inotify: invalid mask should return a error number but not set it
[linux-2.6.git] / fs / ecryptfs / inode.c
1 /**
2  * eCryptfs: Linux filesystem encryption layer
3  *
4  * Copyright (C) 1997-2004 Erez Zadok
5  * Copyright (C) 2001-2004 Stony Brook University
6  * Copyright (C) 2004-2007 International Business Machines Corp.
7  *   Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>
8  *              Michael C. Thompsion <mcthomps@us.ibm.com>
9  *
10  * This program is free software; you can redistribute it and/or
11  * modify it under the terms of the GNU General Public License as
12  * published by the Free Software Foundation; either version 2 of the
13  * License, or (at your option) any later version.
14  *
15  * This program is distributed in the hope that it will be useful, but
16  * WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
18  * General Public License for more details.
19  *
20  * You should have received a copy of the GNU General Public License
21  * along with this program; if not, write to the Free Software
22  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
23  * 02111-1307, USA.
24  */
25
26 #include <linux/file.h>
27 #include <linux/vmalloc.h>
28 #include <linux/pagemap.h>
29 #include <linux/dcache.h>
30 #include <linux/namei.h>
31 #include <linux/mount.h>
32 #include <linux/crypto.h>
33 #include <linux/fs_stack.h>
34 #include <linux/slab.h>
35 #include <linux/xattr.h>
36 #include <asm/unaligned.h>
37 #include "ecryptfs_kernel.h"
38
39 static struct dentry *lock_parent(struct dentry *dentry)
40 {
41         struct dentry *dir;
42
43         dir = dget_parent(dentry);
44         mutex_lock_nested(&(dir->d_inode->i_mutex), I_MUTEX_PARENT);
45         return dir;
46 }
47
48 static void unlock_dir(struct dentry *dir)
49 {
50         mutex_unlock(&dir->d_inode->i_mutex);
51         dput(dir);
52 }
53
54 static int ecryptfs_inode_test(struct inode *inode, void *lower_inode)
55 {
56         if (ecryptfs_inode_to_lower(inode) == (struct inode *)lower_inode)
57                 return 1;
58         return 0;
59 }
60
61 static int ecryptfs_inode_set(struct inode *inode, void *opaque)
62 {
63         struct inode *lower_inode = opaque;
64
65         ecryptfs_set_inode_lower(inode, lower_inode);
66         fsstack_copy_attr_all(inode, lower_inode);
67         /* i_size will be overwritten for encrypted regular files */
68         fsstack_copy_inode_size(inode, lower_inode);
69         inode->i_ino = lower_inode->i_ino;
70         inode->i_version++;
71         inode->i_mapping->a_ops = &ecryptfs_aops;
72         inode->i_mapping->backing_dev_info = inode->i_sb->s_bdi;
73
74         if (S_ISLNK(inode->i_mode))
75                 inode->i_op = &ecryptfs_symlink_iops;
76         else if (S_ISDIR(inode->i_mode))
77                 inode->i_op = &ecryptfs_dir_iops;
78         else
79                 inode->i_op = &ecryptfs_main_iops;
80
81         if (S_ISDIR(inode->i_mode))
82                 inode->i_fop = &ecryptfs_dir_fops;
83         else if (special_file(inode->i_mode))
84                 init_special_inode(inode, inode->i_mode, inode->i_rdev);
85         else
86                 inode->i_fop = &ecryptfs_main_fops;
87
88         return 0;
89 }
90
91 static struct inode *__ecryptfs_get_inode(struct inode *lower_inode,
92                                           struct super_block *sb)
93 {
94         struct inode *inode;
95
96         if (lower_inode->i_sb != ecryptfs_superblock_to_lower(sb))
97                 return ERR_PTR(-EXDEV);
98         if (!igrab(lower_inode))
99                 return ERR_PTR(-ESTALE);
100         inode = iget5_locked(sb, (unsigned long)lower_inode,
101                              ecryptfs_inode_test, ecryptfs_inode_set,
102                              lower_inode);
103         if (!inode) {
104                 iput(lower_inode);
105                 return ERR_PTR(-EACCES);
106         }
107         if (!(inode->i_state & I_NEW))
108                 iput(lower_inode);
109
110         return inode;
111 }
112
113 struct inode *ecryptfs_get_inode(struct inode *lower_inode,
114                                  struct super_block *sb)
115 {
116         struct inode *inode = __ecryptfs_get_inode(lower_inode, sb);
117
118         if (!IS_ERR(inode) && (inode->i_state & I_NEW))
119                 unlock_new_inode(inode);
120
121         return inode;
122 }
123
124 /**
125  * ecryptfs_interpose
126  * @lower_dentry: Existing dentry in the lower filesystem
127  * @dentry: ecryptfs' dentry
128  * @sb: ecryptfs's super_block
129  *
130  * Interposes upper and lower dentries.
131  *
132  * Returns zero on success; non-zero otherwise
133  */
134 static int ecryptfs_interpose(struct dentry *lower_dentry,
135                               struct dentry *dentry, struct super_block *sb)
136 {
137         struct inode *inode = ecryptfs_get_inode(lower_dentry->d_inode, sb);
138
139         if (IS_ERR(inode))
140                 return PTR_ERR(inode);
141         d_instantiate(dentry, inode);
142
143         return 0;
144 }
145
146 static int ecryptfs_do_unlink(struct inode *dir, struct dentry *dentry,
147                               struct inode *inode)
148 {
149         struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
150         struct inode *lower_dir_inode = ecryptfs_inode_to_lower(dir);
151         struct dentry *lower_dir_dentry;
152         int rc;
153
154         dget(lower_dentry);
155         lower_dir_dentry = lock_parent(lower_dentry);
156         rc = vfs_unlink(lower_dir_inode, lower_dentry);
157         if (rc) {
158                 printk(KERN_ERR "Error in vfs_unlink; rc = [%d]\n", rc);
159                 goto out_unlock;
160         }
161         fsstack_copy_attr_times(dir, lower_dir_inode);
162         set_nlink(inode, ecryptfs_inode_to_lower(inode)->i_nlink);
163         inode->i_ctime = dir->i_ctime;
164         d_drop(dentry);
165 out_unlock:
166         unlock_dir(lower_dir_dentry);
167         dput(lower_dentry);
168         return rc;
169 }
170
171 /**
172  * ecryptfs_do_create
173  * @directory_inode: inode of the new file's dentry's parent in ecryptfs
174  * @ecryptfs_dentry: New file's dentry in ecryptfs
175  * @mode: The mode of the new file
176  * @nd: nameidata of ecryptfs' parent's dentry & vfsmount
177  *
178  * Creates the underlying file and the eCryptfs inode which will link to
179  * it. It will also update the eCryptfs directory inode to mimic the
180  * stat of the lower directory inode.
