1/** 2 * eCryptfs: Linux filesystem encryption layer 3 * 4 * Copyright (C) 1997-2003 Erez Zadok 5 * Copyright (C) 2001-2003 Stony Brook University 6 * Copyright (C) 2004-2007 International Business Machines Corp. 7 * Author(s): Michael A. Halcrow <mahalcro@us.ibm.com> 8 * Michael C. Thompson <mcthomps@us.ibm.com> 9 * Tyler Hicks <tyhicks@ou.edu> 10 * 11 * This program is free software; you can redistribute it and/or 12 * modify it under the terms of the GNU General Public License as 13 * published by the Free Software Foundation; either version 2 of the 14 * License, or (at your option) any later version. 15 * 16 * This program is distributed in the hope that it will be useful, but 17 * WITHOUT ANY WARRANTY; without even the implied warranty of 18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 19 * General Public License for more details. 20 * 21 * You should have received a copy of the GNU General Public License 22 * along with this program; if not, write to the Free Software 23 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 24 * 02111-1307, USA. 25 */ 26 27#include <linux/dcache.h> 28#include <linux/file.h> 29#include <linux/module.h> 30#include <linux/namei.h> 31#include <linux/skbuff.h> 32#include <linux/crypto.h> 33#include <linux/netlink.h> 34#include <linux/mount.h> 35#include <linux/dcache.h> 36#include <linux/pagemap.h> 37#include <linux/key.h> 38#include <linux/parser.h> 39#include <linux/fs_stack.h> 40#include "ecryptfs_kernel.h" 41 42/** 43 * Module parameter that defines the ecryptfs_verbosity level. 44 */ 45int ecryptfs_verbosity = 0; 46 47module_param(ecryptfs_verbosity, int, 0); 48MODULE_PARM_DESC(ecryptfs_verbosity, 49 "Initial verbosity level (0 or 1; defaults to " 50 "0, which is Quiet)"); 51 52/** 53 * Module parameter that defines the number of netlink message buffer 54 * elements 55 */ 56unsigned int ecryptfs_message_buf_len = ECRYPTFS_DEFAULT_MSG_CTX_ELEMS; 57 58module_param(ecryptfs_message_buf_len, uint, 0); 59MODULE_PARM_DESC(ecryptfs_message_buf_len, 60 "Number of message buffer elements"); 61 62/** 63 * Module parameter that defines the maximum guaranteed amount of time to wait 64 * for a response through netlink. The actual sleep time will be, more than 65 * likely, a small amount greater than this specified value, but only less if 66 * the netlink message successfully arrives. 67 */ 68signed long ecryptfs_message_wait_timeout = ECRYPTFS_MAX_MSG_CTX_TTL / HZ; 69 70module_param(ecryptfs_message_wait_timeout, long, 0); 71MODULE_PARM_DESC(ecryptfs_message_wait_timeout, 72 "Maximum number of seconds that an operation will " 73 "sleep while waiting for a message response from " 74 "userspace"); 75 76/** 77 * Module parameter that is an estimate of the maximum number of users 78 * that will be concurrently using eCryptfs. Set this to the right 79 * value to balance performance and memory use. 80 */ 81unsigned int ecryptfs_number_of_users = ECRYPTFS_DEFAULT_NUM_USERS; 82 83module_param(ecryptfs_number_of_users, uint, 0); 84MODULE_PARM_DESC(ecryptfs_number_of_users, "An estimate of the number of " 85 "concurrent users of eCryptfs"); 86 87unsigned int ecryptfs_transport = ECRYPTFS_DEFAULT_TRANSPORT; 88 89void __ecryptfs_printk(const char *fmt, ...) 