d4a9431ec73ce0cb215fc3b6e52727b4059f9528
[muen/linux.git] / fs / ecryptfs / inode.c
1 /**
2  * eCryptfs: Linux filesystem encryption layer
3  *
4  * Copyright (C) 1997-2004 Erez Zadok
5  * Copyright (C) 2001-2004 Stony Brook University
6  * Copyright (C) 2004-2007 International Business Machines Corp.
7  *   Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>
8  *              Michael C. Thompsion <mcthomps@us.ibm.com>
9  *
10  * This program is free software; you can redistribute it and/or
11  * modify it under the terms of the GNU General Public License as
12  * published by the Free Software Foundation; either version 2 of the
13  * License, or (at your option) any later version.
14  *
15  * This program is distributed in the hope that it will be useful, but
16  * WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
18  * General Public License for more details.
19  *
20  * You should have received a copy of the GNU General Public License
21  * along with this program; if not, write to the Free Software
22  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
23  * 02111-1307, USA.
24  */
25
26 #include <linux/file.h>
27 #include <linux/vmalloc.h>
28 #include <linux/pagemap.h>
29 #include <linux/dcache.h>
30 #include <linux/namei.h>
31 #include <linux/mount.h>
32 #include <linux/crypto.h>
33 #include <linux/fs_stack.h>
34 #include <linux/slab.h>
35 #include <linux/xattr.h>
36 #include <asm/unaligned.h>
37 #include "ecryptfs_kernel.h"
38
39 static struct dentry *lock_parent(struct dentry *dentry)
40 {
41         struct dentry *dir;
42
43         dir = dget_parent(dentry);
44         mutex_lock_nested(&(dir->d_inode->i_mutex), I_MUTEX_PARENT);
45         return dir;
46 }
47
48 static void unlock_dir(struct dentry *dir)
49 {
50         mutex_unlock(&dir->d_inode->i_mutex);
51         dput(dir);
52 }
53
54 static int ecryptfs_inode_test(struct inode *inode, void *lower_inode)
55 {
56         if (ecryptfs_inode_to_lower(inode) == (struct inode *)lower_inode)
57                 return 1;
58         return 0;
59 }
60
61 static int ecryptfs_inode_set(struct inode *inode, void *opaque)
62 {
63         struct inode *lower_inode = opaque;
64
65         ecryptfs_set_inode_lower(inode, lower_inode);
66         fsstack_copy_attr_all(inode, lower_inode);
67         /* i_size will be overwritten for encrypted regular files */
68         fsstack_copy_inode_size(inode, lower_inode);
69         inode->i_ino = lower_inode->i_ino;
70         inode->i_version++;
71         inode->i_mapping->a_ops = &ecryptfs_aops;
72         inode->i_mapping->backing_dev_info = inode->i_sb->s_bdi;
73
74         if (S_ISLNK(inode->i_mode))
75                 inode->i_op = &ecryptfs_symlink_iops;
76         else if (S_ISDIR(inode->i_mode))
77                 inode->i_op = &ecryptfs_dir_iops;
78         else
79                 inode->i_op = &ecryptfs_main_iops;
80
81         if (S_ISDIR(inode->i_mode))
82                 inode->i_fop = &ecryptfs_dir_fops;
83         else if (special_file(inode->i_mode))
84                 init_special_inode(inode, inode->i_mode, inode->i_rdev);
85         else
86                 inode->i_fop = &ecryptfs_main_fops;
87
88         return 0;
89 }
90
91 static struct inode *__ecryptfs_get_inode(struct inode *lower_inode,
92                                           struct super_block *sb)
93 {
94         struct inode *inode;
95
96         if (lower_inode->i_sb != ecryptfs_superblock_to_lower(sb))
97                 return ERR_PTR(-EXDEV);
98         if (!igrab(lower_inode))
99                 return ERR_PTR(-ESTALE);
100         inode = iget5_locked(sb, (unsigned long)lower_inode,
101                              ecryptfs_inode_test, ecryptfs_inode_set,
102                              lower_inode);
103         if (!inode) {
104                 iput(lower_inode);
105                 return ERR_PTR(-EACCES);
106         }
107         if (!(inode->i_state & I_NEW))
108                 iput(lower_inode);
109
110         return inode;
111 }
112
113 struct inode *ecryptfs_get_inode(struct inode *lower_inode,
114                                  struct super_block *sb)
115 {
116         struct inode *inode = __ecryptfs_get_inode(lower_inode, sb);
117
118         if (!IS_ERR(inode) && (inode->i_state & I_NEW))
119                 unlock_new_inode(inode);
120
121         return inode;
122 }
123
124 /**
125  * ecryptfs_interpose
126  * @lower_dentry: Existing dentry in the lower filesystem
127  * @dentry: ecryptfs' dentry
128  * @sb: ecryptfs's super_block
129  *
130  * Interposes upper and lower dentries.