181  *
182  * Returns the new eCryptfs inode on success; an ERR_PTR on error condition
183  */
184 static struct inode *
185 ecryptfs_do_create(struct inode *directory_inode,
186                    struct dentry *ecryptfs_dentry, umode_t mode)
187 {
188         int rc;
189         struct dentry *lower_dentry;
190         struct dentry *lower_dir_dentry;
191         struct inode *inode;
192
193         lower_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry);
194         lower_dir_dentry = lock_parent(lower_dentry);
195         if (IS_ERR(lower_dir_dentry)) {
196                 ecryptfs_printk(KERN_ERR, "Error locking directory of "
197                                 "dentry\n");
198                 inode = ERR_CAST(lower_dir_dentry);
199                 goto out;
200         }
201         rc = vfs_create(lower_dir_dentry->d_inode, lower_dentry, mode, NULL);
202         if (rc) {
203                 printk(KERN_ERR "%s: Failure to create dentry in lower fs; "
204                        "rc = [%d]\n", __func__, rc);
205                 inode = ERR_PTR(rc);
206                 goto out_lock;
207         }
208         inode = __ecryptfs_get_inode(lower_dentry->d_inode,
209                                      directory_inode->i_sb);
210         if (IS_ERR(inode)) {
211                 vfs_unlink(lower_dir_dentry->d_inode, lower_dentry);
212                 goto out_lock;
213         }
214         fsstack_copy_attr_times(directory_inode, lower_dir_dentry->d_inode);
215         fsstack_copy_inode_size(directory_inode, lower_dir_dentry->d_inode);
216 out_lock:
217         unlock_dir(lower_dir_dentry);
218 out:
219         return inode;
220 }
221
222 /**
223  * ecryptfs_initialize_file
224  *
225  * Cause the file to be changed from a basic empty file to an ecryptfs
226  * file with a header and first data page.
227  *
228  * Returns zero on success
229  */
230 int ecryptfs_initialize_file(struct dentry *ecryptfs_dentry,
231                              struct inode *ecryptfs_inode)
232 {
233         struct ecryptfs_crypt_stat *crypt_stat =
234                 &ecryptfs_inode_to_private(ecryptfs_inode)->crypt_stat;
235         int rc = 0;
236
237         if (S_ISDIR(ecryptfs_inode->i_mode)) {
238                 ecryptfs_printk(KERN_DEBUG, "This is a directory\n");
239                 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
240                 goto out;
241         }
242         ecryptfs_printk(KERN_DEBUG, "Initializing crypto context\n");
243         rc = ecryptfs_new_file_context(ecryptfs_inode);
244         if (rc) {
245                 ecryptfs_printk(KERN_ERR, "Error creating new file "
246                                 "context; rc = [%d]\n", rc);
247                 goto out;
248         }
249         rc = ecryptfs_get_lower_file(ecryptfs_dentry, ecryptfs_inode);
250         if (rc) {
251                 printk(KERN_ERR "%s: Error attempting to initialize "
252                         "the lower file for the dentry with name "
253                         "[%s]; rc = [%d]\n", __func__,
254                         ecryptfs_dentry->d_name.name, rc);
255                 goto out;
256         }
257         rc = ecryptfs_write_metadata(ecryptfs_dentry, ecryptfs_inode);
258         if (rc)
259                 printk(KERN_ERR "Error writing headers; rc = [%d]\n", rc);
260         ecryptfs_put_lower_file(ecryptfs_inode);
261 out:
262         return rc;
263 }
264
265 /**
266  * ecryptfs_create
267  * @dir: The inode of the directory in which to create the file.
268  * @dentry: The eCryptfs dentry
269  * @mode: The mode of the new file.
270  * @nd: nameidata
271  *
272  * Creates a new file.
