| Message ID | 5d9a09398c5432545db73d8f91d6b63cbfd0ee6f.1691505830.git.sweettea-kernel@dorminy.me (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | fscrypt: preliminary rearrangmeents of key setup | expand |
On Tue, Aug 08, 2023 at 01:08:02PM -0400, Sweet Tea Dorminy wrote: > At present, setup_file_encryption_key() does several things: it finds > and locks the master key, and then calls into the appropriate functions > to setup the prepared key for the fscrypt_info. The code is clearer to > follow if these functions are divided. > > Thus, move calling the appropriate file key setup function into a new > fscrypt_setup_file_key() function. After the file key setup functions > are moved, the remaining function can take a const fscrypt_info, and is > renamed find_and_lock_master_key() to precisely describe its action. > > Signed-off-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me> > --- > fs/crypto/keysetup.c | 77 ++++++++++++++++++++++++++++++-------------- > 1 file changed, 52 insertions(+), 25 deletions(-) > > diff --git a/fs/crypto/keysetup.c b/fs/crypto/keysetup.c > index b89c32ad19fb..727d473b6b03 100644 > --- a/fs/crypto/keysetup.c > +++ b/fs/crypto/keysetup.c > @@ -386,6 +386,43 @@ static int fscrypt_setup_v2_file_key(struct fscrypt_info *ci, > return 0; > } > > +/* > + * Find or create the appropriate prepared key for an info. > + */ > +static int fscrypt_setup_file_key(struct fscrypt_info *ci, > + struct fscrypt_master_key *mk, > + bool need_dirhash_key) > +{ > + int err; > + > + if (!mk) { > + if (ci->ci_policy.version != FSCRYPT_POLICY_V1) > + return -ENOKEY; > + > + /* > + * As a legacy fallback for v1 policies, search for the key in > + * the current task's subscribed keyrings too. Don't move this > + * to before the search of ->s_master_keys, since users > + * shouldn't be able to override filesystem-level keys. > + */ > + return fscrypt_setup_v1_file_key_via_subscribed_keyrings(ci); > + } > + > + switch (ci->ci_policy.version) { > + case FSCRYPT_POLICY_V1: > + err = fscrypt_setup_v1_file_key(ci, mk->mk_secret.raw); > + break; > + case FSCRYPT_POLICY_V2: > + err = fscrypt_setup_v2_file_key(ci, mk, need_dirhash_key); > + break; > + default: > + WARN_ON_ONCE(1); > + err = -EINVAL; > + break; > + } > + return err; > +} > + > /* > * Check whether the size of the given master key (@mk) is appropriate for the > * encryption settings which a particular file will use (@ci). > @@ -426,7 +463,7 @@ static bool fscrypt_valid_master_key_size(const struct fscrypt_master_key *mk, > } > > /* > - * Find the master key, then set up the inode's actual encryption key. > + * Find and lock the master key. > * > * If the master key is found in the filesystem-level keyring, then it is > * returned in *mk_ret with its semaphore read-locked. This is needed to ensure > @@ -434,9 +471,8 @@ static bool fscrypt_valid_master_key_size(const struct fscrypt_master_key *mk, > * multiple tasks may race to create an fscrypt_info for the same inode), and to > * synchronize the master key being removed with a new inode starting to use it. > */ > -static int setup_file_encryption_key(struct fscrypt_info *ci, > - bool need_dirhash_key, > - struct fscrypt_master_key **mk_ret) > +static int find_and_lock_master_key(const struct fscrypt_info *ci, > + struct fscrypt_master_key **mk_ret) > { > struct super_block *sb = ci->ci_inode->i_sb; > struct fscrypt_key_specifier mk_spec; > @@ -466,17 +502,19 @@ static int setup_file_encryption_key(struct fscrypt_info *ci, > mk = fscrypt_find_master_key(sb, &mk_spec); > } > } > + Random newline, you can add Reviewed-by: Josef Bacik <josef@toxicpanda.com> once you fix it up. Thanks, Josef
