long ecryptfs_do_sdp_ioctl(struct file *file, unsigned int cmd, unsigned long arg) {
char filename[NAME_MAX+1] = {0};
void __user *ubuf = (void __user *)arg;
struct dentry *ecryptfs_dentry = file->f_path.dentry;
struct inode *inode = ecryptfs_dentry->d_inode;
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(inode)->crypt_stat;
struct dentry *fp_dentry =
ecryptfs_inode_to_private(inode)->lower_file->f_dentry;
if (fp_dentry->d_name.len <= NAME_MAX)
memcpy(filename, fp_dentry->d_name.name,
fp_dentry->d_name.len + 1);
DEK_LOGD("ecryptfs_do_sdp_ioctl\n");
if (!(crypt_stat->flags & ECRYPTFS_DEK_SDP_ENABLED)) {
DEK_LOGE("SDP not enabled, skip sdp ioctl\n");
return -ENOTTY;
}
switch (cmd) {
case ECRYPTFS_IOCTL_GET_SDP_INFO: {
dek_arg_get_sdp_info req;
DEK_LOGD("ECRYPTFS_IOCTL_GET_SDP_INFO\n");
memset(&req, 0, sizeof(dek_arg_get_sdp_info));
if(copy_from_user(&req, ubuf, sizeof(req))) {
DEK_LOGE("can't copy from user\n");
return -EFAULT;
} else {
mutex_lock(&crypt_stat->cs_mutex);
if (crypt_stat->flags & ECRYPTFS_DEK_SDP_ENABLED) {
req.sdp_enabled = 1;
} else {
req.sdp_enabled = 0;
}
if (crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE) {
req.is_sensitive = 1;
} else {
req.is_sensitive = 0;
}
req.type = crypt_stat->sdp_dek.type;
mutex_unlock(&crypt_stat->cs_mutex);
}
if(copy_to_user(ubuf, &req, sizeof(req))) {
DEK_LOGE("can't copy to user\n");
return -EFAULT;
}
break;
}
case ECRYPTFS_IOCTL_GET_FEK: {
dek_arg_get_fek req;
DEK_LOGD("ECRYPTFS_IOCTL_GET_FEK\n");
if (crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE) {
DEK_LOGE("don't return FEK of sensitive file\n");
return -EFAULT;
}
memset(&req, 0, sizeof(dek_arg_get_fek));
if(copy_from_user(&req, ubuf, sizeof(req))) {
DEK_LOGE("can't copy from user\n");
memset(&req, 0, sizeof(dek_arg_get_fek));
return -EFAULT;
} else {
mutex_lock(&crypt_stat->cs_mutex);
memcpy(req.dek.buf, crypt_stat->key, crypt_stat->key_size);
req.dek.len = crypt_stat->key_size;
req.dek.type = DEK_TYPE_PLAIN;
mutex_unlock(&crypt_stat->cs_mutex);
}
if(copy_to_user(ubuf, &req, sizeof(req))) {
DEK_LOGE("can't copy to user\n");
memset(&req, 0, sizeof(dek_arg_get_fek));
return -EFAULT;
}
memset(&req, 0, sizeof(dek_arg_get_fek));
break;
}
case ECRYPTFS_IOCTL_GET_EFEK: {
dek_arg_get_efek req;
DEK_LOGD("ECRYPTFS_IOCTL_GET_EFEK\n");
memset(&req, 0, sizeof(dek_arg_get_efek));
if(copy_from_user(&req, ubuf, sizeof(req))) {
DEK_LOGE("can't copy from user\n");
memset(&req, 0, sizeof(dek_arg_get_efek));
return -EFAULT;
} else {
mutex_lock(&crypt_stat->cs_mutex);
memcpy(req.dek.buf, crypt_stat->sdp_dek.buf, crypt_stat->sdp_dek.len);
req.dek.len = crypt_stat->sdp_dek.len;
req.dek.type = crypt_stat->sdp_dek.type;
mutex_unlock(&crypt_stat->cs_mutex);
}
if(copy_to_user(ubuf, &req, sizeof(req))) {
DEK_LOGE("can't copy to user\n");
memset(&req, 0, sizeof(dek_arg_get_efek));
return -EFAULT;
}
memset(&req, 0, sizeof(dek_arg_get_efek));
break;
}
case ECRYPTFS_IOCTL_SET_EFEK: {
dek_arg_set_efek req;
DEK_LOGD("ECRYPTFS_IOCTL_SET_EFEK\n");
memset(&req, 0, sizeof(dek_arg_set_efek));
if(copy_from_user(&req, ubuf, sizeof(req))) {
DEK_LOGE("can't copy from user\n");
memset(&req, 0, sizeof(dek_arg_set_efek));
return -EFAULT;
} else {
if(req.dek.len > DEK_MAXLEN) {
DEK_LOGE("ECRYPTFS_IOCTL_SET_EFEK invalid EFEK len %d\n",
req.dek.len);
return -EINVAL;
}
if (req.dek.type != DEK_TYPE_PLAIN) {
mutex_lock(&crypt_stat->cs_mutex);
memcpy(crypt_stat->sdp_dek.buf, req.dek.buf, req.dek.len);
crypt_stat->sdp_dek.len = req.dek.len;
crypt_stat->sdp_dek.type = req.dek.type;
memset(crypt_stat->key, 0, crypt_stat->key_size);
crypt_stat->flags &= ~(ECRYPTFS_KEY_SET);
mutex_unlock(&crypt_stat->cs_mutex);
ecryptfs_update_crypt_flag(ecryptfs_dentry, 1);
} else {
DEK_LOGE("failed to set EFEK\n");
memset(&req, 0, sizeof(dek_arg_set_efek));
return -EFAULT;
}
}
memset(&req, 0, sizeof(dek_arg_set_efek));
break;
}
default: {
return -EINVAL;
break;
}
}
return 0;
}
/**
* ecryptfs_prepare_write
* @file: The eCryptfs file
* @page: The eCryptfs page
* @from: The start byte from which we will write
* @to: The end byte to which we will write
*
* This function must zero any hole we create
*
* Returns zero on success; non-zero otherwise
*/
static int ecryptfs_prepare_write(struct file *file, struct page *page,
unsigned from, unsigned to)
{
loff_t prev_page_end_size;
int rc = 0;
if (!PageUptodate(page)) {
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(
file->f_dentry->d_inode)->crypt_stat;
if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)
|| (crypt_stat->flags & ECRYPTFS_NEW_FILE)) {
rc = ecryptfs_read_lower_page_segment(
page, page->index, 0, PAGE_CACHE_SIZE,
page->mapping->host);
if (rc) {
printk(KERN_ERR "%s: Error attemping to read "
"lower page segment; rc = [%d]\n",
__func__, rc);
ClearPageUptodate(page);
goto out;
} else
SetPageUptodate(page);
} else if (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED) {
if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
rc = ecryptfs_copy_up_encrypted_with_header(
page, crypt_stat);
if (rc) {
printk(KERN_ERR "%s: Error attempting "
"to copy the encrypted content "
"from the lower file whilst "
"inserting the metadata from "
"the xattr into the header; rc "
"= [%d]\n", __func__, rc);
ClearPageUptodate(page);
goto out;
}
SetPageUptodate(page);
} else {
rc = ecryptfs_read_lower_page_segment(
page, page->index, 0, PAGE_CACHE_SIZE,
page->mapping->host);
if (rc) {
printk(KERN_ERR "%s: Error reading "
"page; rc = [%d]\n",
__func__, rc);
ClearPageUptodate(page);
goto out;
}
SetPageUptodate(page);
}
} else {
rc = ecryptfs_decrypt_page(page);
if (rc) {
printk(KERN_ERR "%s: Error decrypting page "
"at index [%ld]; rc = [%d]\n",
__func__, page->index, rc);
ClearPageUptodate(page);
goto out;
}
SetPageUptodate(page);
}
}
prev_page_end_size = ((loff_t)page->index << PAGE_CACHE_SHIFT);
/* If creating a page or more of holes, zero them out via truncate.
* Note, this will increase i_size. */
if (page->index != 0) {
if (prev_page_end_size > i_size_read(page->mapping->host)) {
rc = ecryptfs_truncate(file->f_dentry,
prev_page_end_size);
if (rc) {
printk(KERN_ERR "%s: Error on attempt to "
"truncate to (higher) offset [%lld];"
" rc = [%d]\n", __func__,
prev_page_end_size, rc);
goto out;
}
}
}
/* Writing to a new page, and creating a small hole from start
* of page? Zero it out. */
if ((i_size_read(page->mapping->host) == prev_page_end_size)
&& (from != 0))
zero_user(page, 0, PAGE_CACHE_SIZE);
out:
return rc;
}
static int
ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
struct inode *new_dir, struct dentry *new_dentry)
{
int rc;
struct dentry *lower_old_dentry;
struct dentry *lower_new_dentry;
struct dentry *lower_old_dir_dentry;
struct dentry *lower_new_dir_dentry;
struct dentry *trap = NULL;
struct inode *target_inode;
#ifdef CONFIG_DLP
sdp_fs_command_t *cmd1 = NULL;
unsigned long old_inode = old_dentry->d_inode->i_ino;
#endif
#ifdef CONFIG_SDP
sdp_fs_command_t *cmd = NULL;
int rename_event = 0x00;
struct ecryptfs_crypt_stat *crypt_stat =
&(ecryptfs_inode_to_private(old_dentry->d_inode)->crypt_stat);
struct ecryptfs_crypt_stat *parent_crypt_stat =
&(ecryptfs_inode_to_private(old_dentry->d_parent->d_inode)->crypt_stat);
struct ecryptfs_crypt_stat *new_parent_crypt_stat =
&(ecryptfs_inode_to_private(new_dentry->d_parent->d_inode)->crypt_stat);
struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
&ecryptfs_superblock_to_private(old_dentry->d_sb)->mount_crypt_stat;
#if ECRYPTFS_SDP_RENAME_DEBUG
printk("You're renaming %s to %s\n",
old_dentry->d_name.name,
new_dentry->d_name.name);
printk("old_dentry[%p] : %s [parent %s : %s] inode:%p\n",
old_dentry, old_dentry->d_name.name,
old_dentry->d_parent->d_name.name,
IS_SENSITIVE_DENTRY(old_dentry->d_parent) ? "sensitive" : "protected",
old_dentry->d_inode);
printk("new_dentry[%p] : %s [parent %s : %s] inode:%p\n",
new_dentry, new_dentry->d_name.name,
new_dentry->d_parent->d_name.name,
IS_SENSITIVE_DENTRY(new_dentry->d_parent) ? "sensitive" : "protected",
new_dentry->d_inode);
#endif
if(IS_CHAMBER_DENTRY(old_dentry)) {
printk("Rename trial on chamber : failed\n");
return -EIO;
}
#if 0 // kernel panic. new_crypt_stat->engine_id
if(IS_SENSITIVE_DENTRY(old_dentry->d_parent) &&
IS_SENSITIVE_DENTRY(new_dentry->d_parent)) {
if(crypt_stat->engine_id != new_crypt_stat->engine_id) {
printk("Rename chamber file to another chamber : failed\n");
return -EIO;
}
}
#endif
if(IS_SENSITIVE_DENTRY(old_dentry->d_parent)) {
if(ecryptfs_is_sdp_locked(parent_crypt_stat->engine_id)) {
printk("Rename/move trial in locked state\n");
return -EIO;
}
}
if(IS_SENSITIVE_DENTRY(old_dentry->d_parent) &&
IS_SENSITIVE_DENTRY(new_dentry->d_parent)) {
if(parent_crypt_stat->engine_id != new_parent_crypt_stat->engine_id) {
printk("Can't move between chambers\n");
return -EIO;
}
}
if(IS_SENSITIVE_DENTRY(old_dentry->d_parent) &&
!IS_SENSITIVE_DENTRY(new_dentry->d_parent))
rename_event |= ECRYPTFS_EVT_RENAME_OUT_OF_CHAMBER;
if(!IS_SENSITIVE_DENTRY(old_dentry->d_parent) &&
IS_SENSITIVE_DENTRY(new_dentry->d_parent))
rename_event |= ECRYPTFS_EVT_RENAME_TO_CHAMBER;
#endif
lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
dget(lower_old_dentry);
dget(lower_new_dentry);
lower_old_dir_dentry = dget_parent(lower_old_dentry);
lower_new_dir_dentry = dget_parent(lower_new_dentry);
target_inode = new_dentry->d_inode;
trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
/* source should not be ancestor of target */
if (trap == lower_old_dentry) {
rc = -EINVAL;
goto out_lock;
}
/* target should not be ancestor of source */
if (trap == lower_new_dentry) {
rc = -ENOTEMPTY;
goto out_lock;
}
rc = vfs_rename(lower_old_dir_dentry->d_inode, lower_old_dentry,
lower_new_dir_dentry->d_inode, lower_new_dentry);
if (rc)
goto out_lock;
if (target_inode)
fsstack_copy_attr_all(target_inode,
ecryptfs_inode_to_lower(target_inode));
fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode);
if (new_dir != old_dir)
fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
#ifdef CONFIG_SDP
if(!rc) {
crypt_stat = &(ecryptfs_inode_to_private(old_dentry->d_inode)->crypt_stat);
if(rename_event > 0) {
switch(rename_event) {
case ECRYPTFS_EVT_RENAME_TO_CHAMBER:
cmd = sdp_fs_command_alloc(FSOP_SDP_SET_SENSITIVE, current->pid,
mount_crypt_stat->userid, mount_crypt_stat->partition_id,
old_dentry->d_inode->i_ino,
GFP_NOFS);
break;
case ECRYPTFS_EVT_RENAME_OUT_OF_CHAMBER:
cmd = sdp_fs_command_alloc(FSOP_SDP_SET_PROTECTED, current->pid,
mount_crypt_stat->userid, mount_crypt_stat->partition_id,
old_dentry->d_inode->i_ino,
GFP_NOFS);
break;
default:
cmd = NULL;
break;
}
}
#if ECRYPTFS_SDP_RENAME_DEBUG
printk("[end of rename] old_dentry[%p] : %s [parent %s : %s] inode:%p\n",
old_dentry, old_dentry->d_name.name,
old_dentry->d_parent->d_name.name,
IS_SENSITIVE_DENTRY(old_dentry->d_parent) ? "sensitive" : "protected",
old_dentry->d_inode);
printk("[end of rename] new_dentry[%p] : %s [parent %s : %s] inode:%p\n",
new_dentry, new_dentry->d_name.name,
new_dentry->d_parent->d_name.name,
IS_SENSITIVE_DENTRY(new_dentry->d_parent) ? "sensitive" : "protected",
new_dentry->d_inode);
#endif
}
#endif
out_lock:
unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
dput(lower_new_dir_dentry);
dput(lower_old_dir_dentry);
dput(lower_new_dentry);
dput(lower_old_dentry);
#ifdef CONFIG_SDP
if(!rc && cmd != NULL) {
sdp_fs_request(cmd, ecryptfs_fs_request_callback);
sdp_fs_command_free(cmd);
}
#endif
#ifdef CONFIG_DLP
//create new init command and send--Handle transient case MS-Apps
if(crypt_stat->flags & ECRYPTFS_DLP_ENABLED) {
if(!rc && (in_egroup_p(AID_KNOX_DLP) || in_egroup_p(AID_KNOX_DLP_RESTRICTED))){
cmd1 = sdp_fs_command_alloc(FSOP_DLP_FILE_RENAME,
current->tgid, mount_crypt_stat->userid, mount_crypt_stat->partition_id,
old_inode, GFP_KERNEL);
//send cmd
if(cmd1) {
sdp_fs_request(cmd1, NULL);
sdp_fs_command_free(cmd1);
}
}
}
//end- Handle transient case MS-Apps
#endif
return rc;
}
/**
* ecryptfs_open
* @inode: inode speciying file to open
* @file: Structure to return filled in
*
* Opens the file specified by inode.