273  *
274  * Returns zero on success; non-zero on error condition
275  */
276 static int
277 ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry,
278                 umode_t mode, struct nameidata *nd)
279 {
280         struct inode *ecryptfs_inode;
281         int rc;
282
283         ecryptfs_inode = ecryptfs_do_create(directory_inode, ecryptfs_dentry,
284                                             mode);
285         if (unlikely(IS_ERR(ecryptfs_inode))) {
286                 ecryptfs_printk(KERN_WARNING, "Failed to create file in"
287                                 "lower filesystem\n");
288                 rc = PTR_ERR(ecryptfs_inode);
289                 goto out;
290         }
291         /* At this point, a file exists on "disk"; we need to make sure
292          * that this on disk file is prepared to be an ecryptfs file */
293         rc = ecryptfs_initialize_file(ecryptfs_dentry, ecryptfs_inode);
294         if (rc) {
295                 ecryptfs_do_unlink(directory_inode, ecryptfs_dentry,
296                                    ecryptfs_inode);
297                 make_bad_inode(ecryptfs_inode);
298                 unlock_new_inode(ecryptfs_inode);
299                 iput(ecryptfs_inode);
300                 goto out;
301         }
302         d_instantiate(ecryptfs_dentry, ecryptfs_inode);
303         unlock_new_inode(ecryptfs_inode);
304 out:
305         return rc;
306 }
307
308 static int ecryptfs_i_size_read(struct dentry *dentry, struct inode *inode)
309 {
310         struct ecryptfs_crypt_stat *crypt_stat;
311         int rc;
312
313         rc = ecryptfs_get_lower_file(dentry, inode);
314         if (rc) {
315                 printk(KERN_ERR "%s: Error attempting to initialize "
316                         "the lower file for the dentry with name "
317                         "[%s]; rc = [%d]\n", __func__,
318                         dentry->d_name.name, rc);
319                 return rc;
320         }
321
322         crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
323         /* TODO: lock for crypt_stat comparison */
324         if (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED))
325                 ecryptfs_set_default_sizes(crypt_stat);
326
327         rc = ecryptfs_read_and_validate_header_region(inode);
328         ecryptfs_put_lower_file(inode);
329         if (rc) {
330                 rc = ecryptfs_read_and_validate_xattr_region(dentry, inode);
331                 if (!rc)
332                         crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
333         }
334
335         /* Must return 0 to allow non-eCryptfs files to be looked up, too */
336         return 0;
337 }
338
339 /**
340  * ecryptfs_lookup_interpose - Dentry interposition for a lookup
341  */
342 static int ecryptfs_lookup_interpose(struct dentry *dentry,
343                                      struct dentry *lower_dentry,
344                                      struct inode *dir_inode)
345 {
346         struct inode *inode, *lower_inode = lower_dentry->d_inode;
347         struct ecryptfs_dentry_info *dentry_info;
348         struct vfsmount *lower_mnt;
349         int rc = 0;
350
351         lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
352         fsstack_copy_attr_atime(dir_inode, lower_dentry->d_parent->d_inode);
353         BUG_ON(!lower_dentry->d_count);
354
355         dentry_info = kmem_cache_alloc(ecryptfs_dentry_info_cache, GFP_KERNEL);
356         ecryptfs_set_dentry_private(dentry, dentry_info);
357         if (!dentry_info) {
358                 printk(KERN_ERR "%s: Out of memory whilst attempting "
359                        "to allocate ecryptfs_dentry_info struct\n",
360                         __func__);
361                 dput(lower_dentry);
362                 mntput(lower_mnt);
363                 d_drop(dentry);
364                 return -ENOMEM;
365         }
366         ecryptfs_set_dentry_lower(dentry, lower_dentry);
367         ecryptfs_set_dentry_lower_mnt(dentry, lower_mnt);
368
369         if (!lower_dentry->d_inode) {
370                 /* We want to add because we couldn't find in lower */
371                 d_add(dentry, NULL);
372                 return 0;
373         }
374         inode = __ecryptfs_get_inode(lower_inode, dir_inode->i_sb);
375         if (IS_ERR(inode)) {
376                 printk(KERN_ERR "%s: Error interposing; rc = [%ld]\n",
377                        __func__, PTR_ERR(inode));
378                 return PTR_ERR(inode);
379         }
380         if (S_ISREG(inode->i_mode)) {
381                 rc = ecryptfs_i_size_read(dentry, inode);
382                 if (rc) {
383                         make_bad_inode(inode);
384                         return rc;
385                 }
386         }
387
388         if (inode->i_state & I_NEW)
389                 unlock_new_inode(inode);
390         d_add(dentry, inode);
391
392         return rc;
393 }
394
395 /**
396  * ecryptfs_lookup
397  * @ecryptfs_dir_inode: The eCryptfs directory inode
398  * @ecryptfs_dentry: The eCryptfs dentry that we are looking up
399  * @ecryptfs_nd: nameidata; may be NULL
400  *
401  * Find a file on disk. If the file does not exist, then we'll add it to the
402  * dentry cache and continue on to read it from the disk.
403  */
404 static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
405                                       struct dentry *ecryptfs_dentry,
406                                       struct nameidata *ecryptfs_nd)
407 {
408         char *encrypted_and_encoded_name = NULL;
409         size_t encrypted_and_encoded_name_size;
410         struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
411         struct dentry *lower_dir_dentry, *lower_dentry;
412         int rc = 0;
413
414         if ((ecryptfs_dentry->d_name.len == 1
415              && !strcmp(ecryptfs_dentry->d_name.name, "."))