90{ 91 va_list args; 92 va_start(args, fmt); 93 if (fmt[1] == '7') { /* KERN_DEBUG */ 94 if (ecryptfs_verbosity >= 1) 95 vprintk(fmt, args); 96 } else 97 vprintk(fmt, args); 98 va_end(args); 99} 100 101/** 102 * ecryptfs_interpose 103 * @lower_dentry: Existing dentry in the lower filesystem 104 * @dentry: ecryptfs' dentry 105 * @sb: ecryptfs's super_block 106 * @flag: If set to true, then d_add is called, else d_instantiate is called 107 * 108 * Interposes upper and lower dentries. 109 * 110 * Returns zero on success; non-zero otherwise 111 */ 112int ecryptfs_interpose(struct dentry *lower_dentry, struct dentry *dentry, 113 struct super_block *sb, int flag) 114{ 115 struct inode *lower_inode; 116 struct inode *inode; 117 int rc = 0; 118 119 lower_inode = lower_dentry->d_inode; 120 if (lower_inode->i_sb != ecryptfs_superblock_to_lower(sb)) { 121 rc = -EXDEV; 122 goto out; 123 } 124 if (!igrab(lower_inode)) { 125 rc = -ESTALE; 126 goto out; 127 } 128 inode = iget5_locked(sb, (unsigned long)lower_inode, 129 ecryptfs_inode_test, ecryptfs_inode_set, 130 lower_inode); 131 if (!inode) { 132 rc = -EACCES; 133 iput(lower_inode); 134 goto out; 135 } 136 if (inode->i_state & I_NEW) 137 unlock_new_inode(inode); 138 else 139 iput(lower_inode); 140 if (S_ISLNK(lower_inode->i_mode)) 141 inode->i_op = &ecryptfs_symlink_iops; 142 else if (S_ISDIR(lower_inode->i_mode)) 143 inode->i_op = &ecryptfs_dir_iops; 144 if (S_ISDIR(lower_inode->i_mode)) 145 inode->i_fop = &ecryptfs_dir_fops; 146 if (special_file(lower_inode->i_mode)) 147 init_special_inode(inode, lower_inode->i_mode, 148 lower_inode->i_rdev); 149 dentry->d_op = &ecryptfs_dops; 150 if (flag) 151 d_add(dentry, inode); 152 else 153 d_instantiate(dentry, inode); 154 fsstack_copy_attr_all(inode, lower_inode, NULL); 155 /* This size will be overwritten for real files w/ headers and 156 * other metadata */ 157 fsstack_copy_inode_size(inode, lower_inode); 158out: 159 return rc; 160} 161 162enum { ecryptfs_opt_sig, ecryptfs_opt_ecryptfs_sig, ecryptfs_opt_debug, 163 ecryptfs_opt_ecryptfs_debug, ecryptfs_opt_cipher, 164 ecryptfs_opt_ecryptfs_cipher, ecryptfs_opt_ecryptfs_key_bytes, 165 ecryptfs_opt_passthrough, ecryptfs_opt_xattr_metadata, 166 ecryptfs_opt_encrypted_view, ecryptfs_opt_err }; 167 168static match_table_t tokens = { 169 {ecryptfs_opt_sig, "sig=%s"}, 170 {ecryptfs_opt_ecryptfs_sig, "ecryptfs_sig=%s"}, 171 {ecryptfs_opt_debug, "debug=%u"}, 172 {ecryptfs_opt_ecryptfs_debug, "ecryptfs_debug=%u"}, 173 {ecryptfs_opt_cipher, "cipher=%s"}, 174 {ecryptfs_opt_ecryptfs_cipher, "ecryptfs_cipher=%s"}, 175 {ecryptfs_opt_ecryptfs_key_bytes, "ecryptfs_key_bytes=%u"}, 176 {ecryptfs_opt_passthrough, "ecryptfs_passthrough"}, 177 {ecryptfs_opt_xattr_metadata, "ecryptfs_xattr_metadata"}, 178 {ecryptfs_opt_encrypted_view, "ecryptfs_encrypted_view"}, 179 {ecryptfs_opt_err, NULL} 180}; 181 182/** 183 * ecryptfs_verify_version 184 * @version: The version number to confirm 185 * 186 * Returns zero on good version; non-zero otherwise 187 */ 188static int ecryptfs_verify_version(u16 version) 189{ 190 int rc = 0; 191 unsigned char major; 192 unsigned char minor; 193 194 major = ((version >> 8) & 0xFF); 195 minor = (version & 0xFF); 196 if (major != ECRYPTFS_VERSION_MAJOR) { 