131  *
132  * Returns zero on success; non-zero otherwise
133  */
134 static int ecryptfs_interpose(struct dentry *lower_dentry,
135                               struct dentry *dentry, struct super_block *sb)
136 {
137         struct inode *inode = ecryptfs_get_inode(lower_dentry->d_inode, sb);
138
139         if (IS_ERR(inode))
140                 return PTR_ERR(inode);
141         d_instantiate(dentry, inode);
142
143         return 0;
144 }
145
146 static int ecryptfs_do_unlink(struct inode *dir, struct dentry *dentry,
147                               struct inode *inode)
148 {
149         struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
150         struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
151         struct dentry *lower_dir_dentry;
152         int rc;
153
154         dget(lower_dentry);
155         lower_dir_dentry = lock_parent(lower_dentry);
156         rc = vfs_unlink(lower_dir_inode, lower_dentry, NULL);
157         if (rc) {
158                 printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
159                 goto out_unlock;
160         }
161         fsstack_copy_attr_times(dir, lower_dir_inode);
162         set_nlink(inode, ecryptfs_inode_to_lower(inode)->i_nlink);
163         inode->i_ctime = dir->i_ctime;
164         d_drop(dentry);
165 out_unlock:
166         unlock_dir(lower_dir_dentry);
167         dput(lower_dentry);
168         return rc;
169 }
170
171 /**
172  * ecryptfs_do_create
173  * @directory_inode: inode of the new file's dentry's parent in ecryptfs
174  * @ecryptfs_dentry: New file's dentry in ecryptfs
175  * @mode: The mode of the new file
176  * @nd: nameidata of ecryptfs' parent's dentry & vfsmount
177  *
178  * Creates the underlying file and the eCryptfs inode which will link to
179  * it. It will also update the eCryptfs directory inode to mimic the
180  * stat of the lower directory inode.
181  *
182  * Returns the new eCryptfs inode on success; an ERR_PTR on error condition
183  */
184 static struct inode *
185 ecryptfs_do_create(struct inode *directory_inode,
186                    struct dentry *ecryptfs_dentry, umode_t mode)
187 {
188         int rc;
189         struct dentry *lower_dentry;
190         struct dentry *lower_dir_dentry;
191         struct inode *inode;
192
193         lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
194         lower_dir_dentry = lock_parent(lower_dentry);
195         if (IS_ERR(lower_dir_dentry)) {
196                 ecryptfs_printk(KERN_ERR, "Error locking directory of "
197                                 "dentry\n");
198                 inode = ERR_CAST(lower_dir_dentry);
199                 goto out;
200         }
201         rc = vfs_create(lower_dir_dentry->d_inode, lower_dentry, mode, true);
202         if (rc) {
203                 printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
204                        "rc = [%d]\n", __func__, rc);
205                 inode = ERR_PTR(rc);
206                 goto out_lock;
207         }
208         inode = __ecryptfs_get_inode(lower_dentry->d_inode,
209                                      directory_inode->i_sb);
210         if (IS_ERR(inode)) {
211                 vfs_unlink(lower_dir_dentry->d_inode, lower_dentry, NULL);
212                 goto out_lock;
213         }
214         fsstack_copy_attr_times(directory_inode, lower_dir_dentry->d_inode);
215         fsstack_copy_inode_size(directory_inode, lower_dir_dentry->d_inode);
216 out_lock:
217         unlock_dir(lower_dir_dentry);
218 out:
219         return inode;
220 }
221
222 /**
223  * ecryptfs_initialize_file
224  *
225  * Cause the file to be changed from a basic empty file to an ecryptfs
226  * file with a header and first data page.
227  *
228  * Returns zero on success
229  */
230 int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry,
231                              struct inode *ecryptfs_inode)
232 {
233         struct ecryptfs_crypt_stat *crypt_stat =
234                 &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
235         int rc = 0;
236
237         if (S_ISDIR(ecryptfs_inode->i_mode)) {
238                 ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
239                 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
240                 goto out;
241         }
242         ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n");
243         rc = ecryptfs_new_file_context(ecryptfs_inode);
244         if (rc) {
245                 ecryptfs_printk(KERN_ERR, "Error creating new file "
246                                 "context; rc = [%d]\n", rc);
247                 goto out;
248         }
249         rc = ecryptfs_get_lower_file(ecryptfs_dentry, ecryptfs_inode);
250         if (rc) {
251                 printk(KERN_ERR "%s: Error attempting to initialize "
252                         "the lower file for the dentry with name "
253                         "[%s]; rc = [%d]\n", __func__,
254                         ecryptfs_dentry->d_name.name, rc);
255                 goto out;
256         }
257         rc = ecryptfs_write_metadata(ecryptfs_dentry, ecryptfs_inode);
258         if (rc)
259                 printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
260         ecryptfs_put_lower_file(ecryptfs_inode);
261 out:
262         return rc;
263 }
264
265 /**
266  * ecryptfs_create
267  * @dir: The inode of the directory in which to create the file.
268  * @dentry: The eCryptfs dentry
269  * @mode: The mode of the new file.
270  *
271  * Creates a new file.
