main.c

  1// SPDX-License-Identifier: GPL-2.0-or-later
  2/*
  3 * eCryptfs: Linux filesystem encryption layer
  4 *
  5 * Copyright (C) 1997-2003 Erez Zadok
  6 * Copyright (C) 2001-2003 Stony Brook University
  7 * Copyright (C) 2004-2007 International Business Machines Corp.
  8 *   Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>
  9 *              Michael C. Thompson <mcthomps@us.ibm.com>
 10 *              Tyler Hicks <code@tyhicks.com>
 11 */
 12
 13#include <linux/dcache.h>
 14#include <linux/file.h>
 15#include <linux/fips.h>
 16#include <linux/module.h>
 17#include <linux/namei.h>
 18#include <linux/skbuff.h>
 19#include <linux/pagemap.h>
 20#include <linux/key.h>
 21#include <linux/fs_context.h>
 22#include <linux/fs_parser.h>
 23#include <linux/fs_stack.h>
 24#include <linux/sysfs.h>
 25#include <linux/slab.h>
 26#include <linux/magic.h>
 27#include "ecryptfs_kernel.h"
 28
 29/*
 30 * Module parameter that defines the ecryptfs_verbosity level.
 31 */
 32int ecryptfs_verbosity = 0;
 33
 34module_param(ecryptfs_verbosity, int, 0);
 35MODULE_PARM_DESC(ecryptfs_verbosity,
 36		 "Initial verbosity level (0 or 1; defaults to "
 37		 "0, which is Quiet)");
 38
 39/*
 40 * Module parameter that defines the number of message buffer elements
 41 */
 42unsigned int ecryptfs_message_buf_len = ECRYPTFS_DEFAULT_MSG_CTX_ELEMS;
 43
 44module_param(ecryptfs_message_buf_len, uint, 0);
 45MODULE_PARM_DESC(ecryptfs_message_buf_len,
 46		 "Number of message buffer elements");
 47
 48/*
 49 * Module parameter that defines the maximum guaranteed amount of time to wait
 50 * for a response from ecryptfsd.  The actual sleep time will be, more than
 51 * likely, a small amount greater than this specified value, but only less if
 52 * the message successfully arrives.
 53 */
 54signed long ecryptfs_message_wait_timeout = ECRYPTFS_MAX_MSG_CTX_TTL / HZ;
 55
 56module_param(ecryptfs_message_wait_timeout, long, 0);
 57MODULE_PARM_DESC(ecryptfs_message_wait_timeout,
 58		 "Maximum number of seconds that an operation will "
 59		 "sleep while waiting for a message response from "
 60		 "userspace");
 61
 62/*
 63 * Module parameter that is an estimate of the maximum number of users
 64 * that will be concurrently using eCryptfs. Set this to the right
 65 * value to balance performance and memory use.
 66 */
 67unsigned int ecryptfs_number_of_users = ECRYPTFS_DEFAULT_NUM_USERS;
 68
 69module_param(ecryptfs_number_of_users, uint, 0);
 70MODULE_PARM_DESC(ecryptfs_number_of_users, "An estimate of the number of "
 71		 "concurrent users of eCryptfs");
 72
 73void __ecryptfs_printk(const char *fmt, ...)
 74{
 75	va_list args;
 76	va_start(args, fmt);
 77	if (fmt[1] == '7') { /* KERN_DEBUG */
 78		if (ecryptfs_verbosity >= 1)
 79			vprintk(fmt, args);
 80	} else
 81		vprintk(fmt, args);
 82	va_end(args);
 83}
 84
 85/*
 86 * ecryptfs_init_lower_file
 87 * @ecryptfs_dentry: Fully initialized eCryptfs dentry object, with
 88 *                   the lower dentry and the lower mount set
 89 *
 90 * eCryptfs only ever keeps a single open file for every lower
 91 * inode. All I/O operations to the lower inode occur through that
 92 * file. When the first eCryptfs dentry that interposes with the first
 93 * lower dentry for that inode is created, this function creates the
 94 * lower file struct and associates it with the eCryptfs
 95 * inode. When all eCryptfs files associated with the inode are released, the
 96 * file is closed.
 97 *
 98 * The lower file will be opened with read/write permissions, if
 99 * possible. Otherwise, it is opened read-only.
100 *
101 * This function does nothing if a lower file is already
102 * associated with the eCryptfs inode.
