cregit-Linux how code gets into the kernel

Release 4.10 fs/crypto/policy.c

Directory: fs/crypto
 * Encryption policy functions for per-file encryption support.
 * Copyright (C) 2015, Google, Inc.
 * Copyright (C) 2015, Motorola Mobility.
 * Written by Michael Halcrow, 2015.
 * Modified by Jaegeuk Kim, 2015.

#include <linux/random.h>
#include <linux/string.h>
#include <linux/mount.h>
#include "fscrypt_private.h"

static int inode_has_encryption_context(struct inode *inode) { if (!inode->i_sb->s_cop->get_context) return 0; return (inode->i_sb->s_cop->get_context(inode, NULL, 0L) > 0); }


jaegeuk kimjaegeuk kim45100.00%2100.00%

/* * check whether the policy is consistent with the encryption context * for the inode */
static int is_encryption_context_consistent_with_policy(struct inode *inode, const struct fscrypt_policy *policy) { struct fscrypt_context ctx; int res; if (!inode->i_sb->s_cop->get_context) return 0; res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx)); if (res != sizeof(ctx)) return 0; return (memcmp(ctx.master_key_descriptor, policy->master_key_descriptor, FS_KEY_DESCRIPTOR_SIZE) == 0 && (ctx.flags == policy->flags) && (ctx.contents_encryption_mode == policy->contents_encryption_mode) && (ctx.filenames_encryption_mode == policy->filenames_encryption_mode)); }


jaegeuk kimjaegeuk kim119100.00%2100.00%

static int create_encryption_context_from_policy(struct inode *inode, const struct fscrypt_policy *policy) { struct fscrypt_context ctx; int res; if (!inode->i_sb->s_cop->set_context) return -EOPNOTSUPP; if (inode->i_sb->s_cop->prepare_context) { res = inode->i_sb->s_cop->prepare_context(inode); if (res) return res; } ctx.format = FS_ENCRYPTION_CONTEXT_FORMAT_V1; memcpy(ctx.master_key_descriptor, policy->master_key_descriptor, FS_KEY_DESCRIPTOR_SIZE); if (!fscrypt_valid_contents_enc_mode( policy->contents_encryption_mode)) { printk(KERN_WARNING "%s: Invalid contents encryption mode %d\n", __func__, policy->contents_encryption_mode); return -EINVAL; } if (!fscrypt_valid_filenames_enc_mode( policy->filenames_encryption_mode)) { printk(KERN_WARNING "%s: Invalid filenames encryption mode %d\n", __func__, policy->filenames_encryption_mode); return -EINVAL; } if (policy->flags & ~FS_POLICY_FLAGS_VALID) return -EINVAL; ctx.contents_encryption_mode = policy->contents_encryption_mode; ctx.filenames_encryption_mode = policy->filenames_encryption_mode; ctx.flags = policy->flags; BUILD_BUG_ON(sizeof(ctx.nonce) != FS_KEY_DERIVATION_NONCE_SIZE); get_random_bytes(ctx.nonce, FS_KEY_DERIVATION_NONCE_SIZE); return inode->i_sb->s_cop->set_context(inode, &ctx, sizeof(ctx), NULL); }


jaegeuk kimjaegeuk kim226100.00%2100.00%

int fscrypt_ioctl_set_policy(struct file *filp, const void __user *arg) { struct fscrypt_policy policy; struct inode *inode = file_inode(filp); int ret; if (copy_from_user(&policy, arg, sizeof(policy))) return -EFAULT; if (!inode_owner_or_capable(inode)) return -EACCES; if (policy.version != 0) return -EINVAL; ret = mnt_want_write_file(filp); if (ret) return ret; inode_lock(inode); if (!inode_has_encryption_context(inode)) { if (!S_ISDIR(inode->i_mode)) ret = -EINVAL; else if (!inode->i_sb->s_cop->empty_dir) ret = -EOPNOTSUPP; else if (!inode->i_sb->s_cop->empty_dir(inode)) ret = -ENOTEMPTY; else ret = create_encryption_context_from_policy(inode, &policy); } else if (!is_encryption_context_consistent_with_policy(inode, &policy)) { printk(KERN_WARNING "%s: Policy inconsistent with encryption context\n", __func__); ret = -EINVAL; } inode_unlock(inode); mnt_drop_write_file(filp); return ret; }


eric biggerseric biggers12258.65%562.50%
jaegeuk kimjaegeuk kim7937.98%225.00%
chao yuchao yu73.37%112.50%