197 ecryptfs_printk(KERN_ERR, "Major version number mismatch. " 198 "Expected [%d]; got [%d]\n", 199 ECRYPTFS_VERSION_MAJOR, major); 200 rc = -EINVAL; 201 goto out; 202 } 203 if (minor != ECRYPTFS_VERSION_MINOR) { 204 ecryptfs_printk(KERN_ERR, "Minor version number mismatch. " 205 "Expected [%d]; got [%d]\n", 206 ECRYPTFS_VERSION_MINOR, minor); 207 rc = -EINVAL; 208 goto out; 209 } 210out: 211 return rc; 212} 213 214static int ecryptfs_parse_options(struct super_block *sb, char *options) 215{ 216 char *p; 217 int rc = 0; 218 int sig_set = 0; 219 int cipher_name_set = 0; 220 int cipher_key_bytes; 221 int cipher_key_bytes_set = 0; 222 struct key *auth_tok_key = NULL; 223 struct ecryptfs_auth_tok *auth_tok = NULL; 224 struct ecryptfs_mount_crypt_stat *mount_crypt_stat = 225 &ecryptfs_superblock_to_private(sb)->mount_crypt_stat; 226 substring_t args[MAX_OPT_ARGS]; 227 int token; 228 char *sig_src; 229 char *sig_dst; 230 char *debug_src; 231 char *cipher_name_dst; 232 char *cipher_name_src; 233 char *cipher_key_bytes_src; 234 int cipher_name_len; 235 236 if (!options) { 237 rc = -EINVAL; 238 goto out; 239 } 240 while ((p = strsep(&options, ",")) != NULL) { 241 if (!*p) 242 continue; 243 token = match_token(p, tokens, args); 244 switch (token) { 245 case ecryptfs_opt_sig: 246 case ecryptfs_opt_ecryptfs_sig: 247 sig_src = args[0].from; 248 sig_dst = 249 mount_crypt_stat->global_auth_tok_sig; 250 memcpy(sig_dst, sig_src, ECRYPTFS_SIG_SIZE_HEX); 251 sig_dst[ECRYPTFS_SIG_SIZE_HEX] = '\0'; 252 ecryptfs_printk(KERN_DEBUG, 253 "The mount_crypt_stat " 254 "global_auth_tok_sig set to: " 255 "[%s]\n", sig_dst); 256 sig_set = 1; 257 break; 258 case ecryptfs_opt_debug: 259 case ecryptfs_opt_ecryptfs_debug: 260 debug_src = args[0].from; 261 ecryptfs_verbosity = 262 (int)simple_strtol(debug_src, &debug_src, 263 0); 264 ecryptfs_printk(KERN_DEBUG, 265 "Verbosity set to [%d]" "\n", 266 ecryptfs_verbosity); 267 break; 268 case ecryptfs_opt_cipher: 269 case ecryptfs_opt_ecryptfs_cipher: 270 cipher_name_src = args[0].from; 271 cipher_name_dst = 272 mount_crypt_stat-> 273 global_default_cipher_name; 274 strncpy(cipher_name_dst, cipher_name_src, 275 ECRYPTFS_MAX_CIPHER_NAME_SIZE); 276 ecryptfs_printk(KERN_DEBUG, 277 "The mount_crypt_stat " 278 "global_default_cipher_name set to: " 279 "[%s]\n", cipher_name_dst); 280 cipher_name_set = 1; 281 break; 282 case ecryptfs_opt_ecryptfs_key_bytes: 283 cipher_key_bytes_src = args[0].from; 284 cipher_key_bytes = 285 (int)simple_strtol(cipher_key_bytes_src, 286 &cipher_key_bytes_src, 0); 287 mount_crypt_stat->global_default_cipher_key_size = 288 cipher_key_bytes; 289 ecryptfs_printk(KERN_DEBUG, 290 "The mount_crypt_stat " 291 "global_default_cipher_key_size " 292 "set to: [%d]\n", mount_crypt_stat-> 293 global_default_cipher_key_size); 294 cipher_key_bytes_set = 1; 295 break; 296 case ecryptfs_opt_passthrough: 297 mount_crypt_stat->flags |= 298 ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED; 299 break; 300 case ecryptfs_opt_xattr_metadata: 301 mount_crypt_stat->flags |= 302 ECRYPTFS_XATTR_METADATA_ENABLED; 303 break; 304 case ecryptfs_opt_encrypted_view: 305 mount_crypt_stat->flags |= 306 ECRYPTFS_XATTR_METADATA_ENABLED; 307 mount_crypt_stat->flags |= 308 