*
* Returns zero on success; non-zero otherwise
*/
static int ecryptfs_open(struct inode *inode, struct file *file)
{
int rc = 0;
struct ecryptfs_crypt_stat *crypt_stat = NULL;
struct dentry *ecryptfs_dentry = file->f_path.dentry;
/* Private value of ecryptfs_dentry allocated in
* ecryptfs_lookup() */
struct dentry *lower_dentry;
struct ecryptfs_file_info *file_info;
/* Released in ecryptfs_release or end of function if failure */
file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
ecryptfs_set_file_private(file, file_info);
if (!file_info) {
ecryptfs_printk(KERN_ERR,
"Error attempting to allocate memory\n");
rc = -ENOMEM;
goto out;
}
lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mutex_lock(&crypt_stat->cs_mutex);
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)) {
ecryptfs_printk(KERN_DEBUG, "Setting flags for stat...\n");
/* Policy code enabled in future release */
crypt_stat->flags |= (ECRYPTFS_POLICY_APPLIED
| ECRYPTFS_ENCRYPTED);
}
mutex_unlock(&crypt_stat->cs_mutex);
rc = ecryptfs_get_lower_file(ecryptfs_dentry, inode);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the lower file for the dentry with name "
"[%s]; rc = [%d]\n", __func__,
ecryptfs_dentry->d_name.name, rc);
goto out_free;
}
if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_ACCMODE)
== O_RDONLY && (file->f_flags & O_ACCMODE) != O_RDONLY) {
rc = -EPERM;
printk(KERN_WARNING "%s: Lower file is RO; eCryptfs "
"file must hence be opened RO\n", __func__);
goto out_put;
}
ecryptfs_set_file_lower(
file, ecryptfs_inode_to_private(inode)->lower_file);
if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
mutex_lock(&crypt_stat->cs_mutex);
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
rc = 0;
goto out;
}
rc = read_or_initialize_metadata(ecryptfs_dentry);
if (rc)
goto out_put;
ecryptfs_printk(KERN_DEBUG, "inode w/ addr = [0x%p], i_ino = "
"[0x%.16lx] size: [0x%.16llx]\n", inode, inode->i_ino,
(unsigned long long)i_size_read(inode));
goto out;
out_put:
ecryptfs_put_lower_file(inode);
out_free:
kmem_cache_free(ecryptfs_file_info_cache,
ecryptfs_file_to_private(file));
out:
return rc;
}
/**
* ecryptfs_initialize_file
*
* Cause the file to be changed from a basic empty file to an ecryptfs
* file with a header and first data page.
*
* Returns zero on success
*/
static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry)
{
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->crypt_stat;
int rc = 0;
if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
goto out;
}
ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n");
rc = ecryptfs_new_file_context(ecryptfs_dentry);
if (rc) {
ecryptfs_printk(KERN_ERR, "Error creating new file "
"context; rc = [%d]\n", rc);
goto out;
}
rc = ecryptfs_get_lower_file(ecryptfs_dentry,
ecryptfs_dentry->d_inode);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the lower file for the dentry with name "
"[%s]; rc = [%d]\n", __func__,
ecryptfs_dentry->d_name.name, rc);
goto out;
}
#ifdef CONFIG_WTL_ENCRYPTION_FILTER
mutex_lock(&crypt_stat->cs_mutex);
if (crypt_stat->flags & ECRYPTFS_ENCRYPTED) {
struct dentry *fp_dentry =
ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)
->lower_file->f_dentry;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
&ecryptfs_superblock_to_private(ecryptfs_dentry->d_sb)
->mount_crypt_stat;
char filename[256];
strcpy(filename, fp_dentry->d_name.name);
if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_NEW_PASSTHROUGH)
|| ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_FILTERING) &&
(is_file_name_match(mount_crypt_stat, fp_dentry) ||
is_file_ext_match(mount_crypt_stat, filename)))) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
ecryptfs_put_lower_file(ecryptfs_dentry->d_inode);
} else {
rc = ecryptfs_write_metadata(ecryptfs_dentry);
if (rc)
printk(
KERN_ERR "Error writing headers; rc = [%d]\n"
, rc);
ecryptfs_put_lower_file(ecryptfs_dentry->d_inode);
}
}
mutex_unlock(&crypt_stat->cs_mutex);
#else
rc = ecryptfs_write_metadata(ecryptfs_dentry);
if (rc)
printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
ecryptfs_put_lower_file(ecryptfs_dentry->d_inode);
#endif
out:
return rc;
}
/**
* ecryptfs_lookup
* @dir: inode
* @dentry: The dentry
* @nd: nameidata, may be NULL
*
* Find a file on disk. If the file does not exist, then we'll add it to the
* dentry cache and continue on to read it from the disk.
*/
static struct dentry *ecryptfs_lookup(struct inode *dir, struct dentry *dentry,
struct nameidata *nd)
{
int rc = 0;
struct dentry *lower_dir_dentry;
struct dentry *lower_dentry;
struct vfsmount *lower_mnt;
char *encoded_name;
int encoded_namelen;
struct ecryptfs_crypt_stat *crypt_stat = NULL;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
char *page_virt = NULL;
struct inode *lower_inode;
u64 file_size;
lower_dir_dentry = ecryptfs_dentry_to_lower(dentry->d_parent);
dentry->d_op = &ecryptfs_dops;
if ((dentry->d_name.len == 1 && !strcmp(dentry->d_name.name, "."))
|| (dentry->d_name.len == 2
&& !strcmp(dentry->d_name.name, ".."))) {
d_drop(dentry);
goto out;
}
encoded_namelen = ecryptfs_encode_filename(crypt_stat,
dentry->d_name.name,
dentry->d_name.len,
&encoded_name);
if (encoded_namelen < 0) {
rc = encoded_namelen;
d_drop(dentry);
goto out;
}
ecryptfs_printk(KERN_DEBUG, "encoded_name = [%s]; encoded_namelen "
"= [%d]\n", encoded_name, encoded_namelen);
lower_dentry = lookup_one_len(encoded_name, lower_dir_dentry,
encoded_namelen - 1);
kfree(encoded_name);
if (IS_ERR(lower_dentry)) {
ecryptfs_printk(KERN_ERR, "ERR from lower_dentry\n");
rc = PTR_ERR(lower_dentry);
d_drop(dentry);
goto out;
}
lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
ecryptfs_printk(KERN_DEBUG, "lower_dentry = [%p]; lower_dentry->"
"d_name.name = [%s]\n", lower_dentry,
lower_dentry->d_name.name);
lower_inode = lower_dentry->d_inode;
fsstack_copy_attr_atime(dir, lower_dir_dentry->d_inode);
BUG_ON(!atomic_read(&lower_dentry->d_count));
ecryptfs_set_dentry_private(dentry,
kmem_cache_alloc(ecryptfs_dentry_info_cache,
GFP_KERNEL));
if (!ecryptfs_dentry_to_private(dentry)) {
rc = -ENOMEM;
ecryptfs_printk(KERN_ERR, "Out of memory whilst attempting "
"to allocate ecryptfs_dentry_info struct\n");
goto out_dput;
}
ecryptfs_set_dentry_lower(dentry, lower_dentry);
ecryptfs_set_dentry_lower_mnt(dentry, lower_mnt);
if (!lower_dentry->d_inode) {
/* We want to add because we couldn't find in lower */
d_add(dentry, NULL);
goto out;
}
rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb,
ECRYPTFS_INTERPOSE_FLAG_D_ADD);
if (rc) {
ecryptfs_printk(KERN_ERR, "Error interposing\n");
goto out;
}
if (S_ISDIR(lower_inode->i_mode)) {
ecryptfs_printk(KERN_DEBUG, "Is a directory; returning\n");
goto out;
}
if (S_ISLNK(lower_inode->i_mode)) {
ecryptfs_printk(KERN_DEBUG, "Is a symlink; returning\n");
goto out;
}
if (special_file(lower_inode->i_mode)) {
ecryptfs_printk(KERN_DEBUG, "Is a special file; returning\n");
goto out;
}
if (!nd) {
ecryptfs_printk(KERN_DEBUG, "We have a NULL nd, just leave"
"as we *think* we are about to unlink\n");
goto out;
}
/* Released in this function */
page_virt = kmem_cache_zalloc(ecryptfs_header_cache_2,
GFP_USER);
if (!page_virt) {
rc = -ENOMEM;
ecryptfs_printk(KERN_ERR,
"Cannot ecryptfs_kmalloc a page\n");
goto out;
}
crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
ecryptfs_set_default_sizes(crypt_stat);
if (!ecryptfs_inode_to_private(dentry->d_inode)->lower_file) {
rc = ecryptfs_init_persistent_file(dentry);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the persistent file for the dentry with name "
"[%s]; rc = [%d]\n", __func__,
dentry->d_name.name, rc);
goto out;
}
}
rc = ecryptfs_read_and_validate_header_region(page_virt,
dentry->d_inode);
if (rc) {
rc = ecryptfs_read_and_validate_xattr_region(page_virt, dentry);
if (rc) {
printk(KERN_DEBUG "Valid metadata not found in header "
"region or xattr region; treating file as "
"unencrypted\n");
rc = 0;
kmem_cache_free(ecryptfs_header_cache_2, page_virt);
goto out;
}
crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
}
mount_crypt_stat = &ecryptfs_superblock_to_private(
dentry->d_sb)->mount_crypt_stat;
if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) {
if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
file_size = (crypt_stat->num_header_bytes_at_front
+ i_size_read(lower_dentry->d_inode));
else
file_size = i_size_read(lower_dentry->d_inode);
} else {
file_size = get_unaligned_be64(page_virt);
}
i_size_write(dentry->d_inode, (loff_t)file_size);
kmem_cache_free(ecryptfs_header_cache_2, page_virt);
goto out;
out_dput:
dput(lower_dentry);
d_drop(dentry);
out:
return ERR_PTR(rc);
}
/**
* ecryptfs_open
* @inode: inode speciying file to open
* @file: Structure to return filled in
*
* Opens the file specified by inode.
*
* Returns zero on success; non-zero otherwise
*/
static int ecryptfs_open(struct inode *inode, struct file *file)
{
int rc = 0;
struct ecryptfs_crypt_stat *crypt_stat = NULL;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct dentry *ecryptfs_dentry = file->f_path.dentry;
/* Private value of ecryptfs_dentry allocated in
* ecryptfs_lookup() */
struct dentry *lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
struct ecryptfs_file_info *file_info;
mount_crypt_stat = &ecryptfs_superblock_to_private(
ecryptfs_dentry->d_sb)->mount_crypt_stat;
if ((mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
&& ((file->f_flags & O_WRONLY) || (file->f_flags & O_RDWR)
|| (file->f_flags & O_CREAT) || (file->f_flags & O_TRUNC)
|| (file->f_flags & O_APPEND))) {
printk(KERN_WARNING "Mount has encrypted view enabled; "
"files may only be read\n");
rc = -EPERM;
goto out;
}
/* Released in ecryptfs_release or end of function if failure */
file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
ecryptfs_set_file_private(file, file_info);
if (!file_info) {
ecryptfs_printk(KERN_ERR,
"Error attempting to allocate memory\n");
rc = -ENOMEM;
goto out;
}
lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mutex_lock(&crypt_stat->cs_mutex);
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)) {
ecryptfs_printk(KERN_DEBUG, "Setting flags for stat...\n");
/* Policy code enabled in future release */
crypt_stat->flags |= (ECRYPTFS_POLICY_APPLIED
| ECRYPTFS_ENCRYPTED);
}
mutex_unlock(&crypt_stat->cs_mutex);
ecryptfs_set_file_lower(
file, ecryptfs_inode_to_private(inode)->lower_file);
if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
mutex_lock(&crypt_stat->cs_mutex);
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
rc = 0;
goto out;
}
mutex_lock(&crypt_stat->cs_mutex);
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)
|| !(crypt_stat->flags & ECRYPTFS_KEY_VALID)) {
rc = ecryptfs_read_metadata(ecryptfs_dentry);
if (rc) {
ecryptfs_printk(KERN_DEBUG,
"Valid headers not found\n");
if (!(mount_crypt_stat->flags
& ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
rc = -EIO;
printk(KERN_WARNING "Either the lower file "
"is not in a valid eCryptfs format, "
"or the key could not be retrieved. "
"Plaintext passthrough mode is not "
"enabled; returning -EIO\n");
mutex_unlock(&crypt_stat->cs_mutex);
goto out_free;
}
rc = 0;
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
goto out;
}
}
mutex_unlock(&crypt_stat->cs_mutex);
ecryptfs_printk(KERN_DEBUG, "inode w/ addr = [0x%p], i_ino = [0x%.16x] "
"size: [0x%.16x]\n", inode, inode->i_ino,
i_size_read(inode));
goto out;
out_free:
kmem_cache_free(ecryptfs_file_info_cache,
ecryptfs_file_to_private(file));
out:
return rc;
}
/**
* ecryptfs_readpage
* @file: An eCryptfs file
* @page: Page from eCryptfs inode mapping into which to stick the read data
*
* Read in a page, decrypting if necessary.
*
* Returns zero on success; non-zero on error.
