static int
ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
struct inode *new_dir, struct dentry *new_dentry)
{
int rc;
struct dentry *lower_old_dentry;
struct dentry *lower_new_dentry;
struct dentry *lower_old_dir_dentry;
struct dentry *lower_new_dir_dentry;
struct dentry *trap = NULL;
struct inode *target_inode;
lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
dget(lower_old_dentry);
dget(lower_new_dentry);
lower_old_dir_dentry = dget_parent(lower_old_dentry);
lower_new_dir_dentry = dget_parent(lower_new_dentry);
target_inode = new_dentry->d_inode;
trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
/* source should not be ancestor of target */
if (trap == lower_old_dentry) {
rc = -EINVAL;
goto out_lock;
}
/* target should not be ancestor of source */
if (trap == lower_new_dentry) {
rc = -ENOTEMPTY;
goto out_lock;
}
rc = vfs_rename(lower_old_dir_dentry->d_inode, lower_old_dentry,
lower_new_dir_dentry->d_inode, lower_new_dentry);
if (rc)
goto out_lock;
if (target_inode)
fsstack_copy_attr_all(target_inode,
ecryptfs_inode_to_lower(target_inode));
fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode);
if (new_dir != old_dir)
fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
out_lock:
unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
dput(lower_new_dir_dentry);
dput(lower_old_dir_dentry);
dput(lower_new_dentry);
dput(lower_old_dentry);
return rc;
}
static int
ecryptfs_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
unsigned long arg)
{
int rc = 0;
struct file *lower_file = NULL;
if (ecryptfs_file_to_private(file))
lower_file = ecryptfs_file_to_lower(file);
if (lower_file && lower_file->f_op && lower_file->f_op->ioctl)
rc = lower_file->f_op->ioctl(ecryptfs_inode_to_lower(inode),
lower_file, cmd, arg);
else
rc = -ENOTTY;
return rc;
}
static int ecryptfs_release(struct inode *inode, struct file *file)
{
struct file *lower_file = ecryptfs_file_to_lower(file);
struct ecryptfs_file_info *file_info = ecryptfs_file_to_private(file);
struct inode *lower_inode = ecryptfs_inode_to_lower(inode);
int rc;
if ((rc = ecryptfs_close_lower_file(lower_file))) {
printk(KERN_ERR "Error closing lower_file\n");
goto out;
}
inode->i_blocks = lower_inode->i_blocks;
kmem_cache_free(ecryptfs_file_info_cache, file_info);
out:
return rc;
}
static int read_or_initialize_metadata(struct dentry *dentry)
{
struct inode *inode = dentry->d_inode;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct ecryptfs_crypt_stat *crypt_stat;
int rc;
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mount_crypt_stat = &ecryptfs_superblock_to_private(
inode->i_sb)->mount_crypt_stat;
mutex_lock(&crypt_stat->cs_mutex);
if (crypt_stat->flags & ECRYPTFS_POLICY_APPLIED &&
crypt_stat->flags & ECRYPTFS_KEY_VALID) {
rc = 0;
goto out;
}
rc = ecryptfs_read_metadata(dentry);
if (!rc)
goto out;
if (mount_crypt_stat->flags & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
if (!(mount_crypt_stat->flags & ECRYPTFS_XATTR_METADATA_ENABLED) &&
!i_size_read(ecryptfs_inode_to_lower(inode))) {
rc = ecryptfs_initialize_file(dentry, inode);
if (!rc)
goto out;
}
rc = -EIO;
out:
mutex_unlock(&crypt_stat->cs_mutex);
return rc;
}
static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir,
struct dentry *new_dentry)
{
struct dentry *lower_old_dentry;
struct vfsmount *lower_old_mnt;
struct dentry *lower_new_dentry;
struct vfsmount *lower_new_mnt;
struct dentry *lower_dir_dentry;
u64 file_size_save;
int rc;
file_size_save = i_size_read(old_dentry->d_inode);
lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
lower_old_mnt = ecryptfs_dentry_to_lower_mnt(old_dentry);
lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
lower_new_mnt = ecryptfs_dentry_to_lower_mnt(new_dentry);
dget(lower_old_dentry);
dget(lower_new_dentry);
lower_dir_dentry = lock_parent(lower_new_dentry);
rc = vfs_link(lower_old_dentry, lower_old_mnt,
lower_dir_dentry->d_inode, lower_new_dentry,
lower_new_mnt);
if (rc || !lower_new_dentry->d_inode)
goto out_lock;
rc = ecryptfs_interpose(lower_new_dentry, new_dentry, dir->i_sb, 0);
if (rc)
goto out_lock;
fsstack_copy_attr_times(dir, lower_new_dentry->d_inode);
fsstack_copy_inode_size(dir, lower_new_dentry->d_inode);
old_dentry->d_inode->i_nlink =
ecryptfs_inode_to_lower(old_dentry->d_inode)->i_nlink;
i_size_write(new_dentry->d_inode, file_size_save);
out_lock:
unlock_dir(lower_dir_dentry);
dput(lower_new_dentry);
dput(lower_old_dentry);
d_drop(lower_old_dentry);
d_drop(new_dentry);
d_drop(old_dentry);
return rc;
}
/**
* ecryptfs_d_revalidate - revalidate an ecryptfs dentry
* @dentry: The ecryptfs dentry
* @flags: lookup flags
*
* Called when the VFS needs to revalidate a dentry. This
* is called whenever a name lookup finds a dentry in the
* dcache. Most filesystems leave this as NULL, because all their
* dentries in the dcache are valid.