ECRYPTFS_ENCRYPTED_VIEW_ENABLED; 309 break; 310 case ecryptfs_opt_err: 311 default: 312 ecryptfs_printk(KERN_WARNING, 313 "eCryptfs: unrecognized option '%s'\n", 314 p); 315 } 316 } 317 /* Do not support lack of mount-wide signature in 0.1 318 * release */ 319 if (!sig_set) { 320 rc = -EINVAL; 321 ecryptfs_printk(KERN_ERR, "You must supply a valid " 322 "passphrase auth tok signature as a mount " 323 "parameter; see the eCryptfs README\n"); 324 goto out; 325 } 326 if (!cipher_name_set) { 327 cipher_name_len = strlen(ECRYPTFS_DEFAULT_CIPHER); 328 if (unlikely(cipher_name_len 329 >= ECRYPTFS_MAX_CIPHER_NAME_SIZE)) { 330 rc = -EINVAL; 331 BUG(); 332 goto out; 333 } 334 memcpy(mount_crypt_stat->global_default_cipher_name, 335 ECRYPTFS_DEFAULT_CIPHER, cipher_name_len); 336 mount_crypt_stat->global_default_cipher_name[cipher_name_len] 337 = '\0'; 338 } 339 if (!cipher_key_bytes_set) { 340 mount_crypt_stat->global_default_cipher_key_size = 0; 341 } 342 rc = ecryptfs_process_cipher( 343 &mount_crypt_stat->global_key_tfm, 344 mount_crypt_stat->global_default_cipher_name, 345 &mount_crypt_stat->global_default_cipher_key_size); 346 if (rc) { 347 printk(KERN_ERR "Error attempting to initialize cipher [%s] " 348 "with key size [%Zd] bytes; rc = [%d]\n", 349 mount_crypt_stat->global_default_cipher_name, 350 mount_crypt_stat->global_default_cipher_key_size, rc); 351 mount_crypt_stat->global_key_tfm = NULL; 352 mount_crypt_stat->global_auth_tok_key = NULL; 353 rc = -EINVAL; 354 goto out; 355 } 356 mutex_init(&mount_crypt_stat->global_key_tfm_mutex); 357 ecryptfs_printk(KERN_DEBUG, "Requesting the key with description: " 358 "[%s]\n", mount_crypt_stat->global_auth_tok_sig); 359 /* The reference to this key is held until umount is done The 360 * call to key_put is done in ecryptfs_put_super() */ 361 auth_tok_key = request_key(&key_type_user, 362 mount_crypt_stat->global_auth_tok_sig, 363 NULL); 364 if (!auth_tok_key || IS_ERR(auth_tok_key)) { 365 ecryptfs_printk(KERN_ERR, "Could not find key with " 366 "description: [%s]\n", 367 mount_crypt_stat->global_auth_tok_sig); 368 process_request_key_err(PTR_ERR(auth_tok_key)); 369 rc = -EINVAL; 370 goto out; 371 } 372 auth_tok = ecryptfs_get_key_payload_data(auth_tok_key); 373 if (ecryptfs_verify_version(auth_tok->version)) { 374 ecryptfs_printk(KERN_ERR, "Data structure version mismatch. " 375 "Userspace tools must match eCryptfs kernel " 376 "module with major version [%d] and minor " 377 "version [%d]\n", ECRYPTFS_VERSION_MAJOR, 378 ECRYPTFS_VERSION_MINOR); 379 rc = -EINVAL; 380 goto out; 381 } 382 if (auth_tok->token_type != ECRYPTFS_PASSWORD 383 && auth_tok->token_type != ECRYPTFS_PRIVATE_KEY) { 384 ecryptfs_printk(KERN_ERR, "Invalid auth_tok structure " 385 "returned from key query\n"); 386 rc = -EINVAL; 387 goto out; 388 } 389 mount_crypt_stat->global_auth_tok_key = auth_tok_key; 390 mount_crypt_stat->global_auth_tok = auth_tok; 391out: 392 return rc; 393} 394 395struct kmem_cache *ecryptfs_sb_info_cache; 396 397/** 398 * ecryptfs_fill_super 399 * @sb: The ecryptfs super block 400 * @raw_data: The options passed to mount 401 * @silent: Not used but required by function prototype 402 * 403 * Sets up what we can of the sb, rest is done in ecryptfs_read_super 