272  *
273  * Returns zero on success; non-zero on error condition
274  */
275 static int
276 ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry,
277                 umode_t mode, bool excl)
278 {
279         struct inode *ecryptfs_inode;
280         int rc;
281
282         ecryptfs_inode = ecryptfs_do_create(directory_inode, ecryptfs_dentry,
283                                             mode);
284         if (unlikely(IS_ERR(ecryptfs_inode))) {
285                 ecryptfs_printk(KERN_WARNING, "Failed to create file in"
286                                 "lower filesystem\n");
287                 rc = PTR_ERR(ecryptfs_inode);
288                 goto out;
289         }
290         /* At this point, a file exists on "disk"; we need to make sure
291          * that this on disk file is prepared to be an ecryptfs file */
292         rc = ecryptfs_initialize_file(ecryptfs_dentry, ecryptfs_inode);
293         if (rc) {
294                 ecryptfs_do_unlink(directory_inode, ecryptfs_dentry,
295                                    ecryptfs_inode);
296                 make_bad_inode(ecryptfs_inode);
297                 unlock_new_inode(ecryptfs_inode);
298                 iput(ecryptfs_inode);
299                 goto out;
300         }
301         unlock_new_inode(ecryptfs_inode);
302         d_instantiate(ecryptfs_dentry, ecryptfs_inode);
303 out:
304         return rc;
305 }
306
307 static int ecryptfs_i_size_read(struct dentry *dentry, struct inode *inode)
308 {
309         struct ecryptfs_crypt_stat *crypt_stat;
310         int rc;
311
312         rc = ecryptfs_get_lower_file(dentry, inode);
313         if (rc) {
314                 printk(KERN_ERR "%s: Error attempting to initialize "
315                         "the lower file for the dentry with name "
316                         "[%s]; rc = [%d]\n", __func__,
317                         dentry->d_name.name, rc);
318                 return rc;
319         }
320
321         crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
322         /* TODO: lock for crypt_stat comparison */
323         if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
324                 ecryptfs_set_default_sizes(crypt_stat);
325
326         rc = ecryptfs_read_and_validate_header_region(inode);
327         ecryptfs_put_lower_file(inode);
328         if (rc) {
329                 rc = ecryptfs_read_and_validate_xattr_region(dentry, inode);
330                 if (!rc)
331                         crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
332         }
333
334         /* Must return 0 to allow non-eCryptfs files to be looked up, too */
335         return 0;
336 }
337
338 /**
339  * ecryptfs_lookup_interpose - Dentry interposition for a lookup
340  */
341 static int ecryptfs_lookup_interpose(struct dentry *dentry,
342                                      struct dentry *lower_dentry,
343                                      struct inode *dir_inode)
344 {
345         struct inode *inode, *lower_inode = lower_dentry->d_inode;
346         struct ecryptfs_dentry_info *dentry_info;
347         struct vfsmount *lower_mnt;
348         int rc = 0;
349
350         dentry_info = kmem_cache_alloc(ecryptfs_dentry_info_cache, GFP_KERNEL);
351         if (!dentry_info) {
352                 printk(KERN_ERR "%s: Out of memory whilst attempting "
353                        "to allocate ecryptfs_dentry_info struct\n",
354                         __func__);
355                 dput(lower_dentry);
356                 return -ENOMEM;
357         }
358
359         lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
360         fsstack_copy_attr_atime(dir_inode, lower_dentry->d_parent->d_inode);
361         BUG_ON(!d_count(lower_dentry));
362
363         ecryptfs_set_dentry_private(dentry, dentry_info);
364         dentry_info->lower_path.mnt = lower_mnt;
365         dentry_info->lower_path.dentry = lower_dentry;
366
367         if (!lower_dentry->d_inode) {
368                 /* We want to add because we couldn't find in lower */
369                 d_add(dentry, NULL);
370                 return 0;
371         }
372         inode = __ecryptfs_get_inode(lower_inode, dir_inode->i_sb);
373         if (IS_ERR(inode)) {
374                 printk(KERN_ERR "%s: Error interposing; rc = [%ld]\n",
375                        __func__, PTR_ERR(inode));
376                 return PTR_ERR(inode);
377         }
378         if (S_ISREG(inode->i_mode)) {
379                 rc = ecryptfs_i_size_read(dentry, inode);
380                 if (rc) {
381                         make_bad_inode(inode);
382                         return rc;
383                 }
384         }
385
386         if (inode->i_state & I_NEW)
387                 unlock_new_inode(inode);
388         d_add(dentry, inode);
389
390         return rc;
391 }
392
393 /**
394  * ecryptfs_lookup
395  * @ecryptfs_dir_inode: The eCryptfs directory inode
396  * @ecryptfs_dentry: The eCryptfs dentry that we are looking up
397  * @ecryptfs_nd: nameidata; may be NULL
398  *
399  * Find a file on disk. If the file does not exist, then we'll add it to the
400  * dentry cache and continue on to read it from the disk.