*/
static int ecryptfs_readpage(struct file *file, struct page *page)
{
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(page->mapping->host)->crypt_stat;
#ifdef CONFIG_CRYPTO_DEV_KFIPS
struct ecryptfs_page_crypt_req *page_crypt_req = NULL;
#endif
int rc = 0;
if (!crypt_stat || !(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
rc = ecryptfs_read_lower_page_segment(page, page->index, 0,
PAGE_CACHE_SIZE,
page->mapping->host);
} else if (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED) {
if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
rc = ecryptfs_copy_up_encrypted_with_header(page,
crypt_stat);
if (rc) {
printk(KERN_ERR "%s: Error attempting to copy "
"the encrypted content from the lower "
"file whilst inserting the metadata "
"from the xattr into the header; rc = "
"[%d]\n", __func__, rc);
goto out;
}
} else {
rc = ecryptfs_read_lower_page_segment(
page, page->index, 0, PAGE_CACHE_SIZE,
page->mapping->host);
if (rc) {
printk(KERN_ERR "Error reading page; rc = "
"[%d]\n", rc);
goto out;
}
}
} else {
#ifndef CONFIG_CRYPTO_DEV_KFIPS
rc = ecryptfs_decrypt_page(page);
if (rc) {
ecryptfs_printk(KERN_ERR, "Error decrypting page; "
"rc = [%d]\n", rc);
#else
page_crypt_req = ecryptfs_alloc_page_crypt_req(
page, ecryptfs_readpage_complete);
if (!page_crypt_req) {
rc = -ENOMEM;
ecryptfs_printk(KERN_ERR,
"Failed to allocate page crypt request "
"for decryption\n");
#endif
goto out;
}
#ifdef CONFIG_CRYPTO_DEV_KFIPS
ecryptfs_decrypt_page_async(page_crypt_req);
goto out_async_started;
#endif
}
out:
#ifndef CONFIG_CRYPTO_DEV_KFIPS
if (rc)
#else
if (unlikely(rc))
#endif
ClearPageUptodate(page);
else
SetPageUptodate(page);
ecryptfs_printk(KERN_DEBUG, "Unlocking page with index = [0x%.16lx]\n",
page->index);
unlock_page(page);
#ifdef CONFIG_CRYPTO_DEV_KFIPS
out_async_started:
#endif
return rc;
}
/**
* Called with lower inode mutex held.
*/
static int fill_zeros_to_end_of_page(struct page *page, unsigned int to)
{
struct inode *inode = page->mapping->host;
int end_byte_in_page;
if ((i_size_read(inode) / PAGE_CACHE_SIZE) != page->index)
goto out;
end_byte_in_page = i_size_read(inode) % PAGE_CACHE_SIZE;
if (to > end_byte_in_page)
end_byte_in_page = to;
zero_user_segment(page, end_byte_in_page, PAGE_CACHE_SIZE);
out:
return 0;
}
/**
* ecryptfs_write_begin
* @file: The eCryptfs file
* @mapping: The eCryptfs object
* @pos: The file offset at which to start writing
* @len: Length of the write
* @flags: Various flags
* @pagep: Pointer to return the page
* @fsdata: Pointer to return fs data (unused)
*
* This function must zero any hole we create
*
* Returns zero on success; non-zero otherwise
*/
static int ecryptfs_write_begin(struct file *file,
struct address_space *mapping,
loff_t pos, unsigned len, unsigned flags,
struct page **pagep, void **fsdata)
{
pgoff_t index = pos >> PAGE_CACHE_SHIFT;
struct page *page;
loff_t prev_page_end_size;
int rc = 0;
page = grab_cache_page_write_begin(mapping, index, flags);
if (!page)
return -ENOMEM;
*pagep = page;
prev_page_end_size = ((loff_t)index << PAGE_CACHE_SHIFT);
if (!PageUptodate(page)) {
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(mapping->host)->crypt_stat;
if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
rc = ecryptfs_read_lower_page_segment(
page, index, 0, PAGE_CACHE_SIZE, mapping->host);
if (rc) {
printk(KERN_ERR "%s: Error attemping to read "
"lower page segment; rc = [%d]\n",
__func__, rc);
ClearPageUptodate(page);
goto out;
} else
SetPageUptodate(page);
} else if (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED) {
if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
rc = ecryptfs_copy_up_encrypted_with_header(
page, crypt_stat);
if (rc) {
printk(KERN_ERR "%s: Error attempting "
"to copy the encrypted content "
"from the lower file whilst "
"inserting the metadata from "
"the xattr into the header; rc "
"= [%d]\n", __func__, rc);
ClearPageUptodate(page);
goto out;
}
SetPageUptodate(page);
} else {
rc = ecryptfs_read_lower_page_segment(
page, index, 0, PAGE_CACHE_SIZE,
mapping->host);
if (rc) {
printk(KERN_ERR "%s: Error reading "
"page; rc = [%d]\n",
__func__, rc);
ClearPageUptodate(page);
goto out;
}
SetPageUptodate(page);
}
} else {
if (prev_page_end_size
>= i_size_read(page->mapping->host)) {
zero_user(page, 0, PAGE_CACHE_SIZE);
} else {
rc = ecryptfs_decrypt_page(page);
if (rc) {
printk(KERN_ERR "%s: Error decrypting "
"page at index [%ld]; "
"rc = [%d]\n",
__func__, page->index, rc);
ClearPageUptodate(page);
goto out;
}
}
SetPageUptodate(page);
}
}
/* If creating a page or more of holes, zero them out via truncate.
* Note, this will increase i_size. */
if (index != 0) {
if (prev_page_end_size > i_size_read(page->mapping->host)) {
rc = ecryptfs_truncate(file->f_path.dentry,
prev_page_end_size);
if (rc) {
printk(KERN_ERR "%s: Error on attempt to "
"truncate to (higher) offset [%lld];"
" rc = [%d]\n", __func__,
prev_page_end_size, rc);
goto out;
}
}
}
/* Writing to a new page, and creating a small hole from start
* of page? Zero it out. */
if ((i_size_read(mapping->host) == prev_page_end_size)
&& (pos != 0))
zero_user(page, 0, PAGE_CACHE_SIZE);
out:
if (unlikely(rc)) {
unlock_page(page);
page_cache_release(page);
*pagep = NULL;
}
return rc;
}
/**
* ecryptfs_writepage
* @page: Page that is locked before this call is made
*
* Returns zero on success; non-zero otherwise
*
* This is where we encrypt the data and pass the encrypted data to
* the lower filesystem. In OpenPGP-compatible mode, we operate on
* entire underlying packets.
*/
static int ecryptfs_writepage(struct page *page, struct writeback_control *wbc)
{
#ifndef CONFIG_CRYPTO_DEV_KFIPS
int rc;
#else
struct ecryptfs_page_crypt_req *page_crypt_req;
int rc = 0;
#endif
#if 1 // FEATURE_SDCARD_ENCRYPTION
struct inode *ecryptfs_inode;
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(page->mapping->host)->crypt_stat;
ecryptfs_inode = page->mapping->host;
#endif
/*
* Refuse to write the page out if we are called from reclaim context
* since our writepage() path may potentially allocate memory when
* calling into the lower fs vfs_write() which may in turn invoke
* us again.
*/
if (current->flags & PF_MEMALLOC) {
redirty_page_for_writepage(wbc, page);
#ifndef CONFIG_CRYPTO_DEV_KFIPS
rc = 0;
#endif
goto out;
}
#if 1 // FEATURE_SDCARD_ENCRYPTION
if (!crypt_stat || !(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
ecryptfs_printk(KERN_DEBUG,
"Passing through unencrypted page\n");
rc = ecryptfs_write_lower_page_segment(ecryptfs_inode, page,
0, PAGE_CACHE_SIZE);
if (rc) {
ClearPageUptodate(page);
goto out;
}
SetPageUptodate(page);
} else {
#ifndef CONFIG_CRYPTO_DEV_KFIPS
rc = ecryptfs_encrypt_page(page);
if (rc) {
ecryptfs_printk(KERN_WARNING, "Error encrypting "
"page (upper index [0x%.16lx])\n", page->index);
ClearPageUptodate(page);
#else
// rc = ecryptfs_encrypt_page(page);
// if (rc) {
// ecryptfs_printk(KERN_WARNING, "Error encrypting "
// "page (upper index [0x%.16lx])\n", page->index);
// ClearPageUptodate(page);
page_crypt_req = ecryptfs_alloc_page_crypt_req(
page, ecryptfs_writepage_complete);
if (unlikely(!page_crypt_req)) {
rc = -ENOMEM;
ecryptfs_printk(KERN_ERR,
"Failed to allocate page crypt request "
"for encryption\n");
#endif
goto out;
}
#ifndef CONFIG_CRYPTO_DEV_KFIPS
SetPageUptodate(page);
#else
// SetPageUptodate(page);
set_page_writeback(page);
ecryptfs_encrypt_page_async(page_crypt_req);
#endif
}
#else
rc = ecryptfs_encrypt_page(page);
if (rc) {
ecryptfs_printk(KERN_WARNING, "Error encrypting "
"page (upper index [0x%.16lx])\n", page->index);
ClearPageUptodate(page);
goto out;
}
SetPageUptodate(page);
#endif
out:
unlock_page(page);
return rc;
}
static void strip_xattr_flag(char *page_virt,
struct ecryptfs_crypt_stat *crypt_stat)
{
if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
size_t written;
crypt_stat->flags &= ~ECRYPTFS_METADATA_IN_XATTR;
ecryptfs_write_crypt_stat_flags(page_virt, crypt_stat,
&written);
crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
}
}
/**
* Header Extent:
* Octets 0-7: Unencrypted file size (big-endian)
* Octets 8-15: eCryptfs special marker
* Octets 16-19: Flags
* Octet 16: File format version number (between 0 and 255)
* Octets 17-18: Reserved
* Octet 19: Bit 1 (lsb): Reserved
* Bit 2: Encrypted?
* Bits 3-8: Reserved
* Octets 20-23: Header extent size (big-endian)
* Octets 24-25: Number of header extents at front of file
* (big-endian)
* Octet 26: Begin RFC 2440 authentication token packet set
*/
/**
* ecryptfs_copy_up_encrypted_with_header
* @page: Sort of a ``virtual'' representation of the encrypted lower
* file. The actual lower file does not have the metadata in
* the header. This is locked.
* @crypt_stat: The eCryptfs inode's cryptographic context
*
* The ``view'' is the version of the file that userspace winds up
* seeing, with the header information inserted.
*/
static int
ecryptfs_copy_up_encrypted_with_header(struct page *page,
struct ecryptfs_crypt_stat *crypt_stat)
{
loff_t extent_num_in_page = 0;
loff_t num_extents_per_page = (PAGE_CACHE_SIZE
/ crypt_stat->extent_size);
int rc = 0;
while (extent_num_in_page < num_extents_per_page) {
loff_t view_extent_num = ((((loff_t)page->index)
* num_extents_per_page)
+ extent_num_in_page);
size_t num_header_extents_at_front =
(crypt_stat->metadata_size / crypt_stat->extent_size);
if (view_extent_num < num_header_extents_at_front) {
/* This is a header extent */
char *page_virt;
page_virt = kmap_atomic(page);
memset(page_virt, 0, PAGE_CACHE_SIZE);
/* TODO: Support more than one header extent */
if (view_extent_num == 0) {
size_t written;
rc = ecryptfs_read_xattr_region(
page_virt, page->mapping->host);
strip_xattr_flag(page_virt + 16, crypt_stat);
ecryptfs_write_header_metadata(page_virt + 20,
crypt_stat,
&written);
}
kunmap_atomic(page_virt);
flush_dcache_page(page);
if (rc) {
printk(KERN_ERR "%s: Error reading xattr "
"region; rc = [%d]\n", __func__, rc);
goto out;
}
} else {
/* This is an encrypted data extent */
loff_t lower_offset =
((view_extent_num * crypt_stat->extent_size)
- crypt_stat->metadata_size);
rc = ecryptfs_read_lower_page_segment(
page, (lower_offset >> PAGE_CACHE_SHIFT),
(lower_offset & ~PAGE_CACHE_MASK),
crypt_stat->extent_size, page->mapping->host);
if (rc) {
printk(KERN_ERR "%s: Error attempting to read "
"extent at offset [%lld] in the lower "
"file; rc = [%d]\n", __func__,
lower_offset, rc);
goto out;
}
}
extent_num_in_page++;
}
out:
return rc;
}
/*
* ecryptfs_readpages
* This is kernel code, not Java.
*
* Read in multiple pages and decrypt them if necessary.
*/
static int ecryptfs_readpages(struct file *filp, struct address_space *mapping,
struct list_head *pages, unsigned nr_pages)
{
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(mapping->host)->crypt_stat;
struct page **pgs = NULL;
unsigned int page_idx = 0;
int rc = 0;
int nodec = 0; //no decryption needed flag
/* u32 sz = 0; */
if (!crypt_stat
|| !(crypt_stat->flags & ECRYPTFS_ENCRYPTED)
|| (crypt_stat->flags & ECRYPTFS_NEW_FILE)
|| (crypt_stat->flags & ECRYPTFS_VIEW_AS_ENCRYPTED)) {
nodec = 1;
}
if (!nodec) {
/* sz = __ilog2_u32((u32)__roundup_pow_of_two(nr_pages*sizeof(struct page*))); */
/* pgs = (struct page **)__get_free_pages(GFP_KERNEL, sz); */
pgs = (struct page **)kmalloc(nr_pages*sizeof(struct page*), GFP_KERNEL);
if (!pgs) {
return -EFAULT;
}
}
/* printk("[g-ecryptfs] Info: in read_pages read %d pages %d: \n", nr_pages, nodec); */
/* dump_stack(); */
for (page_idx = 0; page_idx < nr_pages; page_idx++) {
struct page *page = list_entry(pages->prev, struct page, lru);
list_del(&page->lru);
if (add_to_page_cache_lru(page, mapping, page->index, GFP_KERNEL)) {
printk("[g-eCryptfs] INFO: cannot add page %lu to cache lru\n",
(unsigned long)(page->index));
} else {
if (nodec)
rc |= ecryptfs_readpage(filp, page);
}
if (nodec)
page_cache_release(page);
else
pgs[page_idx] = page;
}
if (!nodec) {
rc = ecryptfs_decrypt_pages(pgs, nr_pages);
for (page_idx = 0; page_idx < nr_pages; page_idx++) {
if (rc)
ClearPageUptodate(pgs[page_idx]);
else
SetPageUptodate(pgs[page_idx]);
unlock_page(pgs[page_idx]);
page_cache_release(pgs[page_idx]);
}
kfree(pgs);
/* free_pages((unsigned long)pgs, sz); */
}
return 0;
}
* @len: The length of the data (unused)
* @copied: The amount of data copied
* @page: The eCryptfs page
* @fsdata: The fsdata (unused)
*/
static int ecryptfs_write_end(struct file *file,
struct address_space *mapping,
loff_t pos, unsigned len, unsigned copied,
struct page *page, void *fsdata)
{
pgoff_t index = pos >> PAGE_CACHE_SHIFT;
unsigned from = pos & (PAGE_CACHE_SIZE - 1);
unsigned to = from + copied;
struct inode *ecryptfs_inode = mapping->host;
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
int rc;
ecryptfs_printk(KERN_DEBUG, "Calling fill_zeros_to_end_of_page"
"(page w/ index = [0x%.16lx], to = [%d])\n", index, to);
if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
rc = ecryptfs_write_lower_page_segment(ecryptfs_inode, page, 0,
to);
if (!rc) {
rc = copied;
fsstack_copy_inode_size(ecryptfs_inode,
ecryptfs_inode_to_lower(ecryptfs_inode));
}
goto out;
}
/* Fills in zeros if 'to' goes beyond inode size */
/**
* ecryptfs_lookup
* @ecryptfs_dir_inode: The eCryptfs directory inode
* @ecryptfs_dentry: The eCryptfs dentry that we are looking up
* @ecryptfs_nd: nameidata; may be NULL
*
* Find a file on disk. If the file does not exist, then we'll add it to the
* dentry cache and continue on to read it from the disk.