404 * 405 * Returns zero on success; non-zero otherwise 406 */ 407static int 408ecryptfs_fill_super(struct super_block *sb, void *raw_data, int silent) 409{ 410 int rc = 0; 411 412 /* Released in ecryptfs_put_super() */ 413 ecryptfs_set_superblock_private(sb, 414 kmem_cache_zalloc(ecryptfs_sb_info_cache, 415 GFP_KERNEL)); 416 if (!ecryptfs_superblock_to_private(sb)) { 417 ecryptfs_printk(KERN_WARNING, "Out of memory\n"); 418 rc = -ENOMEM; 419 goto out; 420 } 421 sb->s_op = &ecryptfs_sops; 422 /* Released through deactivate_super(sb) from get_sb_nodev */ 423 sb->s_root = d_alloc(NULL, &(const struct qstr) { 424 .hash = 0,.name = "/",.len = 1}); 425 if (!sb->s_root) { 426 ecryptfs_printk(KERN_ERR, "d_alloc failed\n"); 427 rc = -ENOMEM; 428 goto out; 429 } 430 sb->s_root->d_op = &ecryptfs_dops; 431 sb->s_root->d_sb = sb; 432 sb->s_root->d_parent = sb->s_root; 433 /* Released in d_release when dput(sb->s_root) is called */ 434 /* through deactivate_super(sb) from get_sb_nodev() */ 435 ecryptfs_set_dentry_private(sb->s_root, 436 kmem_cache_zalloc(ecryptfs_dentry_info_cache, 437 GFP_KERNEL)); 438 if (!ecryptfs_dentry_to_private(sb->s_root)) { 439 ecryptfs_printk(KERN_ERR, 440 "dentry_info_cache alloc failed\n"); 441 rc = -ENOMEM; 442 goto out; 443 } 444 rc = 0; 445out: 446 /* Should be able to rely on deactivate_super called from 447 * get_sb_nodev */ 448 return rc; 449} 450 451/** 452 * ecryptfs_read_super 453 * @sb: The ecryptfs super block 454 * @dev_name: The path to mount over 455 * 456 * Read the super block of the lower filesystem, and use 457 * ecryptfs_interpose to create our initial inode and super block 458 * struct. 459 */ 460static int ecryptfs_read_super(struct super_block *sb, const char *dev_name) 461{ 462 int rc; 463 struct nameidata nd; 464 struct dentry *lower_root; 465 struct vfsmount *lower_mnt; 466 467 memset(&nd, 0, sizeof(struct nameidata)); 468 rc = path_lookup(dev_name, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &nd); 469 if (rc) { 470 ecryptfs_printk(KERN_WARNING, "path_lookup() failed\n"); 471 goto out; 472 } 473 lower_root = nd.dentry; 474 lower_mnt = nd.mnt; 475 ecryptfs_set_superblock_lower(sb, lower_root->d_sb); 476 sb->s_maxbytes = lower_root->d_sb->s_maxbytes; 477 ecryptfs_set_dentry_lower(sb->s_root, lower_root); 478 ecryptfs_set_dentry_lower_mnt(sb->s_root, lower_mnt); 479 if ((rc = ecryptfs_interpose(lower_root, sb->s_root, sb, 0))) 480 goto out_free; 481 rc = 0; 482 goto out; 483out_free: 484 path_release(&nd); 485out: 486 return rc; 487} 488 489/** 490 * ecryptfs_get_sb 491 * @fs_type 492 * @flags 493 * @dev_name: The path to mount over 494 * @raw_data: The options passed into the kernel 495 * 496 * The whole ecryptfs_get_sb process is broken into 4 functions: 497 * ecryptfs_parse_options(): handle options passed to ecryptfs, if any 498 * ecryptfs_fill_super(): used by get_sb_nodev, fills out the super_block 499 * with as much information as it can before needing 500 * the lower filesystem. 