401  */
402 static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
403                                       struct dentry *ecryptfs_dentry,
404                                       unsigned int flags)
405 {
406         char *encrypted_and_encoded_name = NULL;
407         size_t encrypted_and_encoded_name_size;
408         struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
409         struct dentry *lower_dir_dentry, *lower_dentry;
410         int rc = 0;
411
412         lower_dir_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry->d_parent);
413         mutex_lock(&lower_dir_dentry->d_inode->i_mutex);
414         lower_dentry = lookup_one_len(ecryptfs_dentry->d_name.name,
415                                       lower_dir_dentry,
416                                       ecryptfs_dentry->d_name.len);
417         mutex_unlock(&lower_dir_dentry->d_inode->i_mutex);
418         if (IS_ERR(lower_dentry)) {
419                 rc = PTR_ERR(lower_dentry);
420                 ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned "
421                                 "[%d] on lower_dentry = [%s]\n", __func__, rc,
422                                 ecryptfs_dentry->d_name.name);
423                 goto out;
424         }
425         if (lower_dentry->d_inode)
426                 goto interpose;
427         mount_crypt_stat = &ecryptfs_superblock_to_private(
428                                 ecryptfs_dentry->d_sb)->mount_crypt_stat;
429         if (!(mount_crypt_stat
430             && (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)))
431                 goto interpose;
432         dput(lower_dentry);
433         rc = ecryptfs_encrypt_and_encode_filename(
434                 &encrypted_and_encoded_name, &encrypted_and_encoded_name_size,
435                 NULL, mount_crypt_stat, ecryptfs_dentry->d_name.name,
436                 ecryptfs_dentry->d_name.len);
437         if (rc) {
438                 printk(KERN_ERR "%s: Error attempting to encrypt and encode "
439                        "filename; rc = [%d]\n", __func__, rc);
440                 goto out;
441         }
442         mutex_lock(&lower_dir_dentry->d_inode->i_mutex);
443         lower_dentry = lookup_one_len(encrypted_and_encoded_name,
444                                       lower_dir_dentry,
445                                       encrypted_and_encoded_name_size);
446         mutex_unlock(&lower_dir_dentry->d_inode->i_mutex);
447         if (IS_ERR(lower_dentry)) {
448                 rc = PTR_ERR(lower_dentry);
449                 ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned "
450                                 "[%d] on lower_dentry = [%s]\n", __func__, rc,
451                                 encrypted_and_encoded_name);
452                 goto out;
453         }
454 interpose:
455         rc = ecryptfs_lookup_interpose(ecryptfs_dentry, lower_dentry,
456                                        ecryptfs_dir_inode);
457 out:
458         kfree(encrypted_and_encoded_name);
459         return ERR_PTR(rc);
460 }
461
462 static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir,
463                          struct dentry *new_dentry)
464 {
465         struct dentry *lower_old_dentry;
466         struct dentry *lower_new_dentry;
467         struct dentry *lower_dir_dentry;
468         u64 file_size_save;
469         int rc;
470
471         file_size_save = i_size_read(old_dentry->d_inode);
472         lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
473         lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
474         dget(lower_old_dentry);
475         dget(lower_new_dentry);
476         lower_dir_dentry = lock_parent(lower_new_dentry);
477         rc = vfs_link(lower_old_dentry, lower_dir_dentry->d_inode,
478                       lower_new_dentry, NULL);
479         if (rc || !lower_new_dentry->d_inode)
480                 goto out_lock;
481         rc = ecryptfs_interpose(lower_new_dentry, new_dentry, dir->i_sb);
482         if (rc)
483                 goto out_lock;
484         fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
485         fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
486         set_nlink(old_dentry->d_inode,
487                   ecryptfs_inode_to_lower(old_dentry->d_inode)->i_nlink);
488         i_size_write(new_dentry->d_inode, file_size_save);
489 out_lock:
490         unlock_dir(lower_dir_dentry);
491         dput(lower_new_dentry);
492         dput(lower_old_dentry);
493         return rc;
494 }
495
496 static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
497 {
498         return ecryptfs_do_unlink(dir, dentry, dentry->d_inode);
499 }
500
501 static int ecryptfs_symlink(struct inode *dir, struct dentry *dentry,
502                             const char *symname)
503 {
504         int rc;
505         struct dentry *lower_dentry;
506         struct dentry *lower_dir_dentry;
507         char *encoded_symname;
508         size_t encoded_symlen;
509         struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
510
511         lower_dentry = ecryptfs_dentry_to_lower(dentry);
512         dget(lower_dentry);
513         lower_dir_dentry = lock_parent(lower_dentry);
514         mount_crypt_stat = &ecryptfs_superblock_to_private(
515                 dir->i_sb)->mount_crypt_stat;
516         rc = ecryptfs_encrypt_and_encode_filename(&encoded_symname,
517                                                   &encoded_symlen,
518                                                   NULL,
519                                                   mount_crypt_stat, symname,
520                                                   strlen(symname));
521         if (rc)
522                 goto out_lock;
523         rc = vfs_symlink(lower_dir_dentry->d_inode, lower_dentry,
524                          encoded_symname);
525         kfree(encoded_symname);
526         if (rc || !lower_dentry->d_inode)
527                 goto out_lock;
528         rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
529         if (rc)
530                 goto out_lock;
531         fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
532         fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
533 out_lock:
534         unlock_dir(lower_dir_dentry);
535         dput(lower_dentry);
536         if (!dentry->d_inode)
537                 d_drop(dentry);
538         return rc;
539 }
540
541 static int ecryptfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
542 {
543         int rc;
544         struct dentry *lower_dentry;
545         struct dentry *lower_dir_dentry;
546
547         lower_dentry = ecryptfs_dentry_to_lower(dentry);
548         lower_dir_dentry = lock_parent(lower_dentry);
549         rc = vfs_mkdir(lower_dir_dentry->d_inode, lower_dentry, mode);
550         if (rc || !lower_dentry->d_inode)
551                 goto out;
552         rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
553         if (rc)
554                 goto out;
555         fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
556         fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
557         set_nlink(dir, lower_dir_dentry->d_inode->i_nlink);
