Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dddfa461 authored by Michael Halcrow's avatar Michael Halcrow Committed by Linus Torvalds
Browse files

[PATCH] eCryptfs: Public key; packet management 



Public key support code.  This reads and writes packets in the header that
contain public key encrypted file keys.  It calls the messaging code in the
previous patch to send and receive encryption and decryption request
packets from the userspace daemon.

[akpm@osdl.org: cleab fix]
Signed-off-by: default avatarMichael Halcrow <mhalcrow@us.ibm.com>
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 88b4a07e

fs/ecryptfs/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -4,4 +4,4 @@ 


obj-$(CONFIG_ECRYPT_FS) += ecryptfs.o



ecryptfs-objs := dentry.o file.o inode.o main.o super.o mmap.o crypto.o keystore.o debug.o
 
ecryptfs-objs := dentry.o file.o inode.o main.o super.o mmap.o crypto.o keystore.o messaging.o netlink.o debug.o

fs/ecryptfs/ecryptfs_kernel.h

+5 −2
Original line number Diff line number Diff line
@@ -33,6 +33,7 @@ 
#include <linux/fs_stack.h>

#include <linux/namei.h>

#include <linux/scatterlist.h>

#include <linux/hash.h>



/* Version verification for shared data structures w/ userspace */

#define ECRYPTFS_VERSION_MAJOR 0x00
@@ -47,7 +48,8 @@ 
#define ECRYPTFS_VERSIONING_PLAINTEXT_PASSTHROUGH 0x00000004

#define ECRYPTFS_VERSIONING_POLICY 0x00000008

#define ECRYPTFS_VERSIONING_MASK (ECRYPTFS_VERSIONING_PASSPHRASE \

                                  | ECRYPTFS_VERSIONING_PLAINTEXT_PASSTHROUGH)

                                  | ECRYPTFS_VERSIONING_PLAINTEXT_PASSTHROUGH \

                                  | ECRYPTFS_VERSIONING_PUBKEY)



#define ECRYPTFS_MAX_PASSWORD_LENGTH 64

#define ECRYPTFS_MAX_PASSPHRASE_BYTES ECRYPTFS_MAX_PASSWORD_LENGTH
@@ -558,7 +560,8 @@ int ecryptfs_close_lower_file(struct file *lower_file); 


int ecryptfs_process_helo(unsigned int transport, uid_t uid, pid_t pid);

int ecryptfs_process_quit(uid_t uid, pid_t pid);

int ecryptfs_process_response(struct ecryptfs_message *msg, pid_t pid, u32 seq);

int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t uid,

			      pid_t pid, u32 seq);

int ecryptfs_send_message(unsigned int transport, char *data, int data_len,

			  struct ecryptfs_msg_ctx **msg_ctx);

int ecryptfs_wait_for_response(struct ecryptfs_msg_ctx *msg_ctx,

fs/ecryptfs/keystore.c

+712 −72

File changed.

Preview size limit exceeded, changes collapsed.

fs/ecryptfs/main.c

+47 −2
Original line number Diff line number Diff line
@@ -6,6 +6,7 @@ 
 * Copyright (C) 2004-2006 International Business Machines Corp.

 *   Author(s): Michael A. Halcrow <mahalcro@us.ibm.com>

 *              Michael C. Thompson <mcthomps@us.ibm.com>

 *              Tyler Hicks <tyhicks@ou.edu>

 *

 * This program is free software; you can redistribute it and/or

 * modify it under the terms of the GNU General Public License as
@@ -48,6 +49,43 @@ MODULE_PARM_DESC(ecryptfs_verbosity, 
		 "Initial verbosity level (0 or 1; defaults to "

		 "0, which is Quiet)");



/**

 * Module parameter that defines the number of netlink message buffer

 * elements

 */

unsigned int ecryptfs_message_buf_len = ECRYPTFS_DEFAULT_MSG_CTX_ELEMS;



module_param(ecryptfs_message_buf_len, uint, 0);

MODULE_PARM_DESC(ecryptfs_message_buf_len,

		 "Number of message buffer elements");



/**

 * Module parameter that defines the maximum guaranteed amount of time to wait

 * for a response through netlink.  The actual sleep time will be, more than

 * likely, a small amount greater than this specified value, but only less if

 * the netlink message successfully arrives.

