Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 43f70c96 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'ecryptfs-4.17-rc2-fixes' of... 

Merge tag 'ecryptfs-4.17-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs

Pull eCryptfs fixes from Tyler Hicks:
 "Minor cleanups and a bug fix to completely ignore unencrypted
  filenames in the lower filesystem when filename encryption is enabled
  at the eCryptfs layer"

* tag 'ecryptfs-4.17-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tyhicks/ecryptfs:
  eCryptfs: don't pass up plaintext names when using filename encryption
  ecryptfs: fix spelling mistake: "cadidate" -> "candidate"
  ecryptfs: lookup: Don't check if mount_crypt_stat is NULL
parents 0d9cf33b e86281e7

fs/ecryptfs/crypto.c

+28 −13
Original line number Diff line number Diff line
@@ -1997,6 +1997,16 @@ int ecryptfs_encrypt_and_encode_filename( 
	return rc;

}



static bool is_dot_dotdot(const char *name, size_t name_size)

{

	if (name_size == 1 && name[0] == '.')

		return true;

	else if (name_size == 2 && name[0] == '.' && name[1] == '.')

		return true;



	return false;

}



/**

 * ecryptfs_decode_and_decrypt_filename - converts the encoded cipher text name to decoded plaintext

 * @plaintext_name: The plaintext name
@@ -2021,13 +2031,21 @@ int ecryptfs_decode_and_decrypt_filename(char **plaintext_name, 
	size_t packet_size;

	int rc = 0;



	if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)

	    && !(mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)

	    && (name_size > ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE)

	    && (strncmp(name, ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX,

			ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE) == 0)) {

		const char *orig_name = name;

		size_t orig_name_size = name_size;

	if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) &&

	    !(mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)) {

		if (is_dot_dotdot(name, name_size)) {

			rc = ecryptfs_copy_filename(plaintext_name,

						    plaintext_name_size,

						    name, name_size);

			goto out;

		}



		if (name_size <= ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE ||

		    strncmp(name, ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX,

			    ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE)) {

			rc = -EINVAL;

			goto out;

		}



		name += ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE;

		name_size -= ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE;
@@ -2047,12 +2065,9 @@ int ecryptfs_decode_and_decrypt_filename(char **plaintext_name, 
						  decoded_name,

						  decoded_name_size);

		if (rc) {

			printk(KERN_INFO "%s: Could not parse tag 70 packet "

			       "from filename; copying through filename "

			       "as-is\n", __func__);

			rc = ecryptfs_copy_filename(plaintext_name,

						    plaintext_name_size,

						    orig_name, orig_name_size);

			ecryptfs_printk(KERN_DEBUG,

					"%s: Could not parse tag 70 packet from filename\n",

					__func__);

			goto out_free;

		}

	} else {

fs/ecryptfs/file.c

+16 −5
Original line number Diff line number Diff line
@@ -82,17 +82,28 @@ ecryptfs_filldir(struct dir_context *ctx, const char *lower_name, 
						  buf->sb, lower_name,

						  lower_namelen);

	if (rc) {

		printk(KERN_ERR "%s: Error attempting to decode and decrypt "

		       "filename [%s]; rc = [%d]\n", __func__, lower_name,

		       rc);

		goto out;

		if (rc != -EINVAL) {

			ecryptfs_printk(KERN_DEBUG,

					"%s: Error attempting to decode and decrypt filename [%s]; rc = [%d]\n",

					__func__, lower_name, rc);

			return rc;

		}



		/* Mask -EINVAL errors as these are most likely due a plaintext

		 * filename present in the lower filesystem despite filename

		 * encryption being enabled. One unavoidable example would be

		 * the "lost+found" dentry in the root directory of an Ext4

		 * filesystem.

		 */

		return 0;

	}



	buf->caller->pos = buf->ctx.pos;

	rc = !dir_emit(buf->caller, name, name_size, ino, d_type);

	kfree(name);

	if (!rc)

		buf->entries_written++;

out:



	return rc;

}

fs/ecryptfs/inode.c

+1 −2
Original line number Diff line number Diff line
@@ -395,8 +395,7 @@ static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode, 


	mount_crypt_stat = &ecryptfs_superblock_to_private(

				ecryptfs_dentry->d_sb)->mount_crypt_stat;

	if (mount_crypt_stat

	    && (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)) {

	if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {

		rc = ecryptfs_encrypt_and_encode_filename(

			&encrypted_and_encoded_name, &len,

			mount_crypt_stat, name, len);

fs/ecryptfs/keystore.c

+1 −1
Original line number Diff line number Diff line
@@ -1880,7 +1880,7 @@ int ecryptfs_parse_packet_set(struct ecryptfs_crypt_stat *crypt_stat, 
		candidate_auth_tok = &auth_tok_list_item->auth_tok;

		if (unlikely(ecryptfs_verbosity > 0)) {

			ecryptfs_printk(KERN_DEBUG,

					"Considering cadidate auth tok:\n");

					"Considering candidate auth tok:\n");

			ecryptfs_dump_auth_tok(candidate_auth_tok);

		}

		rc = ecryptfs_get_auth_tok_sig(&candidate_auth_tok_sig,