*
* Returns 1 if valid, 0 otherwise.
*
*/
static int ecryptfs_d_revalidate(struct dentry *dentry, unsigned int flags)
{
struct dentry *lower_dentry;
struct vfsmount *lower_mnt;
int rc = 1;
if (flags & LOOKUP_RCU)
return -ECHILD;
lower_dentry = ecryptfs_dentry_to_lower(dentry);
lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry);
if (!lower_dentry->d_op || !lower_dentry->d_op->d_revalidate)
goto out;
rc = lower_dentry->d_op->d_revalidate(lower_dentry, flags);
if (dentry->d_inode) {
struct inode *lower_inode =
ecryptfs_inode_to_lower(dentry->d_inode);
fsstack_copy_attr_all(dentry->d_inode, lower_inode);
}
out:
return rc;
}
static int ecryptfs_inode_test(struct inode *inode, void *lower_inode)
{
if (ecryptfs_inode_to_lower(inode) == (struct inode *)lower_inode)
return 1;
return 0;
}
/**
* ecryptfs_readdir
* @file: The eCryptfs directory file
* @ctx: The actor to feed the entries to
*/
static int ecryptfs_readdir(struct file *file, struct dir_context *ctx)
{
int rc;
struct file *lower_file;
struct inode *inode = file_inode(file);
struct ecryptfs_getdents_callback buf = {
.ctx.actor = ecryptfs_filldir,
.caller = ctx,
.sb = inode->i_sb,
};
lower_file = ecryptfs_file_to_lower(file);
lower_file->f_pos = ctx->pos;
rc = iterate_dir(lower_file, &buf.ctx);
ctx->pos = buf.ctx.pos;
if (rc < 0)
goto out;
if (buf.filldir_called && !buf.entries_written)
goto out;
if (rc >= 0)
fsstack_copy_attr_atime(inode,
file_inode(lower_file));
out:
return rc;
}
struct kmem_cache *ecryptfs_file_info_cache;
static int read_or_initialize_metadata(struct dentry *dentry)
{
struct inode *inode = dentry->d_inode;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct ecryptfs_crypt_stat *crypt_stat;
int rc;
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mount_crypt_stat = &ecryptfs_superblock_to_private(
inode->i_sb)->mount_crypt_stat;
mutex_lock(&crypt_stat->cs_mutex);
if (crypt_stat->flags & ECRYPTFS_POLICY_APPLIED &&
crypt_stat->flags & ECRYPTFS_KEY_VALID) {
rc = 0;
goto out;
}
rc = ecryptfs_read_metadata(dentry);
if (!rc)
goto out;
if (mount_crypt_stat->flags & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
if (!(mount_crypt_stat->flags & ECRYPTFS_XATTR_METADATA_ENABLED) &&
!i_size_read(ecryptfs_inode_to_lower(inode))) {
rc = ecryptfs_initialize_file(dentry, inode);
if (!rc)
goto out;
}
rc = -EIO;
out:
mutex_unlock(&crypt_stat->cs_mutex);
return rc;
}
/**
* ecryptfs_open
* @inode: inode speciying file to open
* @file: Structure to return filled in
*
* Opens the file specified by inode.
*
* Returns zero on success; non-zero otherwise
*/
static int ecryptfs_open(struct inode *inode, struct file *file)
{
int rc = 0;
struct ecryptfs_crypt_stat *crypt_stat = NULL;
struct dentry *ecryptfs_dentry = file->f_path.dentry;
/* Private value of ecryptfs_dentry allocated in
* ecryptfs_lookup() */
struct ecryptfs_file_info *file_info;
/* Released in ecryptfs_release or end of function if failure */
file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
ecryptfs_set_file_private(file, file_info);
if (!file_info) {
ecryptfs_printk(KERN_ERR,
"Error attempting to allocate memory\n");
rc = -ENOMEM;
goto out;
}
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mutex_lock(&crypt_stat->cs_mutex);
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)) {
ecryptfs_printk(KERN_DEBUG, "Setting flags for stat...\n");
/* Policy code enabled in future release */
crypt_stat->flags |= (ECRYPTFS_POLICY_APPLIED
| ECRYPTFS_ENCRYPTED);
}
mutex_unlock(&crypt_stat->cs_mutex);
rc = ecryptfs_get_lower_file(ecryptfs_dentry, inode);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the lower file for the dentry with name "
"[%s]; rc = [%d]\n", __func__,
ecryptfs_dentry->d_name.name, rc);
goto out_free;
}
if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_ACCMODE)
== O_RDONLY && (file->f_flags & O_ACCMODE) != O_RDONLY) {
rc = -EPERM;
printk(KERN_WARNING "%s: Lower file is RO; eCryptfs "
"file must hence be opened RO\n", __func__);
goto out_put;
}
ecryptfs_set_file_lower(
file, ecryptfs_inode_to_private(inode)->lower_file);
if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
mutex_lock(&crypt_stat->cs_mutex);
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
rc = 0;
goto out;
}
rc = read_or_initialize_metadata(ecryptfs_dentry);
if (rc)
goto out_put;
ecryptfs_printk(KERN_DEBUG, "inode w/ addr = [0x%p], i_ino = "
"[0x%.16lx] size: [0x%.16llx]\n", inode, inode->i_ino,
(unsigned long long)i_size_read(inode));
goto out;
out_put:
ecryptfs_put_lower_file(inode);
out_free:
kmem_cache_free(ecryptfs_file_info_cache,
