1/*
  2 * fs/crypto/hooks.c
  3 *
  4 * Encryption hooks for higher-level filesystem operations.
  5 */
  6
  7#include <linux/ratelimit.h>
  8#include "fscrypt_private.h"
  9
 10/**
 11 * fscrypt_file_open - prepare to open a possibly-encrypted regular file
 12 * @inode: the inode being opened
 13 * @filp: the struct file being set up
 14 *
 15 * Currently, an encrypted regular file can only be opened if its encryption key
 16 * is available; access to the raw encrypted contents is not supported.
 17 * Therefore, we first set up the inode's encryption key (if not already done)
 18 * and return an error if it's unavailable.
 19 *
 20 * We also verify that if the parent directory (from the path via which the file
 21 * is being opened) is encrypted, then the inode being opened uses the same
 22 * encryption policy.  This is needed as part of the enforcement that all files
 23 * in an encrypted directory tree use the same encryption policy, as a
 24 * protection against certain types of offline attacks.  Note that this check is
 25 * needed even when opening an *unencrypted* file, since it's forbidden to have
 26 * an unencrypted file in an encrypted directory.
 27 *
 28 * Return: 0 on success, -ENOKEY if the key is missing, or another -errno code
 29 */
 30int fscrypt_file_open(struct inode *inode, struct file *filp)
 31{
 32	int err;
 33	struct dentry *dir;
 34
 35	err = fscrypt_require_key(inode);
 36	if (err)
 37		return err;
 38
 39	dir = dget_parent(file_dentry(filp));
 40	if (IS_ENCRYPTED(d_inode(dir)) &&
 41	    !fscrypt_has_permitted_context(d_inode(dir), inode)) {
 42		pr_warn_ratelimited("fscrypt: inconsistent encryption contexts: %lu/%lu",
 43				    d_inode(dir)->i_ino, inode->i_ino);
 44		err = -EPERM;
 45	}
 46	dput(dir);
 47	return err;
 48}
 49EXPORT_SYMBOL_GPL(fscrypt_file_open);
 50
 51int __fscrypt_prepare_link(struct inode *inode, struct inode *dir)
 52{
 53	int err;
 54
 55	err = fscrypt_require_key(dir);
 56	if (err)
 57		return err;
 58
 59	if (!fscrypt_has_permitted_context(dir, inode))
 60		return -EPERM;
 61
 62	return 0;
 63}
 64EXPORT_SYMBOL_GPL(__fscrypt_prepare_link);
 65
 66int __fscrypt_prepare_rename(struct inode *old_dir, struct dentry *old_dentry,
 67			     struct inode *new_dir, struct dentry *new_dentry,
 68			     unsigned int flags)
 69{
 70	int err;
 71
 72	err = fscrypt_require_key(old_dir);
 73	if (err)
 74		return err;
 75
 76	err = fscrypt_require_key(new_dir);
 77	if (err)
 78		return err;
 79
 80	if (old_dir != new_dir) {
 81		if (IS_ENCRYPTED(new_dir) &&
 82		    !fscrypt_has_permitted_context(new_dir,
 83						   d_inode(old_dentry)))
 84			return -EPERM;
 85
 86		if ((flags & RENAME_EXCHANGE) &&
 87		    IS_ENCRYPTED(old_dir) &&
 88		    !fscrypt_has_permitted_context(old_dir,
 89						   d_inode(new_dentry)))
 90			return -EPERM;
 91	}
 92	return 0;
 93}
 94EXPORT_SYMBOL_GPL(__fscrypt_prepare_rename);
 95
 96int __fscrypt_prepare_lookup(struct inode *dir, struct dentry *dentry)
 97{
 98	int err = fscrypt_get_encryption_info(dir);
 99
100	if (err)
101		return err;
102
103	if (fscrypt_has_encryption_key(dir)) {
104		spin_lock(&dentry->d_lock);
105		dentry->d_flags |= DCACHE_ENCRYPTED_WITH_KEY;
106		spin_unlock(&dentry->d_lock);
107	}
108
109	d_set_d_op(dentry, &fscrypt_d_ops);
110	return 0;
111}
112EXPORT_SYMBOL_GPL(__fscrypt_prepare_lookup);
113
114int __fscrypt_prepare_symlink(struct inode *dir, unsigned int len,
115			      unsigned int max_len,
116			      struct fscrypt_str *disk_link)
117{
118	int err;
119
120	/*
121	 * To calculate the size of the encrypted symlink target we need to know
122	 * the amount of NUL padding, which is determined by the flags set in
123	 * the encryption policy which will be inherited from the directory.
124	 * The easiest way to get access to this is to just load the directory's
125	 * fscrypt_info, since we'll need it to create the dir_entry anyway.
126	 *
127	 * Note: in test_dummy_encryption mode, @dir may be unencrypted.