*/
static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
struct dentry *ecryptfs_dentry,
struct nameidata *ecryptfs_nd)
{
char *encrypted_and_encoded_name = NULL;
size_t encrypted_and_encoded_name_size;
struct ecryptfs_crypt_stat *crypt_stat = NULL;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
struct ecryptfs_inode_info *inode_info;
struct dentry *lower_dir_dentry, *lower_dentry;
int rc = 0;
ecryptfs_dentry->d_op = &ecryptfs_dops;
if ((ecryptfs_dentry->d_name.len == 1
&& !strcmp(ecryptfs_dentry->d_name.name, "."))
|| (ecryptfs_dentry->d_name.len == 2
&& !strcmp(ecryptfs_dentry->d_name.name, ".."))) {
goto out_d_drop;
}
lower_dir_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry->d_parent);
lower_dentry = lookup_one_len(ecryptfs_dentry->d_name.name,
lower_dir_dentry,
ecryptfs_dentry->d_name.len);
if (IS_ERR(lower_dentry)) {
rc = PTR_ERR(lower_dentry);
printk(KERN_ERR "%s: lookup_one_len() returned [%d] on "
"lower_dentry = [%s]\n", __func__, rc,
ecryptfs_dentry->d_name.name);
goto out_d_drop;
}
if (lower_dentry->d_inode)
goto lookup_and_interpose;
inode_info = ecryptfs_inode_to_private(ecryptfs_dentry->d_inode);
if (inode_info) {
crypt_stat = &inode_info->crypt_stat;
/* TODO: lock for crypt_stat comparison */
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
ecryptfs_set_default_sizes(crypt_stat);
}
if (crypt_stat)
mount_crypt_stat = crypt_stat->mount_crypt_stat;
else
mount_crypt_stat = &ecryptfs_superblock_to_private(
ecryptfs_dentry->d_sb)->mount_crypt_stat;
if (!(crypt_stat && (crypt_stat->flags & ECRYPTFS_ENCRYPT_FILENAMES))
&& !(mount_crypt_stat && (mount_crypt_stat->flags
& ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)))
goto lookup_and_interpose;
dput(lower_dentry);
rc = ecryptfs_encrypt_and_encode_filename(
&encrypted_and_encoded_name, &encrypted_and_encoded_name_size,
crypt_stat, mount_crypt_stat, ecryptfs_dentry->d_name.name,
ecryptfs_dentry->d_name.len);
if (rc) {
printk(KERN_ERR "%s: Error attempting to encrypt and encode "
"filename; rc = [%d]\n", __func__, rc);
goto out_d_drop;
}
lower_dentry = lookup_one_len(encrypted_and_encoded_name,
lower_dir_dentry,
encrypted_and_encoded_name_size - 1);
if (IS_ERR(lower_dentry)) {
rc = PTR_ERR(lower_dentry);
printk(KERN_ERR "%s: lookup_one_len() returned [%d] on "
"lower_dentry = [%s]\n", __func__, rc,
encrypted_and_encoded_name);
goto out_d_drop;
}
lookup_and_interpose:
rc = ecryptfs_lookup_and_interpose_lower(ecryptfs_dentry, lower_dentry,
crypt_stat, ecryptfs_dir_inode,
ecryptfs_nd);
goto out;
out_d_drop:
d_drop(ecryptfs_dentry);
out:
kfree(encrypted_and_encoded_name);
return ERR_PTR(rc);
}
static long
ecryptfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
{
struct file *lower_file = ecryptfs_file_to_lower(file);
long rc = -ENOIOCTLCMD;
#ifdef CONFIG_WTL_ENCRYPTION_FILTER
if (cmd == ECRYPTFS_IOCTL_GET_ATTRIBUTES) {
u32 __user *user_attr = (u32 __user *)arg;
u32 attr = 0;
char filename[NAME_MAX+1] = {0};
struct dentry *ecryptfs_dentry = file->f_path.dentry;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
&ecryptfs_superblock_to_private(ecryptfs_dentry->d_sb)
->mount_crypt_stat;
struct inode *inode = ecryptfs_dentry->d_inode;
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(inode)->crypt_stat;
struct dentry *fp_dentry =
ecryptfs_inode_to_private(inode)->lower_file->f_dentry;
if (fp_dentry->d_name.len <= NAME_MAX)
memcpy(filename, fp_dentry->d_name.name,
fp_dentry->d_name.len + 1);
mutex_lock(&crypt_stat->cs_mutex);
if ((crypt_stat->flags & ECRYPTFS_ENCRYPTED
|| crypt_stat->flags & ECRYPTFS_ENCRYPTED_OTHER_DEVICE)
|| ((mount_crypt_stat->flags
& ECRYPTFS_ENABLE_FILTERING)
&& (is_file_name_match
(mount_crypt_stat, fp_dentry)
|| is_file_ext_match
(mount_crypt_stat, filename)))) {
if (crypt_stat->flags & ECRYPTFS_KEY_VALID)
attr = ECRYPTFS_WAS_ENCRYPTED;
else
attr = ECRYPTFS_WAS_ENCRYPTED_OTHER_DEVICE;
}
mutex_unlock(&crypt_stat->cs_mutex);
put_user(attr, user_attr);
return 0;
}
#endif
#ifdef CONFIG_SDP
rc = ecryptfs_do_sdp_ioctl(file, cmd, arg);
if (rc != EOPNOTSUPP)
return rc;
#else
printk("%s CONFIG_SDP not enabled \n", __func__);
#endif
if (!lower_file->f_op->compat_ioctl)
return rc;
switch (cmd) {
case FITRIM:
case FS_IOC32_GETFLAGS:
case FS_IOC32_SETFLAGS:
case FS_IOC32_GETVERSION:
case FS_IOC32_SETVERSION:
rc = lower_file->f_op->compat_ioctl(lower_file, cmd, arg);
fsstack_copy_attr_all(file_inode(file), file_inode(lower_file));
return rc;
default:
return rc;
}
}
/**
* ecryptfs_readdir
* @file: The eCryptfs directory file
* @ctx: The actor to feed the entries to
*/
static int ecryptfs_readdir(struct file *file, struct dir_context *ctx)
{
int rc;
struct file *lower_file;
struct inode *inode = file_inode(file);
struct ecryptfs_getdents_callback buf = {
.ctx.actor = ecryptfs_filldir,
.caller = ctx,
.sb = inode->i_sb,
};
lower_file = ecryptfs_file_to_lower(file);
lower_file->f_pos = ctx->pos;
rc = iterate_dir(lower_file, &buf.ctx);
ctx->pos = buf.ctx.pos;
if (rc < 0)
goto out;
if (buf.filldir_called && !buf.entries_written)
goto out;
if (rc >= 0)
fsstack_copy_attr_atime(inode,
file_inode(lower_file));
out:
return rc;
}
struct kmem_cache *ecryptfs_file_info_cache;
static int read_or_initialize_metadata(struct dentry *dentry)
{
struct inode *inode = dentry->d_inode;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct ecryptfs_crypt_stat *crypt_stat;
int rc;
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mount_crypt_stat = &ecryptfs_superblock_to_private(
inode->i_sb)->mount_crypt_stat;
#ifdef CONFIG_WTL_ENCRYPTION_FILTER
if (crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED
&& crypt_stat->flags & ECRYPTFS_POLICY_APPLIED
&& crypt_stat->flags & ECRYPTFS_ENCRYPTED
&& !(crypt_stat->flags & ECRYPTFS_KEY_VALID)
&& !(crypt_stat->flags & ECRYPTFS_KEY_SET)
&& crypt_stat->flags & ECRYPTFS_I_SIZE_INITIALIZED) {
crypt_stat->flags |= ECRYPTFS_ENCRYPTED_OTHER_DEVICE;
}
mutex_lock(&crypt_stat->cs_mutex);
if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_NEW_PASSTHROUGH)
&& (crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
if (ecryptfs_read_metadata(dentry)) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
} else if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_FILTERING)
&& (crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
struct dentry *fp_dentry =
ecryptfs_inode_to_private(inode)->lower_file->f_dentry;
char filename[NAME_MAX+1] = {0};
if (fp_dentry->d_name.len <= NAME_MAX)
memcpy(filename, fp_dentry->d_name.name,
fp_dentry->d_name.len + 1);
if (is_file_name_match(mount_crypt_stat, fp_dentry)
|| is_file_ext_match(mount_crypt_stat, filename)) {
if (ecryptfs_read_metadata(dentry))
crypt_stat->flags &=
~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
}
mutex_unlock(&crypt_stat->cs_mutex);
#endif
mutex_lock(&crypt_stat->cs_mutex);
if (crypt_stat->flags & ECRYPTFS_POLICY_APPLIED &&
crypt_stat->flags & ECRYPTFS_KEY_VALID) {
rc = 0;
goto out;
}
rc = ecryptfs_read_metadata(dentry);
if (!rc)
goto out;
#ifdef CONFIG_SDP
/*
* no passthrough/xattr for sensitive files
*/
if ((rc) && crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE)
goto out;
#endif
if (mount_crypt_stat->flags & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
if (!(mount_crypt_stat->flags & ECRYPTFS_XATTR_METADATA_ENABLED) &&
!i_size_read(ecryptfs_inode_to_lower(inode))) {
rc = ecryptfs_initialize_file(dentry, inode);
if (!rc)
goto out;
}
rc = -EIO;
out:
mutex_unlock(&crypt_stat->cs_mutex);
#ifdef CONFIG_SDP
if(!rc)
{
/*
* SDP v2.0 : sensitive directory (SDP vault)
* Files under sensitive directory automatically becomes sensitive
*/
struct dentry *p = dentry->d_parent;
struct inode *parent_inode = p->d_inode;
struct ecryptfs_crypt_stat *parent_crypt_stat =
&ecryptfs_inode_to_private(parent_inode)->crypt_stat;
if (!(crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE) &&
((S_ISDIR(parent_inode->i_mode)) &&
(parent_crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE))) {
rc = ecryptfs_sdp_set_sensitive(parent_crypt_stat->engine_id, dentry);
}
}
#endif
return rc;
}
#if defined(CONFIG_MMC_DW_FMP_ECRYPT_FS) || defined(CONFIG_UFS_FMP_ECRYPT_FS)
static void ecryptfs_set_rapages(struct file *file, unsigned int flag)
{
if (!flag)
file->f_ra.ra_pages = 0;
else
file->f_ra.ra_pages = (unsigned int)file->f_mapping->backing_dev_info->ra_pages;
}
static int ecryptfs_set_fmpinfo(struct file *file, struct inode *inode, unsigned int set_flag)
{
struct address_space *mapping = file->f_mapping;
if (set_flag) {
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(inode)->crypt_stat;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
&ecryptfs_superblock_to_private(inode->i_sb)->mount_crypt_stat;
if (strncmp(crypt_stat->cipher, "aesxts", sizeof("aesxts"))
&& strncmp(crypt_stat->cipher, "aes", sizeof("aes"))) {
if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
mapping->plain_text = 1;
return 0;
} else {
ecryptfs_printk(KERN_ERR,
"%s: Error invalid file encryption algorithm, inode %lu, filename %s alg %s\n"
, __func__, inode->i_ino, file->f_dentry->d_name.name, crypt_stat->cipher);
return -EINVAL;
}
}
mapping->iv = crypt_stat->root_iv;
mapping->key = crypt_stat->key;
mapping->sensitive_data_index = crypt_stat->metadata_size/4096;
if (mount_crypt_stat->cipher_code == RFC2440_CIPHER_AES_XTS_256) {
mapping->key_length = crypt_stat->key_size * 2;
mapping->alg = "aesxts";
} else {
mapping->key_length = crypt_stat->key_size;
mapping->alg = crypt_stat->cipher;
}
mapping->hash_tfm = crypt_stat->hash_tfm;
#ifdef CONFIG_CRYPTO_FIPS
mapping->cc_enable =
(mount_crypt_stat->flags & ECRYPTFS_ENABLE_CC)?1:0;
#endif
} else {
mapping->iv = NULL;
mapping->key = NULL;
mapping->key_length = 0;
mapping->sensitive_data_index = 0;
mapping->alg = NULL;
mapping->hash_tfm = NULL;
#ifdef CONFIG_CRYPTO_FIPS
mapping->cc_enable = 0;
#endif
mapping->plain_text = 0;
}
return 0;
}
void ecryptfs_propagate_rapages(struct file *file, unsigned int flag)
{
struct file *f = file;
do {
if (!f)
return;
ecryptfs_set_rapages(f, flag);
} while(f->f_op->get_lower_file && (f = f->f_op->get_lower_file(f)));
}
int ecryptfs_propagate_fmpinfo(struct inode *inode, unsigned int flag)
{
struct file *f = ecryptfs_inode_to_private(inode)->lower_file;
do {
if (!f)
return 0;
if (ecryptfs_set_fmpinfo(f, inode, flag))
return -EINVAL;
} while(f->f_op->get_lower_file && (f = f->f_op->get_lower_file(f)));
return 0;
}
#endif
/**
* ecryptfs_open
* @inode: inode speciying file to open
* @file: Structure to return filled in
*
* Opens the file specified by inode.