416             || (ecryptfs_dentry->d_name.len == 2
417                 && !strcmp(ecryptfs_dentry->d_name.name, ".."))) {
418                 goto out_d_drop;
419         }
420         lower_dir_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry->d_parent);
421         mutex_lock(&lower_dir_dentry->d_inode->i_mutex);
422         lower_dentry = lookup_one_len(ecryptfs_dentry->d_name.name,
423                                       lower_dir_dentry,
424                                       ecryptfs_dentry->d_name.len);
425         mutex_unlock(&lower_dir_dentry->d_inode->i_mutex);
426         if (IS_ERR(lower_dentry)) {
427                 rc = PTR_ERR(lower_dentry);
428                 ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned "
429                                 "[%d] on lower_dentry = [%s]\n", __func__, rc,
430                                 encrypted_and_encoded_name);
431                 goto out_d_drop;
432         }
433         if (lower_dentry->d_inode)
434                 goto interpose;
435         mount_crypt_stat = &ecryptfs_superblock_to_private(
436                                 ecryptfs_dentry->d_sb)->mount_crypt_stat;
437         if (!(mount_crypt_stat
438             && (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)))
439                 goto interpose;
440         dput(lower_dentry);
441         rc = ecryptfs_encrypt_and_encode_filename(
442                 &encrypted_and_encoded_name, &encrypted_and_encoded_name_size,
443                 NULL, mount_crypt_stat, ecryptfs_dentry->d_name.name,
444                 ecryptfs_dentry->d_name.len);
445         if (rc) {
446                 printk(KERN_ERR "%s: Error attempting to encrypt and encode "
447                        "filename; rc = [%d]\n", __func__, rc);
448                 goto out_d_drop;
449         }
450         mutex_lock(&lower_dir_dentry->d_inode->i_mutex);
451         lower_dentry = lookup_one_len(encrypted_and_encoded_name,
452                                       lower_dir_dentry,
453                                       encrypted_and_encoded_name_size);
454         mutex_unlock(&lower_dir_dentry->d_inode->i_mutex);
455         if (IS_ERR(lower_dentry)) {
456                 rc = PTR_ERR(lower_dentry);
457                 ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned "
458                                 "[%d] on lower_dentry = [%s]\n", __func__, rc,
459                                 encrypted_and_encoded_name);
460                 goto out_d_drop;
461         }
462 interpose:
463         rc = ecryptfs_lookup_interpose(ecryptfs_dentry, lower_dentry,
464                                        ecryptfs_dir_inode);
465         goto out;
466 out_d_drop:
467         d_drop(ecryptfs_dentry);
468 out:
469         kfree(encrypted_and_encoded_name);
470         return ERR_PTR(rc);
471 }
472
473 static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir,
474                          struct dentry *new_dentry)
475 {
476         struct dentry *lower_old_dentry;
477         struct dentry *lower_new_dentry;
478         struct dentry *lower_dir_dentry;
479         u64 file_size_save;
480         int rc;
481
482         file_size_save = i_size_read(old_dentry->d_inode);
483         lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
484         lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
485         dget(lower_old_dentry);
486         dget(lower_new_dentry);
487         lower_dir_dentry = lock_parent(lower_new_dentry);
488         rc = vfs_link(lower_old_dentry, lower_dir_dentry->d_inode,
489                       lower_new_dentry);
490         if (rc || !lower_new_dentry->d_inode)
491                 goto out_lock;
492         rc = ecryptfs_interpose(lower_new_dentry, new_dentry, dir->i_sb);
493         if (rc)
494                 goto out_lock;
495         fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
496         fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
497         set_nlink(old_dentry->d_inode,
498                   ecryptfs_inode_to_lower(old_dentry->d_inode)->i_nlink);
499         i_size_write(new_dentry->d_inode, file_size_save);
500 out_lock:
501         unlock_dir(lower_dir_dentry);
502         dput(lower_new_dentry);
503         dput(lower_old_dentry);
504         return rc;
505 }
506
507 static int ecryptfs_unlink(struct inode *dir, struct dentry *dentry)
508 {
509         return ecryptfs_do_unlink(dir, dentry, dentry->d_inode);
510 }
511
512 static int ecryptfs_symlink(struct inode *dir, struct dentry *dentry,
513                             const char *symname)
514 {
515         int rc;
516         struct dentry *lower_dentry;
517         struct dentry *lower_dir_dentry;
518         char *encoded_symname;
519         size_t encoded_symlen;
520         struct ecryptfs_mount_crypt_stat *mount_crypt_stat = NULL;
521
522         lower_dentry = ecryptfs_dentry_to_lower(dentry);
523         dget(lower_dentry);
524         lower_dir_dentry = lock_parent(lower_dentry);
525         mount_crypt_stat = &ecryptfs_superblock_to_private(
526                 dir->i_sb)->mount_crypt_stat;
527         rc = ecryptfs_encrypt_and_encode_filename(&encoded_symname,
528                                                   &encoded_symlen,
529                                                   NULL,
530                                                   mount_crypt_stat, symname,
531                                                   strlen(symname));
532         if (rc)
533                 goto out_lock;
534         rc = vfs_symlink(lower_dir_dentry->d_inode, lower_dentry,
535                          encoded_symname);
536         kfree(encoded_symname);
537         if (rc || !lower_dentry->d_inode)
538                 goto out_lock;
539         rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
540         if (rc)
541                 goto out_lock;
542         fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
543         fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
544 out_lock:
545         unlock_dir(lower_dir_dentry);
546         dput(lower_dentry);
547         if (!dentry->d_inode)
548                 d_drop(dentry);
549         return rc;
550 }
551
552 static int ecryptfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
553 {
554         int rc;
555         struct dentry *lower_dentry;
556         struct dentry *lower_dir_dentry;
557
558         lower_dentry = ecryptfs_dentry_to_lower(dentry);
559         lower_dir_dentry = lock_parent(lower_dentry);
560         rc = vfs_mkdir(lower_dir_dentry->d_inode, lower_dentry, mode);
561         if (rc || !lower_dentry->d_inode)
562                 goto out;
563         rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
564         if (rc)
565                 goto out;
566         fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
567         fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
568         set_nlink(dir, lower_dir_dentry->d_inode->i_nlink);
569 out:
570         unlock_dir(lower_dir_dentry);
571         if (!dentry->d_inode)