ecryptfs_file_to_private(file));
out:
return rc;
}
static int read_or_initialize_metadata(struct dentry *dentry)
{
struct inode *inode = dentry->d_inode;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct ecryptfs_crypt_stat *crypt_stat;
int rc;
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mount_crypt_stat = &ecryptfs_superblock_to_private(
inode->i_sb)->mount_crypt_stat;
#ifdef CONFIG_WTL_ENCRYPTION_FILTER
if (crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED
&& crypt_stat->flags & ECRYPTFS_POLICY_APPLIED
&& crypt_stat->flags & ECRYPTFS_ENCRYPTED
&& !(crypt_stat->flags & ECRYPTFS_KEY_VALID)
&& !(crypt_stat->flags & ECRYPTFS_KEY_SET)
&& crypt_stat->flags & ECRYPTFS_I_SIZE_INITIALIZED) {
crypt_stat->flags |= ECRYPTFS_ENCRYPTED_OTHER_DEVICE;
}
mutex_lock(&crypt_stat->cs_mutex);
if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_NEW_PASSTHROUGH)
&& (crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
if (ecryptfs_read_metadata(dentry)) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
rc = 0;
goto out;
}
} else if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_FILTERING)
&& (crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
struct dentry *fp_dentry =
ecryptfs_inode_to_private(inode)->lower_file->f_dentry;
char filename[NAME_MAX+1] = {0};
if (fp_dentry->d_name.len <= NAME_MAX)
memcpy(filename, fp_dentry->d_name.name,
fp_dentry->d_name.len + 1);
if (is_file_name_match(mount_crypt_stat, fp_dentry)
|| is_file_ext_match(mount_crypt_stat, filename)) {
if (ecryptfs_read_metadata(dentry))
crypt_stat->flags &=
~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
rc = 0;
goto out;
}
}
mutex_unlock(&crypt_stat->cs_mutex);
#endif
mutex_lock(&crypt_stat->cs_mutex);
if (crypt_stat->flags & ECRYPTFS_POLICY_APPLIED &&
crypt_stat->flags & ECRYPTFS_KEY_VALID) {
rc = 0;
goto out;
}
rc = ecryptfs_read_metadata(dentry);
if (!rc)
goto out;
if (mount_crypt_stat->flags & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
if (!(mount_crypt_stat->flags & ECRYPTFS_XATTR_METADATA_ENABLED) &&
!i_size_read(ecryptfs_inode_to_lower(inode))) {
rc = ecryptfs_initialize_file(dentry, inode);
if (!rc)
goto out;
}
rc = -EIO;
out:
mutex_unlock(&crypt_stat->cs_mutex);
return rc;
}
static int read_or_initialize_metadata(struct dentry *dentry)
{
struct inode *inode = dentry->d_inode;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct ecryptfs_crypt_stat *crypt_stat;
int rc;
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mount_crypt_stat = &ecryptfs_superblock_to_private(
inode->i_sb)->mount_crypt_stat;
#ifdef CONFIG_WTL_ENCRYPTION_FILTER
if (crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED
&& crypt_stat->flags & ECRYPTFS_POLICY_APPLIED
&& crypt_stat->flags & ECRYPTFS_ENCRYPTED
&& !(crypt_stat->flags & ECRYPTFS_KEY_VALID)
&& !(crypt_stat->flags & ECRYPTFS_KEY_SET)
&& crypt_stat->flags & ECRYPTFS_I_SIZE_INITIALIZED) {
crypt_stat->flags |= ECRYPTFS_ENCRYPTED_OTHER_DEVICE;
}
mutex_lock(&crypt_stat->cs_mutex);
if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_NEW_PASSTHROUGH)
&& (crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
if (ecryptfs_read_metadata(dentry)) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
} else if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_FILTERING)
&& (crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
struct dentry *fp_dentry =
ecryptfs_inode_to_private(inode)->lower_file->f_dentry;
char filename[NAME_MAX+1] = {0};
if (fp_dentry->d_name.len <= NAME_MAX)
memcpy(filename, fp_dentry->d_name.name,
fp_dentry->d_name.len + 1);
if (is_file_name_match(mount_crypt_stat, fp_dentry)
|| is_file_ext_match(mount_crypt_stat, filename)) {
if (ecryptfs_read_metadata(dentry))
crypt_stat->flags &=
~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
}
mutex_unlock(&crypt_stat->cs_mutex);
#endif
mutex_lock(&crypt_stat->cs_mutex);
if (crypt_stat->flags & ECRYPTFS_POLICY_APPLIED &&
crypt_stat->flags & ECRYPTFS_KEY_VALID) {
rc = 0;
goto out;
}
rc = ecryptfs_read_metadata(dentry);
if (!rc)
goto out;
#ifdef CONFIG_SDP
/*
* no passthrough/xattr for sensitive files
*/
if ((rc) && crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE)
goto out;
#endif
if (mount_crypt_stat->flags & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
if (!(mount_crypt_stat->flags & ECRYPTFS_XATTR_METADATA_ENABLED) &&
!i_size_read(ecryptfs_inode_to_lower(inode))) {
rc = ecryptfs_initialize_file(dentry, inode);
if (!rc)
goto out;
}
rc = -EIO;
out:
mutex_unlock(&crypt_stat->cs_mutex);
#ifdef CONFIG_SDP