558 out:
559         unlock_dir(lower_dir_dentry);
560         if (!dentry->d_inode)
561                 d_drop(dentry);
562         return rc;
563 }
564
565 static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry)
566 {
567         struct dentry *lower_dentry;
568         struct dentry *lower_dir_dentry;
569         int rc;
570
571         lower_dentry = ecryptfs_dentry_to_lower(dentry);
572         dget(dentry);
573         lower_dir_dentry = lock_parent(lower_dentry);
574         dget(lower_dentry);
575         rc = vfs_rmdir(lower_dir_dentry->d_inode, lower_dentry);
576         dput(lower_dentry);
577         if (!rc && dentry->d_inode)
578                 clear_nlink(dentry->d_inode);
579         fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
580         set_nlink(dir, lower_dir_dentry->d_inode->i_nlink);
581         unlock_dir(lower_dir_dentry);
582         if (!rc)
583                 d_drop(dentry);
584         dput(dentry);
585         return rc;
586 }
587
588 static int
589 ecryptfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
590 {
591         int rc;
592         struct dentry *lower_dentry;
593         struct dentry *lower_dir_dentry;
594
595         lower_dentry = ecryptfs_dentry_to_lower(dentry);
596         lower_dir_dentry = lock_parent(lower_dentry);
597         rc = vfs_mknod(lower_dir_dentry->d_inode, lower_dentry, mode, dev);
598         if (rc || !lower_dentry->d_inode)
599                 goto out;
600         rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
601         if (rc)
602                 goto out;
603         fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
604         fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
605 out:
606         unlock_dir(lower_dir_dentry);
607         if (!dentry->d_inode)
608                 d_drop(dentry);
609         return rc;
610 }
611
612 static int
613 ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
614                 struct inode *new_dir, struct dentry *new_dentry)
615 {
616         int rc;
617         struct dentry *lower_old_dentry;
618         struct dentry *lower_new_dentry;
619         struct dentry *lower_old_dir_dentry;
620         struct dentry *lower_new_dir_dentry;
621         struct dentry *trap = NULL;
622         struct inode *target_inode;
623
624         lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
625         lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
626         dget(lower_old_dentry);
627         dget(lower_new_dentry);
628         lower_old_dir_dentry = dget_parent(lower_old_dentry);
629         lower_new_dir_dentry = dget_parent(lower_new_dentry);
630         target_inode = new_dentry->d_inode;
631         trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
632         /* source should not be ancestor of target */
633         if (trap == lower_old_dentry) {
634                 rc = -EINVAL;
635                 goto out_lock;
636         }
637         /* target should not be ancestor of source */
638         if (trap == lower_new_dentry) {
639                 rc = -ENOTEMPTY;
640                 goto out_lock;
641         }
642         rc = vfs_rename(lower_old_dir_dentry->d_inode, lower_old_dentry,
643                         lower_new_dir_dentry->d_inode, lower_new_dentry,
644                         NULL, 0);
645         if (rc)
646                 goto out_lock;
647         if (target_inode)
648                 fsstack_copy_attr_all(target_inode,
649                                       ecryptfs_inode_to_lower(target_inode));
650         fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode);
651         if (new_dir != old_dir)
652                 fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
653 out_lock:
654         unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
655         dput(lower_new_dir_dentry);
656         dput(lower_old_dir_dentry);
657         dput(lower_new_dentry);
658         dput(lower_old_dentry);
659         return rc;
660 }
661
662 static char *ecryptfs_readlink_lower(struct dentry *dentry, size_t *bufsiz)
663 {
664         struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
665         char *lower_buf;
666         char *buf;
667         mm_segment_t old_fs;
668         int rc;
669
670         lower_buf = kmalloc(PATH_MAX, GFP_KERNEL);
671         if (!lower_buf)
672                 return ERR_PTR(-ENOMEM);
673         old_fs = get_fs();
674         set_fs(get_ds());
675         rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
676                                                    (char __user *)lower_buf,
677                                                    PATH_MAX);
678         set_fs(old_fs);
679         if (rc < 0)
680                 goto out;
681         rc = ecryptfs_decode_and_decrypt_filename(&buf, bufsiz, dentry->d_sb,
682                                                   lower_buf, rc);
683 out:
684         kfree(lower_buf);
685         return rc ? ERR_PTR(rc) : buf;
686 }
687
688 static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
689 {
690         size_t len;
691         char *buf = ecryptfs_readlink_lower(dentry, &len);
692         if (IS_ERR(buf))
693                 goto out;
694         fsstack_copy_attr_atime(dentry->d_inode,
695                                 ecryptfs_dentry_to_lower(dentry)->d_inode);
696         buf[len] = '\0';
697 out:
698         nd_set_link(nd, buf);
699         return NULL;
700 }
701
702 /**
703  * upper_size_to_lower_size
704  * @crypt_stat: Crypt_stat associated with file
705  * @upper_size: Size of the upper file
706  *
707  * Calculate the required size of the lower file based on the
708  * specified size of the upper file. This calculation is based on the
709  * number of headers in the underlying file and the extent size.
710  *
711  * Returns Calculated size of the lower file.
712  */
713 static loff_t
714 upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat,
715                          loff_t upper_size)
716 {
717         loff_t lower_size;
718
719         lower_size = ecryptfs_lower_header_size(crypt_stat);
720         if (upper_size != 0) {
721                 loff_t num_extents;
722
723                 num_extents = upper_size >> crypt_stat->extent_shift;
724                 if (upper_size & ~crypt_stat->extent_mask)
725                         num_extents++;
726                 lower_size += (num_extents * crypt_stat->extent_size);
727         }
728         return lower_size;
729 }
730
731 /**
732  * truncate_upper
733  * @dentry: The ecryptfs layer dentry
734  * @ia: Address of the ecryptfs inode's attributes
735  * @lower_ia: Address of the lower inode's attributes
736  *
737  * Function to handle truncations modifying the size of the file. Note
738  * that the file sizes are interpolated. When expanding, we are simply
739  * writing strings of 0's out. When truncating, we truncate the upper
740  * inode and update the lower_ia according to the page index
741  * interpolations. If ATTR_SIZE is set in lower_ia->ia_valid upon return,
742  * the caller must use lower_ia in a call to notify_change() to perform
743  * the truncation of the lower inode.