572                 d_drop(dentry);
573         return rc;
574 }
575
576 static int ecryptfs_rmdir(struct inode *dir, struct dentry *dentry)
577 {
578         struct dentry *lower_dentry;
579         struct dentry *lower_dir_dentry;
580         int rc;
581
582         lower_dentry = ecryptfs_dentry_to_lower(dentry);
583         dget(dentry);
584         lower_dir_dentry = lock_parent(lower_dentry);
585         dget(lower_dentry);
586         rc = vfs_rmdir(lower_dir_dentry->d_inode, lower_dentry);
587         dput(lower_dentry);
588         if (!rc && dentry->d_inode)
589                 clear_nlink(dentry->d_inode);
590         fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
591         set_nlink(dir, lower_dir_dentry->d_inode->i_nlink);
592         unlock_dir(lower_dir_dentry);
593         if (!rc)
594                 d_drop(dentry);
595         dput(dentry);
596         return rc;
597 }
598
599 static int
600 ecryptfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
601 {
602         int rc;
603         struct dentry *lower_dentry;
604         struct dentry *lower_dir_dentry;
605
606         lower_dentry = ecryptfs_dentry_to_lower(dentry);
607         lower_dir_dentry = lock_parent(lower_dentry);
608         rc = vfs_mknod(lower_dir_dentry->d_inode, lower_dentry, mode, dev);
609         if (rc || !lower_dentry->d_inode)
610                 goto out;
611         rc = ecryptfs_interpose(lower_dentry, dentry, dir->i_sb);
612         if (rc)
613                 goto out;
614         fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
615         fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
616 out:
617         unlock_dir(lower_dir_dentry);
618         if (!dentry->d_inode)
619                 d_drop(dentry);
620         return rc;
621 }
622
623 static int
624 ecryptfs_rename(struct inode *old_dir, struct dentry *old_dentry,
625                 struct inode *new_dir, struct dentry *new_dentry)
626 {
627         int rc;
628         struct dentry *lower_old_dentry;
629         struct dentry *lower_new_dentry;
630         struct dentry *lower_old_dir_dentry;
631         struct dentry *lower_new_dir_dentry;
632         struct dentry *trap = NULL;
633         struct inode *target_inode;
634
635         lower_old_dentry = ecryptfs_dentry_to_lower(old_dentry);
636         lower_new_dentry = ecryptfs_dentry_to_lower(new_dentry);
637         dget(lower_old_dentry);
638         dget(lower_new_dentry);
639         lower_old_dir_dentry = dget_parent(lower_old_dentry);
640         lower_new_dir_dentry = dget_parent(lower_new_dentry);
641         target_inode = new_dentry->d_inode;
642         trap = lock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
643         /* source should not be ancestor of target */
644         if (trap == lower_old_dentry) {
645                 rc = -EINVAL;
646                 goto out_lock;
647         }
648         /* target should not be ancestor of source */
649         if (trap == lower_new_dentry) {
650                 rc = -ENOTEMPTY;
651                 goto out_lock;
652         }
653         rc = vfs_rename(lower_old_dir_dentry->d_inode, lower_old_dentry,
654                         lower_new_dir_dentry->d_inode, lower_new_dentry);
655         if (rc)
656                 goto out_lock;
657         if (target_inode)
658                 fsstack_copy_attr_all(target_inode,
659                                       ecryptfs_inode_to_lower(target_inode));
660         fsstack_copy_attr_all(new_dir, lower_new_dir_dentry->d_inode);
661         if (new_dir != old_dir)
662                 fsstack_copy_attr_all(old_dir, lower_old_dir_dentry->d_inode);
663 out_lock:
664         unlock_rename(lower_old_dir_dentry, lower_new_dir_dentry);
665         dput(lower_new_dir_dentry);
666         dput(lower_old_dir_dentry);
667         dput(lower_new_dentry);
668         dput(lower_old_dentry);
669         return rc;
670 }
671
672 static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf,
673                                    size_t *bufsiz)
674 {
675         struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
676         char *lower_buf;
677         size_t lower_bufsiz = PATH_MAX;
678         mm_segment_t old_fs;
679         int rc;
680
681         lower_buf = kmalloc(lower_bufsiz, GFP_KERNEL);
682         if (!lower_buf) {
683                 rc = -ENOMEM;
684                 goto out;
685         }
686         old_fs = get_fs();
687         set_fs(get_ds());
688         rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
689                                                    (char __user *)lower_buf,
690                                                    lower_bufsiz);
691         set_fs(old_fs);
692         if (rc < 0)
693                 goto out;
694         lower_bufsiz = rc;
695         rc = ecryptfs_decode_and_decrypt_filename(buf, bufsiz, dentry,
696                                                   lower_buf, lower_bufsiz);
697 out:
698         kfree(lower_buf);
699         return rc;
700 }
701
702 static int
703 ecryptfs_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
704 {
705         char *kbuf;
706         size_t kbufsiz, copied;
707         int rc;
708
709         rc = ecryptfs_readlink_lower(dentry, &kbuf, &kbufsiz);
710         if (rc)
711                 goto out;
712         copied = min_t(size_t, bufsiz, kbufsiz);
713         rc = copy_to_user(buf, kbuf, copied) ? -EFAULT : copied;
714         kfree(kbuf);
715         fsstack_copy_attr_atime(dentry->d_inode,
716                                 ecryptfs_dentry_to_lower(dentry)->d_inode);
717 out:
718         return rc;
719 }
720
721 static void *ecryptfs_follow_link(struct dentry *dentry, struct nameidata *nd)
722 {
723         char *buf;
724         int len = PAGE_SIZE, rc;
725         mm_segment_t old_fs;
726
727         /* Released in ecryptfs_put_link(); only release here on error */
728         buf = kmalloc(len, GFP_KERNEL);
729         if (!buf) {
730                 buf = ERR_PTR(-ENOMEM);
731                 goto out;
732         }
733         old_fs = get_fs();
734         set_fs(get_ds());
735         rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
736         set_fs(old_fs);
737         if (rc < 0) {
738                 kfree(buf);
739                 buf = ERR_PTR(rc);
740         } else
741                 buf[rc] = '\0';
742 out:
743         nd_set_link(nd, buf);
744         return NULL;
745 }
746
747 static void
748 ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
749 {
750         char *buf = nd_get_link(nd);
751         if (!IS_ERR(buf)) {
752                 /* Free the char* */
753                 kfree(buf);
754         }
755 }
756
757 /**
758  * upper_size_to_lower_size
759  * @crypt_stat: Crypt_stat associated with file
760  * @upper_size: Size of the upper file
761  *
762  * Calculate the required size of the lower file based on the
763  * specified size of the upper file. This calculation is based on the
764  * number of headers in the underlying file and the extent size.
765  *
766  * Returns Calculated size of the lower file.