On Tue, Aug 08, 2023 at 01:08:02PM -0400, Sweet Tea Dorminy wrote: > +/* > + * Find or create the appropriate prepared key for an info. > + */ > +static int fscrypt_setup_file_key(struct fscrypt_info *ci, > + struct fscrypt_master_key *mk, > + bool need_dirhash_key) > +{ > + int err; > + > + if (!mk) { > + if (ci->ci_policy.version != FSCRYPT_POLICY_V1) > + return -ENOKEY; > + > + /* > + * As a legacy fallback for v1 policies, search for the key in > + * the current task's subscribed keyrings too. Don't move this > + * to before the search of ->s_master_keys, since users > + * shouldn't be able to override filesystem-level keys. > + */ > + return fscrypt_setup_v1_file_key_via_subscribed_keyrings(ci); > + } > + > + switch (ci->ci_policy.version) { > + case FSCRYPT_POLICY_V1: > + err = fscrypt_setup_v1_file_key(ci, mk->mk_secret.raw); > + break; > + case FSCRYPT_POLICY_V2: > + err = fscrypt_setup_v2_file_key(ci, mk, need_dirhash_key); > + break; > + default: > + WARN_ON_ONCE(1); > + err = -EINVAL; > + break; > + } > + return err; > +} 'err' is not needed. The switch statement should look like: switch (ci->ci_policy.version) { case FSCRYPT_POLICY_V1: return fscrypt_setup_v1_file_key(ci, mk->mk_secret.raw); case FSCRYPT_POLICY_V2: return fscrypt_setup_v2_file_key(ci, mk, need_dirhash_key); default: WARN_ON_ONCE(1); return -EINVAL; } > /* > - * Find the master key, then set up the inode's actual encryption key. > + * Find and lock the master key. > * > * If the master key is found in the filesystem-level keyring, then it is > * returned in *mk_ret with its semaphore read-locked. This is needed to ensure > @@ -434,9 +471,8 @@ static bool fscrypt_valid_master_key_size(const struct fscrypt_master_key *mk, > * multiple tasks may race to create an fscrypt_info for the same inode), and to > * synchronize the master key being removed with a new inode starting to use it. > */ > -static int setup_file_encryption_key(struct fscrypt_info *ci, > - bool need_dirhash_key, > - struct fscrypt_master_key **mk_ret) > +static int find_and_lock_master_key(const struct fscrypt_info *ci, > + struct fscrypt_master_key **mk_ret) I think it would be a bit cleaner if this returned 'struct fscrypt_master_key *'. Use NULL for not found, ERR_PTR() for errors. > { > struct super_block *sb = ci->ci_inode->i_sb; > struct fscrypt_key_specifier mk_spec; > @@ -466,17 +502,19 @@ static int setup_file_encryption_key(struct fscrypt_info *ci, > mk = fscrypt_find_master_key(sb, &mk_spec); > } > } > + > if (unlikely(!mk)) { > if (ci->ci_policy.version != FSCRYPT_POLICY_V1) > return -ENOKEY; > > /* > - * As a legacy fallback for v1 policies, search for the key in > - * the current task's subscribed keyrings too. Don't move this > - * to before the search of ->s_master_keys, since users > - * shouldn't be able to override filesystem-level keys. > + * This might be the case of a v1 policy using a process > + * subscribed keyring to get the key, so there may not be > + * a relevant master key. > */ > - return fscrypt_setup_v1_file_key_via_subscribed_keyrings(ci); > + > + *mk_ret = NULL; > + return 0; > } 'ci->ci_policy.version != FSCRYPT_POLICY_V1' is duplicated with fscrypt_setup_file_key(). The problem is really that this patch makes the handling of "master key not found" happen in two different places. I think find_and_lock_master_key() should just return NULL for the master key when it's not found. Then fscrypt_setup_file_key() decides what to do about it. Also, the comment for find_and_lock_master_key() needs to be updated. The last sentence in particular is not necessary anymore. I think your refactoring fixes the reason why that explanation was needed in the first place. With my suggestion to return a pointer, I think a good comment would be: /* * Find the master key for ci_policy in the filesystem-level keyring. Returns * the read-locked key if found, NULL if not found, or an ERR_PTR on error. The * caller is responsible for unlocking and putting the key if found. */ - Eric