744  *
745  * Returns zero on success; non-zero otherwise
746  */
747 static int truncate_upper(struct dentry *dentry, struct iattr *ia,
748                           struct iattr *lower_ia)
749 {
750         int rc = 0;
751         struct inode *inode = dentry->d_inode;
752         struct ecryptfs_crypt_stat *crypt_stat;
753         loff_t i_size = i_size_read(inode);
754         loff_t lower_size_before_truncate;
755         loff_t lower_size_after_truncate;
756
757         if (unlikely((ia->ia_size == i_size))) {
758                 lower_ia->ia_valid &= ~ATTR_SIZE;
759                 return 0;
760         }
761         rc = ecryptfs_get_lower_file(dentry, inode);
762         if (rc)
763                 return rc;
764         crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
765         /* Switch on growing or shrinking file */
766         if (ia->ia_size > i_size) {
767                 char zero[] = { 0x00 };
768
769                 lower_ia->ia_valid &= ~ATTR_SIZE;
770                 /* Write a single 0 at the last position of the file;
771                  * this triggers code that will fill in 0's throughout
772                  * the intermediate portion of the previous end of the
773                  * file and the new and of the file */
774                 rc = ecryptfs_write(inode, zero,
775                                     (ia->ia_size - 1), 1);
776         } else { /* ia->ia_size < i_size_read(inode) */
777                 /* We're chopping off all the pages down to the page
778                  * in which ia->ia_size is located. Fill in the end of
779                  * that page from (ia->ia_size & ~PAGE_CACHE_MASK) to
780                  * PAGE_CACHE_SIZE with zeros. */
781                 size_t num_zeros = (PAGE_CACHE_SIZE
782                                     - (ia->ia_size & ~PAGE_CACHE_MASK));
783
784                 if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
785                         truncate_setsize(inode, ia->ia_size);
786                         lower_ia->ia_size = ia->ia_size;
787                         lower_ia->ia_valid |= ATTR_SIZE;
788                         goto out;
789                 }
790                 if (num_zeros) {
791                         char *zeros_virt;
792
793                         zeros_virt = kzalloc(num_zeros, GFP_KERNEL);
794                         if (!zeros_virt) {
795                                 rc = -ENOMEM;
796                                 goto out;
797                         }
798                         rc = ecryptfs_write(inode, zeros_virt,
799                                             ia->ia_size, num_zeros);
800                         kfree(zeros_virt);
801                         if (rc) {
802                                 printk(KERN_ERR "Error attempting to zero out "
803                                        "the remainder of the end page on "
804                                        "reducing truncate; rc = [%d]\n", rc);
805                                 goto out;
806                         }
807                 }
808                 truncate_setsize(inode, ia->ia_size);
809                 rc = ecryptfs_write_inode_size_to_metadata(inode);
810                 if (rc) {
811                         printk(KERN_ERR "Problem with "
812                                "ecryptfs_write_inode_size_to_metadata; "
813                                "rc = [%d]\n", rc);
814                         goto out;
815                 }
816                 /* We are reducing the size of the ecryptfs file, and need to
817                  * know if we need to reduce the size of the lower file. */
818                 lower_size_before_truncate =
819                     upper_size_to_lower_size(crypt_stat, i_size);
820                 lower_size_after_truncate =
821                     upper_size_to_lower_size(crypt_stat, ia->ia_size);
822                 if (lower_size_after_truncate < lower_size_before_truncate) {
823                         lower_ia->ia_size = lower_size_after_truncate;
824                         lower_ia->ia_valid |= ATTR_SIZE;
825                 } else
826                         lower_ia->ia_valid &= ~ATTR_SIZE;
827         }
828 out:
829         ecryptfs_put_lower_file(inode);
830         return rc;
831 }
832
833 static int ecryptfs_inode_newsize_ok(struct inode *inode, loff_t offset)
834 {
835         struct ecryptfs_crypt_stat *crypt_stat;
836         loff_t lower_oldsize, lower_newsize;
837
838         crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
839         lower_oldsize = upper_size_to_lower_size(crypt_stat,
840                                                  i_size_read(inode));
841         lower_newsize = upper_size_to_lower_size(crypt_stat, offset);
842         if (lower_newsize > lower_oldsize) {
843                 /*
844                  * The eCryptfs inode and the new *lower* size are mixed here
845                  * because we may not have the lower i_mutex held and/or it may
846                  * not be appropriate to call inode_newsize_ok() with inodes
847                  * from other filesystems.
848                  */
849                 return inode_newsize_ok(inode, lower_newsize);
850         }
851
852         return 0;
853 }
854
855 /**
856  * ecryptfs_truncate
857  * @dentry: The ecryptfs layer dentry
858  * @new_length: The length to expand the file to
859  *
860  * Simple function that handles the truncation of an eCryptfs inode and
861  * its corresponding lower inode.