103 *
104 * Returns zero on success; non-zero otherwise
105 */
106static int ecryptfs_init_lower_file(struct dentry *dentry,
107				    struct file **lower_file)
108{
109	const struct cred *cred = current_cred();
110	struct path path = ecryptfs_lower_path(dentry);
111	int rc;
112
113	rc = ecryptfs_privileged_open(lower_file, path.dentry, path.mnt, cred);
114	if (rc) {
115		printk(KERN_ERR "Error opening lower file "
116		       "for lower_dentry [0x%p] and lower_mnt [0x%p]; "
117		       "rc = [%d]\n", path.dentry, path.mnt, rc);
118		(*lower_file) = NULL;
119	}
120	return rc;
121}
122
123int ecryptfs_get_lower_file(struct dentry *dentry, struct inode *inode)
124{
125	struct ecryptfs_inode_info *inode_info;
126	int count, rc = 0;
127
128	inode_info = ecryptfs_inode_to_private(inode);
129	mutex_lock(&inode_info->lower_file_mutex);
130	count = atomic_inc_return(&inode_info->lower_file_count);
131	if (WARN_ON_ONCE(count < 1))
132		rc = -EINVAL;
133	else if (count == 1) {
134		rc = ecryptfs_init_lower_file(dentry,
135					      &inode_info->lower_file);
136		if (rc)
137			atomic_set(&inode_info->lower_file_count, 0);
138	}
139	mutex_unlock(&inode_info->lower_file_mutex);
140	return rc;
141}
142
143void ecryptfs_put_lower_file(struct inode *inode)
144{
145	struct ecryptfs_inode_info *inode_info;
146
147	inode_info = ecryptfs_inode_to_private(inode);
148	if (atomic_dec_and_mutex_lock(&inode_info->lower_file_count,
149				      &inode_info->lower_file_mutex)) {
150		filemap_write_and_wait(inode->i_mapping);
151		fput(inode_info->lower_file);
152		inode_info->lower_file = NULL;
153		mutex_unlock(&inode_info->lower_file_mutex);
154	}
155}
156
157enum {
158	Opt_sig, Opt_ecryptfs_sig, Opt_cipher, Opt_ecryptfs_cipher,
159	Opt_ecryptfs_key_bytes, Opt_passthrough, Opt_xattr_metadata,
160	Opt_encrypted_view, Opt_fnek_sig, Opt_fn_cipher,
161	Opt_fn_cipher_key_bytes, Opt_unlink_sigs, Opt_mount_auth_tok_only,
162	Opt_check_dev_ruid
163};
164
165static const struct fs_parameter_spec ecryptfs_fs_param_spec[] = {
166	fsparam_string	("sig",			    Opt_sig),
167	fsparam_string	("ecryptfs_sig",	    Opt_ecryptfs_sig),
168	fsparam_string	("cipher",		    Opt_cipher),
169	fsparam_string	("ecryptfs_cipher",	    Opt_ecryptfs_cipher),
170	fsparam_u32	("ecryptfs_key_bytes",	    Opt_ecryptfs_key_bytes),
171	fsparam_flag	("ecryptfs_passthrough",    Opt_passthrough),
172	fsparam_flag	("ecryptfs_xattr_metadata", Opt_xattr_metadata),
173	fsparam_flag	("ecryptfs_encrypted_view", Opt_encrypted_view),
174	fsparam_string	("ecryptfs_fnek_sig",	    Opt_fnek_sig),
175	fsparam_string	("ecryptfs_fn_cipher",	    Opt_fn_cipher),
176	fsparam_u32	("ecryptfs_fn_key_bytes",   Opt_fn_cipher_key_bytes),
177	fsparam_flag	("ecryptfs_unlink_sigs",    Opt_unlink_sigs),
178	fsparam_flag	("ecryptfs_mount_auth_tok_only", Opt_mount_auth_tok_only),
179	fsparam_flag	("ecryptfs_check_dev_ruid", Opt_check_dev_ruid),
180	{}
181};
182
183static int ecryptfs_init_global_auth_toks(
184	struct ecryptfs_mount_crypt_stat *mount_crypt_stat)
185{
186	struct ecryptfs_global_auth_tok *global_auth_tok;
187	struct ecryptfs_auth_tok *auth_tok;
188	int rc = 0;
189
190	list_for_each_entry(global_auth_tok,
191			    &mount_crypt_stat->global_auth_tok_list,
192			    mount_crypt_stat_list) {
193		rc = ecryptfs_keyring_auth_tok_for_sig(
194			&global_auth_tok->global_auth_tok_key, &auth_tok,