 */

signed long ecryptfs_message_wait_timeout = ECRYPTFS_MAX_MSG_CTX_TTL / HZ;



module_param(ecryptfs_message_wait_timeout, long, 0);

MODULE_PARM_DESC(ecryptfs_message_wait_timeout,

		 "Maximum number of seconds that an operation will "

		 "sleep while waiting for a message response from "

		 "userspace");



/**

 * Module parameter that is an estimate of the maximum number of users

 * that will be concurrently using eCryptfs. Set this to the right

 * value to balance performance and memory use.

 */

unsigned int ecryptfs_number_of_users = ECRYPTFS_DEFAULT_NUM_USERS;



module_param(ecryptfs_number_of_users, uint, 0);

MODULE_PARM_DESC(ecryptfs_number_of_users, "An estimate of the number of "

		 "concurrent users of eCryptfs");



unsigned int ecryptfs_transport = ECRYPTFS_DEFAULT_TRANSPORT;



void __ecryptfs_printk(const char *fmt, ...)

{

	va_list args;
@@ -347,9 +385,10 @@ static int ecryptfs_parse_options(struct super_block *sb, char *options) 
		rc = -EINVAL;

		goto out;

	}

	if (auth_tok->token_type != ECRYPTFS_PASSWORD) {

	if (auth_tok->token_type != ECRYPTFS_PASSWORD

	    && auth_tok->token_type != ECRYPTFS_PRIVATE_KEY) {

		ecryptfs_printk(KERN_ERR, "Invalid auth_tok structure "

				"returned from key\n");

				"returned from key query\n");

		rc = -EINVAL;

		goto out;

	}
@@ -794,6 +833,11 @@ static int __init ecryptfs_init(void) 
		ecryptfs_free_kmem_caches();

		goto out;

	}

	rc = ecryptfs_init_messaging(ecryptfs_transport);

	if (rc) {

		ecryptfs_printk(KERN_ERR, "Failure occured while attempting to "

				"initialize the eCryptfs netlink socket\n");

	}

out:

	return rc;

}
@@ -805,6 +849,7 @@ static void __exit ecryptfs_exit(void) 
	sysfs_remove_file(&ecryptfs_subsys.kset.kobj,

			  &sysfs_attr_version_str.attr);

	subsystem_unregister(&ecryptfs_subsys);

	ecryptfs_release_messaging(ecryptfs_transport);

	unregister_filesystem(&ecryptfs_fs_type);

	ecryptfs_free_kmem_caches();

}

fs/ecryptfs/messaging.c

+9 −1
Original line number Diff line number Diff line
@@ -243,7 +243,8 @@ int ecryptfs_process_quit(uid_t uid, pid_t pid) 
 * userspace. Returns zero upon delivery to desired context element;

 * non-zero upon delivery failure or error.

 */

int ecryptfs_process_response(struct ecryptfs_message *msg, pid_t pid, u32 seq)

int ecryptfs_process_response(struct ecryptfs_message *msg, uid_t uid,

			      pid_t pid, u32 seq)

{

	struct ecryptfs_daemon_id *id;

	struct ecryptfs_msg_ctx *msg_ctx;
@@ -268,6 +269,13 @@ int ecryptfs_process_response(struct ecryptfs_message *msg, pid_t pid, u32 seq) 
				msg_ctx->task->euid, pid);

		goto wake_up;

	}

	if (msg_ctx->task->euid != uid) {

		rc = -EBADMSG;

		ecryptfs_printk(KERN_WARNING, "Received message from user "

				"[%d]; expected message from user [%d]\n",

				uid, msg_ctx->task->euid);

		goto unlock;

	}

	if (id->pid != pid) {

		rc = -EBADMSG;

		ecryptfs_printk(KERN_ERR, "User [%d] received a "