if(!rc)
{
/*
* SDP v2.0 : sensitive directory (SDP vault)
* Files under sensitive directory automatically becomes sensitive
*/
struct dentry *p = dentry->d_parent;
struct inode *parent_inode = p->d_inode;
struct ecryptfs_crypt_stat *parent_crypt_stat =
&ecryptfs_inode_to_private(parent_inode)->crypt_stat;
if (!(crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE) &&
((S_ISDIR(parent_inode->i_mode)) &&
(parent_crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE))) {
ecryptfs_sdp_set_sensitive(dentry);
}
}
#endif
return rc;
}
static int ecryptfs_update_crypt_flag(struct dentry *dentry, int is_sensitive)
{
int rc = 0;
struct dentry *lower_dentry;
struct inode *inode;
struct inode *lower_inode;
struct ecryptfs_crypt_stat *crypt_stat;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
if (!(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED))
ecryptfs_init_crypt_stat(crypt_stat);
inode = dentry->d_inode;
lower_inode = ecryptfs_inode_to_lower(inode);
lower_dentry = ecryptfs_dentry_to_lower(dentry);
mutex_lock(&crypt_stat->cs_mutex);
mount_crypt_stat = &ecryptfs_superblock_to_private(
dentry->d_sb)->mount_crypt_stat;
rc = ecryptfs_get_lower_file(dentry, inode);
if (rc) {
mutex_unlock(&crypt_stat->cs_mutex);
DEK_LOGE("ecryptfs_get_lower_file rc=%d\n", rc);
goto out;
}
if (is_sensitive) {
crypt_stat->flags |= ECRYPTFS_DEK_IS_SENSITIVE;
/*
* Set sensirive for all the pages in the inode
*/
set_sensitive_mapping_pages(inode->i_mapping, 0, -1);
}
else{
crypt_stat->flags &= ~ECRYPTFS_DEK_IS_SENSITIVE;
}
rc = ecryptfs_write_metadata(dentry, inode);
if (rc) {
if (!(mount_crypt_stat->flags
& ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
rc = -EIO;
DEK_LOGE("Either the lower file "
"is not in a valid eCryptfs format, "
"or the key could not be retrieved. "
"Plaintext passthrough mode is not "
"enabled; returning -EIO\n");
mutex_unlock(&crypt_stat->cs_mutex);
DEK_LOGD("ecryptfs_write_metadata rc=%d\n", rc);
goto out;
}
rc = 0;
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
}
rc = ecryptfs_write_inode_size_to_metadata(inode);
if (rc) {
mutex_unlock(&crypt_stat->cs_mutex);
DEK_LOGE("Problem with "
"ecryptfs_write_inode_size_to_metadata; "
"rc = [%d]\n", rc);
goto out;
}
ecryptfs_put_lower_file(inode);
mutex_unlock(&crypt_stat->cs_mutex);
out:
fsstack_copy_attr_all(inode, lower_inode);
return rc;
}
/**
* ecryptfs_clear_inode
* @inode - The ecryptfs inode
*
* Called by iput() when the inode reference count reached zero
* and the inode is not hashed anywhere. Used to clear anything
* that needs to be, before the inode is completely destroyed and put
* on the inode free list. We use this to drop out reference to the
* lower inode.
*/
static void ecryptfs_clear_inode(struct inode *inode)
{
iput(ecryptfs_inode_to_lower(inode));
}
static int ecryptfs_inode_test(struct inode *inode, void *lower_inode)
{
return ecryptfs_inode_to_lower(inode) == lower_inode;
}
/**
* ecryptfs_readdir
* @file: The eCryptfs directory file
* @ctx: The actor to feed the entries to
*/
static int ecryptfs_readdir(struct file *file, struct dir_context *ctx)
{
int rc;
struct file *lower_file;
struct inode *inode = file_inode(file);
struct ecryptfs_getdents_callback buf = {
.ctx.actor = ecryptfs_filldir,
.caller = ctx,
.sb = inode->i_sb,
};
lower_file = ecryptfs_file_to_lower(file);
lower_file->f_pos = ctx->pos;
rc = iterate_dir(lower_file, &buf.ctx);
ctx->pos = buf.ctx.pos;
if (rc < 0)
goto out;
if (buf.filldir_called && !buf.entries_written)
goto out;
if (rc >= 0)
fsstack_copy_attr_atime(inode,
file_inode(lower_file));
out:
return rc;
}
struct kmem_cache *ecryptfs_file_info_cache;
static int read_or_initialize_metadata(struct dentry *dentry)
{
struct inode *inode = dentry->d_inode;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
struct ecryptfs_crypt_stat *crypt_stat;
int rc;
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mount_crypt_stat = &ecryptfs_superblock_to_private(
inode->i_sb)->mount_crypt_stat;
#ifdef CONFIG_WTL_ENCRYPTION_FILTER
if (crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED
&& crypt_stat->flags & ECRYPTFS_POLICY_APPLIED
&& crypt_stat->flags & ECRYPTFS_ENCRYPTED
&& !(crypt_stat->flags & ECRYPTFS_KEY_VALID)
&& !(crypt_stat->flags & ECRYPTFS_KEY_SET)
&& crypt_stat->flags & ECRYPTFS_I_SIZE_INITIALIZED) {
crypt_stat->flags |= ECRYPTFS_ENCRYPTED_OTHER_DEVICE;
}
mutex_lock(&crypt_stat->cs_mutex);
if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_NEW_PASSTHROUGH)
&& (crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