int fscrypt_ioctl_get_policy(struct file *filp, void __user *arg) { struct inode *inode = file_inode(filp); struct fscrypt_context ctx; struct fscrypt_policy policy; int res; if (!inode->i_sb->s_cop->get_context || !inode->i_sb->s_cop->is_encrypted(inode)) return -ENODATA; res = inode->i_sb->s_cop->get_context(inode, &ctx, sizeof(ctx)); if (res != sizeof(ctx)) return -ENODATA; if (ctx.format != FS_ENCRYPTION_CONTEXT_FORMAT_V1) return -EINVAL; policy.version = 0; policy.contents_encryption_mode = ctx.contents_encryption_mode; policy.filenames_encryption_mode = ctx.filenames_encryption_mode; policy.flags = ctx.flags; memcpy(policy.master_key_descriptor, ctx.master_key_descriptor, FS_KEY_DESCRIPTOR_SIZE); if (copy_to_user(arg, &policy, sizeof(policy))) return -EFAULT; return 0; }


jaegeuk kimjaegeuk kim13074.71%266.67%
eric biggerseric biggers4425.29%133.33%

int fscrypt_has_permitted_context(struct inode *parent, struct inode *child) { struct fscrypt_info *parent_ci, *child_ci; int res; if ((parent == NULL) || (child == NULL)) { printk(KERN_ERR "parent %p child %p\n", parent, child); BUG_ON(1); } /* No restrictions on file types which are never encrypted */ if (!S_ISREG(child->i_mode) && !S_ISDIR(child->i_mode) && !S_ISLNK(child->i_mode)) return 1; /* no restrictions if the parent directory is not encrypted */ if (!parent->i_sb->s_cop->is_encrypted(parent)) return 1; /* if the child directory is not encrypted, this is always a problem */ if (!parent->i_sb->s_cop->is_encrypted(child)) return 0; res = fscrypt_get_encryption_info(parent); if (res) return 0; res = fscrypt_get_encryption_info(child); if (res) return 0; parent_ci = parent->i_crypt_info; child_ci = child->i_crypt_info; if (!parent_ci && !child_ci) return 1; if (!parent_ci || !child_ci) return 0; return (memcmp(parent_ci->ci_master_key, child_ci->ci_master_key, FS_KEY_DESCRIPTOR_SIZE) == 0 && (parent_ci->ci_data_mode == child_ci->ci_data_mode) && (parent_ci->ci_filename_mode == child_ci->ci_filename_mode) && (parent_ci->ci_flags == child_ci->ci_flags)); }


jaegeuk kimjaegeuk kim20387.12%266.67%
eric biggerseric biggers3012.88%133.33%

EXPORT_SYMBOL(fscrypt_has_permitted_context); /** * fscrypt_inherit_context() - Sets a child context from its parent * @parent: Parent inode from which the context is inherited. * @child: Child inode that inherits the context from @parent. * @fs_data: private data given by FS. * @preload: preload child i_crypt_info * * Return: Zero on success, non-zero otherwise */
int fscrypt_inherit_context(struct inode *parent, struct inode *child, void *fs_data, bool preload) { struct fscrypt_context ctx; struct fscrypt_info *ci; int res; if (!parent->i_sb->s_cop->set_context) return -EOPNOTSUPP; res = fscrypt_get_encryption_info(parent); if (res < 0) return res; ci = parent->i_crypt_info; if (ci == NULL) return -ENOKEY; ctx.format = FS_ENCRYPTION_CONTEXT_FORMAT_V1; if (fscrypt_dummy_context_enabled(parent)) { ctx.contents_encryption_mode = FS_ENCRYPTION_MODE_AES_256_XTS; ctx.filenames_encryption_mode = FS_ENCRYPTION_MODE_AES_256_CTS; ctx.flags = 0; memset(ctx.master_key_descriptor, 0x42, FS_KEY_DESCRIPTOR_SIZE); res = 0; } else { ctx.contents_encryption_mode = ci->ci_data_mode; ctx.filenames_encryption_mode = ci->ci_filename_mode; ctx.flags = ci->ci_flags; memcpy(ctx.master_key_descriptor, ci->ci_master_key, FS_KEY_DESCRIPTOR_SIZE); } get_random_bytes(ctx.nonce, FS_KEY_DERIVATION_NONCE_SIZE); res = parent->i_sb->s_cop->set_context(child, &ctx, sizeof(ctx), fs_data); if (res) return res; return preload ? fscrypt_get_encryption_info(child): 0; }


jaegeuk kimjaegeuk kim21196.79%266.67%
chao yuchao yu73.21%133.33%


Overall Contributors

jaegeuk kimjaegeuk kim104282.83%218.18%
eric biggerseric biggers20015.90%654.55%
chao yuchao yu141.11%218.18%
theodore tsotheodore tso20.16%19.09%
Directory: fs/crypto
Information contained on this website is for historical information purposes only and does not indicate or represent copyright ownership.