862  *
863  * Returns zero on success; non-zero otherwise
864  */
865 int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
866 {
867         struct iattr ia = { .ia_valid = ATTR_SIZE, .ia_size = new_length };
868         struct iattr lower_ia = { .ia_valid = 0 };
869         int rc;
870
871         rc = ecryptfs_inode_newsize_ok(dentry->d_inode, new_length);
872         if (rc)
873                 return rc;
874
875         rc = truncate_upper(dentry, &ia, &lower_ia);
876         if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
877                 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
878
879                 mutex_lock(&lower_dentry->d_inode->i_mutex);
880                 rc = notify_change(lower_dentry, &lower_ia, NULL);
881                 mutex_unlock(&lower_dentry->d_inode->i_mutex);
882         }
883         return rc;
884 }
885
886 static int
887 ecryptfs_permission(struct inode *inode, int mask)
888 {
889         return inode_permission(ecryptfs_inode_to_lower(inode), mask);
890 }
891
892 /**
893  * ecryptfs_setattr
894  * @dentry: dentry handle to the inode to modify
895  * @ia: Structure with flags of what to change and values
896  *
897  * Updates the metadata of an inode. If the update is to the size
898  * i.e. truncation, then ecryptfs_truncate will handle the size modification
899  * of both the ecryptfs inode and the lower inode.
900  *
901  * All other metadata changes will be passed right to the lower filesystem,
902  * and we will just update our inode to look like the lower.
903  */
904 static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
905 {
906         int rc = 0;
907         struct dentry *lower_dentry;
908         struct iattr lower_ia;
909         struct inode *inode;
910         struct inode *lower_inode;
911         struct ecryptfs_crypt_stat *crypt_stat;
912
913         crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
914         if (!(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED))
915                 ecryptfs_init_crypt_stat(crypt_stat);
916         inode = dentry->d_inode;
917         lower_inode = ecryptfs_inode_to_lower(inode);
918         lower_dentry = ecryptfs_dentry_to_lower(dentry);
919         mutex_lock(&crypt_stat->cs_mutex);
920         if (S_ISDIR(dentry->d_inode->i_mode))
921                 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
922         else if (S_ISREG(dentry->d_inode->i_mode)
923                  && (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)
924                      || !(crypt_stat->flags & ECRYPTFS_KEY_VALID))) {
925                 struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
926
927                 mount_crypt_stat = &ecryptfs_superblock_to_private(
928                         dentry->d_sb)->mount_crypt_stat;
929                 rc = ecryptfs_get_lower_file(dentry, inode);
930                 if (rc) {
931                         mutex_unlock(&crypt_stat->cs_mutex);
932                         goto out;
933                 }
934                 rc = ecryptfs_read_metadata(dentry);
935                 ecryptfs_put_lower_file(inode);
936                 if (rc) {
937                         if (!(mount_crypt_stat->flags
938                               & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
939                                 rc = -EIO;
940                                 printk(KERN_WARNING "Either the lower file "
941                                        "is not in a valid eCryptfs format, "
942                                        "or the key could not be retrieved. "
943                                        "Plaintext passthrough mode is not "
944                                        "enabled; returning -EIO\n");
945                                 mutex_unlock(&crypt_stat->cs_mutex);
946                                 goto out;
947                         }
948                         rc = 0;
949                         crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
950                                                | ECRYPTFS_ENCRYPTED);
951                 }
952         }
953         mutex_unlock(&crypt_stat->cs_mutex);
954
955         rc = inode_change_ok(inode, ia);
956         if (rc)
957                 goto out;
958         if (ia->ia_valid & ATTR_SIZE) {
959                 rc = ecryptfs_inode_newsize_ok(inode, ia->ia_size);
960                 if (rc)
961                         goto out;
962         }
963
964         memcpy(&lower_ia, ia, sizeof(lower_ia));
965         if (ia->ia_valid & ATTR_FILE)
966                 lower_ia.ia_file = ecryptfs_file_to_lower(ia->ia_file);
967         if (ia->ia_valid & ATTR_SIZE) {
968                 rc = truncate_upper(dentry, ia, &lower_ia);
969                 if (rc < 0)
970                         goto out;
971         }
972
973         /*
974          * mode change is for clearing setuid/setgid bits. Allow lower fs
975          * to interpret this in its own way.