767  */
768 static loff_t
769 upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat,
770                          loff_t upper_size)
771 {
772         loff_t lower_size;
773
774         lower_size = ecryptfs_lower_header_size(crypt_stat);
775         if (upper_size != 0) {
776                 loff_t num_extents;
777
778                 num_extents = upper_size >> crypt_stat->extent_shift;
779                 if (upper_size & ~crypt_stat->extent_mask)
780                         num_extents++;
781                 lower_size += (num_extents * crypt_stat->extent_size);
782         }
783         return lower_size;
784 }
785
786 /**
787  * truncate_upper
788  * @dentry: The ecryptfs layer dentry
789  * @ia: Address of the ecryptfs inode's attributes
790  * @lower_ia: Address of the lower inode's attributes
791  *
792  * Function to handle truncations modifying the size of the file. Note
793  * that the file sizes are interpolated. When expanding, we are simply
794  * writing strings of 0's out. When truncating, we truncate the upper
795  * inode and update the lower_ia according to the page index
796  * interpolations. If ATTR_SIZE is set in lower_ia->ia_valid upon return,
797  * the caller must use lower_ia in a call to notify_change() to perform
798  * the truncation of the lower inode.
799  *
800  * Returns zero on success; non-zero otherwise
801  */
802 static int truncate_upper(struct dentry *dentry, struct iattr *ia,
803                           struct iattr *lower_ia)
804 {
805         int rc = 0;
806         struct inode *inode = dentry->d_inode;
807         struct ecryptfs_crypt_stat *crypt_stat;
808         loff_t i_size = i_size_read(inode);
809         loff_t lower_size_before_truncate;
810         loff_t lower_size_after_truncate;
811
812         if (unlikely((ia->ia_size == i_size))) {
813                 lower_ia->ia_valid &= ~ATTR_SIZE;
814                 return 0;
815         }
816         rc = ecryptfs_get_lower_file(dentry, inode);
817         if (rc)
818                 return rc;
819         crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
820         /* Switch on growing or shrinking file */
821         if (ia->ia_size > i_size) {
822                 char zero[] = { 0x00 };
823
824                 lower_ia->ia_valid &= ~ATTR_SIZE;
825                 /* Write a single 0 at the last position of the file;
826                  * this triggers code that will fill in 0's throughout
827                  * the intermediate portion of the previous end of the
828                  * file and the new and of the file */
829                 rc = ecryptfs_write(inode, zero,
830                                     (ia->ia_size - 1), 1);
831         } else { /* ia->ia_size < i_size_read(inode) */
832                 /* We're chopping off all the pages down to the page
833                  * in which ia->ia_size is located. Fill in the end of
834                  * that page from (ia->ia_size & ~PAGE_CACHE_MASK) to
835                  * PAGE_CACHE_SIZE with zeros. */
836                 size_t num_zeros = (PAGE_CACHE_SIZE
837                                     - (ia->ia_size & ~PAGE_CACHE_MASK));
838
839                 if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
840                         truncate_setsize(inode, ia->ia_size);
841                         lower_ia->ia_size = ia->ia_size;
842                         lower_ia->ia_valid |= ATTR_SIZE;
843                         goto out;
844                 }
845                 if (num_zeros) {
846                         char *zeros_virt;
847
848                         zeros_virt = kzalloc(num_zeros, GFP_KERNEL);
849                         if (!zeros_virt) {
850                                 rc = -ENOMEM;
851                                 goto out;
852                         }
853                         rc = ecryptfs_write(inode, zeros_virt,
854                                             ia->ia_size, num_zeros);
855                         kfree(zeros_virt);
856                         if (rc) {
857                                 printk(KERN_ERR "Error attempting to zero out "
858                                        "the remainder of the end page on "
859                                        "reducing truncate; rc = [%d]\n", rc);
860                                 goto out;
861                         }
862                 }
863                 truncate_setsize(inode, ia->ia_size);
864                 rc = ecryptfs_write_inode_size_to_metadata(inode);
865                 if (rc) {
866                         printk(KERN_ERR "Problem with "
867                                "ecryptfs_write_inode_size_to_metadata; "
868                                "rc = [%d]\n", rc);
869                         goto out;
870                 }
871                 /* We are reducing the size of the ecryptfs file, and need to
872                  * know if we need to reduce the size of the lower file. */
873                 lower_size_before_truncate =
874                     upper_size_to_lower_size(crypt_stat, i_size);
875                 lower_size_after_truncate =
876                     upper_size_to_lower_size(crypt_stat, ia->ia_size);
877                 if (lower_size_after_truncate < lower_size_before_truncate) {
878                         lower_ia->ia_size = lower_size_after_truncate;
879                         lower_ia->ia_valid |= ATTR_SIZE;
880                 } else
881                         lower_ia->ia_valid &= ~ATTR_SIZE;
882         }
883 out:
884         ecryptfs_put_lower_file(inode);
885         return rc;
886 }
887
888 static int ecryptfs_inode_newsize_ok(struct inode *inode, loff_t offset)
889 {
890         struct ecryptfs_crypt_stat *crypt_stat;
891         loff_t lower_oldsize, lower_newsize;
892
893         crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
894         lower_oldsize = upper_size_to_lower_size(crypt_stat,
895                                                  i_size_read(inode));
896         lower_newsize = upper_size_to_lower_size(crypt_stat, offset);
897         if (lower_newsize > lower_oldsize) {
898                 /*
899                  * The eCryptfs inode and the new *lower* size are mixed here
900                  * because we may not have the lower i_mutex held and/or it may
901                  * not be appropriate to call inode_newsize_ok() with inodes
902                  * from other filesystems.
903                  */
904                 return inode_newsize_ok(inode, lower_newsize);
905         }
906
907         return 0;
908 }
909
910 /**
911  * ecryptfs_truncate
912  * @dentry: The ecryptfs layer dentry
913  * @new_length: The length to expand the file to
914  *
915  * Simple function that handles the truncation of an eCryptfs inode and
916  * its corresponding lower inode.