diff --git a/fs/crypto/keysetup.c b/fs/crypto/keysetup.c index b89c32ad19fb..727d473b6b03 100644 --- a/fs/crypto/keysetup.c +++ b/fs/crypto/keysetup.c @@ -386,6 +386,43 @@ static int fscrypt_setup_v2_file_key(struct fscrypt_info *ci, return 0; } +/* + * Find or create the appropriate prepared key for an info. + */ +static int fscrypt_setup_file_key(struct fscrypt_info *ci, + struct fscrypt_master_key *mk, + bool need_dirhash_key) +{ + int err; + + if (!mk) { + if (ci->ci_policy.version != FSCRYPT_POLICY_V1) + return -ENOKEY; + + /* + * As a legacy fallback for v1 policies, search for the key in + * the current task's subscribed keyrings too. Don't move this + * to before the search of ->s_master_keys, since users + * shouldn't be able to override filesystem-level keys. + */ + return fscrypt_setup_v1_file_key_via_subscribed_keyrings(ci); + } + + switch (ci->ci_policy.version) { + case FSCRYPT_POLICY_V1: + err = fscrypt_setup_v1_file_key(ci, mk->mk_secret.raw); + break; + case FSCRYPT_POLICY_V2: + err = fscrypt_setup_v2_file_key(ci, mk, need_dirhash_key); + break; + default: + WARN_ON_ONCE(1); + err = -EINVAL; + break; + } + return err; +} + /* * Check whether the size of the given master key (@mk) is appropriate for the * encryption settings which a particular file will use (@ci). @@ -426,7 +463,7 @@ static bool fscrypt_valid_master_key_size(const struct fscrypt_master_key *mk, } /* - * Find the master key, then set up the inode's actual encryption key. + * Find and lock the master key. * * If the master key is found in the filesystem-level keyring, then it is * returned in *mk_ret with its semaphore read-locked. This is needed to ensure @@ -434,9 +471,8 @@ static bool fscrypt_valid_master_key_size(const struct fscrypt_master_key *mk, * multiple tasks may race to create an fscrypt_info for the same inode), and to * synchronize the master key being removed with a new inode starting to use it. */ -static int setup_file_encryption_key(struct fscrypt_info *ci, - bool need_dirhash_key, - struct fscrypt_master_key **mk_ret) +static int find_and_lock_master_key(const struct fscrypt_info *ci, + struct fscrypt_master_key **mk_ret) { struct super_block *sb = ci->ci_inode->i_sb; struct fscrypt_key_specifier mk_spec; @@ -466,17 +502,19 @@ static int setup_file_encryption_key(struct fscrypt_info *ci, mk = fscrypt_find_master_key(sb, &mk_spec); } } + if (unlikely(!mk)) { if (ci->ci_policy.version != FSCRYPT_POLICY_V1) return -ENOKEY; /* - * As a legacy fallback for v1 policies, search for the key in - * the current task's subscribed keyrings too. Don't move this - * to before the search of ->s_master_keys, since users - * shouldn't be able to override filesystem-level keys. + * This might be the case of a v1 policy using a process + * subscribed keyring to get the key, so there may not be + * a relevant master key. */ - return fscrypt_setup_v1_file_key_via_subscribed_keyrings(ci); + + *mk_ret = NULL; + return 0; } down_read(&mk->mk_sem); @@ -491,21 +529,6 @@ static int setup_file_encryption_key(struct fscrypt_info *ci, goto out_release_key; } - switch (ci->ci_policy.version) { - case FSCRYPT_POLICY_V1: - err = fscrypt_setup_v1_file_key(ci, mk->mk_secret.raw); - break; - case FSCRYPT_POLICY_V2: - err = fscrypt_setup_v2_file_key(ci, mk, need_dirhash_key); - break; - default: - WARN_ON_ONCE(1); - err = -EINVAL; - break; - } - if (err) - goto out_release_key; - *mk_ret = mk; return 0; @@ -580,7 +603,11 @@ fscrypt_setup_encryption_info(struct inode *inode, if (res) goto out; - res = setup_file_encryption_key(crypt_info, need_dirhash_key, &mk); + res = find_and_lock_master_key(crypt_info, &mk); + if (res) + goto out; + + res = fscrypt_setup_file_key(crypt_info, mk, need_dirhash_key); if (res) goto out;
At present, setup_file_encryption_key() does several things: it finds and locks the master key, and then calls into the appropriate functions to setup the prepared key for the fscrypt_info. The code is clearer to follow if these functions are divided. Thus, move calling the appropriate file key setup function into a new fscrypt_setup_file_key() function. After the file key setup functions are moved, the remaining function can take a const fscrypt_info, and is renamed find_and_lock_master_key() to precisely describe its action. Signed-off-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me> --- fs/crypto/keysetup.c | 77 ++++++++++++++++++++++++++++++-------------- 1 file changed, 52 insertions(+), 25 deletions(-)