4 * Encryption hooks for higher-level filesystem operations.
7 #include <linux/ratelimit.h>
8 #include "fscrypt_private.h"
11 * fscrypt_file_open - prepare to open a possibly-encrypted regular file
12 * @inode: the inode being opened
13 * @filp: the struct file being set up
15 * Currently, an encrypted regular file can only be opened if its encryption key
16 * is available; access to the raw encrypted contents is not supported.
17 * Therefore, we first set up the inode's encryption key (if not already done)
18 * and return an error if it's unavailable.
20 * We also verify that if the parent directory (from the path via which the file
21 * is being opened) is encrypted, then the inode being opened uses the same
22 * encryption policy. This is needed as part of the enforcement that all files
23 * in an encrypted directory tree use the same encryption policy, as a
24 * protection against certain types of offline attacks. Note that this check is
25 * needed even when opening an *unencrypted* file, since it's forbidden to have
26 * an unencrypted file in an encrypted directory.
28 * Return: 0 on success, -ENOKEY if the key is missing, or another -errno code
30 int fscrypt_file_open(struct inode *inode, struct file *filp)
35 err = fscrypt_require_key(inode);
39 dir = dget_parent(file_dentry(filp));
40 if (IS_ENCRYPTED(d_inode(dir)) &&
41 !fscrypt_has_permitted_context(d_inode(dir), inode)) {
42 pr_warn_ratelimited("fscrypt: inconsistent encryption contexts: %lu/%lu",
43 d_inode(dir)->i_ino, inode->i_ino);
49 EXPORT_SYMBOL_GPL(fscrypt_file_open);
51 int __fscrypt_prepare_link(struct inode *inode, struct inode *dir)
55 err = fscrypt_require_key(dir);
59 if (!fscrypt_has_permitted_context(dir, inode))
64 EXPORT_SYMBOL_GPL(__fscrypt_prepare_link);
66 int __fscrypt_prepare_rename(struct inode *old_dir, struct dentry *old_dentry,
67 struct inode *new_dir, struct dentry *new_dentry,
72 err = fscrypt_require_key(old_dir);
76 err = fscrypt_require_key(new_dir);
80 if (old_dir != new_dir) {
81 if (IS_ENCRYPTED(new_dir) &&
82 !fscrypt_has_permitted_context(new_dir,
86 if ((flags & RENAME_EXCHANGE) &&
87 IS_ENCRYPTED(old_dir) &&
88 !fscrypt_has_permitted_context(old_dir,
94 EXPORT_SYMBOL_GPL(__fscrypt_prepare_rename);
96 int __fscrypt_prepare_lookup(struct inode *dir, struct dentry *dentry)
98 int err = fscrypt_get_encryption_info(dir);
103 if (fscrypt_has_encryption_key(dir)) {
104 spin_lock(&dentry->d_lock);
105 dentry->d_flags |= DCACHE_ENCRYPTED_WITH_KEY;
106 spin_unlock(&dentry->d_lock);
109 d_set_d_op(dentry, &fscrypt_d_ops);
112 EXPORT_SYMBOL_GPL(__fscrypt_prepare_lookup);
114 int __fscrypt_prepare_symlink(struct inode *dir, unsigned int len,
115 unsigned int max_len,
116 struct fscrypt_str *disk_link)
121 * To calculate the size of the encrypted symlink target we need to know
122 * the amount of NUL padding, which is determined by the flags set in
123 * the encryption policy which will be inherited from the directory.
124 * The easiest way to get access to this is to just load the directory's
125 * fscrypt_info, since we'll need it to create the dir_entry anyway.
127 * Note: in test_dummy_encryption mode, @dir may be unencrypted.
129 err = fscrypt_get_encryption_info(dir);
132 if (!fscrypt_has_encryption_key(dir))
136 * Calculate the size of the encrypted symlink and verify it won't
137 * exceed max_len. Note that for historical reasons, encrypted symlink
138 * targets are prefixed with the ciphertext length, despite this
139 * actually being redundant with i_size. This decreases by 2 bytes the
140 * longest symlink target we can accept.