917  *
918  * Returns zero on success; non-zero otherwise
919  */
920 int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
921 {
922         struct iattr ia = { .ia_valid = ATTR_SIZE, .ia_size = new_length };
923         struct iattr lower_ia = { .ia_valid = 0 };
924         int rc;
925
926         rc = ecryptfs_inode_newsize_ok(dentry->d_inode, new_length);
927         if (rc)
928                 return rc;
929
930         rc = truncate_upper(dentry, &ia, &lower_ia);
931         if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
932                 struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
933
934                 mutex_lock(&lower_dentry->d_inode->i_mutex);
935                 rc = notify_change(lower_dentry, &lower_ia);
936                 mutex_unlock(&lower_dentry->d_inode->i_mutex);
937         }
938         return rc;
939 }
940
941 static int
942 ecryptfs_permission(struct inode *inode, int mask)
943 {
944         return inode_permission(ecryptfs_inode_to_lower(inode), mask);
945 }
946
947 /**
948  * ecryptfs_setattr
949  * @dentry: dentry handle to the inode to modify
950  * @ia: Structure with flags of what to change and values
951  *
952  * Updates the metadata of an inode. If the update is to the size
953  * i.e. truncation, then ecryptfs_truncate will handle the size modification
954  * of both the ecryptfs inode and the lower inode.
955  *
956  * All other metadata changes will be passed right to the lower filesystem,
957  * and we will just update our inode to look like the lower.
958  */
959 static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
960 {
961         int rc = 0;
962         struct dentry *lower_dentry;
963         struct iattr lower_ia;
964         struct inode *inode;
965         struct inode *lower_inode;
966         struct ecryptfs_crypt_stat *crypt_stat;
967
968         crypt_stat = &ecryptfs_inode_to_private(dentry->d_inode)->crypt_stat;
969         if (!(crypt_stat->flags & ECRYPTFS_STRUCT_INITIALIZED))
970                 ecryptfs_init_crypt_stat(crypt_stat);
971         inode = dentry->d_inode;
972         lower_inode = ecryptfs_inode_to_lower(inode);
973         lower_dentry = ecryptfs_dentry_to_lower(dentry);
974         mutex_lock(&crypt_stat->cs_mutex);
975         if (S_ISDIR(dentry->d_inode->i_mode))
976                 crypt_stat->flags &= ~(ECRYPTFS_ENCRYPTED);
977         else if (S_ISREG(dentry->d_inode->i_mode)
978                  && (!(crypt_stat->flags & ECRYPTFS_POLICY_APPLIED)
979                      || !(crypt_stat->flags & ECRYPTFS_KEY_VALID))) {
980                 struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
981
982                 mount_crypt_stat = &ecryptfs_superblock_to_private(
983                         dentry->d_sb)->mount_crypt_stat;
984                 rc = ecryptfs_get_lower_file(dentry, inode);
985                 if (rc) {
986                         mutex_unlock(&crypt_stat->cs_mutex);
987                         goto out;
988                 }
989                 rc = ecryptfs_read_metadata(dentry);
990                 ecryptfs_put_lower_file(inode);
991                 if (rc) {
992                         if (!(mount_crypt_stat->flags
993                               & ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED)) {
994                                 rc = -EIO;
995                                 printk(KERN_WARNING "Either the lower file "
996                                        "is not in a valid eCryptfs format, "
997                                        "or the key could not be retrieved. "
998                                        "Plaintext passthrough mode is not "
999                                        "enabled; returning -EIO\n");
1000                                 mutex_unlock(&crypt_stat->cs_mutex);
1001                                 goto out;
1002                         }
1003                         rc = 0;
1004                         crypt_stat->flags &= ~(ECRYPTFS_I_SIZE_INITIALIZED
1005                                                | ECRYPTFS_ENCRYPTED);
1006                 }
1007         }
1008         mutex_unlock(&crypt_stat->cs_mutex);
1009
1010         rc = inode_change_ok(inode, ia);
1011         if (rc)
1012                 goto out;
1013         if (ia->ia_valid & ATTR_SIZE) {
1014                 rc = ecryptfs_inode_newsize_ok(inode, ia->ia_size);
1015                 if (rc)
1016                         goto out;
1017         }
1018
1019         memcpy(&lower_ia, ia, sizeof(lower_ia));
1020         if (ia->ia_valid & ATTR_FILE)
1021                 lower_ia.ia_file = ecryptfs_file_to_lower(ia->ia_file);
1022         if (ia->ia_valid & ATTR_SIZE) {
1023                 rc = truncate_upper(dentry, ia, &lower_ia);
1024                 if (rc < 0)
1025                         goto out;
1026         }
1027
1028         /*
1029          * mode change is for clearing setuid/setgid bits. Allow lower fs
1030          * to interpret this in its own way.