501 * ecryptfs_read_super(): this accesses the lower filesystem and uses 502 * ecryptfs_interpolate to perform most of the linking 503 * ecryptfs_interpolate(): links the lower filesystem into ecryptfs 504 */ 505static int ecryptfs_get_sb(struct file_system_type *fs_type, int flags, 506 const char *dev_name, void *raw_data, 507 struct vfsmount *mnt) 508{ 509 int rc; 510 struct super_block *sb; 511 512 rc = get_sb_nodev(fs_type, flags, raw_data, ecryptfs_fill_super, mnt); 513 if (rc < 0) { 514 printk(KERN_ERR "Getting sb failed; rc = [%d]\n", rc); 515 goto out; 516 } 517 sb = mnt->mnt_sb; 518 rc = ecryptfs_parse_options(sb, raw_data); 519 if (rc) { 520 printk(KERN_ERR "Error parsing options; rc = [%d]\n", rc); 521 goto out_abort; 522 } 523 rc = ecryptfs_read_super(sb, dev_name); 524 if (rc) { 525 printk(KERN_ERR "Reading sb failed; rc = [%d]\n", rc); 526 goto out_abort; 527 } 528 goto out; 529out_abort: 530 dput(sb->s_root); 531 up_write(&sb->s_umount); 532 deactivate_super(sb); 533out: 534 return rc; 535} 536 537/** 538 * ecryptfs_kill_block_super 539 * @sb: The ecryptfs super block 540 * 541 * Used to bring the superblock down and free the private data. 542 * Private data is free'd in ecryptfs_put_super() 543 */ 544static void ecryptfs_kill_block_super(struct super_block *sb) 545{ 546 generic_shutdown_super(sb); 547} 548 549static struct file_system_type ecryptfs_fs_type = { 550 .owner = THIS_MODULE, 551 .name = "ecryptfs", 552 .get_sb = ecryptfs_get_sb, 553 .kill_sb = ecryptfs_kill_block_super, 554 .fs_flags = 0 555}; 556 557/** 558 * inode_info_init_once 559 * 560 * Initializes the ecryptfs_inode_info_cache when it is created 561 */ 562static void 563inode_info_init_once(void *vptr, struct kmem_cache *cachep, unsigned long flags) 564{ 565 struct ecryptfs_inode_info *ei = (struct ecryptfs_inode_info *)vptr; 566 567 inode_init_once(&ei->vfs_inode); 568} 569 570static struct ecryptfs_cache_info { 571 struct kmem_cache **cache; 572 const char *name; 573 size_t size; 574 void (*ctor)(void*, struct kmem_cache *, unsigned long); 575} ecryptfs_cache_infos[] = { 576 { 577 .cache = &ecryptfs_auth_tok_list_item_cache, 578 .name = "ecryptfs_auth_tok_list_item", 579 .size = sizeof(struct ecryptfs_auth_tok_list_item), 580 }, 581 { 582 .cache = &ecryptfs_file_info_cache, 583 .name = "ecryptfs_file_cache", 584 .size = sizeof(struct ecryptfs_file_info), 585 }, 586 { 587 .cache = &ecryptfs_dentry_info_cache, 588 .name = "ecryptfs_dentry_info_cache", 589 .size = sizeof(struct ecryptfs_dentry_info), 590 }, 591 { 592 .cache = &ecryptfs_inode_info_cache, 593 .name = "ecryptfs_inode_cache", 594 .size = sizeof(struct ecryptfs_inode_info), 595 .ctor = inode_info_init_once, 596 }, 597 { 598 .cache = &ecryptfs_sb_info_cache, 599 .name = "ecryptfs_sb_cache", 600 .size = sizeof(struct ecryptfs_sb_info), 601 }, 602 { 603 .cache = &ecryptfs_header_cache_0, 604 .name = "ecryptfs_headers_0", 605 .size = PAGE_CACHE_SIZE, 606 }, 607 { 608 .cache = &ecryptfs_header_cache_1, 609 .name = "ecryptfs_headers_1", 610 .size = PAGE_CACHE_SIZE, 611 }, 612 { 613 .cache = &ecryptfs_header_cache_2, 614 .name = "ecryptfs_headers_2", 615 .size = PAGE_CACHE_SIZE, 616 }, 617 { 618 .cache = &ecryptfs_xattr_cache, 619 .name = "ecryptfs_xattr_cache", 620 .size = PAGE_CACHE_SIZE, 621 }, 622 { 623 .cache = &ecryptfs_lower_page_cache, 624 .name = "ecryptfs_lower_page_cache", 625 .size = PAGE_CACHE_SIZE, 626 }, 627 { 628 .cache = &ecryptfs_key_record_cache, 629 .name = "ecryptfs_key_record_cache", 