142 * We could recover 1 byte by not counting a null terminator, but
143 * counting it (even though it is meaningless for ciphertext) is simpler
144 * for now since filesystems will assume it is there and subtract it.
146 if (!fscrypt_fname_encrypted_size(dir, len,
147 max_len - sizeof(struct fscrypt_symlink_data),
149 return -ENAMETOOLONG;
150 disk_link->len += sizeof(struct fscrypt_symlink_data);
152 disk_link->name = NULL;
155 EXPORT_SYMBOL_GPL(__fscrypt_prepare_symlink);
157 int __fscrypt_encrypt_symlink(struct inode *inode, const char *target,
158 unsigned int len, struct fscrypt_str *disk_link)
161 struct qstr iname = QSTR_INIT(target, len);
162 struct fscrypt_symlink_data *sd;
163 unsigned int ciphertext_len;
165 err = fscrypt_require_key(inode);
169 if (disk_link->name) {
170 /* filesystem-provided buffer */
171 sd = (struct fscrypt_symlink_data *)disk_link->name;
173 sd = kmalloc(disk_link->len, GFP_NOFS);
177 ciphertext_len = disk_link->len - sizeof(*sd);
178 sd->len = cpu_to_le16(ciphertext_len);
180 err = fname_encrypt(inode, &iname, sd->encrypted_path, ciphertext_len);
182 if (!disk_link->name)
187 * Null-terminating the ciphertext doesn't make sense, but we still
188 * count the null terminator in the length, so we might as well
189 * initialize it just in case the filesystem writes it out.
191 sd->encrypted_path[ciphertext_len] = '\0';
193 if (!disk_link->name)
194 disk_link->name = (unsigned char *)sd;
197 EXPORT_SYMBOL_GPL(__fscrypt_encrypt_symlink);
200 * fscrypt_get_symlink - get the target of an encrypted symlink
201 * @inode: the symlink inode
202 * @caddr: the on-disk contents of the symlink
203 * @max_size: size of @caddr buffer
204 * @done: if successful, will be set up to free the returned target
206 * If the symlink's encryption key is available, we decrypt its target.
207 * Otherwise, we encode its target for presentation.
209 * This may sleep, so the filesystem must have dropped out of RCU mode already.
211 * Return: the presentable symlink target or an ERR_PTR()
213 const char *fscrypt_get_symlink(struct inode *inode, const void *caddr,
214 unsigned int max_size,
215 struct delayed_call *done)
217 const struct fscrypt_symlink_data *sd;
218 struct fscrypt_str cstr, pstr;
221 /* This is for encrypted symlinks only */
222 if (WARN_ON(!IS_ENCRYPTED(inode)))
223 return ERR_PTR(-EINVAL);
226 * Try to set up the symlink's encryption key, but we can continue
227 * regardless of whether the key is available or not.
229 err = fscrypt_get_encryption_info(inode);
234 * For historical reasons, encrypted symlink targets are prefixed with
235 * the ciphertext length, even though this is redundant with i_size.
238 if (max_size < sizeof(*sd))
239 return ERR_PTR(-EUCLEAN);
241 cstr.name = (unsigned char *)sd->encrypted_path;
242 cstr.len = le16_to_cpu(sd->len);
245 return ERR_PTR(-EUCLEAN);
247 if (cstr.len + sizeof(*sd) - 1 > max_size)
248 return ERR_PTR(-EUCLEAN);
250 err = fscrypt_fname_alloc_buffer(inode, cstr.len, &pstr);
254 err = fscrypt_fname_disk_to_usr(inode, 0, 0, &cstr, &pstr);
259 if (pstr.name[0] == '\0')
262 pstr.name[pstr.len] = '\0';
263 set_delayed_call(done, kfree_link, pstr.name);
270 EXPORT_SYMBOL_GPL(fscrypt_get_symlink);