*
* Returns zero on success; non-zero otherwise
*/
static int ecryptfs_open(struct inode *inode, struct file *file)
{
int rc = 0;
struct ecryptfs_crypt_stat *crypt_stat = NULL;
struct dentry *ecryptfs_dentry = file->f_path.dentry;
/* Private value of ecryptfs_dentry allocated in
* ecryptfs_lookup() */
struct ecryptfs_file_info *file_info;
#ifdef CONFIG_DLP
sdp_fs_command_t *cmd = NULL;
ssize_t dlp_len = 0;
struct knox_dlp_data dlp_data;
struct timespec ts;
#endif
#if defined(CONFIG_MMC_DW_FMP_ECRYPT_FS) || defined(CONFIG_UFS_FMP_ECRYPT_FS) || defined(CONFIG_SDP)
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
mount_crypt_stat = &ecryptfs_superblock_to_private(
inode->i_sb)->mount_crypt_stat;
#endif
/* Released in ecryptfs_release or end of function if failure */
file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
ecryptfs_set_file_private(file, file_info);
if (!file_info) {
ecryptfs_printk(KERN_ERR,
"Error attempting to allocate memory\n");
rc = -ENOMEM;
goto out;
}
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mutex_lock(&crypt_stat->cs_mutex);
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)) {
ecryptfs_printk(KERN_DEBUG, "Setting flags for stat...\n");
/* Policy code enabled in future release */
crypt_stat->flags |= (ECRYPTFS_POLICY_APPLIED
| ECRYPTFS_ENCRYPTED);
}
mutex_unlock(&crypt_stat->cs_mutex);
rc = ecryptfs_get_lower_file(ecryptfs_dentry, inode);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the lower file for the dentry with name "
"[%pd]; rc = [%d]\n", __func__,
ecryptfs_dentry, rc);
goto out_free;
}
if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_ACCMODE)
== O_RDONLY && (file->f_flags & O_ACCMODE) != O_RDONLY) {
rc = -EPERM;
printk(KERN_WARNING "%s: Lower file is RO; eCryptfs "
"file must hence be opened RO\n", __func__);
goto out_put;
}
ecryptfs_set_file_lower(
file, ecryptfs_inode_to_private(inode)->lower_file);
if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
#ifdef CONFIG_SDP
/*
* it's possible to have a sensitive directory. (vault)
*/
if (mount_crypt_stat->flags & ECRYPTFS_MOUNT_SDP_ENABLED)
crypt_stat->flags |= ECRYPTFS_DEK_SDP_ENABLED;
#endif
ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
mutex_lock(&crypt_stat->cs_mutex);
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
rc = 0;
goto out;
}
rc = read_or_initialize_metadata(ecryptfs_dentry);
if (rc) {
#ifdef CONFIG_SDP
if(file->f_flags & O_SDP){
printk("Failed to initialize metadata, "
"but let it continue cause current call is from SDP API\n");
mutex_lock(&crypt_stat->cs_mutex);
crypt_stat->flags &= ~(ECRYPTFS_KEY_VALID);
mutex_unlock(&crypt_stat->cs_mutex);
rc = 0;
/*
* Letting this continue doesn't mean to allow read/writing. It will anyway fail later.
*
* 1. In this stage, ecryptfs_stat won't have key/iv and encryption ctx.
* 2. ECRYPTFS_KEY_VALID bit is off, next attempt will try reading metadata again.
* 3. Skip DEK conversion. it cannot be done anyway.
*/
goto out;
}
#endif
goto out_put;
}
#if defined(CONFIG_MMC_DW_FMP_ECRYPT_FS) || defined(CONFIG_UFS_FMP_ECRYPT_FS)
if (mount_crypt_stat->flags & ECRYPTFS_USE_FMP)
rc = ecryptfs_propagate_fmpinfo(inode, FMPINFO_SET);
else
rc = ecryptfs_propagate_fmpinfo(inode, FMPINFO_CLEAR);
#endif
if (rc)
goto out_put;
#ifdef CONFIG_SDP
if (crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE) {
#ifdef CONFIG_SDP_KEY_DUMP
if (S_ISREG(ecryptfs_dentry->d_inode->i_mode)) {
if(get_sdp_sysfs_key_dump()) {
printk("FEK[%s] : ", ecryptfs_dentry->d_name.name);
key_dump(crypt_stat->key, 32);
}
}
#endif
/*
* Need to update sensitive mapping on file open
*/
if (S_ISREG(ecryptfs_dentry->d_inode->i_mode)) {
ecryptfs_set_mapping_sensitive(inode, mount_crypt_stat->userid, TO_SENSITIVE);
}
if (ecryptfs_is_sdp_locked(crypt_stat->engine_id)) {
ecryptfs_printk(KERN_INFO, "ecryptfs_open: persona is locked, rc=%d\n", rc);
} else {
int dek_type = crypt_stat->sdp_dek.type;
ecryptfs_printk(KERN_INFO, "ecryptfs_open: persona is unlocked, rc=%d\n", rc);
if(dek_type != DEK_TYPE_AES_ENC) {
ecryptfs_printk(KERN_DEBUG, "converting dek...\n");
rc = ecryptfs_sdp_convert_dek(ecryptfs_dentry);
ecryptfs_printk(KERN_DEBUG, "conversion ready, rc=%d\n", rc);
rc = 0; // TODO: Do we need to return error if conversion fails?
}
}
}
#if ECRYPTFS_DEK_DEBUG
else {
ecryptfs_printk(KERN_INFO, "ecryptfs_open: dek_file_type is protected\n");
}
#endif
#endif
#ifdef CONFIG_DLP
if(crypt_stat->flags & ECRYPTFS_DLP_ENABLED) {
#if DLP_DEBUG
printk("DLP %s: try to open %s with crypt_stat->flags %d\n",
__func__, ecryptfs_dentry->d_name.name, crypt_stat->flags);
#endif
if (dlp_is_locked(mount_crypt_stat->userid)) {
printk("%s: DLP locked\n", __func__);
rc = -EPERM;
goto out_put;
}
if(in_egroup_p(AID_KNOX_DLP) || in_egroup_p(AID_KNOX_DLP_RESTRICTED)) {
dlp_len = ecryptfs_getxattr_lower(
ecryptfs_dentry_to_lower(ecryptfs_dentry),
KNOX_DLP_XATTR_NAME,
&dlp_data, sizeof(dlp_data));
if (dlp_len == sizeof(dlp_data)) {
getnstimeofday(&ts);
#if DLP_DEBUG
printk("DLP %s: current time [%ld/%ld] %s\n",
__func__, (long)ts.tv_sec, (long)dlp_data.expiry_time.tv_sec, ecryptfs_dentry->d_name.name);
#endif
if ((ts.tv_sec > dlp_data.expiry_time.tv_sec) && dlp_isInterestedFile(ecryptfs_dentry->d_name.name)==0) {
/* Command to delete expired file */
cmd = sdp_fs_command_alloc(FSOP_DLP_FILE_REMOVE,
current->tgid, mount_crypt_stat->userid, mount_crypt_stat->partition_id,
inode->i_ino, GFP_KERNEL);
rc = -ENOENT;
goto out_put;
}
} else if (dlp_len == -ENODATA) {
/* DLP flag is set, but no DLP data. Let it continue, xattr will be set later */
printk("DLP %s: normal file [%s]\n",
__func__, ecryptfs_dentry->d_name.name);
} else {
printk("DLP %s: Error, len [%ld], [%s]\n",
__func__, (long)dlp_len, ecryptfs_dentry->d_name.name);
rc = -EFAULT;
goto out_put;
}
#if DLP_DEBUG
printk("DLP %s: DLP file [%s] opened with tgid %d, %d\n" ,
__func__, ecryptfs_dentry->d_name.name, current->tgid, in_egroup_p(AID_KNOX_DLP_RESTRICTED));
#endif
if(in_egroup_p(AID_KNOX_DLP_RESTRICTED)) {
cmd = sdp_fs_command_alloc(FSOP_DLP_FILE_OPENED,
current->tgid, mount_crypt_stat->userid, mount_crypt_stat->partition_id,
inode->i_ino, GFP_KERNEL);
}
} else {
printk("DLP %s: not DLP app [%s]\n", __func__, current->comm);
rc = -EPERM;
goto out_put;
}
}
#endif
ecryptfs_printk(KERN_DEBUG, "inode w/ addr = [0x%p], i_ino = "
"[0x%.16lx] size: [0x%.16llx]\n", inode, inode->i_ino,
(unsigned long long)i_size_read(inode));
goto out;
out_put:
ecryptfs_put_lower_file(inode);
out_free:
kmem_cache_free(ecryptfs_file_info_cache,
ecryptfs_file_to_private(file));
out:
#ifdef CONFIG_DLP
if(cmd) {
sdp_fs_request(cmd, NULL);
sdp_fs_command_free(cmd);
}
#endif
return rc;
}
static int read_or_initialize_metadata(struct dentry *dentry)
{
struct inode *inode = dentry->d_inode;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct ecryptfs_crypt_stat *crypt_stat;
int rc;
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mount_crypt_stat = &ecryptfs_superblock_to_private(
inode->i_sb)->mount_crypt_stat;
#ifdef CONFIG_WTL_ENCRYPTION_FILTER
if (crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED
&& crypt_stat->flags & ECRYPTFS_POLICY_APPLIED
&& crypt_stat->flags & ECRYPTFS_ENCRYPTED
&& !(crypt_stat->flags & ECRYPTFS_KEY_VALID)
&& !(crypt_stat->flags & ECRYPTFS_KEY_SET)
&& crypt_stat->flags & ECRYPTFS_I_SIZE_INITIALIZED) {
crypt_stat->flags |= ECRYPTFS_ENCRYPTED_OTHER_DEVICE;
}
mutex_lock(&crypt_stat->cs_mutex);
if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_NEW_PASSTHROUGH)
&& (crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
if (ecryptfs_read_metadata(dentry)) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
} else if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_FILTERING)
&& (crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
struct dentry *fp_dentry =
ecryptfs_inode_to_private(inode)->lower_file->f_dentry;
char filename[NAME_MAX+1] = {0};
if (fp_dentry->d_name.len <= NAME_MAX)
memcpy(filename, fp_dentry->d_name.name,
fp_dentry->d_name.len + 1);
if (is_file_name_match(mount_crypt_stat, fp_dentry)
|| is_file_ext_match(mount_crypt_stat, filename)) {
if (ecryptfs_read_metadata(dentry))
crypt_stat->flags &=
~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
}
mutex_unlock(&crypt_stat->cs_mutex);
#endif
mutex_lock(&crypt_stat->cs_mutex);
if (crypt_stat->flags & ECRYPTFS_POLICY_APPLIED &&
crypt_stat->flags & ECRYPTFS_KEY_VALID) {
rc = 0;
goto out;
}
rc = ecryptfs_read_metadata(dentry);
if (!rc)
goto out;
#ifdef CONFIG_SDP
/*
* no passthrough/xattr for sensitive files
*/
if ((rc) && crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE)
goto out;
#endif
if (mount_crypt_stat->flags & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
if (!(mount_crypt_stat->flags & ECRYPTFS_XATTR_METADATA_ENABLED) &&
!i_size_read(ecryptfs_inode_to_lower(inode))) {
rc = ecryptfs_initialize_file(dentry, inode);
if (!rc)
goto out;
}
rc = -EIO;
out:
mutex_unlock(&crypt_stat->cs_mutex);
#ifdef CONFIG_SDP
if(!rc)
{
/*
* SDP v2.0 : sensitive directory (SDP vault)
* Files under sensitive directory automatically becomes sensitive
*/
struct dentry *p = dentry->d_parent;
struct inode *parent_inode = p->d_inode;
struct ecryptfs_crypt_stat *parent_crypt_stat =
&ecryptfs_inode_to_private(parent_inode)->crypt_stat;
if (!(crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE) &&
((S_ISDIR(parent_inode->i_mode)) &&
(parent_crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE))) {
ecryptfs_sdp_set_sensitive(dentry);
}
}
#endif
return rc;
}
/**
* ecryptfs_open
* @inode: inode speciying file to open
* @file: Structure to return filled in
*
* Opens the file specified by inode.
*
* Returns zero on success; non-zero otherwise
*/
static int ecryptfs_open(struct inode *inode, struct file *file)
{
int rc = 0;
struct ecryptfs_crypt_stat *crypt_stat = NULL;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct dentry *ecryptfs_dentry = file->f_path.dentry;
/* Private value of ecryptfs_dentry allocated in
* ecryptfs_lookup() */
struct dentry *lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
struct ecryptfs_file_info *file_info;
mount_crypt_stat = &ecryptfs_superblock_to_private(
ecryptfs_dentry->d_sb)->mount_crypt_stat;
if ((mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
&& ((file->f_flags & O_WRONLY) || (file->f_flags & O_RDWR)
|| (file->f_flags & O_CREAT) || (file->f_flags & O_TRUNC)
|| (file->f_flags & O_APPEND))) {
printk(KERN_WARNING "Mount has encrypted view enabled; "
"files may only be read\n");
rc = -EPERM;
goto out;
}
/* Released in ecryptfs_release or end of function if failure */
file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
ecryptfs_set_file_private(file, file_info);
if (!file_info) {
ecryptfs_printk(KERN_ERR,
"Error attempting to allocate memory\n");
rc = -ENOMEM;
goto out;
}
lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mutex_lock(&crypt_stat->cs_mutex);
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)) {
ecryptfs_printk(KERN_DEBUG, "Setting flags for stat...\n");
/* Policy code enabled in future release */
crypt_stat->flags |= (ECRYPTFS_POLICY_APPLIED
| ECRYPTFS_ENCRYPTED);
}
mutex_unlock(&crypt_stat->cs_mutex);
if (!ecryptfs_inode_to_private(inode)->lower_file) {
rc = ecryptfs_init_persistent_file(ecryptfs_dentry);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the persistent file for the dentry with name "
"[%s]; rc = [%d]\n", __func__,
ecryptfs_dentry->d_name.name, rc);
goto out_free;
}
}
if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_RDONLY)
&& !(file->f_flags & O_RDONLY)) {
rc = -EPERM;
printk(KERN_WARNING "%s: Lower persistent file is RO; eCryptfs "
"file must hence be opened RO\n", __func__);
goto out_free;
}
ecryptfs_set_file_lower(
file, ecryptfs_inode_to_private(inode)->lower_file);
if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
mutex_lock(&crypt_stat->cs_mutex);
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
rc = 0;
goto out;
}
rc = read_or_initialize_metadata(ecryptfs_dentry);
if (rc)
goto out_free;
ecryptfs_printk(KERN_DEBUG, "inode w/ addr = [0x%p], i_ino = [0x%.16x] "
"size: [0x%.16x]\n", inode, inode->i_ino,
i_size_read(inode));
goto out;
out_free:
kmem_cache_free(ecryptfs_file_info_cache,
ecryptfs_file_to_private(file));
out:
return rc;
}
/**
* ecryptfs_open
* @inode: inode speciying file to open
* @file: Structure to return filled in
*
* Opens the file specified by inode.