if (ecryptfs_read_metadata(dentry)) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
} else if ((mount_crypt_stat->flags & ECRYPTFS_ENABLE_FILTERING)
&& (crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
struct dentry *fp_dentry =
ecryptfs_inode_to_private(inode)->lower_file->f_dentry;
char filename[NAME_MAX+1] = {0};
if (fp_dentry->d_name.len <= NAME_MAX)
memcpy(filename, fp_dentry->d_name.name,
fp_dentry->d_name.len + 1);
if (is_file_name_match(mount_crypt_stat, fp_dentry)
|| is_file_ext_match(mount_crypt_stat, filename)) {
if (ecryptfs_read_metadata(dentry))
crypt_stat->flags &=
~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
}
mutex_unlock(&crypt_stat->cs_mutex);
#endif
mutex_lock(&crypt_stat->cs_mutex);
if (crypt_stat->flags & ECRYPTFS_POLICY_APPLIED &&
crypt_stat->flags & ECRYPTFS_KEY_VALID) {
rc = 0;
goto out;
}
rc = ecryptfs_read_metadata(dentry);
if (!rc)
goto out;
#ifdef CONFIG_SDP
/*
* no passthrough/xattr for sensitive files
*/
if ((rc) && crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE)
goto out;
#endif
if (mount_crypt_stat->flags & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED) {
crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
| ECRYPTFS_ENCRYPTED);
rc = 0;
goto out;
}
if (!(mount_crypt_stat->flags & ECRYPTFS_XATTR_METADATA_ENABLED) &&
!i_size_read(ecryptfs_inode_to_lower(inode))) {
rc = ecryptfs_initialize_file(dentry, inode);
if (!rc)
goto out;
}
rc = -EIO;
out:
mutex_unlock(&crypt_stat->cs_mutex);
#ifdef CONFIG_SDP
if(!rc)
{
/*
* SDP v2.0 : sensitive directory (SDP vault)
* Files under sensitive directory automatically becomes sensitive
*/
struct dentry *p = dentry->d_parent;
struct inode *parent_inode = p->d_inode;
struct ecryptfs_crypt_stat *parent_crypt_stat =
&ecryptfs_inode_to_private(parent_inode)->crypt_stat;
if (!(crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE) &&
((S_ISDIR(parent_inode->i_mode)) &&
(parent_crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE))) {
rc = ecryptfs_sdp_set_sensitive(parent_crypt_stat->engine_id, dentry);
}
}
#endif
return rc;
}
#if defined(CONFIG_MMC_DW_FMP_ECRYPT_FS) || defined(CONFIG_UFS_FMP_ECRYPT_FS)
static void ecryptfs_set_rapages(struct file *file, unsigned int flag)
{
if (!flag)
file->f_ra.ra_pages = 0;
else
file->f_ra.ra_pages = (unsigned int)file->f_mapping->backing_dev_info->ra_pages;
}
static int ecryptfs_set_fmpinfo(struct file *file, struct inode *inode, unsigned int set_flag)
{
struct address_space *mapping = file->f_mapping;
if (set_flag) {
struct ecryptfs_crypt_stat *crypt_stat =
&ecryptfs_inode_to_private(inode)->crypt_stat;
struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
&ecryptfs_superblock_to_private(inode->i_sb)->mount_crypt_stat;
if (strncmp(crypt_stat->cipher, "aesxts", sizeof("aesxts"))
&& strncmp(crypt_stat->cipher, "aes", sizeof("aes"))) {
if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
mapping->plain_text = 1;
return 0;
} else {
ecryptfs_printk(KERN_ERR,
"%s: Error invalid file encryption algorithm, inode %lu, filename %s alg %s\n"
, __func__, inode->i_ino, file->f_dentry->d_name.name, crypt_stat->cipher);
return -EINVAL;
}
}
mapping->iv = crypt_stat->root_iv;
mapping->key = crypt_stat->key;
mapping->sensitive_data_index = crypt_stat->metadata_size/4096;
if (mount_crypt_stat->cipher_code == RFC2440_CIPHER_AES_XTS_256) {
mapping->key_length = crypt_stat->key_size * 2;
mapping->alg = "aesxts";
} else {
mapping->key_length = crypt_stat->key_size;
mapping->alg = crypt_stat->cipher;
}
mapping->hash_tfm = crypt_stat->hash_tfm;
#ifdef CONFIG_CRYPTO_FIPS
mapping->cc_enable =
(mount_crypt_stat->flags & ECRYPTFS_ENABLE_CC)?1:0;
#endif
} else {
mapping->iv = NULL;
mapping->key = NULL;
mapping->key_length = 0;
mapping->sensitive_data_index = 0;
mapping->alg = NULL;
mapping->hash_tfm = NULL;
#ifdef CONFIG_CRYPTO_FIPS
mapping->cc_enable = 0;
#endif
mapping->plain_text = 0;
}
return 0;
}
void ecryptfs_propagate_rapages(struct file *file, unsigned int flag)
{
struct file *f = file;
do {
if (!f)
return;
ecryptfs_set_rapages(f, flag);
} while(f->f_op->get_lower_file && (f = f->f_op->get_lower_file(f)));
}
int ecryptfs_propagate_fmpinfo(struct inode *inode, unsigned int flag)
{
struct file *f = ecryptfs_inode_to_private(inode)->lower_file;
do {
if (!f)
return 0;
if (ecryptfs_set_fmpinfo(f, inode, flag))
return -EINVAL;
} while(f->f_op->get_lower_file && (f = f->f_op->get_lower_file(f)));
return 0;
}
#endif
/**
* ecryptfs_open
* @inode: inode speciying file to open
* @file: Structure to return filled in
*
* Opens the file specified by inode.