195			global_auth_tok->sig);
196		if (rc) {
197			printk(KERN_ERR "Could not find valid key in user "
198			       "session keyring for sig specified in mount "
199			       "option: [%s]\n", global_auth_tok->sig);
200			global_auth_tok->flags |= ECRYPTFS_AUTH_TOK_INVALID;
201			goto out;
202		} else {
203			global_auth_tok->flags &= ~ECRYPTFS_AUTH_TOK_INVALID;
204			up_write(&(global_auth_tok->global_auth_tok_key)->sem);
205		}
206	}
207out:
208	return rc;
209}
210
211static void ecryptfs_init_mount_crypt_stat(
212	struct ecryptfs_mount_crypt_stat *mount_crypt_stat)
213{
214	memset((void *)mount_crypt_stat, 0,
215	       sizeof(struct ecryptfs_mount_crypt_stat));
216	INIT_LIST_HEAD(&mount_crypt_stat->global_auth_tok_list);
217	mutex_init(&mount_crypt_stat->global_auth_tok_list_mutex);
218	mount_crypt_stat->flags |= ECRYPTFS_MOUNT_CRYPT_STAT_INITIALIZED;
219}
220
221struct ecryptfs_fs_context {
222	/* Mount option status trackers */
223	bool check_ruid;
224	bool sig_set;
225	bool cipher_name_set;
226	bool cipher_key_bytes_set;
227	bool fn_cipher_name_set;
228	bool fn_cipher_key_bytes_set;
229};
230
231/**
232 * ecryptfs_parse_param
233 * @fc: The ecryptfs filesystem context
234 * @param: The mount parameter to parse
235 *
236 * The signature of the key to use must be the description of a key
237 * already in the keyring. Mounting will fail if the key can not be
238 * found.
239 *
240 * Returns zero on success; non-zero on error
241 */
242static int ecryptfs_parse_param(
243	struct fs_context *fc,
244	struct fs_parameter *param)
245{
246	int rc;
247	int opt;
248	struct fs_parse_result result;
249	struct ecryptfs_fs_context *ctx = fc->fs_private;
250	struct ecryptfs_sb_info *sbi = fc->s_fs_info;
251	struct ecryptfs_mount_crypt_stat *mount_crypt_stat =
252		&sbi->mount_crypt_stat;
253
254	opt = fs_parse(fc, ecryptfs_fs_param_spec, param, &result);
255	if (opt < 0)
256		return opt;
257
258	switch (opt) {
259	case Opt_sig:
260	case Opt_ecryptfs_sig:
261		rc = ecryptfs_add_global_auth_tok(mount_crypt_stat,
262						  param->string, 0);
263		if (rc) {
264			printk(KERN_ERR "Error attempting to register "
265			       "global sig; rc = [%d]\n", rc);
266			return rc;
267		}
268		ctx->sig_set = 1;
269		break;
270	case Opt_cipher:
271	case Opt_ecryptfs_cipher:
272		strscpy(mount_crypt_stat->global_default_cipher_name,
273			param->string);
274		ctx->cipher_name_set = 1;
275		break;
276	case Opt_ecryptfs_key_bytes:
277		mount_crypt_stat->global_default_cipher_key_size =
278			result.uint_32;
279		ctx->cipher_key_bytes_set = 1;
280		break;
281	case Opt_passthrough:
282		mount_crypt_stat->flags |=
283			ECRYPTFS_PLAINTEXT_PASSTHROUGH_ENABLED;
284		break;
285	case Opt_xattr_metadata:
286		mount_crypt_stat->flags |= ECRYPTFS_XATTR_METADATA_ENABLED;
287		break;
288	case Opt_encrypted_view:
289		mount_crypt_stat->flags |= ECRYPTFS_XATTR_METADATA_ENABLED;
290		mount_crypt_stat->flags |= ECRYPTFS_ENCRYPTED_VIEW_ENABLED;
291		break;
292	case Opt_fnek_sig:
293		strscpy(mount_crypt_stat->global_default_fnek_sig,
294			param->string);
295		rc = ecryptfs_add_global_auth_tok(
296			mount_crypt_stat,
297			mount_crypt_stat->global_default_fnek_sig,
298			ECRYPTFS_AUTH_TOK_FNEK);
299		if (rc) {
300			printk(KERN_ERR "Error attempting to register "
301			       "global fnek sig [%s]; rc = [%d]\n",