1031          */
1032         if (lower_ia.ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID))
1033                 lower_ia.ia_valid &= ~ATTR_MODE;
1034
1035         mutex_lock(&lower_dentry->d_inode->i_mutex);
1036         rc = notify_change(lower_dentry, &lower_ia);
1037         mutex_unlock(&lower_dentry->d_inode->i_mutex);
1038 out:
1039         fsstack_copy_attr_all(inode, lower_inode);
1040         return rc;
1041 }
1042
1043 int ecryptfs_getattr_link(struct vfsmount *mnt, struct dentry *dentry,
1044                           struct kstat *stat)
1045 {
1046         struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
1047         int rc = 0;
1048
1049         mount_crypt_stat = &ecryptfs_superblock_to_private(
1050                                                 dentry->d_sb)->mount_crypt_stat;
1051         generic_fillattr(dentry->d_inode, stat);
1052         if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
1053                 char *target;
1054                 size_t targetsiz;
1055
1056                 rc = ecryptfs_readlink_lower(dentry, &target, &targetsiz);
1057                 if (!rc) {
1058                         kfree(target);
1059                         stat->size = targetsiz;
1060                 }
1061         }
1062         return rc;
1063 }
1064
1065 int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
1066                      struct kstat *stat)
1067 {
1068         struct kstat lower_stat;
1069         int rc;
1070
1071         rc = vfs_getattr(ecryptfs_dentry_to_lower_mnt(dentry),
1072                          ecryptfs_dentry_to_lower(dentry), &lower_stat);
1073         if (!rc) {
1074                 fsstack_copy_attr_all(dentry->d_inode,
1075                                       ecryptfs_inode_to_lower(dentry->d_inode));
1076                 generic_fillattr(dentry->d_inode, stat);
1077                 stat->blocks = lower_stat.blocks;
1078         }
1079         return rc;
1080 }
1081
1082 int
1083 ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
1084                   size_t size, int flags)
1085 {
1086         int rc = 0;
1087         struct dentry *lower_dentry;
1088
1089         lower_dentry = ecryptfs_dentry_to_lower(dentry);
1090         if (!lower_dentry->d_inode->i_op->setxattr) {
1091                 rc = -EOPNOTSUPP;
1092                 goto out;
1093         }
1094
1095         rc = vfs_setxattr(lower_dentry, name, value, size, flags);
1096         if (!rc)
1097                 fsstack_copy_attr_all(dentry->d_inode, lower_dentry->d_inode);
1098 out:
1099         return rc;
1100 }
1101
1102 ssize_t
1103 ecryptfs_getxattr_lower(struct dentry *lower_dentry, const char *name,
1104                         void *value, size_t size)
1105 {
1106         int rc = 0;
1107
1108         if (!lower_dentry->d_inode->i_op->getxattr) {
1109                 rc = -EOPNOTSUPP;
1110                 goto out;
1111         }
1112         mutex_lock(&lower_dentry->d_inode->i_mutex);
1113         rc = lower_dentry->d_inode->i_op->getxattr(lower_dentry, name, value,
1114                                                    size);
1115         mutex_unlock(&lower_dentry->d_inode->i_mutex);
1116 out:
1117         return rc;
1118 }
1119
1120 static ssize_t
1121 ecryptfs_getxattr(struct dentry *dentry, const char *name, void *value,
1122                   size_t size)
1123 {
1124         return ecryptfs_getxattr_lower(ecryptfs_dentry_to_lower(dentry), name,
1125                                        value, size);
1126 }
1127
1128 static ssize_t
1129 ecryptfs_listxattr(struct dentry *dentry, char *list, size_t size)
1130 {
1131         int rc = 0;
1132         struct dentry *lower_dentry;
1133
1134         lower_dentry = ecryptfs_dentry_to_lower(dentry);
1135         if (!lower_dentry->d_inode->i_op->listxattr) {
1136                 rc = -EOPNOTSUPP;
1137                 goto out;
1138         }
1139         mutex_lock(&lower_dentry->d_inode->i_mutex);
1140         rc = lower_dentry->d_inode->i_op->listxattr(lower_dentry, list, size);
1141         mutex_unlock(&lower_dentry->d_inode->i_mutex);
1142 out:
1143         return rc;
1144 }
1145
1146 static int ecryptfs_removexattr(struct dentry *dentry, const char *name)
1147 {
1148         int rc = 0;
1149         struct dentry *lower_dentry;
1150
1151         lower_dentry = ecryptfs_dentry_to_lower(dentry);
1152         if (!lower_dentry->d_inode->i_op->removexattr) {
1153                 rc = -EOPNOTSUPP;
1154                 goto out;
1155         }
1156         mutex_lock(&lower_dentry->d_inode->i_mutex);
1157         rc = lower_dentry->d_inode->i_op->removexattr(lower_dentry, name);
1158         mutex_unlock(&lower_dentry->d_inode->i_mutex);
1159 out:
1160         return rc;
1161 }
1162
1163 const struct inode_operations ecryptfs_symlink_iops = {
1164         .readlink = ecryptfs_readlink,
1165         .follow_link = ecryptfs_follow_link,
1166         .put_link = ecryptfs_put_link,
1167         .permission = ecryptfs_permission,
1168         .setattr = ecryptfs_setattr,
1169         .getattr = ecryptfs_getattr_link,
1170         .setxattr = ecryptfs_setxattr,
1171         .getxattr = ecryptfs_getxattr,
1172         .listxattr = ecryptfs_listxattr,
1173         .removexattr = ecryptfs_removexattr
1174 };
1175
1176 const struct inode_operations ecryptfs_dir_iops = {
1177         .create = ecryptfs_create,
1178         .lookup = ecryptfs_lookup,
1179         .link = ecryptfs_link,
1180         .unlink = ecryptfs_unlink,
1181         .symlink = ecryptfs_symlink,
1182         .mkdir = ecryptfs_mkdir,
1183         .rmdir = ecryptfs_rmdir,
1184         .mknod = ecryptfs_mknod,
1185         .rename = ecryptfs_rename,
1186         .permission = ecryptfs_permission,
1187         .setattr = ecryptfs_setattr,
1188         .setxattr = ecryptfs_setxattr,
1189         .getxattr = ecryptfs_getxattr,
1190         .listxattr = ecryptfs_listxattr,
1191         .removexattr = ecryptfs_removexattr
1192 };
1193
1194 const struct inode_operations ecryptfs_main_iops = {
1195         .permission = ecryptfs_permission,
1196         .setattr = ecryptfs_setattr,
1197         .getattr = ecryptfs_getattr,
1198         .setxattr = ecryptfs_setxattr,
1199         .getxattr = ecryptfs_getxattr,
1200         .listxattr = ecryptfs_listxattr,
1201         .removexattr = ecryptfs_removexattr
1202 };