*
* Returns zero on success; non-zero otherwise
*/
static int ecryptfs_open(struct inode *inode, struct file *file)
{
int rc = 0;
struct ecryptfs_crypt_stat *crypt_stat = NULL;
struct dentry *ecryptfs_dentry = file->f_path.dentry;
/* Private value of ecryptfs_dentry allocated in
* ecryptfs_lookup() */
struct ecryptfs_file_info *file_info;
#ifdef CONFIG_DLP
sdp_fs_command_t *cmd = NULL;
ssize_t dlp_len = 0;
struct knox_dlp_data dlp_data;
struct timespec ts;
#endif
#if defined(CONFIG_MMC_DW_FMP_ECRYPT_FS) || defined(CONFIG_UFS_FMP_ECRYPT_FS) || defined(CONFIG_SDP)
struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
mount_crypt_stat = &ecryptfs_superblock_to_private(
inode->i_sb)->mount_crypt_stat;
#endif
/* Released in ecryptfs_release or end of function if failure */
file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
ecryptfs_set_file_private(file, file_info);
if (!file_info) {
ecryptfs_printk(KERN_ERR,
"Error attempting to allocate memory\n");
rc = -ENOMEM;
goto out;
}
crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
mutex_lock(&crypt_stat->cs_mutex);
if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)) {
ecryptfs_printk(KERN_DEBUG, "Setting flags for stat...\n");
/* Policy code enabled in future release */
crypt_stat->flags |= (ECRYPTFS_POLICY_APPLIED
| ECRYPTFS_ENCRYPTED);
}
mutex_unlock(&crypt_stat->cs_mutex);
rc = ecryptfs_get_lower_file(ecryptfs_dentry, inode);
if (rc) {
printk(KERN_ERR "%s: Error attempting to initialize "
"the lower file for the dentry with name "
"[%pd]; rc = [%d]\n", __func__,
ecryptfs_dentry, rc);
goto out_free;
}
if ((ecryptfs_inode_to_private(inode)->lower_file->f_flags & O_ACCMODE)
== O_RDONLY && (file->f_flags & O_ACCMODE) != O_RDONLY) {
rc = -EPERM;
printk(KERN_WARNING "%s: Lower file is RO; eCryptfs "
"file must hence be opened RO\n", __func__);
goto out_put;
}
ecryptfs_set_file_lower(
file, ecryptfs_inode_to_private(inode)->lower_file);
if (S_ISDIR(ecryptfs_dentry->d_inode->i_mode)) {
#ifdef CONFIG_SDP
/*
* it's possible to have a sensitive directory. (vault)
*/
if (mount_crypt_stat->flags & ECRYPTFS_MOUNT_SDP_ENABLED)
crypt_stat->flags |= ECRYPTFS_DEK_SDP_ENABLED;
#endif
ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
mutex_lock(&crypt_stat->cs_mutex);
crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
mutex_unlock(&crypt_stat->cs_mutex);
rc = 0;
goto out;
}
rc = read_or_initialize_metadata(ecryptfs_dentry);
if (rc) {
#ifdef CONFIG_SDP
if(file->f_flags & O_SDP){
printk("Failed to initialize metadata, "
"but let it continue cause current call is from SDP API\n");
mutex_lock(&crypt_stat->cs_mutex);
crypt_stat->flags &= ~(ECRYPTFS_KEY_VALID);
mutex_unlock(&crypt_stat->cs_mutex);
rc = 0;
/*
* Letting this continue doesn't mean to allow read/writing. It will anyway fail later.
*
* 1. In this stage, ecryptfs_stat won't have key/iv and encryption ctx.
* 2. ECRYPTFS_KEY_VALID bit is off, next attempt will try reading metadata again.
* 3. Skip DEK conversion. it cannot be done anyway.
*/
goto out;
}
#endif
goto out_put;
}
#if defined(CONFIG_MMC_DW_FMP_ECRYPT_FS) || defined(CONFIG_UFS_FMP_ECRYPT_FS)
if (mount_crypt_stat->flags & ECRYPTFS_USE_FMP)
rc = ecryptfs_propagate_fmpinfo(inode, FMPINFO_SET);
else
rc = ecryptfs_propagate_fmpinfo(inode, FMPINFO_CLEAR);
#endif
if (rc)
goto out_put;
#ifdef CONFIG_SDP
if (crypt_stat->flags & ECRYPTFS_DEK_IS_SENSITIVE) {
#ifdef CONFIG_SDP_KEY_DUMP
if (S_ISREG(ecryptfs_dentry->d_inode->i_mode)) {
if(get_sdp_sysfs_key_dump()) {
printk("FEK[%s] : ", ecryptfs_dentry->d_name.name);
key_dump(crypt_stat->key, 32);
}
}
#endif
/*
* Need to update sensitive mapping on file open
*/
if (S_ISREG(ecryptfs_dentry->d_inode->i_mode)) {
ecryptfs_set_mapping_sensitive(inode, mount_crypt_stat->userid, TO_SENSITIVE);
}
if (ecryptfs_is_sdp_locked(crypt_stat->engine_id)) {
ecryptfs_printk(KERN_INFO, "ecryptfs_open: persona is locked, rc=%d\n", rc);
} else {
int dek_type = crypt_stat->sdp_dek.type;
ecryptfs_printk(KERN_INFO, "ecryptfs_open: persona is unlocked, rc=%d\n", rc);
if(dek_type != DEK_TYPE_AES_ENC) {
ecryptfs_printk(KERN_DEBUG, "converting dek...\n");
rc = ecryptfs_sdp_convert_dek(ecryptfs_dentry);
ecryptfs_printk(KERN_DEBUG, "conversion ready, rc=%d\n", rc);
rc = 0; // TODO: Do we need to return error if conversion fails?