630 .size = sizeof(struct ecryptfs_key_record), 631 }, 632}; 633 634static void ecryptfs_free_kmem_caches(void) 635{ 636 int i; 637 638 for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) { 639 struct ecryptfs_cache_info *info; 640 641 info = &ecryptfs_cache_infos[i]; 642 if (*(info->cache)) 643 kmem_cache_destroy(*(info->cache)); 644 } 645} 646 647/** 648 * ecryptfs_init_kmem_caches 649 * 650 * Returns zero on success; non-zero otherwise 651 */ 652static int ecryptfs_init_kmem_caches(void) 653{ 654 int i; 655 656 for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) { 657 struct ecryptfs_cache_info *info; 658 659 info = &ecryptfs_cache_infos[i]; 660 *(info->cache) = kmem_cache_create(info->name, info->size, 661 0, SLAB_HWCACHE_ALIGN, info->ctor, NULL); 662 if (!*(info->cache)) { 663 ecryptfs_free_kmem_caches(); 664 ecryptfs_printk(KERN_WARNING, "%s: " 665 "kmem_cache_create failed\n", 666 info->name); 667 return -ENOMEM; 668 } 669 } 670 return 0; 671} 672 673struct ecryptfs_obj { 674 char *name; 675 struct list_head slot_list; 676 struct kobject kobj; 677}; 678 679struct ecryptfs_attribute { 680 struct attribute attr; 681 ssize_t(*show) (struct ecryptfs_obj *, char *); 682 ssize_t(*store) (struct ecryptfs_obj *, const char *, size_t); 683}; 684 685static ssize_t 686ecryptfs_attr_store(struct kobject *kobj, 687 struct attribute *attr, const char *buf, size_t len) 688{ 689 struct ecryptfs_obj *obj = container_of(kobj, struct ecryptfs_obj, 690 kobj); 691 struct ecryptfs_attribute *attribute = 692 container_of(attr, struct ecryptfs_attribute, attr); 693 694 return (attribute->store ? attribute->store(obj, buf, len) : 0); 695} 696 697static ssize_t 698ecryptfs_attr_show(struct kobject *kobj, struct attribute *attr, char *buf) 699{ 700 struct ecryptfs_obj *obj = container_of(kobj, struct ecryptfs_obj, 701 kobj); 702 struct ecryptfs_attribute *attribute = 703 container_of(attr, struct ecryptfs_attribute, attr); 704 705 return (attribute->show ? attribute->show(obj, buf) : 0); 706} 707 708static struct sysfs_ops ecryptfs_sysfs_ops = { 709 .show = ecryptfs_attr_show, 710 .store = ecryptfs_attr_store 711}; 712 713static struct kobj_type ecryptfs_ktype = { 714 .sysfs_ops = &ecryptfs_sysfs_ops 715}; 716 717static decl_subsys(ecryptfs, &ecryptfs_ktype, NULL); 718 719static ssize_t version_show(struct ecryptfs_obj *obj, char *buff) 720{ 721 return snprintf(buff, PAGE_SIZE, "%d\n", ECRYPTFS_VERSIONING_MASK); 722} 723 724static struct ecryptfs_attribute sysfs_attr_version = __ATTR_RO(version); 725 726static struct ecryptfs_version_str_map_elem { 727 u32 flag; 728 char *str; 729} ecryptfs_version_str_map[] = { 730 {ECRYPTFS_VERSIONING_PASSPHRASE, "passphrase"}, 731 {ECRYPTFS_VERSIONING_PUBKEY, "pubkey"}, 732 {ECRYPTFS_VERSIONING_PLAINTEXT_PASSTHROUGH, "plaintext passthrough"}, 733 {ECRYPTFS_VERSIONING_POLICY, "policy"}, 734 {ECRYPTFS_VERSIONING_XATTR, "metadata in extended attribute"} 735}; 736 737static ssize_t version_str_show(struct ecryptfs_obj *obj, char *buff) 738{ 739 int i; 740 int remaining = PAGE_SIZE; 741 int total_written = 0; 742 743 buff[0] = '\0'; 744 for (i = 0; i < ARRAY_SIZE(ecryptfs_version_str_map); i++) { 745 int entry_size; 746 747 if (!