302			       mount_crypt_stat->global_default_fnek_sig, rc);
303			return rc;
304		}
305		mount_crypt_stat->flags |=
306			(ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES
307			 | ECRYPTFS_GLOBAL_ENCFN_USE_MOUNT_FNEK);
308		break;
309	case Opt_fn_cipher:
310		strscpy(mount_crypt_stat->global_default_fn_cipher_name,
311			param->string);
312		ctx->fn_cipher_name_set = 1;
313		break;
314	case Opt_fn_cipher_key_bytes:
315		mount_crypt_stat->global_default_fn_cipher_key_bytes =
316			result.uint_32;
317		ctx->fn_cipher_key_bytes_set = 1;
318		break;
319	case Opt_unlink_sigs:
320		mount_crypt_stat->flags |= ECRYPTFS_UNLINK_SIGS;
321		break;
322	case Opt_mount_auth_tok_only:
323		mount_crypt_stat->flags |= ECRYPTFS_GLOBAL_MOUNT_AUTH_TOK_ONLY;
324		break;
325	case Opt_check_dev_ruid:
326		ctx->check_ruid = 1;
327		break;
328	default:
329		return -EINVAL;
330	}
331
332	return 0;
333}
334
335static int ecryptfs_validate_options(struct fs_context *fc)
336{
337	int rc = 0;
338	u8 cipher_code;
339	struct ecryptfs_fs_context *ctx = fc->fs_private;
340	struct ecryptfs_sb_info *sbi = fc->s_fs_info;
341	struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
342
343
344	mount_crypt_stat = &sbi->mount_crypt_stat;
345
346	if (!ctx->sig_set) {
347		rc = -EINVAL;
348		ecryptfs_printk(KERN_ERR, "You must supply at least one valid "
349				"auth tok signature as a mount "
350				"parameter; see the eCryptfs README\n");
351		goto out;
352	}
353	if (!ctx->cipher_name_set) {
354		int cipher_name_len = strlen(ECRYPTFS_DEFAULT_CIPHER);
355
356		BUG_ON(cipher_name_len > ECRYPTFS_MAX_CIPHER_NAME_SIZE);
357		strcpy(mount_crypt_stat->global_default_cipher_name,
358		       ECRYPTFS_DEFAULT_CIPHER);
359	}
360	if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
361	    && !ctx->fn_cipher_name_set)
362		strcpy(mount_crypt_stat->global_default_fn_cipher_name,
363		       mount_crypt_stat->global_default_cipher_name);
364	if (!ctx->cipher_key_bytes_set)
365		mount_crypt_stat->global_default_cipher_key_size = 0;
366	if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
367	    && !ctx->fn_cipher_key_bytes_set)
368		mount_crypt_stat->global_default_fn_cipher_key_bytes =
369			mount_crypt_stat->global_default_cipher_key_size;
370
371	cipher_code = ecryptfs_code_for_cipher_string(
372		mount_crypt_stat->global_default_cipher_name,
373		mount_crypt_stat->global_default_cipher_key_size);
374	if (!cipher_code) {
375		ecryptfs_printk(KERN_ERR,
376				"eCryptfs doesn't support cipher: %s\n",
377				mount_crypt_stat->global_default_cipher_name);
378		rc = -EINVAL;
379		goto out;
380	}
381
382	mutex_lock(&key_tfm_list_mutex);
383	if (!ecryptfs_tfm_exists(mount_crypt_stat->global_default_cipher_name,
384				 NULL)) {
385		rc = ecryptfs_add_new_key_tfm(
386			NULL, mount_crypt_stat->global_default_cipher_name,
387			mount_crypt_stat->global_default_cipher_key_size);
388		if (rc) {
389			printk(KERN_ERR "Error attempting to initialize "
390			       "cipher with name = [%s] and key size = [%td]; "
391			       "rc = [%d]\n",
392			       mount_crypt_stat->global_default_cipher_name,
393			       mount_crypt_stat->global_default_cipher_key_size,
394			       rc);
395			rc = -EINVAL;
396			mutex_unlock(&key_tfm_list_mutex);
397			goto out;
398		}
399	}
400	if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
