From patchwork Sun Apr 3 05:22:03 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Biggers X-Patchwork-Id: 8732951 Return-Path: X-Original-To: patchwork-linux-fsdevel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 4541AC0553 for ; Sun, 3 Apr 2016 05:25:44 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 697AD20251 for ; Sun, 3 Apr 2016 05:25:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7C0142022D for ; Sun, 3 Apr 2016 05:25:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752337AbcDCFZ0 (ORCPT ); Sun, 3 Apr 2016 01:25:26 -0400 Received: from mail-ig0-f196.google.com ([209.85.213.196]:35608 "EHLO mail-ig0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752435AbcDCFXr (ORCPT ); Sun, 3 Apr 2016 01:23:47 -0400 Received: by mail-ig0-f196.google.com with SMTP id ya17so7659315igc.2; Sat, 02 Apr 2016 22:23:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=sg2PUiq7egWeLUL7bXACDTQNR1RoCFJbSkhC8arUYOk=; b=UYfNS2wy3l0lU7y1CefMJxGxqRiaGltDG1NH0zYeZyKwO4d4fmnbsR39hnj4sCQe1w difHQRr8xG06d5vZAWeStO8OH6aneqjYjB9xCBuxzuLEmEJtQ3W3IQO7OmJQjJ8CsMSQ rwB+YDWHtufn2B6v5Hw0xEOj89tJIhePGI94bNqqDnowpFK5QnexqcByyvu43IzOsUYD f9nj7LJt/g3wPS/0A3I1oFi7KCrl+KluPyWdrmOWP5D2nCLTzpvLm1DBhVW/LAByHjCj S2rJRDh14enQu7ExParv9AM/lMBjLr8q+0d4+6hsK12KINSRvFmCgC9A1WRW3sy8ajC9 Ay5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=sg2PUiq7egWeLUL7bXACDTQNR1RoCFJbSkhC8arUYOk=; b=TA3zVtwi1ZjE1J1BQfZUIBp93tXCHLNlWy1hZxLg7c/3sfGf4pV3/vYcBqRPZax9KR HHb6Z0hwynqg3OV7ucvPHAKDqd/5F6WBqabWushMZfE7pfmhDjOpKGusXgwQ6Uo/Hjqp NCxeKZJ5/VsooUCmuPuh5rDoqdYqTDsoYqhViWzmKxqAXOXPfT/8a8z86yLCOqKeDY9G yRU/Lnntk8WO+ayijHuROD5iRJ1DLWULch66vjNPN7XRVGMraqpIGUEdP1+KrC4KByos NDkM0WVKyroYmJA+s7w8hETPIIj6AxlPiOwNAwZNhXWxpgKDvrLu/zI4S3Nj5YO8R1JE Qejg== X-Gm-Message-State: AD7BkJJlMImtxvHmPKkAFWUwso49fp1iuv4tFXPHJMR/Yoob10TJgsL48NoaWpacG5cllQ== X-Received: by 10.50.43.170 with SMTP id x10mr5781777igl.47.1459661026464; Sat, 02 Apr 2016 22:23:46 -0700 (PDT) Received: from localhost.localdomain (c-24-7-245-123.hsd1.mn.comcast.net. [24.7.245.123]) by smtp.gmail.com with ESMTPSA id je6sm2914954igb.15.2016.04.02.22.23.45 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sat, 02 Apr 2016 22:23:46 -0700 (PDT) From: Eric Biggers To: linux-fsdevel@vger.kernel.org Cc: linux-f2fs-devel@lists.sourceforge.net, linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org, jaegeuk@kernel.org, tytso@mit.edu, mhalcrow@google.com, Eric Biggers Subject: [PATCH 12/13] fscrypto: require write access to mount to set encryption policy Date: Sun, 3 Apr 2016 00:22:03 -0500 Message-Id: <1459660924-2960-13-git-send-email-ebiggers3@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1459660924-2960-1-git-send-email-ebiggers3@gmail.com> References: <1459660924-2960-1-git-send-email-ebiggers3@gmail.com> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Spam-Status: No, score=-7.8 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Since setting an encryption policy requires writing data to the filesystem, it should be guarded by mnt_want_write/mnt_drop_write. Otherwise, a user could cause a write to a readonly or frozen filesystem. Signed-off-by: Eric Biggers --- fs/crypto/policy.c | 11 +++++++++-- fs/f2fs/file.c | 2 +- include/linux/fscrypto.h | 4 ++-- 3 files changed, 12 insertions(+), 5 deletions(-) diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c index 3f5c275..6a767e6 100644 --- a/fs/crypto/policy.c +++ b/fs/crypto/policy.c @@ -11,6 +11,7 @@ #include #include #include +#include static bool inode_has_encryption_context(struct inode *inode) { @@ -92,9 +93,10 @@ static int create_encryption_context_from_policy(struct inode *inode, return inode->i_sb->s_cop->set_context(inode, &ctx, sizeof(ctx), NULL); } -int fscrypt_set_policy(struct inode *inode, const struct fscrypt_policy *policy) +int fscrypt_set_policy(struct file *file, const struct fscrypt_policy *policy) { - int ret = 0; + struct inode *inode = file_inode(file); + int ret; if (!inode_owner_or_capable(inode)) return -EACCES; @@ -102,6 +104,10 @@ int fscrypt_set_policy(struct inode *inode, const struct fscrypt_policy *policy) if (policy->version != 0) return -EINVAL; + ret = mnt_want_write_file(file); + if (ret) + return ret; + inode_lock(inode); if (!inode_has_encryption_context(inode)) { @@ -131,6 +137,7 @@ int fscrypt_set_policy(struct inode *inode, const struct fscrypt_policy *policy) ret = -EINVAL; } inode_unlock(inode); + mnt_drop_write_file(file); return ret; } EXPORT_SYMBOL(fscrypt_set_policy); diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c index cf691ae..d4837280 100644 --- a/fs/f2fs/file.c +++ b/fs/f2fs/file.c @@ -1542,7 +1542,7 @@ static int f2fs_ioc_set_encryption_policy(struct file *filp, unsigned long arg) return -EFAULT; f2fs_update_time(F2FS_I_SB(inode), REQ_TIME); - return fscrypt_set_policy(inode, &policy); + return fscrypt_set_policy(filp, &policy); } static int f2fs_ioc_get_encryption_policy(struct file *filp, unsigned long arg) diff --git a/include/linux/fscrypto.h b/include/linux/fscrypto.h index f29dc8c..130bf23 100644 --- a/include/linux/fscrypto.h +++ b/include/linux/fscrypto.h @@ -314,7 +314,7 @@ extern void fscrypt_restore_control_page(struct page *); extern int fscrypt_zeroout_range(struct inode *, pgoff_t, sector_t, unsigned int); /* policy.c */ -extern int fscrypt_set_policy(struct inode *, const struct fscrypt_policy *); +extern int fscrypt_set_policy(struct file *, const struct fscrypt_policy *); extern int fscrypt_get_policy(struct inode *, struct fscrypt_policy *); extern bool fscrypt_has_permitted_context(struct inode *, struct inode *); extern int fscrypt_inherit_context(struct inode *, struct inode *, @@ -384,7 +384,7 @@ static inline int fscrypt_notsupp_zeroout_range(struct inode *i, pgoff_t p, } /* policy.c */ -static inline int fscrypt_notsupp_set_policy(struct inode *i, +static inline int fscrypt_notsupp_set_policy(struct file *f, const struct fscrypt_policy *p) { return -EOPNOTSUPP;