976          */
977         if (lower_ia.ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
978                 lower_ia.ia_valid &= ~ATTR_MODE;
979
980         mutex_lock(&lower_dentry->d_inode->i_mutex);
981         rc = notify_change(lower_dentry, &lower_ia, NULL);
982         mutex_unlock(&lower_dentry->d_inode->i_mutex);
983 out:
984         fsstack_copy_attr_all(inode, lower_inode);
985         return rc;
986 }
987
988 static int ecryptfs_getattr_link(struct vfsmount *mnt, struct dentry *dentry,
989                                  struct kstat *stat)
990 {
991         struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
992         int rc = 0;
993
994         mount_crypt_stat = &ecryptfs_superblock_to_private(
995                                                 dentry->d_sb)->mount_crypt_stat;
996         generic_fillattr(dentry->d_inode, stat);
997         if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
998                 char *target;
999                 size_t targetsiz;
1000
1001                 target = ecryptfs_readlink_lower(dentry, &targetsiz);
1002                 if (!IS_ERR(target)) {
1003                         kfree(target);
1004                         stat->size = targetsiz;
1005                 } else {
1006                         rc = PTR_ERR(target);
1007                 }
1008         }
1009         return rc;
1010 }
1011
1012 static int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
1013                             struct kstat *stat)
1014 {
1015         struct kstat lower_stat;
1016         int rc;
1017
1018         rc = vfs_getattr(ecryptfs_dentry_to_lower_path(dentry), &lower_stat);
1019         if (!rc) {
1020                 fsstack_copy_attr_all(dentry->d_inode,
1021                                       ecryptfs_inode_to_lower(dentry->d_inode));
1022                 generic_fillattr(dentry->d_inode, stat);
1023                 stat->blocks = lower_stat.blocks;
1024         }
1025         return rc;
1026 }
1027
1028 int
1029 ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
1030                   size_t size, int flags)
1031 {
1032         int rc = 0;
1033         struct dentry *lower_dentry;
1034
1035         lower_dentry = ecryptfs_dentry_to_lower(dentry);
1036         if (!lower_dentry->d_inode->i_op->setxattr) {
1037                 rc = -EOPNOTSUPP;
1038                 goto out;
1039         }
1040
1041         rc = vfs_setxattr(lower_dentry, name, value, size, flags);
1042         if (!rc)
1043                 fsstack_copy_attr_all(dentry->d_inode, lower_dentry->d_inode);
1044 out:
1045         return rc;
1046 }
1047
1048 ssize_t
1049 ecryptfs_getxattr_lower(struct dentry *lower_dentry, const char *name,
1050                         void *value, size_t size)
1051 {
1052         int rc = 0;
1053
1054         if (!lower_dentry->d_inode->i_op->getxattr) {
1055                 rc = -EOPNOTSUPP;
1056                 goto out;
1057         }
1058         mutex_lock(&lower_dentry->d_inode->i_mutex);
1059         rc = lower_dentry->d_inode->i_op->getxattr(lower_dentry, name, value,
1060                                                    size);
1061         mutex_unlock(&lower_dentry->d_inode->i_mutex);
1062 out:
1063         return rc;
1064 }
1065
1066 static ssize_t
1067 ecryptfs_getxattr(struct dentry *dentry, const char *name, void *value,
1068                   size_t size)
1069 {
1070         return ecryptfs_getxattr_lower(ecryptfs_dentry_to_lower(dentry), name,
1071                                        value, size);
1072 }
1073
1074 static ssize_t
1075 ecryptfs_listxattr(struct dentry *dentry, char *list, size_t size)
1076 {
1077         int rc = 0;
1078         struct dentry *lower_dentry;
1079
1080         lower_dentry = ecryptfs_dentry_to_lower(dentry);
1081         if (!lower_dentry->d_inode->i_op->listxattr) {
1082                 rc = -EOPNOTSUPP;
1083                 goto out;
1084         }
1085         mutex_lock(&lower_dentry->d_inode->i_mutex);
1086         rc = lower_dentry->d_inode->i_op->listxattr(lower_dentry, list, size);
1087         mutex_unlock(&lower_dentry->d_inode->i_mutex);
1088 out:
1089         return rc;
1090 }
1091
1092 static int ecryptfs_removexattr(struct dentry *dentry, const char *name)
1093 {
1094         int rc = 0;
1095         struct dentry *lower_dentry;
1096
1097         lower_dentry = ecryptfs_dentry_to_lower(dentry);
1098         if (!lower_dentry->d_inode->i_op->removexattr) {
1099                 rc = -EOPNOTSUPP;
1100                 goto out;
1101         }
1102         mutex_lock(&lower_dentry->d_inode->i_mutex);
1103         rc = lower_dentry->d_inode->i_op->removexattr(lower_dentry, name);
1104         mutex_unlock(&lower_dentry->d_inode->i_mutex);
1105 out:
1106         return rc;
1107 }
1108
1109 const struct inode_operations ecryptfs_symlink_iops = {
1110         .readlink = generic_readlink,
1111         .follow_link = ecryptfs_follow_link,
1112         .put_link = kfree_put_link,
1113         .permission = ecryptfs_permission,
1114         .setattr = ecryptfs_setattr,
1115         .getattr = ecryptfs_getattr_link,
1116         .setxattr = ecryptfs_setxattr,
1117         .getxattr = ecryptfs_getxattr,
1118         .listxattr = ecryptfs_listxattr,
1119         .removexattr = ecryptfs_removexattr
1120 };
1121
1122 const struct inode_operations ecryptfs_dir_iops = {
1123         .create = ecryptfs_create,
1124         .lookup = ecryptfs_lookup,
1125         .link = ecryptfs_link,
1126         .unlink = ecryptfs_unlink,
1127         .symlink = ecryptfs_symlink,
1128         .mkdir = ecryptfs_mkdir,
1129         .rmdir = ecryptfs_rmdir,
1130         .mknod = ecryptfs_mknod,
1131         .rename = ecryptfs_rename,
1132         .permission = ecryptfs_permission,
1133         .setattr = ecryptfs_setattr,
1134         .setxattr = ecryptfs_setxattr,
1135         .getxattr = ecryptfs_getxattr,
1136         .listxattr = ecryptfs_listxattr,
1137         .removexattr = ecryptfs_removexattr
1138 };
1139
1140 const struct inode_operations ecryptfs_main_iops = {
1141         .permission = ecryptfs_permission,
1142         .setattr = ecryptfs_setattr,
1143         .getattr = ecryptfs_getattr,
1144         .setxattr = ecryptfs_setxattr,
1145         .getxattr = ecryptfs_getxattr,
1146         .listxattr = ecryptfs_listxattr,
1147         .removexattr = ecryptfs_removexattr
1148 };