401	    && !ecryptfs_tfm_exists(
402		    mount_crypt_stat->global_default_fn_cipher_name, NULL)) {
403		rc = ecryptfs_add_new_key_tfm(
404			NULL, mount_crypt_stat->global_default_fn_cipher_name,
405			mount_crypt_stat->global_default_fn_cipher_key_bytes);
406		if (rc) {
407			printk(KERN_ERR "Error attempting to initialize "
408			       "cipher with name = [%s] and key size = [%td]; "
409			       "rc = [%d]\n",
410			       mount_crypt_stat->global_default_fn_cipher_name,
411			       mount_crypt_stat->global_default_fn_cipher_key_bytes,
412			       rc);
413			rc = -EINVAL;
414			mutex_unlock(&key_tfm_list_mutex);
415			goto out;
416		}
417	}
418	mutex_unlock(&key_tfm_list_mutex);
419	rc = ecryptfs_init_global_auth_toks(mount_crypt_stat);
420	if (rc)
421		printk(KERN_WARNING "One or more global auth toks could not "
422		       "properly register; rc = [%d]\n", rc);
423out:
424	return rc;
425}
426
427struct kmem_cache *ecryptfs_sb_info_cache;
428static struct file_system_type ecryptfs_fs_type;
429
430/*
431 * ecryptfs_get_tree
432 * @fc: The filesystem context
433 */
434static int ecryptfs_get_tree(struct fs_context *fc)
435{
436	struct super_block *s;
437	struct ecryptfs_fs_context *ctx = fc->fs_private;
438	struct ecryptfs_sb_info *sbi = fc->s_fs_info;
439	struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
440	const char *err = "Getting sb failed";
441	struct inode *inode;
442	struct path path;
443	int rc;
444
445	if (!fc->source) {
446		rc = -EINVAL;
447		err = "Device name cannot be null";
448		goto out;
449	}
450
451	mount_crypt_stat = &sbi->mount_crypt_stat;
452	rc = ecryptfs_validate_options(fc);
453	if (rc) {
454		err = "Error validating options";
455		goto out;
456	}
457
458	if (fips_enabled) {
459		rc = -EINVAL;
460		err = "eCryptfs support is disabled due to FIPS";
461		goto out;
462	}
463
464	s = sget_fc(fc, NULL, set_anon_super_fc);
465	if (IS_ERR(s)) {
466		rc = PTR_ERR(s);
467		goto out;
468	}
469
470	rc = super_setup_bdi(s);
471	if (rc)
472		goto out1;
473
474	ecryptfs_set_superblock_private(s, sbi);
475
476	/* ->kill_sb() will take care of sbi after that point */
477	sbi = NULL;
478	s->s_op = &ecryptfs_sops;
479	s->s_xattr = ecryptfs_xattr_handlers;
480	set_default_d_op(s, &ecryptfs_dops);
481
482	err = "Reading sb failed";
483	rc = kern_path(fc->source, LOOKUP_FOLLOW | LOOKUP_DIRECTORY, &path);
484	if (rc) {
485		ecryptfs_printk(KERN_WARNING, "kern_path() failed\n");
486		goto out1;
487	}
488	if (path.dentry->d_sb->s_type == &ecryptfs_fs_type) {
489		rc = -EINVAL;
490		printk(KERN_ERR "Mount on filesystem of type "
491			"eCryptfs explicitly disallowed due to "
492			"known incompatibilities\n");
493		goto out_free;
494	}
495
496	if (is_idmapped_mnt(path.mnt)) {
497		rc = -EINVAL;
498		printk(KERN_ERR "Mounting on idmapped mounts currently disallowed\n");
499		goto out_free;
500	}
501
502	if (ctx->check_ruid &&
503	    !uid_eq(d_inode(path.dentry)->i_uid, current_uid())) {
504		rc = -EPERM;
505		printk(KERN_ERR "Mount of device (uid: %d) not owned by "
506		       "requested user (uid: %d)\n",
507			i_uid_read(d_inode(path.dentry)),
508			from_kuid(&init_user_ns, current_uid()));
509		goto out_free;
510	}
511
512	ecryptfs_set_superblock_lower(s, path.dentry->d_sb);
513
514	/**
515	 * Set the POSIX ACL flag based on whether they're enabled in the lower
516	 * mount.