*
* Returns zero on success; non-zero otherwise
*/
static int ecryptfs_open(struct inode *inode, struct file *file)
{
int rc = 0;
struct ecryptfs_crypt_stat *crypt_stat = NULL;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct dentry *ecryptfs_dentry = file->f_path.dentry;
/* Private value of ecryptfs_dentry allocated in
* ecryptfs_lookup() */
struct ecryptfs_file_info *file_info;
mount_crypt_stat = &ecryptfs_superblock_to_private(
ecryptfs_dentry->d_sb)->mount_crypt_stat;
if ((mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
&& ((file->f_flags & O_WRONLY) || (file->f_flags & O_RDWR)
|| (file->f_flags & O_CREAT) || (file->f_flags & O_TRUNC)
|| (file->f_flags & O_APPEND))) {
printk(KERN_WARNING "Mount has encrypted view enabled; "
"files may only be read\n");
rc = -EPERM;
goto out;
}
/* Released in ecryptfs_release or end of function if failure */
file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
ecryptfs_set_file_private(file, file_info);
if (!file_info) {
ecryptfs_printk(KERN_ERR,
"Error attempting to allocate memory\n");
rc = -ENOMEM;
goto out;
}
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mutex_lock(&crypt_stat->cs_mutex);
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)) {
ecryptfs_printk(KERN_DEBUG, "Setting flags for stat...\n");
/* Policy code enabled in future release */
crypt_stat->flags |= (ECRYPTFS_POLICY_APPLIED
| ECRYPTFS_ENCRYPTED);
}
mutex_unlock(&crypt_stat->cs_mutex);
rc = ecryptfs_get_lower_file(ecryptfs_dentry, inode);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the lower file for the dentry with name "
"[%s]; rc = [%d]\n", __func__,
ecryptfs_dentry->d_name.name, rc);
goto out_free;
}
if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_ACCMODE)
== O_RDONLY && (file->f_flags & O_ACCMODE) != O_RDONLY) {
rc = -EPERM;
printk(KERN_WARNING "%s: Lower file is RO; eCryptfs "
"file must hence be opened RO\n", __func__);
goto out_put;
}
ecryptfs_set_file_lower(
file, ecryptfs_inode_to_private(inode)->lower_file);
if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
#ifdef CONFIG_SDP
/*
* it's possible to have a sensitive directory. (vault)
*/
if (mount_crypt_stat->flags & ECRYPTFS_MOUNT_SDP_ENABLED)
crypt_stat->flags |= ECRYPTFS_DEK_SDP_ENABLED;
#endif
ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
mutex_lock(&crypt_stat->cs_mutex);
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
rc = 0;
goto out;
}
rc = read_or_initialize_metadata(ecryptfs_dentry);
if (rc)
goto out_put;
#ifdef CONFIG_SDP
if (crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE) {
if (ecryptfs_is_persona_locked(crypt_stat->userid)) {
ecryptfs_printk(KERN_INFO, "ecryptfs_open: persona is locked, rc=%d\n", rc);
#if 0
if (file->f_flags & O_SDP) {
ecryptfs_printk(KERN_INFO, "ecryptfs_open: O_SDP is set, allow open, rc=%d\n", rc);
mutex_lock(&crypt_stat->cs_mutex);
crypt_stat->flags &= ~(ECRYPTFS_KEY_VALID);
mutex_unlock(&crypt_stat->cs_mutex);
} else {
mutex_lock(&crypt_stat->cs_mutex);
crypt_stat->flags &= ~(ECRYPTFS_KEY_VALID);
mutex_unlock(&crypt_stat->cs_mutex);
rc = -EACCES;
goto out_put;
}
#endif
} else {
int dek_type = crypt_stat->sdp_dek.type;
ecryptfs_printk(KERN_INFO, "ecryptfs_open: persona is unlocked, rc=%d\n", rc);
if(dek_type != DEK_TYPE_AES_ENC) {
ecryptfs_printk(KERN_DEBUG, "converting dek...\n");
rc = ecryptfs_sdp_convert_dek(ecryptfs_dentry);
ecryptfs_printk(KERN_DEBUG, "conversion ready, rc=%d\n", rc);
rc = 0; // TODO: Do we need to return error if conversion fails?
/*
if(!(file->f_flags & O_SDP)){
ecryptfs_printk(KERN_WARNING, "Busy sensitive file (try again later)\n");
rc = -EBUSY;
goto out_put;
}
*/
}
}
}
#if ECRYPTFS_DEK_DEBUG
else {
ecryptfs_printk(KERN_INFO, "ecryptfs_open: dek_file_type is protected");
}
#endif
#endif
ecryptfs_printk(KERN_DEBUG, "inode w/ addr = [0x%p], i_ino = "
"[0x%.16lx] size: [0x%.16llx]\n", inode, inode->i_ino,
(unsigned long long)i_size_read(inode));
goto out;
out_put:
ecryptfs_put_lower_file(inode);
out_free:
kmem_cache_free(ecryptfs_file_info_cache,
ecryptfs_file_to_private(file));
out:
return rc;
}
/**
* ecryptfs_initialize_file
*
* Cause the file to be changed from a basic empty file to an ecryptfs
* file with a header and first data page.
*
* Returns zero on success
*/
int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry,
struct inode *ecryptfs_inode)
{
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
#if 1 // FEATURE_SDCARD_ENCRYPTION
struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
&ecryptfs_superblock_to_private(
ecryptfs_dentry->d_sb)->mount_crypt_stat;
char dentry_name[MAX_FILE_NAME_LENGTH] = {0,};
#endif
int rc = 0;
if (S_ISDIR(ecryptfs_inode->i_mode)) {
ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
goto out;
}
#if defined (FEATURE_SDCARD_MEDIAEXN_SYSTEMCALL_ENCRYPTION)
memcpy (dentry_name, ecryptfs_dentry->d_name.name, ecryptfs_dentry->d_name.len);
if (getMediaProperty() == 1) {
if(ecryptfs_mediaFileSearch(dentry_name)) {
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
goto out;
}
}
if(ecryptfs_asecFileSearch(dentry_name)) {
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
goto out;
}
#endif //FEATURE_SDCARD_MEDIAEXN_SYSTEMCALL_ENCRYPTION
#if 1 // FEATURE_SDCARD_ENCRYPTION
if (mount_crypt_stat && (mount_crypt_stat->flags
& ECRYPTFS_DECRYPTION_ONLY)) {
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
goto out;
}
#endif
ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n");
rc = ecryptfs_new_file_context(ecryptfs_inode);
if (rc) {
ecryptfs_printk(KERN_ERR, "Error creating new file "
"context; rc = [%d]\n", rc);
goto out;
}
rc = ecryptfs_get_lower_file(ecryptfs_dentry, ecryptfs_inode);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the lower file for the dentry with name "
"[%s]; rc = [%d]\n", __func__,
ecryptfs_dentry->d_name.name, rc);
goto out;
}
rc = ecryptfs_write_metadata(ecryptfs_dentry, ecryptfs_inode);
if (rc)
printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
ecryptfs_put_lower_file(ecryptfs_inode);
out:
return rc;
}
/**
* ecryptfs_open
* @inode: inode speciying file to open
* @file: Structure to return filled in
*
* Opens the file specified by inode.
*
* Returns zero on success; non-zero otherwise
*/
static int ecryptfs_open(struct inode *inode, struct file *file)
{
int rc = 0;
struct ecryptfs_crypt_stat *crypt_stat = NULL;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct dentry *ecryptfs_dentry = file->f_path.dentry;
/* Private value of ecryptfs_dentry allocated in
* ecryptfs_lookup() */
struct dentry *lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
struct inode *lower_inode = NULL;
struct file *lower_file = NULL;
struct vfsmount *lower_mnt;
struct ecryptfs_file_info *file_info;
int lower_flags;
/* Released in ecryptfs_release or end of function if failure */
file_info = kmem_cache_alloc(ecryptfs_file_info_cache, GFP_KERNEL);
ecryptfs_set_file_private(file, file_info);
if (!file_info) {
ecryptfs_printk(KERN_ERR,
"Error attempting to allocate memory\n");
rc = -ENOMEM;
goto out;
}
memset(file_info, 0, sizeof(*file_info));
lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mount_crypt_stat = &ecryptfs_superblock_to_private(
ecryptfs_dentry->d_sb)->mount_crypt_stat;
mutex_lock(&crypt_stat->cs_mutex);
if (!ECRYPTFS_CHECK_FLAG(crypt_stat->flags, ECRYPTFS_POLICY_APPLIED)) {
ecryptfs_printk(KERN_DEBUG, "Setting flags for stat...\n");
/* Policy code enabled in future release */
ECRYPTFS_SET_FLAG(crypt_stat->flags, ECRYPTFS_POLICY_APPLIED);
ECRYPTFS_SET_FLAG(crypt_stat->flags, ECRYPTFS_ENCRYPTED);
}
mutex_unlock(&crypt_stat->cs_mutex);
lower_flags = file->f_flags;
if ((lower_flags & O_ACCMODE) == O_WRONLY)
lower_flags = (lower_flags & O_ACCMODE) | O_RDWR;
if (file->f_flags & O_APPEND)
lower_flags &= ~O_APPEND;
lower_mnt = ecryptfs_dentry_to_lower_mnt(ecryptfs_dentry);
/* Corresponding fput() in ecryptfs_release() */
if ((rc = ecryptfs_open_lower_file(&lower_file, lower_dentry, lower_mnt,
lower_flags))) {
ecryptfs_printk(KERN_ERR, "Error opening lower file\n");
goto out_puts;
}
ecryptfs_set_file_lower(file, lower_file);
/* Isn't this check the same as the one in lookup? */
lower_inode = lower_dentry->d_inode;
if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
ECRYPTFS_CLEAR_FLAG(crypt_stat->flags, ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
mutex_lock(&crypt_stat->cs_mutex);
if (i_size_read(lower_inode) < ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE) {
if (!(mount_crypt_stat->flags
& ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
rc = -EIO;
printk(KERN_WARNING "Attempt to read file that is "
"not in a valid eCryptfs format, and plaintext "
"passthrough mode is not enabled; returning "
"-EIO\n");
mutex_unlock(&crypt_stat->cs_mutex);
goto out_puts;
}
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
rc = 0;
mutex_unlock(&crypt_stat->cs_mutex);
goto out;
} else if (!ECRYPTFS_CHECK_FLAG(crypt_stat->flags,
ECRYPTFS_POLICY_APPLIED)
|| !ECRYPTFS_CHECK_FLAG(crypt_stat->flags,
ECRYPTFS_KEY_VALID)) {
rc = ecryptfs_read_headers(ecryptfs_dentry, lower_file);
if (rc) {
ecryptfs_printk(KERN_DEBUG,
"Valid headers not found\n");
if (!(mount_crypt_stat->flags
& ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
rc = -EIO;
printk(KERN_WARNING "Attempt to read file that "
"is not in a valid eCryptfs format, "
"and plaintext passthrough mode is not "
"enabled; returning -EIO\n");
mutex_unlock(&crypt_stat->cs_mutex);
goto out_puts;
}
ECRYPTFS_CLEAR_FLAG(crypt_stat->flags,
ECRYPTFS_ENCRYPTED);
rc = 0;
mutex_unlock(&crypt_stat->cs_mutex);
goto out;
}
}
mutex_unlock(&crypt_stat->cs_mutex);
ecryptfs_printk(KERN_DEBUG, "inode w/ addr = [0x%p], i_ino = [0x%.16x] "
"size: [0x%.16x]\n", inode, inode->i_ino,
i_size_read(inode));
ecryptfs_set_file_lower(file, lower_file);
goto out;
out_puts:
mntput(lower_mnt);
dput(lower_dentry);
kmem_cache_free(ecryptfs_file_info_cache,
ecryptfs_file_to_private(file));
out:
return rc;
}
static int read_or_initialize_metadata(struct dentry *dentry)
{
struct inode *inode = dentry->d_inode;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct ecryptfs_crypt_stat *crypt_stat;
int rc;
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mount_crypt_stat = &ecryptfs_superblock_to_private(
inode->i_sb)->mount_crypt_stat;
#ifdef CONFIG_WTL_ENCRYPTION_FILTER
if (crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED
&& crypt_stat->flags & ECRYPTFS_POLICY_APPLIED
&& crypt_stat->flags & ECRYPTFS_ENCRYPTED
&& !(crypt_stat->flags & ECRYPTFS_KEY_VALID)
&& !(crypt_stat->flags & ECRYPTFS_KEY_SET)
&& crypt_stat->flags & ECRYPTFS_I_SIZE_INITIALIZED) {
crypt_stat->flags |= ECRYPTFS_ENCRYPTED_OTHER_DEVICE;
}
mutex_lock(&crypt_stat->cs_mutex);
if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_NEW_PASSTHROUGH)
&& (crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
if (ecryptfs_read_metadata(dentry)) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
} else if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_FILTERING)
&& (crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
struct dentry *fp_dentry =
ecryptfs_inode_to_private(inode)->lower_file->f_dentry;
char filename[NAME_MAX+1] = {0};
if (fp_dentry->d_name.len <= NAME_MAX)
memcpy(filename, fp_dentry->d_name.name,
fp_dentry->d_name.len + 1);
if (is_file_name_match(mount_crypt_stat, fp_dentry)
|| is_file_ext_match(mount_crypt_stat, filename)) {
if (ecryptfs_read_metadata(dentry))
crypt_stat->flags &=
~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
}
mutex_unlock(&crypt_stat->cs_mutex);
#endif
mutex_lock(&crypt_stat->cs_mutex);
if (crypt_stat->flags & ECRYPTFS_POLICY_APPLIED &&
crypt_stat->flags & ECRYPTFS_KEY_VALID) {
rc = 0;
goto out;
}
rc = ecryptfs_read_metadata(dentry);
if (!rc)
goto out;
if (mount_crypt_stat->flags & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
if (!(mount_crypt_stat->flags & ECRYPTFS_XATTR_METADATA_ENABLED) &&
!i_size_read(ecryptfs_inode_to_lower(inode))) {
rc = ecryptfs_initialize_file(dentry, inode);
if (!rc)
goto out;
}
rc = -EIO;
out:
mutex_unlock(&crypt_stat->cs_mutex);
return rc;
}
/**
* ecryptfs_lookup_and_interpose_lower - Perform a lookup
*/
int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
struct dentry *lower_dentry,
struct inode *ecryptfs_dir_inode)
{
struct dentry *lower_dir_dentry;
struct vfsmount *lower_mnt;
struct inode *lower_inode;
struct ecryptfs_crypt_stat *crypt_stat;
char *page_virt = NULL;
int put_lower = 0, rc = 0;
lower_dir_dentry = lower_dentry->d_parent;
lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(
ecryptfs_dentry->d_parent));
lower_inode = lower_dentry->d_inode;
fsstack_copy_attr_atime(ecryptfs_dir_inode, lower_dir_dentry->d_inode);
BUG_ON(!lower_dentry->d_count);
ecryptfs_set_dentry_private(ecryptfs_dentry,
kmem_cache_alloc(ecryptfs_dentry_info_cache,
GFP_KERNEL));
if (!ecryptfs_dentry_to_private(ecryptfs_dentry)) {
rc = -ENOMEM;
printk(KERN_ERR "%s: Out of memory whilst attempting "
"to allocate ecryptfs_dentry_info struct\n",
__func__);
goto out_put;
}
ecryptfs_set_dentry_lower(ecryptfs_dentry, lower_dentry);
ecryptfs_set_dentry_lower_mnt(ecryptfs_dentry, lower_mnt);
if (!lower_dentry->d_inode) {
/* We want to add because we couldn't find in lower */
d_add(ecryptfs_dentry, NULL);
goto out;
}
rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
ecryptfs_dir_inode->i_sb,
ECRYPTFS_INTERPOSE_FLAG_D_ADD);
if (rc) {
printk(KERN_ERR "%s: Error interposing; rc = [%d]\n",
__func__, rc);
goto out;
}
if (S_ISDIR(lower_inode->i_mode))
goto out;
if (S_ISLNK(lower_inode->i_mode))
goto out;
if (special_file(lower_inode->i_mode))
goto out;
/* Released in this function */
page_virt = kmem_cache_zalloc(ecryptfs_header_cache_2, GFP_USER);
if (!page_virt) {
printk(KERN_ERR "%s: Cannot kmem_cache_zalloc() a page\n",
__func__);
rc = -ENOMEM;
goto out;
}
rc = ecryptfs_get_lower_file(ecryptfs_dentry);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the lower file for the dentry with name "
"[%s]; rc = [%d]\n", __func__,
ecryptfs_dentry->d_name.name, rc);
goto out_free_kmem;
}
put_lower = 1;
crypt_stat = &ecryptfs_inode_to_private(
ecryptfs_dentry->d_inode)->crypt_stat;
/* TODO: lock for crypt_stat comparison */
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
ecryptfs_set_default_sizes(crypt_stat);
rc = ecryptfs_read_and_validate_header_region(page_virt,
ecryptfs_dentry->d_inode);
if (rc) {
memset(page_virt, 0, PAGE_CACHE_SIZE);
rc = ecryptfs_read_and_validate_xattr_region(page_virt,
ecryptfs_dentry);
if (rc) {
rc = 0;
goto out_free_kmem;
}
crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
}
ecryptfs_i_size_init(page_virt, ecryptfs_dentry->d_inode);
out_free_kmem:
kmem_cache_free(ecryptfs_header_cache_2, page_virt);
goto out;
out_put:
dput(lower_dentry);
mntput(lower_mnt);
d_drop(ecryptfs_dentry);
out:
if (put_lower)
ecryptfs_put_lower_file(ecryptfs_dentry->d_inode);
return rc;
}
/**
* ecryptfs_open
* @inode: inode speciying file to open
* @file: Structure to return filled in
*
* Opens the file specified by inode.