128	 */
129	err = fscrypt_get_encryption_info(dir);
130	if (err)
131		return err;
132	if (!fscrypt_has_encryption_key(dir))
133		return -ENOKEY;
134
135	/*
136	 * Calculate the size of the encrypted symlink and verify it won't
137	 * exceed max_len.  Note that for historical reasons, encrypted symlink
138	 * targets are prefixed with the ciphertext length, despite this
139	 * actually being redundant with i_size.  This decreases by 2 bytes the
140	 * longest symlink target we can accept.
141	 *
142	 * We could recover 1 byte by not counting a null terminator, but
143	 * counting it (even though it is meaningless for ciphertext) is simpler
144	 * for now since filesystems will assume it is there and subtract it.
145	 */
146	if (!fscrypt_fname_encrypted_size(dir, len,
147					  max_len - sizeof(struct fscrypt_symlink_data),
148					  &disk_link->len))
149		return -ENAMETOOLONG;
150	disk_link->len += sizeof(struct fscrypt_symlink_data);
151
152	disk_link->name = NULL;
153	return 0;
154}
155EXPORT_SYMBOL_GPL(__fscrypt_prepare_symlink);
156
157int __fscrypt_encrypt_symlink(struct inode *inode, const char *target,
158			      unsigned int len, struct fscrypt_str *disk_link)
159{
160	int err;
161	struct qstr iname = QSTR_INIT(target, len);
162	struct fscrypt_symlink_data *sd;
163	unsigned int ciphertext_len;
164
165	err = fscrypt_require_key(inode);
166	if (err)
167		return err;
168
169	if (disk_link->name) {
170		/* filesystem-provided buffer */
171		sd = (struct fscrypt_symlink_data *)disk_link->name;
172	} else {
173		sd = kmalloc(disk_link->len, GFP_NOFS);
174		if (!sd)
175			return -ENOMEM;
176	}
177	ciphertext_len = disk_link->len - sizeof(*sd);
178	sd->len = cpu_to_le16(ciphertext_len);
179
180	err = fname_encrypt(inode, &iname, sd->encrypted_path, ciphertext_len);
181	if (err) {
182		if (!disk_link->name)
183			kfree(sd);
184		return err;
185	}
186	/*
187	 * Null-terminating the ciphertext doesn't make sense, but we still
188	 * count the null terminator in the length, so we might as well
189	 * initialize it just in case the filesystem writes it out.
190	 */
191	sd->encrypted_path[ciphertext_len] = '\0';
192
193	if (!disk_link->name)
194		disk_link->name = (unsigned char *)sd;
195	return 0;
196}
197EXPORT_SYMBOL_GPL(__fscrypt_encrypt_symlink);
198
199/**
200 * fscrypt_get_symlink - get the target of an encrypted symlink
201 * @inode: the symlink inode
202 * @caddr: the on-disk contents of the symlink
203 * @max_size: size of @caddr buffer
204 * @done: if successful, will be set up to free the returned target
205 *
206 * If the symlink's encryption key is available, we decrypt its target.
207 * Otherwise, we encode its target for presentation.
208 *
209 * This may sleep, so the filesystem must have dropped out of RCU mode already.
210 *
211 * Return: the presentable symlink target or an ERR_PTR()
212 */
213const char *fscrypt_get_symlink(struct inode *inode, const void *caddr,
214				unsigned int max_size,
215				struct delayed_call *done)
216{
217	const struct fscrypt_symlink_data *sd;
218	struct fscrypt_str cstr, pstr;
219	int err;
220
221	/* This is for encrypted symlinks only */
222	if (WARN_ON(!IS_ENCRYPTED(inode)))
223		return ERR_PTR(-EINVAL);
224
225	/*
226	 * Try to set up the symlink's encryption key, but we can continue
227	 * regardless of whether the key is available or not.
228	 */
229	err = fscrypt_get_encryption_info(inode);
230	if (err)
231		return ERR_PTR(err);
232
233	/*
234	 * For historical reasons, encrypted symlink targets are prefixed with
235	 * the ciphertext length, even though this is redundant with i_size.
236	 */
237
238	if (max_size < sizeof(*sd))
239		return ERR_PTR(-EUCLEAN);
240	sd = caddr;
241	cstr.name = (unsigned char *)sd->encrypted_path;
242	cstr.len = le16_to_cpu(sd->len);
243
244	if (cstr.len == 0)
245		return ERR_PTR(-EUCLEAN);
246
247	if (cstr.len + sizeof(*sd) - 1 > max_size)
248		return ERR_PTR(-EUCLEAN);
249
250	err = fscrypt_fname_alloc_buffer(inode, cstr.len, &pstr);
251	if (err)
252		return ERR_PTR(err);
253
254	err = fscrypt_fname_disk_to_usr(inode, 0, 0, &cstr, &pstr);
255	if (err)
256		goto err_kfree;
257
258	err = -EUCLEAN;
259	if (pstr.name[0] == '\0')
260		goto err_kfree;
261
262	pstr.name[pstr.len] = '\0';
263	set_delayed_call(done, kfree_link, pstr.name);
264	return pstr.name;
265
266err_kfree:
267	kfree(pstr.name);
268	return ERR_PTR(err);
269}
270EXPORT_SYMBOL_GPL(fscrypt_get_symlink);