517	 */
518	s->s_flags = fc->sb_flags & ~SB_POSIXACL;
519	s->s_flags |= path.dentry->d_sb->s_flags & SB_POSIXACL;
520
521	/**
522	 * Force a read-only eCryptfs mount when:
523	 *   1) The lower mount is ro
524	 *   2) The ecryptfs_encrypted_view mount option is specified
525	 */
526	if (sb_rdonly(path.dentry->d_sb) || mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
527		s->s_flags |= SB_RDONLY;
528
529	s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
530	s->s_blocksize = path.dentry->d_sb->s_blocksize;
531	s->s_magic = ECRYPTFS_SUPER_MAGIC;
532	s->s_stack_depth = path.dentry->d_sb->s_stack_depth + 1;
533
534	rc = -EINVAL;
535	if (s->s_stack_depth > FILESYSTEM_MAX_STACK_DEPTH) {
536		pr_err("eCryptfs: maximum fs stacking depth exceeded\n");
537		goto out_free;
538	}
539
540	inode = ecryptfs_get_inode(d_inode(path.dentry), s);
541	rc = PTR_ERR(inode);
542	if (IS_ERR(inode))
543		goto out_free;
544
545	s->s_root = d_make_root(inode);
546	if (!s->s_root) {
547		rc = -ENOMEM;
548		goto out_free;
549	}
550
551	ecryptfs_set_dentry_lower(s->s_root, path.dentry);
552	ecryptfs_superblock_to_private(s)->lower_mnt = path.mnt;
553
554	s->s_flags |= SB_ACTIVE;
555	fc->root = dget(s->s_root);
556	return 0;
557
558out_free:
559	path_put(&path);
560out1:
561	deactivate_locked_super(s);
562out:
563	if (sbi)
564		ecryptfs_destroy_mount_crypt_stat(&sbi->mount_crypt_stat);
565
566	printk(KERN_ERR "%s; rc = [%d]\n", err, rc);
567	return rc;
568}
569
570/**
571 * ecryptfs_kill_block_super
572 * @sb: The ecryptfs super block
573 *
574 * Used to bring the superblock down and free the private data.
575 */
576static void ecryptfs_kill_block_super(struct super_block *sb)
577{
578	struct ecryptfs_sb_info *sb_info = ecryptfs_superblock_to_private(sb);
579	kill_anon_super(sb);
580	if (!sb_info)
581		return;
582	mntput(sb_info->lower_mnt);
583	ecryptfs_destroy_mount_crypt_stat(&sb_info->mount_crypt_stat);
584	kmem_cache_free(ecryptfs_sb_info_cache, sb_info);
585}
586
587static void ecryptfs_free_fc(struct fs_context *fc)
588{
589	struct ecryptfs_fs_context *ctx = fc->fs_private;
590	struct ecryptfs_sb_info *sbi = fc->s_fs_info;
591
592	kfree(ctx);
593
594	if (sbi) {
595		ecryptfs_destroy_mount_crypt_stat(&sbi->mount_crypt_stat);
596		kmem_cache_free(ecryptfs_sb_info_cache, sbi);
597	}
598}
599
600static const struct fs_context_operations ecryptfs_context_ops = {
601	.free		= ecryptfs_free_fc,
602	.parse_param	= ecryptfs_parse_param,
603	.get_tree	= ecryptfs_get_tree,
604	.reconfigure	= NULL,
605};
606
607static int ecryptfs_init_fs_context(struct fs_context *fc)
608{
609	struct ecryptfs_fs_context *ctx;
610	struct ecryptfs_sb_info *sbi = NULL;
611
612	ctx = kzalloc(sizeof(struct ecryptfs_fs_context), GFP_KERNEL);
613	if (!ctx)
614		return -ENOMEM;
615	sbi = kmem_cache_zalloc(ecryptfs_sb_info_cache, GFP_KERNEL);
616	if (!sbi) {
617		kfree(ctx);
618		ctx = NULL;
619		return -ENOMEM;
620	}
621
622	ecryptfs_init_mount_crypt_stat(&sbi->mount_crypt_stat);
623
624	fc->fs_private = ctx;
625	fc->s_fs_info = sbi;
626	fc->ops = &ecryptfs_context_ops;
627	return 0;
628}
629
630static struct file_system_type ecryptfs_fs_type = {
631	.owner = THIS_MODULE,
632	.name = "ecryptfs",
633	.init_fs_context = ecryptfs_init_fs_context,
634	.parameters = ecryptfs_fs_param_spec,
635	.kill_sb = ecryptfs_kill_block_super,
636	.fs_flags = 0
637};