*
* Returns zero on success; non-zero otherwise
*/
static int ecryptfs_open(struct inode *inode, struct file *file)
{
int rc = 0;
struct ecryptfs_crypt_stat *crypt_stat = NULL;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct dentry *ecryptfs_dentry = file->f_path.dentry;
/* Private value of ecryptfs_dentry allocated in
* ecryptfs_lookup() */
struct dentry *lower_dentry;
struct ecryptfs_file_info *file_info;
mount_crypt_stat = &ecryptfs_superblock_to_private(
ecryptfs_dentry->d_sb)->mount_crypt_stat;
if ((mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
&& ((file->f_flags & O_WRONLY) || (file->f_flags & O_RDWR)
|| (file->f_flags & O_CREAT) || (file->f_flags & O_TRUNC)
|| (file->f_flags & O_APPEND))) {
printk(KERN_WARNING "Mount has encrypted view enabled; "
"files may only be read\n");
rc = -EPERM;
goto out;
}
/* Released in ecryptfs_release or end of function if failure */
file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
ecryptfs_set_file_private(file, file_info);
if (!file_info) {
ecryptfs_printk(KERN_ERR,
"Error attempting to allocate memory\n");
rc = -ENOMEM;
goto out;
}
lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mutex_lock(&crypt_stat->cs_mutex);
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)) {
ecryptfs_printk(KERN_DEBUG, "Setting flags for stat...\n");
/* Policy code enabled in future release */
crypt_stat->flags |= (ECRYPTFS_POLICY_APPLIED
| ECRYPTFS_ENCRYPTED);
}
mutex_unlock(&crypt_stat->cs_mutex);
rc = ecryptfs_get_lower_file(ecryptfs_dentry, inode);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the lower file for the dentry with name "
"[%s]; rc = [%d]\n", __func__,
ecryptfs_dentry->d_name.name, rc);
goto out_free;
}
if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_ACCMODE)
== O_RDONLY && (file->f_flags & O_ACCMODE) != O_RDONLY) {
rc = -EPERM;
printk(KERN_WARNING "%s: Lower file is RO; eCryptfs "
"file must hence be opened RO\n", __func__);
goto out_put;
}
ecryptfs_set_file_lower(
file, ecryptfs_inode_to_private(inode)->lower_file);
if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
mutex_lock(&crypt_stat->cs_mutex);
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
rc = 0;
goto out;
}
#ifdef CONFIG_WTL_ENCRYPTION_FILTER
if (crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED
&& crypt_stat->flags & ECRYPTFS_POLICY_APPLIED
&& crypt_stat->flags & ECRYPTFS_ENCRYPTED
&& !(crypt_stat->flags & ECRYPTFS_KEY_VALID)
&& !(crypt_stat->flags & ECRYPTFS_KEY_SET)
&& crypt_stat->flags & ECRYPTFS_I_SIZE_INITIALIZED) {
crypt_stat->flags |= ECRYPTFS_ENCRYPTED_OTHER_DEVICE;
}
mutex_lock(&crypt_stat->cs_mutex);
if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_NEW_PASSTHROUGH)
&& (crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
if (ecryptfs_read_metadata(ecryptfs_dentry)) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
goto out;
}
} else if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_FILTERING)
&& (crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
struct dentry *fp_dentry =
ecryptfs_inode_to_private(inode)->lower_file->f_dentry;
char filename[NAME_MAX+1] = {0};
if (fp_dentry->d_name.len <= NAME_MAX)
memcpy(filename, fp_dentry->d_name.name,
fp_dentry->d_name.len + 1);
if (is_file_name_match(mount_crypt_stat, fp_dentry)
|| is_file_ext_match(mount_crypt_stat, filename)) {
if (ecryptfs_read_metadata(ecryptfs_dentry))
crypt_stat->flags &=
~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
goto out;
}
}
mutex_unlock(&crypt_stat->cs_mutex);
#endif
mutex_lock(&crypt_stat->cs_mutex);
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)
|| !(crypt_stat->flags & ECRYPTFS_KEY_VALID)) {
rc = ecryptfs_read_metadata(ecryptfs_dentry);
if (rc) {
ecryptfs_printk(KERN_DEBUG,
"Valid headers not found\n");
if (!(mount_crypt_stat->flags
& ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
rc = -EIO;
printk(KERN_WARNING "Either the lower file "
"is not in a valid eCryptfs format, "
"or the key could not be retrieved. "
"Plaintext passthrough mode is not "
"enabled; returning -EIO\n");
mutex_unlock(&crypt_stat->cs_mutex);
goto out_put;
}
rc = 0;
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
goto out;
}
}
mutex_unlock(&crypt_stat->cs_mutex);
ecryptfs_printk(KERN_DEBUG, "inode w/ addr = [0x%p], i_ino = "
"[0x%.16lx] size: [0x%.16llx]\n", inode, inode->i_ino,
(unsigned long long)i_size_read(inode));
goto out;
out_put:
ecryptfs_put_lower_file(inode);
out_free:
kmem_cache_free(ecryptfs_file_info_cache,
ecryptfs_file_to_private(file));
out:
return rc;
}
/**
* ecryptfs_lookup_interpose - Dentry interposition for a lookup
*/
static int ecryptfs_lookup_interpose(struct dentry *dentry,
struct dentry *lower_dentry,
struct inode *dir_inode)
{
struct inode *inode, *lower_inode = lower_dentry->d_inode;
struct ecryptfs_dentry_info *dentry_info;
struct vfsmount *lower_mnt;
int rc = 0;
dentry_info = kmem_cache_alloc(ecryptfs_dentry_info_cache, GFP_KERNEL);
if (!dentry_info) {
printk(KERN_ERR "%s: Out of memory whilst attempting "
"to allocate ecryptfs_dentry_info struct\n",
__func__);
dput(lower_dentry);
return -ENOMEM;
}
lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
fsstack_copy_attr_atime(dir_inode, lower_dentry->d_parent->d_inode);
BUG_ON(!lower_dentry->d_count);
ecryptfs_set_dentry_private(dentry, dentry_info);
ecryptfs_set_dentry_lower(dentry, lower_dentry);
ecryptfs_set_dentry_lower_mnt(dentry, lower_mnt);
if (!lower_dentry->d_inode) {
/* We want to add because we couldn't find in lower */
d_add(dentry, NULL);
return 0;
}
inode = __ecryptfs_get_inode(lower_inode, dir_inode->i_sb);
if (IS_ERR(inode)) {
printk(KERN_ERR "%s: Error interposing; rc = [%ld]\n",
__func__, PTR_ERR(inode));
return PTR_ERR(inode);
}
if (S_ISREG(inode->i_mode)) {
rc = ecryptfs_i_size_read(dentry, inode);
if (rc) {
make_bad_inode(inode);
return rc;
}
}
#ifdef CONFIG_SDP
if (S_ISDIR(inode->i_mode) && dentry) {
if(IS_UNDER_ROOT(dentry)) {
struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
&ecryptfs_superblock_to_private(inode->i_sb)->mount_crypt_stat;
printk("Lookup a directoy under root directory of current partition.\n");
if(is_chamber_directory(mount_crypt_stat, (char *)dentry->d_name.name)) {
/*
* When this directory is under ROOT directory and the name is registered
* as Chamber.
*/
printk("This is a chamber directory\n");
set_chamber_flag(inode);
}
} else if(IS_SENSITIVE_DENTRY(dentry->d_parent)) {
/*
* When parent directory is sensitive
*/
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(inode)->crypt_stat;
printk("Parent %s is sensitive. so this directory is sensitive too\n",
dentry->d_parent->d_name.name);
crypt_stat->flags |= ECRYPTFS_DEK_IS_SENSITIVE;
}
}
#endif
if (inode->i_state & I_NEW)
unlock_new_inode(inode);
d_add(dentry, inode);
return rc;
}
/**
* ecryptfs_readdir
* @file: The eCryptfs directory file
* @ctx: The actor to feed the entries to
*/
static int ecryptfs_readdir(struct file *file, struct dir_context *ctx)
{
int rc;
struct file *lower_file;
struct inode *inode = file_inode(file);
struct ecryptfs_getdents_callback buf = {
.ctx.actor = ecryptfs_filldir,
.caller = ctx,
.sb = inode->i_sb,
};
lower_file = ecryptfs_file_to_lower(file);
lower_file->f_pos = ctx->pos;
rc = iterate_dir(lower_file, &buf.ctx);
ctx->pos = buf.ctx.pos;
if (rc < 0)
goto out;
if (buf.filldir_called && !buf.entries_written)
goto out;
if (rc >= 0)
fsstack_copy_attr_atime(inode,
file_inode(lower_file));
out:
return rc;
}
struct kmem_cache *ecryptfs_file_info_cache;
static int read_or_initialize_metadata(struct dentry *dentry)
{
struct inode *inode = dentry->d_inode;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct ecryptfs_crypt_stat *crypt_stat;
int rc;
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mount_crypt_stat = &ecryptfs_superblock_to_private(
inode->i_sb)->mount_crypt_stat;
mutex_lock(&crypt_stat->cs_mutex);
if (crypt_stat->flags & ECRYPTFS_POLICY_APPLIED &&
crypt_stat->flags & ECRYPTFS_KEY_VALID) {
rc = 0;
goto out;
}
rc = ecryptfs_read_metadata(dentry);
if (!rc)
goto out;
if (mount_crypt_stat->flags & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
if (!(mount_crypt_stat->flags & ECRYPTFS_XATTR_METADATA_ENABLED) &&
!i_size_read(ecryptfs_inode_to_lower(inode))) {
rc = ecryptfs_initialize_file(dentry, inode);
if (!rc)
goto out;
}
rc = -EIO;
out:
mutex_unlock(&crypt_stat->cs_mutex);
return rc;
}
/**
* ecryptfs_open
* @inode: inode speciying file to open
* @file: Structure to return filled in
*
* Opens the file specified by inode.
