERR
,
181 "Error attempting to allocate memory\n");
185 lower_dentry
= ecryptfs_dentry_to_lower(ecryptfs_dentry
);
186 crypt_stat
= &ecryptfs_inode_to_private(inode
)->crypt_stat
;
187 mutex_lock(&crypt_stat
->cs_mutex
);
188 if (!(crypt_stat
->flags
& ECRYPTFS_POLICY_APPLIED
)) {
189 ecryptfs_printk(KERN_DEBUG
, "Setting flags for stat...\n");
190 /* Policy code enabled in future release */
191 crypt_stat
->flags
|= (ECRYPTFS_POLICY_APPLIED
192 | ECRYPTFS_ENCRYPTED
);
194 mutex_unlock(&crypt_stat
->cs_mutex
);
195 ecryptfs_set_file_lower(
196 file
, ecryptfs_inode_to_private(inode
)->lower_file
);
197 if (S_ISDIR(ecryptfs_dentry
->d_inode
->i_mode
)) {
198 ecryptfs_printk(KERN_DEBUG
, "This is a directory\n");
199 mutex_lock(&crypt_stat
->cs_mutex
);
200 crypt_stat
->flags
&= ~(ECRYPTFS_ENCRYPTED
);
201 mutex_unlock(&crypt_stat
->cs_mutex
);
205 mutex_lock(&crypt_stat
->cs_mutex
);
206 if (!(crypt_stat
->flags
& ECRYPTFS_POLICY_APPLIED
)
207 || !(crypt_stat
->flags
& ECRYPTFS_KEY_VALID
)) {
208 rc
= ecryptfs_read_metadata(ecryptfs_dentry
);
210 ecryptfs_printk(KERN_DEBUG
,
211 "Valid headers not found\n");
212 if (!(mount_crypt_stat
->flags
213 & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED
)) {
215 printk(KERN_WARNING
"Either the lower file "
216 "is not in a valid eCryptfs format, "
217 "or the key could not be retrieved. "
218 "Plaintext passthrough mode is not "
219 "enabled; returning -EIO\n");
220 mutex_unlock(&crypt_stat
->cs_mutex
);
224 crypt_stat
->flags
&= ~(ECRYPTFS_ENCRYPTED
);
225 mutex_unlock(&crypt_stat
->cs_mutex
);
229 mutex_unlock(&crypt_stat
->cs_mutex
);
230 ecryptfs_printk(KERN_DEBUG
, "inode w/ addr = [0x%p], i_ino = [0x%.16x] "
231 "size: [0x%.16x]\n", inode
, inode
->i_ino
,
235 kmem_cache_free(ecryptfs_file_info_cache
,
236 ecryptfs_file_to_private(file
));
241 static int ecryptfs_flush(struct file
*file
, fl_owner_t td
)
244 struct file
*lower_file
= NULL
;
246 lower_file
= ecryptfs_file_to_lower(file
);
247 if (lower_file
->f_op
&& lower_file
->f_op
->flush
)
248 rc
= lower_file
->f_op
->flush(lower_file
, td
);
252 static int ecryptfs_release(struct inode
*inode
, struct file
*file
)
254 kmem_cache_free(ecryptfs_file_info_cache
,
255 ecryptfs_file_to_private(file
));
260 ecryptfs_fsync(struct file
*file
, struct dentry
*dentry
, int datasync
)
262 struct file
*lower_file
= ecryptfs_file_to_lower(file
);
263 struct dentry
*lower_dentry
= ecryptfs_dentry_to_lower(dentry
);
264 struct inode
*lower_inode
= lower_dentry
->d_inode
;
267 if (lower_inode
->i_fop
->fsync
) {
268 mutex_lock(&lower_inode
->i_mutex
);
269 rc
= lower_inode
->i_fop
->fsync(lower_file
, lower_dentry
,
271 mutex_unlock(&lower_inode
->i_mutex
);
276 static int ecryptfs_fasync(int fd
, struct file
*file
, int flag
)
279 struct file
*lower_file
= NULL
;
282 lower_file
= ecryptfs_file_to_lower(file
);
283 if (lower_file
->f_op
&& lower_file
->f_op
->fasync
)
284 rc
= lower_file
->f_op
->fasync(fd
, lower_file
, flag
);
289 static int ecryptfs_ioctl(struct inode
*inode
, struct file
*file
,
290 unsigned int cmd
, unsigned long arg
);
292 const struct file_operations ecryptfs_dir_fops
= {
293 .readdir
= ecryptfs_readdir
,
294 .ioctl
= ecryptfs_ioctl
,
295 .mmap
= generic_file_mmap
,
296 .open
= ecryptfs_open
,
297 .flush
= ecryptfs_flush
,
298 .release
= ecryptfs_release
,
299 .fsync
= ecryptfs_fsync
,
300 .fasync
= ecryptfs_fasync
,
301 .splice_read
= generic_file_splice_read
,
304 const struct file_operations ecryptfs_main_fops
= {
305 .llseek
= generic_file_llseek
,
306 .read
= do_sync_read
,
307 .aio_read
= ecryptfs_read_update_atime
,
308 .write
= do_sync_write
,
309 .aio_write
= generic_file_aio_write
,
310 .readdir
= ecryptfs_readdir
,
311 .ioctl
= ecryptfs_ioctl
,
312 .mmap
= generic_file_mmap
,
313 .open
= ecryptfs_open
,
314 .flush
= ecryptfs_flush
,
315 .release
= ecryptfs_release
,
316 .fsync
= ecryptfs_fsync
,
317 .fasync
= ecryptfs_fasync
,
318 .splice_read
= generic_file_splice_read
,
322 ecryptfs_ioctl(struct inode
*inode
, struct file
*file
, unsigned int cmd
,
326 struct file
*lower_file
= NULL
;
328 if (ecryptfs_file_to_private(file
))
329 lower_file
= ecryptfs_file_to_lower(file
);
330 if (lower_file
&& lower_file
->f_op
&& lower_file
->f_op
->ioctl
)
331 rc
= lower_file
->f_op
->ioctl(ecryptfs_inode_to_lower(inode
),
332 lower_file
, cmd
, arg
);