638MODULE_ALIAS_FS("ecryptfs");
639
640/*
641 * inode_info_init_once
642 *
643 * Initializes the ecryptfs_inode_info_cache when it is created
644 */
645static void
646inode_info_init_once(void *vptr)
647{
648	struct ecryptfs_inode_info *ei = (struct ecryptfs_inode_info *)vptr;
649
650	inode_init_once(&ei->vfs_inode);
651}
652
653static struct ecryptfs_cache_info {
654	struct kmem_cache **cache;
655	const char *name;
656	size_t size;
657	slab_flags_t flags;
658	void (*ctor)(void *obj);
659} ecryptfs_cache_infos[] = {
660	{
661		.cache = &ecryptfs_auth_tok_list_item_cache,
662		.name = "ecryptfs_auth_tok_list_item",
663		.size = sizeof(struct ecryptfs_auth_tok_list_item),
664	},
665	{
666		.cache = &ecryptfs_file_info_cache,
667		.name = "ecryptfs_file_cache",
668		.size = sizeof(struct ecryptfs_file_info),
669	},
670	{
671		.cache = &ecryptfs_inode_info_cache,
672		.name = "ecryptfs_inode_cache",
673		.size = sizeof(struct ecryptfs_inode_info),
674		.flags = SLAB_ACCOUNT,
675		.ctor = inode_info_init_once,
676	},
677	{
678		.cache = &ecryptfs_sb_info_cache,
679		.name = "ecryptfs_sb_cache",
680		.size = sizeof(struct ecryptfs_sb_info),
681	},
682	{
683		.cache = &ecryptfs_header_cache,
684		.name = "ecryptfs_headers",
685		.size = PAGE_SIZE,
686	},
687	{
688		.cache = &ecryptfs_xattr_cache,
689		.name = "ecryptfs_xattr_cache",
690		.size = PAGE_SIZE,
691	},
692	{
693		.cache = &ecryptfs_key_record_cache,
694		.name = "ecryptfs_key_record_cache",
695		.size = sizeof(struct ecryptfs_key_record),
696	},
697	{
698		.cache = &ecryptfs_key_sig_cache,
699		.name = "ecryptfs_key_sig_cache",
700		.size = sizeof(struct ecryptfs_key_sig),
701	},
702	{
703		.cache = &ecryptfs_global_auth_tok_cache,
704		.name = "ecryptfs_global_auth_tok_cache",
705		.size = sizeof(struct ecryptfs_global_auth_tok),
706	},
707	{
708		.cache = &ecryptfs_key_tfm_cache,
709		.name = "ecryptfs_key_tfm_cache",
710		.size = sizeof(struct ecryptfs_key_tfm),
711	},
712};
713
714static void ecryptfs_free_kmem_caches(void)
715{
716	int i;
717
718	/*
719	 * Make sure all delayed rcu free inodes are flushed before we
720	 * destroy cache.
721	 */
722	rcu_barrier();
723
724	for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) {
725		struct ecryptfs_cache_info *info;
726
727		info = &ecryptfs_cache_infos[i];
728		kmem_cache_destroy(*(info->cache));
729	}
730}
731
732/**
733 * ecryptfs_init_kmem_caches
734 *
735 * Returns zero on success; non-zero otherwise
736 */
737static int ecryptfs_init_kmem_caches(void)
738{
739	int i;
740
741	for (i = 0; i < ARRAY_SIZE(ecryptfs_cache_infos); i++) {
742		struct ecryptfs_cache_info *info;
743
744		info = &ecryptfs_cache_infos[i];
745		*(info->cache) = kmem_cache_create(info->name, info->size, 0,
746				SLAB_HWCACHE_ALIGN | info->flags, info->ctor);
747		if (!*(info->cache)) {
748			ecryptfs_free_kmem_caches();
749			ecryptfs_printk(KERN_WARNING, "%s: "
750					"kmem_cache_create failed\n",
751					info->name);
752			return -ENOMEM;
753		}
754	}
755	return 0;
756}
757
758static struct kobject *ecryptfs_kobj;
759
760static ssize_t version_show(struct kobject *kobj,
761			    struct kobj_attribute *attr, char *buff)
762{
763	return sysfs_emit(buff, "%d\n", ECRYPTFS_VERSIONING_MASK);
764}
765
766static struct kobj_attribute version_attr = __ATTR_RO(version);
767
768static struct attribute *attributes[] = {
769	&version_attr.attr,