*
* Returns zero on success; non-zero otherwise
*/
static int ecryptfs_open(struct inode *inode, struct file *file)
{
int rc = 0;
struct ecryptfs_crypt_stat *crypt_stat = NULL;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct dentry *ecryptfs_dentry = file->f_path.dentry;
/* Private value of ecryptfs_dentry allocated in
* ecryptfs_lookup() */
struct ecryptfs_file_info *file_info;
mount_crypt_stat = &ecryptfs_superblock_to_private(
ecryptfs_dentry->d_sb)->mount_crypt_stat;
if ((mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
&& ((file->f_flags & O_WRONLY) || (file->f_flags & O_RDWR)
|| (file->f_flags & O_CREAT) || (file->f_flags & O_TRUNC)
|| (file->f_flags & O_APPEND))) {
printk(KERN_WARNING "Mount has encrypted view enabled; "
"files may only be read\n");
rc = -EPERM;
goto out;
}
/* Released in ecryptfs_release or end of function if failure */
file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
ecryptfs_set_file_private(file, file_info);
if (!file_info) {
ecryptfs_printk(KERN_ERR,
"Error attempting to allocate memory\n");
rc = -ENOMEM;
goto out;
}
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mutex_lock(&crypt_stat->cs_mutex);
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)) {
ecryptfs_printk(KERN_DEBUG, "Setting flags for stat...\n");
/* Policy code enabled in future release */
crypt_stat->flags |= (ECRYPTFS_POLICY_APPLIED
| ECRYPTFS_ENCRYPTED);
}
mutex_unlock(&crypt_stat->cs_mutex);
rc = ecryptfs_get_lower_file(ecryptfs_dentry, inode);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the lower file for the dentry with name "
"[%s]; rc = [%d]\n", __func__,
ecryptfs_dentry->d_name.name, rc);
goto out_free;
}
if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_ACCMODE)
== O_RDONLY && (file->f_flags & O_ACCMODE) != O_RDONLY) {
rc = -EPERM;
printk(KERN_WARNING "%s: Lower file is RO; eCryptfs "
"file must hence be opened RO\n", __func__);
goto out_put;
}
ecryptfs_set_file_lower(
file, ecryptfs_inode_to_private(inode)->lower_file);
if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
mutex_lock(&crypt_stat->cs_mutex);
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
rc = 0;
goto out;
}
rc = read_or_initialize_metadata(ecryptfs_dentry);
if (rc)
goto out_put;
ecryptfs_printk(KERN_DEBUG, "inode w/ addr = [0x%p], i_ino = "
"[0x%.16lx] size: [0x%.16llx]\n", inode, inode->i_ino,
(unsigned long long)i_size_read(inode));
goto out;
out_put:
ecryptfs_put_lower_file(inode);
out_free:
kmem_cache_free(ecryptfs_file_info_cache,
ecryptfs_file_to_private(file));
out:
return rc;
}
/**
* ecryptfs_initialize_file
*
* Cause the file to be changed from a basic empty file to an ecryptfs
* file with a header and first data page.
*
* Returns zero on success
*/
static int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry)
{
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->crypt_stat;
int rc = 0;
if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
goto out;
}
crypt_stat->flags |= ECRYPTFS_NEW_FILE;
ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n");
rc = ecryptfs_new_file_context(ecryptfs_dentry);
if (rc) {
ecryptfs_printk(KERN_ERR, "Error creating new file "
"context; rc = [%d]\n", rc);
goto out;
}
if (!ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->lower_file) {
rc = ecryptfs_init_persistent_file(ecryptfs_dentry);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the persistent file for the dentry with name "
"[%s]; rc = [%d]\n", __func__,
ecryptfs_dentry->d_name.name, rc);
goto out;
}
}
/* [email protected] encryption filter */
#ifdef WTL_ENCRYPTION_FILTER
/* fzhang, TODO, should not change flags for existing encrypted
files even through their ext match filter rule */
if (crypt_stat->flags & ECRYPTFS_ENCRYPTED) {
struct dentry *fp_dentry =
ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)
->lower_file->f_dentry;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat = &ecryptfs_superblock_to_private(
ecryptfs_dentry->d_sb)->mount_crypt_stat;
char filename[256];
strcpy(filename, fp_dentry->d_name.name);
if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_NEW_PASSTHROUGH)
|| ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_FILTERING) &&
(is_file_name_match(mount_crypt_stat, fp_dentry) ||
is_file_ext_match(mount_crypt_stat, filename)))) {
/*printk(KERN_ERR "fzhang %s will not be encrypted.\n",
fp_dentry->d_iname); */
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
} else {
rc = ecryptfs_write_metadata(ecryptfs_dentry);
if (rc) {
printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
goto out;
}
rc = grow_file(ecryptfs_dentry);
if (rc)
printk(KERN_ERR "Error growing file; rc = [%d]\n", rc);
}
}
#else
rc = ecryptfs_write_metadata(ecryptfs_dentry);
if (rc) {
printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
goto out;
}
rc = grow_file(ecryptfs_dentry);
if (rc)
printk(KERN_ERR "Error growing file; rc = [%d]\n", rc);
#endif
out:
return rc;
}
static int ecryptfs_update_crypt_flag(struct dentry *dentry, int is_sensitive)
{
int rc = 0;
struct dentry *lower_dentry;
struct inode *inode;
struct inode *lower_inode;
struct ecryptfs_crypt_stat *crypt_stat;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
if (!(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED))
ecryptfs_init_crypt_stat(crypt_stat);
inode = dentry->d_inode;
lower_inode = ecryptfs_inode_to_lower(inode);
lower_dentry = ecryptfs_dentry_to_lower(dentry);
mutex_lock(&crypt_stat->cs_mutex);
mount_crypt_stat = &ecryptfs_superblock_to_private(
dentry->d_sb)->mount_crypt_stat;
rc = ecryptfs_get_lower_file(dentry, inode);
if (rc) {
mutex_unlock(&crypt_stat->cs_mutex);
DEK_LOGE("ecryptfs_get_lower_file rc=%d\n", rc);
goto out;
}
if (is_sensitive) {
crypt_stat->flags |= ECRYPTFS_DEK_IS_SENSITIVE;
/*
* Set sensirive for all the pages in the inode
*/
set_sensitive_mapping_pages(inode->i_mapping, 0, -1);
}
else{
crypt_stat->flags &= ~ECRYPTFS_DEK_IS_SENSITIVE;
}
rc = ecryptfs_write_metadata(dentry, inode);
if (rc) {
if (!(mount_crypt_stat->flags
& ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
rc = -EIO;
DEK_LOGE("Either the lower file "
"is not in a valid eCryptfs format, "
"or the key could not be retrieved. "
"Plaintext passthrough mode is not "
"enabled; returning -EIO\n");
mutex_unlock(&crypt_stat->cs_mutex);
DEK_LOGD("ecryptfs_write_metadata rc=%d\n", rc);
goto out;
}
rc = 0;
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
}
rc = ecryptfs_write_inode_size_to_metadata(inode);
if (rc) {
mutex_unlock(&crypt_stat->cs_mutex);
DEK_LOGE("Problem with "
"ecryptfs_write_inode_size_to_metadata; "
"rc = [%d]\n", rc);
goto out;
}
ecryptfs_put_lower_file(inode);
mutex_unlock(&crypt_stat->cs_mutex);
out:
fsstack_copy_attr_all(inode, lower_inode);
return rc;
}
/**
* ecryptfs_lookup_and_interpose_lower - Perform a lookup
*/
int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
struct dentry *lower_dentry,
struct inode *ecryptfs_dir_inode,
struct nameidata *ecryptfs_nd)
{
struct dentry *lower_dir_dentry;
struct vfsmount *lower_mnt;
struct inode *lower_inode;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct ecryptfs_crypt_stat *crypt_stat;
char *page_virt = NULL;
u64 file_size;
int rc = 0;
lower_dir_dentry = lower_dentry->d_parent;
lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(
ecryptfs_dentry->d_parent));
lower_inode = lower_dentry->d_inode;
fsstack_copy_attr_atime(ecryptfs_dir_inode, lower_dir_dentry->d_inode);
BUG_ON(!atomic_read(&lower_dentry->d_count));
ecryptfs_set_dentry_private(ecryptfs_dentry,
kmem_cache_alloc(ecryptfs_dentry_info_cache,
GFP_KERNEL));
if (!ecryptfs_dentry_to_private(ecryptfs_dentry)) {
rc = -ENOMEM;
printk(KERN_ERR "%s: Out of memory whilst attempting "
"to allocate ecryptfs_dentry_info struct\n",
__func__);
goto out_put;
}
ecryptfs_set_dentry_lower(ecryptfs_dentry, lower_dentry);
ecryptfs_set_dentry_lower_mnt(ecryptfs_dentry, lower_mnt);
if (!lower_dentry->d_inode) {
/* We want to add because we couldn't find in lower */
d_add(ecryptfs_dentry, NULL);
goto out;
}
rc = ecryptfs_interpose(lower_dentry, ecryptfs_dentry,
ecryptfs_dir_inode->i_sb, 1);
if (rc) {
printk(KERN_ERR "%s: Error interposing; rc = [%d]\n",
__func__, rc);
goto out;
}
if (S_ISDIR(lower_inode->i_mode))
goto out;
if (S_ISLNK(lower_inode->i_mode))
goto out;
if (special_file(lower_inode->i_mode))
goto out;
if (!ecryptfs_nd)
goto out;
/* Released in this function */
page_virt = kmem_cache_zalloc(ecryptfs_header_cache_2, GFP_USER);
if (!page_virt) {
printk(KERN_ERR "%s: Cannot kmem_cache_zalloc() a page\n",
__func__);
rc = -ENOMEM;
goto out;
}
if (!ecryptfs_inode_to_private(ecryptfs_dentry->d_inode)->lower_file) {
rc = ecryptfs_init_persistent_file(ecryptfs_dentry);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the persistent file for the dentry with name "
"[%s]; rc = [%d]\n", __func__,
ecryptfs_dentry->d_name.name, rc);
goto out_free_kmem;
}
}
crypt_stat = &ecryptfs_inode_to_private(
ecryptfs_dentry->d_inode)->crypt_stat;
/* TODO: lock for crypt_stat comparison */
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
ecryptfs_set_default_sizes(crypt_stat);
rc = ecryptfs_read_and_validate_header_region(page_virt,
ecryptfs_dentry->d_inode);
if (rc) {
rc = ecryptfs_read_and_validate_xattr_region(page_virt,
ecryptfs_dentry);
if (rc) {
rc = 0;
goto out_free_kmem;
}
crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
}
mount_crypt_stat = &ecryptfs_superblock_to_private(
ecryptfs_dentry->d_sb)->mount_crypt_stat;
if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) {
if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
file_size = (crypt_stat->num_header_bytes_at_front
+ i_size_read(lower_dentry->d_inode));
else
file_size = i_size_read(lower_dentry->d_inode);
} else {
file_size = get_unaligned_be64(page_virt);
}
i_size_write(ecryptfs_dentry->d_inode, (loff_t)file_size);
out_free_kmem:
kmem_cache_free(ecryptfs_header_cache_2, page_virt);
goto out;
out_put:
dput(lower_dentry);
mntput(lower_mnt);
d_drop(ecryptfs_dentry);
out:
return rc;
}
/**
* ecryptfs_initialize_file
*
* Cause the file to be changed from a basic empty file to an ecryptfs
* file with a header and first data page.
*
* Returns zero on success
*/
int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry,
struct inode *ecryptfs_inode)
{
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
int rc = 0;
#ifdef CONFIG_DLP
sdp_fs_command_t *cmd = NULL;
#endif
if (S_ISDIR(ecryptfs_inode->i_mode)) {
ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
goto out;
}
ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n");
rc = ecryptfs_new_file_context(ecryptfs_inode);
if (rc) {
ecryptfs_printk(KERN_ERR, "Error creating new file "
"context; rc = [%d]\n", rc);
goto out;
}
rc = ecryptfs_get_lower_file(ecryptfs_dentry, ecryptfs_inode);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the lower file for the dentry with name "
"[%s]; rc = [%d]\n", __func__,
ecryptfs_dentry->d_name.name, rc);
goto out;
}
#ifdef CONFIG_DLP
if(crypt_stat->mount_crypt_stat->flags & ECRYPTFS_MOUNT_DLP_ENABLED) {
#if DLP_DEBUG
printk(KERN_ERR "DLP %s: file name: [%s], userid: [%d]\n",
__func__, ecryptfs_dentry->d_iname, crypt_stat->mount_crypt_stat->userid);
#endif
if(!rc && (in_egroup_p(AID_KNOX_DLP) || in_egroup_p(AID_KNOX_DLP_RESTRICTED))) {
/* TODO: Can DLP files be created while in locked state? */
struct timespec ts;
crypt_stat->flags |= ECRYPTFS_DLP_ENABLED;
getnstimeofday(&ts);
crypt_stat->expiry.expiry_time.tv_sec = (int64_t)ts.tv_sec + 600;
crypt_stat->expiry.expiry_time.tv_nsec = (int64_t)ts.tv_nsec;
#if DLP_DEBUG
printk(KERN_ERR "DLP %s: current->pid : %d\n", __func__, current->tgid);
printk(KERN_ERR "DLP %s: crypt_stat->mount_crypt_stat->userid : %d\n", __func__, crypt_stat->mount_crypt_stat->userid);
printk(KERN_ERR "DLP %s: crypt_stat->mount_crypt_stat->partition_id : %d\n", __func__, crypt_stat->mount_crypt_stat->partition_id);
#endif
if(in_egroup_p(AID_KNOX_DLP)) {
cmd = sdp_fs_command_alloc(FSOP_DLP_FILE_INIT,
current->tgid, crypt_stat->mount_crypt_stat->userid, crypt_stat->mount_crypt_stat->partition_id,
ecryptfs_inode->i_ino, GFP_KERNEL);
}
else if(in_egroup_p(AID_KNOX_DLP_RESTRICTED)) {
cmd = sdp_fs_command_alloc(FSOP_DLP_FILE_INIT_RESTRICTED,
current->tgid, crypt_stat->mount_crypt_stat->userid, crypt_stat->mount_crypt_stat->partition_id,
ecryptfs_inode->i_ino, GFP_KERNEL);
}
} else {
printk(KERN_ERR "DLP %s: not in group\n", __func__);
}
}
#endif
#ifdef CONFIG_WTL_ENCRYPTION_FILTER
mutex_lock(&crypt_stat->cs_mutex);
if (crypt_stat->flags & ECRYPTFS_ENCRYPTED) {
struct dentry *fp_dentry =
ecryptfs_inode_to_private(ecryptfs_inode)
->lower_file->f_dentry;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
&ecryptfs_superblock_to_private(ecryptfs_dentry->d_sb)
->mount_crypt_stat;
char filename[NAME_MAX+1] = {0};
if (fp_dentry->d_name.len <= NAME_MAX)
memcpy(filename, fp_dentry->d_name.name,
fp_dentry->d_name.len + 1);
if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_NEW_PASSTHROUGH)
|| ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_FILTERING) &&
(is_file_name_match(mount_crypt_stat, fp_dentry) ||
is_file_ext_match(mount_crypt_stat, filename)))) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
ecryptfs_put_lower_file(ecryptfs_inode);
} else {
rc = ecryptfs_write_metadata(ecryptfs_dentry,
ecryptfs_inode);
if (rc)
printk(
KERN_ERR "Error writing headers; rc = [%d]\n"
, rc);
ecryptfs_put_lower_file(ecryptfs_inode);
}
}
mutex_unlock(&crypt_stat->cs_mutex);
#else
rc = ecryptfs_write_metadata(ecryptfs_dentry, ecryptfs_inode);
if (rc)
printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
ecryptfs_put_lower_file(ecryptfs_inode);
#endif
out:
#ifdef CONFIG_DLP
if(cmd) {
sdp_fs_request(cmd, NULL);
sdp_fs_command_free(cmd);
}
#endif
return rc;
}