}
}
}
#if ECRYPTFS_DEK_DEBUG
else {
ecryptfs_printk(KERN_INFO, "ecryptfs_open: dek_file_type is protected\n");
}
#endif
#endif
#ifdef CONFIG_DLP
if(crypt_stat->flags & ECRYPTFS_DLP_ENABLED) {
#if DLP_DEBUG
printk("DLP %s: try to open %s with crypt_stat->flags %d\n",
__func__, ecryptfs_dentry->d_name.name, crypt_stat->flags);
#endif
if (dlp_is_locked(mount_crypt_stat->userid)) {
printk("%s: DLP locked\n", __func__);
rc = -EPERM;
goto out_put;
}
if(in_egroup_p(AID_KNOX_DLP) || in_egroup_p(AID_KNOX_DLP_RESTRICTED)) {
dlp_len = ecryptfs_getxattr_lower(
ecryptfs_dentry_to_lower(ecryptfs_dentry),
KNOX_DLP_XATTR_NAME,
&dlp_data, sizeof(dlp_data));
if (dlp_len == sizeof(dlp_data)) {
getnstimeofday(&ts);
#if DLP_DEBUG
printk("DLP %s: current time [%ld/%ld] %s\n",
__func__, (long)ts.tv_sec, (long)dlp_data.expiry_time.tv_sec, ecryptfs_dentry->d_name.name);
#endif
if ((ts.tv_sec > dlp_data.expiry_time.tv_sec) && dlp_isInterestedFile(ecryptfs_dentry->d_name.name)==0) {
/* Command to delete expired file */
cmd = sdp_fs_command_alloc(FSOP_DLP_FILE_REMOVE,
current->tgid, mount_crypt_stat->userid, mount_crypt_stat->partition_id,
inode->i_ino, GFP_KERNEL);
rc = -ENOENT;
goto out_put;
}
} else if (dlp_len == -ENODATA) {
/* DLP flag is set, but no DLP data. Let it continue, xattr will be set later */
printk("DLP %s: normal file [%s]\n",
__func__, ecryptfs_dentry->d_name.name);
} else {
printk("DLP %s: Error, len [%ld], [%s]\n",
__func__, (long)dlp_len, ecryptfs_dentry->d_name.name);
rc = -EFAULT;
goto out_put;
}
#if DLP_DEBUG
printk("DLP %s: DLP file [%s] opened with tgid %d, %d\n" ,
__func__, ecryptfs_dentry->d_name.name, current->tgid, in_egroup_p(AID_KNOX_DLP_RESTRICTED));
#endif
if(in_egroup_p(AID_KNOX_DLP_RESTRICTED)) {
cmd = sdp_fs_command_alloc(FSOP_DLP_FILE_OPENED,
current->tgid, mount_crypt_stat->userid, mount_crypt_stat->partition_id,
inode->i_ino, GFP_KERNEL);
}
} else {
printk("DLP %s: not DLP app [%s]\n", __func__, current->comm);
rc = -EPERM;
goto out_put;
}
}
#endif
ecryptfs_printk(KERN_DEBUG, "inode w/ addr = [0x%p], i_ino = "
"[0x%.16lx] size: [0x%.16llx]\n", inode, inode->i_ino,
(unsigned long long)i_size_read(inode));
goto out;
out_put:
ecryptfs_put_lower_file(inode);
out_free:
kmem_cache_free(ecryptfs_file_info_cache,
ecryptfs_file_to_private(file));
out:
#ifdef CONFIG_DLP
if(cmd) {
sdp_fs_request(cmd, NULL);
sdp_fs_command_free(cmd);
}
#endif
return rc;
}
static int
ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
struct inode *new_dir, struct dentry *new_dentry)
{
int rc;
struct dentry *lower_old_dentry;
struct dentry *lower_new_dentry;
struct dentry *lower_old_dir_dentry;
struct dentry *lower_new_dir_dentry;
struct dentry *trap = NULL;
struct inode *target_inode;
#ifdef CONFIG_DLP
sdp_fs_command_t *cmd1 = NULL;
unsigned long old_inode = old_dentry->d_inode->i_ino;
#endif
#ifdef CONFIG_SDP
sdp_fs_command_t *cmd = NULL;
int rename_event = 0x00;
struct ecryptfs_crypt_stat *crypt_stat =
&(ecryptfs_inode_to_private(old_dentry->d_inode)->crypt_stat);
struct ecryptfs_crypt_stat *parent_crypt_stat =
&(ecryptfs_inode_to_private(old_dentry->d_parent->d_inode)->crypt_stat);
struct ecryptfs_crypt_stat *new_parent_crypt_stat =
&(ecryptfs_inode_to_private(new_dentry->d_parent->d_inode)->crypt_stat);
struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
&ecryptfs_superblock_to_private(old_dentry->d_sb)->mount_crypt_stat;
#if ECRYPTFS_SDP_RENAME_DEBUG
printk("You're renaming %s to %s\n",
old_dentry->d_name.name,
new_dentry->d_name.name);
printk("old_dentry[%p] : %s [parent %s : %s] inode:%p\n",
old_dentry, old_dentry->d_name.name,
old_dentry->d_parent->d_name.name,
IS_SENSITIVE_DENTRY(old_dentry->d_parent) ? "sensitive" : "protected",
old_dentry->d_inode);
printk("new_dentry[%p] : %s [parent %s : %s] inode:%p\n",
new_dentry, new_dentry->d_name.name,
new_dentry->d_parent->d_name.name,
IS_SENSITIVE_DENTRY(new_dentry->d_parent) ? "sensitive" : "protected",