770	NULL,
771};
772
773static const struct attribute_group attr_group = {
774	.attrs = attributes,
775};
776
777static int do_sysfs_registration(void)
778{
779	int rc;
780
781	ecryptfs_kobj = kobject_create_and_add("ecryptfs", fs_kobj);
782	if (!ecryptfs_kobj) {
783		printk(KERN_ERR "Unable to create ecryptfs kset\n");
784		rc = -ENOMEM;
785		goto out;
786	}
787	rc = sysfs_create_group(ecryptfs_kobj, &attr_group);
788	if (rc) {
789		printk(KERN_ERR
790		       "Unable to create ecryptfs version attributes\n");
791		kobject_put(ecryptfs_kobj);
792	}
793out:
794	return rc;
795}
796
797static void do_sysfs_unregistration(void)
798{
799	sysfs_remove_group(ecryptfs_kobj, &attr_group);
800	kobject_put(ecryptfs_kobj);
801}
802
803static int __init ecryptfs_init(void)
804{
805	int rc;
806
807	if (ECRYPTFS_DEFAULT_EXTENT_SIZE > PAGE_SIZE) {
808		rc = -EINVAL;
809		ecryptfs_printk(KERN_ERR, "The eCryptfs extent size is "
810				"larger than the host's page size, and so "
811				"eCryptfs cannot run on this system. The "
812				"default eCryptfs extent size is [%u] bytes; "
813				"the page size is [%lu] bytes.\n",
814				ECRYPTFS_DEFAULT_EXTENT_SIZE,
815				(unsigned long)PAGE_SIZE);
816		goto out;
817	}
818	rc = ecryptfs_init_kmem_caches();
819	if (rc) {
820		printk(KERN_ERR
821		       "Failed to allocate one or more kmem_cache objects\n");
822		goto out;
823	}
824	rc = do_sysfs_registration();
825	if (rc) {
826		printk(KERN_ERR "sysfs registration failed\n");
827		goto out_free_kmem_caches;
828	}
829	rc = ecryptfs_init_kthread();
830	if (rc) {
831		printk(KERN_ERR "%s: kthread initialization failed; "
832		       "rc = [%d]\n", __func__, rc);
833		goto out_do_sysfs_unregistration;
834	}
835	rc = ecryptfs_init_messaging();
836	if (rc) {
837		printk(KERN_ERR "Failure occurred while attempting to "
838				"initialize the communications channel to "
839				"ecryptfsd\n");
840		goto out_destroy_kthread;
841	}
842	rc = ecryptfs_init_crypto();
843	if (rc) {
844		printk(KERN_ERR "Failure whilst attempting to init crypto; "
845		       "rc = [%d]\n", rc);
846		goto out_release_messaging;
847	}
848	rc = register_filesystem(&ecryptfs_fs_type);
849	if (rc) {
850		printk(KERN_ERR "Failed to register filesystem\n");
851		goto out_destroy_crypto;
852	}
853	if (ecryptfs_verbosity > 0)
854		printk(KERN_CRIT "eCryptfs verbosity set to %d. Secret values "
855			"will be written to the syslog!\n", ecryptfs_verbosity);
856
857	goto out;
858out_destroy_crypto:
859	ecryptfs_destroy_crypto();
860out_release_messaging:
861	ecryptfs_release_messaging();
862out_destroy_kthread:
863	ecryptfs_destroy_kthread();
864out_do_sysfs_unregistration:
865	do_sysfs_unregistration();
866out_free_kmem_caches:
867	ecryptfs_free_kmem_caches();
868out:
869	return rc;
870}
871
872static void __exit ecryptfs_exit(void)
873{
874	int rc;
875
876	rc = ecryptfs_destroy_crypto();
877	if (rc)
878		printk(KERN_ERR "Failure whilst attempting to destroy crypto; "
879		       "rc = [%d]\n", rc);
880	ecryptfs_release_messaging();
881	ecryptfs_destroy_kthread();
882	do_sysfs_unregistration();
883	unregister_filesystem(&ecryptfs_fs_type);
884	ecryptfs_free_kmem_caches();
885}
886
887MODULE_AUTHOR("Michael A. Halcrow <mhalcrow@us.ibm.com>");
888MODULE_DESCRIPTION("eCryptfs");
889
890MODULE_LICENSE("GPL");
891
892module_init(ecryptfs_init)
893module_exit(ecryptfs_exit)