(ECRYPTFS_VERSIONING_MASK 748 & ecryptfs_version_str_map[i].flag)) 749 continue; 750 entry_size = strlen(ecryptfs_version_str_map[i].str); 751 if ((entry_size + 2) > remaining) 752 goto out; 753 memcpy(buff, ecryptfs_version_str_map[i].str, entry_size); 754 buff[entry_size++] = '\n'; 755 buff[entry_size] = '\0'; 756 buff += entry_size; 757 total_written += entry_size; 758 remaining -= entry_size; 759 } 760out: 761 return total_written; 762} 763 764static struct ecryptfs_attribute sysfs_attr_version_str = __ATTR_RO(version_str); 765 766static int do_sysfs_registration(void) 767{ 768 int rc; 769 770 if ((rc = subsystem_register(&ecryptfs_subsys))) { 771 printk(KERN_ERR 772 "Unable to register ecryptfs sysfs subsystem\n"); 773 goto out; 774 } 775 rc = sysfs_create_file(&ecryptfs_subsys.kobj, 776 &sysfs_attr_version.attr); 777 if (rc) { 778 printk(KERN_ERR 779 "Unable to create ecryptfs version attribute\n"); 780 subsystem_unregister(&ecryptfs_subsys); 781 goto out; 782 } 783 rc = sysfs_create_file(&ecryptfs_subsys.kobj, 784 &sysfs_attr_version_str.attr); 785 if (rc) { 786 printk(KERN_ERR 787 "Unable to create ecryptfs version_str attribute\n"); 788 sysfs_remove_file(&ecryptfs_subsys.kobj, 789 &sysfs_attr_version.attr); 790 subsystem_unregister(&ecryptfs_subsys); 791 goto out; 792 } 793out: 794 return rc; 795} 796 797static int __init ecryptfs_init(void) 798{ 799 int rc; 800 801 if (ECRYPTFS_DEFAULT_EXTENT_SIZE > PAGE_CACHE_SIZE) { 802 rc = -EINVAL; 803 ecryptfs_printk(KERN_ERR, "The eCryptfs extent size is " 804 "larger than the host's page size, and so " 805 "eCryptfs cannot run on this system. The " 806 "default eCryptfs extent size is [%d] bytes; " 807 "the page size is [%d] bytes.\n", 808 ECRYPTFS_DEFAULT_EXTENT_SIZE, PAGE_CACHE_SIZE); 809 goto out; 810 } 811 rc = ecryptfs_init_kmem_caches(); 812 if (rc) { 813 printk(KERN_ERR 814 "Failed to allocate one or more kmem_cache objects\n"); 815 goto out; 816 } 817 rc = register_filesystem(&ecryptfs_fs_type); 818 if (rc) { 819 printk(KERN_ERR "Failed to register filesystem\n"); 820 ecryptfs_free_kmem_caches(); 821 goto out; 822 } 823 kobj_set_kset_s(&ecryptfs_subsys, fs_subsys); 824 sysfs_attr_version.attr.owner = THIS_MODULE; 825 sysfs_attr_version_str.attr.owner = THIS_MODULE; 826 rc = do_sysfs_registration(); 827 if (rc) { 828 printk(KERN_ERR "sysfs registration failed\n"); 829 unregister_filesystem(&ecryptfs_fs_type); 830 ecryptfs_free_kmem_caches(); 831 goto out; 832 } 833 rc = ecryptfs_init_messaging(ecryptfs_transport); 834 if (rc) { 835 ecryptfs_printk(KERN_ERR, "Failure occured while attempting to " 836 "initialize the eCryptfs netlink socket\n"); 837 } 838out: 839 return rc; 840} 841 842static void __exit ecryptfs_exit(void) 843{ 844 sysfs_remove_file(&ecryptfs_subsys.kobj, 845 &sysfs_attr_version.attr); 846 sysfs_remove_file(&ecryptfs_subsys.kobj, 847 &sysfs_attr_version_str.attr); 848 subsystem_unregister(&ecryptfs_subsys); 849 ecryptfs_release_messaging(ecryptfs_transport); 850 unregister_filesystem(&ecryptfs_fs_type); 851 ecryptfs_free_kmem_caches(); 852} 853 854MODULE_AUTHOR("Michael A. Halcrow <mhalcrow@us.ibm.com>"); 855MODULE_DESCRIPTION("eCryptfs"); 856 857MODULE_LICENSE("GPL"); 858 859module_init(ecryptfs_init) 860module_exit(ecryptfs_exit) 861