new_dentry->d_inode);
#endif
if(IS_CHAMBER_DENTRY(old_dentry)) {
printk("Rename trial on chamber : failed\n");
return -EIO;
}
#if 0 // kernel panic. new_crypt_stat->engine_id
if(IS_SENSITIVE_DENTRY(old_dentry->d_parent) &&
IS_SENSITIVE_DENTRY(new_dentry->d_parent)) {
if(crypt_stat->engine_id != new_crypt_stat->engine_id) {
printk("Rename chamber file to another chamber : failed\n");
return -EIO;
}
}
#endif
if(IS_SENSITIVE_DENTRY(old_dentry->d_parent)) {
if(ecryptfs_is_sdp_locked(parent_crypt_stat->engine_id)) {
printk("Rename/move trial in locked state\n");
return -EIO;
}
}
if(IS_SENSITIVE_DENTRY(old_dentry->d_parent) &&
IS_SENSITIVE_DENTRY(new_dentry->d_parent)) {
if(parent_crypt_stat->engine_id != new_parent_crypt_stat->engine_id) {
printk("Can't move between chambers\n");
return -EIO;
}
}
if(IS_SENSITIVE_DENTRY(old_dentry->d_parent) &&
!IS_SENSITIVE_DENTRY(new_dentry->d_parent))
rename_event |= ECRYPTFS_EVT_RENAME_OUT_OF_CHAMBER;
if(!IS_SENSITIVE_DENTRY(old_dentry->d_parent) &&
IS_SENSITIVE_DENTRY(new_dentry->d_parent))
rename_event |= ECRYPTFS_EVT_RENAME_TO_CHAMBER;
#endif
lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
dget(lower_old_dentry);
dget(lower_new_dentry);
lower_old_dir_dentry = dget_parent(lower_old_dentry);
lower_new_dir_dentry = dget_parent(lower_new_dentry);
target_inode = new_dentry->d_inode;
trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
/* source should not be ancestor of target */
if (trap == lower_old_dentry) {
rc = -EINVAL;
goto out_lock;
}
/* target should not be ancestor of source */
if (trap == lower_new_dentry) {
rc = -ENOTEMPTY;
goto out_lock;
}
rc = vfs_rename(lower_old_dir_dentry->d_inode, lower_old_dentry,
lower_new_dir_dentry->d_inode, lower_new_dentry);
if (rc)
goto out_lock;
if (target_inode)
fsstack_copy_attr_all(target_inode,
ecryptfs_inode_to_lower(target_inode));
fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode);
if (new_dir != old_dir)
fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
#ifdef CONFIG_SDP
if(!rc) {
crypt_stat = &(ecryptfs_inode_to_private(old_dentry->d_inode)->crypt_stat);
if(rename_event > 0) {
switch(rename_event) {
case ECRYPTFS_EVT_RENAME_TO_CHAMBER:
cmd = sdp_fs_command_alloc(FSOP_SDP_SET_SENSITIVE, current->pid,
mount_crypt_stat->userid, mount_crypt_stat->partition_id,
old_dentry->d_inode->i_ino,
GFP_NOFS);
break;
case ECRYPTFS_EVT_RENAME_OUT_OF_CHAMBER:
cmd = sdp_fs_command_alloc(FSOP_SDP_SET_PROTECTED, current->pid,
mount_crypt_stat->userid, mount_crypt_stat->partition_id,
old_dentry->d_inode->i_ino,
GFP_NOFS);
break;
default:
cmd = NULL;
break;
}
}
#if ECRYPTFS_SDP_RENAME_DEBUG
printk("[end of rename] old_dentry[%p] : %s [parent %s : %s] inode:%p\n",
old_dentry, old_dentry->d_name.name,
old_dentry->d_parent->d_name.name,
IS_SENSITIVE_DENTRY(old_dentry->d_parent) ? "sensitive" : "protected",
old_dentry->d_inode);
printk("[end of rename] new_dentry[%p] : %s [parent %s : %s] inode:%p\n",
new_dentry, new_dentry->d_name.name,
new_dentry->d_parent->d_name.name,
IS_SENSITIVE_DENTRY(new_dentry->d_parent) ? "sensitive" : "protected",
new_dentry->d_inode);
#endif
}
#endif
out_lock:
unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
dput(lower_new_dir_dentry);
dput(lower_old_dir_dentry);
dput(lower_new_dentry);
dput(lower_old_dentry);
#ifdef CONFIG_SDP
if(!rc && cmd != NULL) {
sdp_fs_request(cmd, ecryptfs_fs_request_callback);
sdp_fs_command_free(cmd);
}
#endif
#ifdef CONFIG_DLP
//create new init command and send--Handle transient case MS-Apps
if(crypt_stat->flags & ECRYPTFS_DLP_ENABLED) {
if(!rc && (in_egroup_p(AID_KNOX_DLP) || in_egroup_p(AID_KNOX_DLP_RESTRICTED))){
cmd1 = sdp_fs_command_alloc(FSOP_DLP_FILE_RENAME,
current->tgid, mount_crypt_stat->userid, mount_crypt_stat->partition_id,
old_inode, GFP_KERNEL);
//send cmd
if(cmd1) {
sdp_fs_request(cmd1, NULL);
sdp_fs_command_free(cmd1);
}
}
}
//end- Handle transient case MS-Apps
#endif
return rc;
}
