From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.3 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, USER_AGENT_MUTT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7C258C43613 for ; Sat, 22 Jun 2019 22:43:30 +0000 (UTC) Received: from lists.sourceforge.net (lists.sourceforge.net [216.105.38.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 457722084E; Sat, 22 Jun 2019 22:43:30 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=sourceforge.net header.i=@sourceforge.net header.b="Qz088J5W"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=sf.net header.i=@sf.net header.b="lwlYZW0d"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="09+J15NZ" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 457722084E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=linux-f2fs-devel-bounces@lists.sourceforge.net Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.90_1) (envelope-from ) id 1heojF-0007aD-Ei; Sat, 22 Jun 2019 22:43:25 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) (envelope-from ) id 1heojC-0007a2-Vl for linux-f2fs-devel@lists.sourceforge.net; Sat, 22 Jun 2019 22:43:22 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=In-Reply-To:Content-Type:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=LBhlsAe1PE8jso9D+bbAZy8ItdnmyUOKdnN2mmMdi8Q=; b=Qz088J5W0VBiY0Qo5WKzXZ2uRj 201/vogyD4Nqc/k7aZjO+zPvVDv4EeSEyUOD2OIGKunENtb32jFm2XlwmKs8BRlLyJR0a8BF/yrVR avFmAXEbHJvZdzrwvtDzoIA3wC0QJRSyQi43enhxtZKknYmMCAQlt4R36pUrKMvxxK18=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=In-Reply-To:Content-Type:MIME-Version:References:Message-ID:Subject:Cc:To :From:Date:Sender:Reply-To:Content-Transfer-Encoding:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=LBhlsAe1PE8jso9D+bbAZy8ItdnmyUOKdnN2mmMdi8Q=; b=lwlYZW0d6c/FqnZv2CiRXoogaZ rjHITKzWu1iL3AZbPJGJoxSRmPcRrHux4ocvUWPzU69i42aJ5mj2BsdP4/qhV+ebrW8WcPfojh6t8 osM4YkZAO2kjUpiedzporcWIJJf0i40Bzp462U74aT9TdIXvBtkHE7rcO/UXeDdK6g9M=; Received: from mail.kernel.org ([198.145.29.99]) by sfi-mx-4.v28.lw.sourceforge.com with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.90_1) id 1heojF-009c9N-Kk for linux-f2fs-devel@lists.sourceforge.net; Sat, 22 Jun 2019 22:43:27 +0000 Received: from localhost (unknown [104.132.1.68]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id F25FC2084E; Sat, 22 Jun 2019 22:43:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1561243400; bh=duxhqvdQRlm6YhM2SeV8CWRZ7FSjKDTqagJXTnY4fak=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=09+J15NZ5ySok90iLVT9ZiK5cqx0/DR2Oo+EVhLmMaS7mo+I4x2wOcvXDXXLALwO3 kVUeZonqxg60iJnC7g0lhGjbMKf24IVWL1g88eS83tiygp9cA7bzzFJ0nKDDCAX3pk xPiI4/t6m2NM+EdZbAWxsl5zuz24CW7KUepd3fgA= Date: Sat, 22 Jun 2019 15:43:19 -0700 From: Jaegeuk Kim To: Eric Biggers Message-ID: <20190622224319.GJ19686@jaegeuk-macbookpro.roam.corp.google.com> References: <20190620205043.64350-1-ebiggers@kernel.org> <20190620205043.64350-11-ebiggers@kernel.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20190620205043.64350-11-ebiggers@kernel.org> User-Agent: Mutt/1.8.2 (2017-04-18) X-Headers-End: 1heojF-009c9N-Kk Subject: Re: [f2fs-dev] [PATCH v5 10/16] fs-verity: implement FS_IOC_ENABLE_VERITY ioctl X-BeenThere: linux-f2fs-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: "Theodore Y . Ts'o" , "Darrick J . Wong" , linux-api@vger.kernel.org, Dave Chinner , linux-f2fs-devel@lists.sourceforge.net, linux-fscrypt@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-integrity@vger.kernel.org, linux-ext4@vger.kernel.org, Linus Torvalds , Christoph Hellwig , Victor Hsieh Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: linux-f2fs-devel-bounces@lists.sourceforge.net On 06/20, Eric Biggers wrote: > From: Eric Biggers > > Add a function for filesystems to call to implement the > FS_IOC_ENABLE_VERITY ioctl. This ioctl enables fs-verity on a file. > > See the "FS_IOC_ENABLE_VERITY" section of > Documentation/filesystems/fsverity.rst for the documentation. > Reviewed-by: Jaegeuk Kim > Signed-off-by: Eric Biggers > --- > fs/verity/Makefile | 3 +- > fs/verity/enable.c | 341 +++++++++++++++++++++++++++++++++++++++ > include/linux/fsverity.h | 64 ++++++++ > 3 files changed, 407 insertions(+), 1 deletion(-) > create mode 100644 fs/verity/enable.c > > diff --git a/fs/verity/Makefile b/fs/verity/Makefile > index 7fa628cd5eba24..04b37475fd280a 100644 > --- a/fs/verity/Makefile > +++ b/fs/verity/Makefile > @@ -1,6 +1,7 @@ > # SPDX-License-Identifier: GPL-2.0 > > -obj-$(CONFIG_FS_VERITY) += hash_algs.o \ > +obj-$(CONFIG_FS_VERITY) += enable.o \ > + hash_algs.o \ > init.o \ > open.o \ > verify.o > diff --git a/fs/verity/enable.c b/fs/verity/enable.c > new file mode 100644 > index 00000000000000..144721bbe4aab9 > --- /dev/null > +++ b/fs/verity/enable.c > @@ -0,0 +1,341 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* > + * fs/verity/enable.c: ioctl to enable verity on a file > + * > + * Copyright 2019 Google LLC > + */ > + > +#include "fsverity_private.h" > + > +#include > +#include > +#include > +#include > +#include > + > +static int build_merkle_tree_level(struct inode *inode, unsigned int level, > + u64 num_blocks_to_hash, > + const struct merkle_tree_params *params, > + u8 *pending_hashes, > + struct ahash_request *req) > +{ > + const struct fsverity_operations *vops = inode->i_sb->s_vop; > + unsigned int pending_size = 0; > + u64 dst_block_num; > + u64 i; > + int err; > + > + if (WARN_ON(params->block_size != PAGE_SIZE)) /* checked earlier too */ > + return -EINVAL; > + > + if (level < params->num_levels) { > + dst_block_num = params->level_start[level]; > + } else { > + if (WARN_ON(num_blocks_to_hash != 1)) > + return -EINVAL; > + dst_block_num = 0; /* unused */ > + } > + > + for (i = 0; i < num_blocks_to_hash; i++) { > + struct page *src_page; > + > + if ((pgoff_t)i % 10000 == 0 || i + 1 == num_blocks_to_hash) > + pr_debug("Hashing block %llu of %llu for level %u\n", > + i + 1, num_blocks_to_hash, level); > + > + if (level == 0) > + /* Leaf: hashing a data block */ > + src_page = read_mapping_page(inode->i_mapping, i, NULL); > + else > + /* Non-leaf: hashing hash block from level below */ > + src_page = vops->read_merkle_tree_page(inode, > + params->level_start[level - 1] + i); > + if (IS_ERR(src_page)) { > + err = PTR_ERR(src_page); > + fsverity_err(inode, > + "Error %d reading Merkle tree page %llu", > + err, params->level_start[level - 1] + i); > + return err; > + } > + > + err = fsverity_hash_page(params, inode, req, src_page, > + &pending_hashes[pending_size]); > + put_page(src_page); > + if (err) > + return err; > + pending_size += params->digest_size; > + > + if (level == params->num_levels) /* Root hash? */ > + return 0; > + > + if (pending_size + params->digest_size > params->block_size || > + i + 1 == num_blocks_to_hash) { > + /* Flush the pending hash block */ > + memset(&pending_hashes[pending_size], 0, > + params->block_size - pending_size); > + err = vops->write_merkle_tree_block(inode, > + pending_hashes, > + dst_block_num, > + params->log_blocksize); > + if (err) { > + fsverity_err(inode, > + "Error %d writing Merkle tree block %llu", > + err, dst_block_num); > + return err; > + } > + dst_block_num++; > + pending_size = 0; > + } > + > + if (fatal_signal_pending(current)) > + return -EINTR; > + cond_resched(); > + } > + return 0; > +} > + > +/* > + * Build the Merkle tree for the given inode using the given parameters, and > + * return the root hash in @root_hash. > + * > + * The tree is written to a filesystem-specific location as determined by the > + * ->write_merkle_tree_block() method. However, the blocks that comprise the > + * tree are the same for all filesystems. > + */ > +static int build_merkle_tree(struct inode *inode, > + const struct merkle_tree_params *params, > + u8 *root_hash) > +{ > + u8 *pending_hashes; > + struct ahash_request *req; > + u64 blocks; > + unsigned int level; > + int err = -ENOMEM; > + > + if (inode->i_size == 0) { > + /* Empty file is a special case; root hash is all 0's */ > + memset(root_hash, 0, params->digest_size); > + return 0; > + } > + > + pending_hashes = kmalloc(params->block_size, GFP_KERNEL); > + req = ahash_request_alloc(params->hash_alg->tfm, GFP_KERNEL); > + if (!pending_hashes || !req) > + goto out; > + > + /* > + * Build each level of the Merkle tree, starting at the leaf level > + * (level 0) and ascending to the root node (level 'num_levels - 1'). > + * Then at the end (level 'num_levels'), calculate the root hash. > + */ > + blocks = (inode->i_size + params->block_size - 1) >> > + params->log_blocksize; > + for (level = 0; level <= params->num_levels; level++) { > + err = build_merkle_tree_level(inode, level, blocks, params, > + pending_hashes, req); > + if (err) > + goto out; > + blocks = (blocks + params->hashes_per_block - 1) >> > + params->log_arity; > + } > + memcpy(root_hash, pending_hashes, params->digest_size); > + err = 0; > +out: > + kfree(pending_hashes); > + ahash_request_free(req); > + return err; > +} > + > +static int enable_verity(struct file *filp, > + const struct fsverity_enable_arg *arg) > +{ > + struct inode *inode = file_inode(filp); > + const struct fsverity_operations *vops = inode->i_sb->s_vop; > + struct merkle_tree_params params = { }; > + struct fsverity_descriptor *desc; > + size_t desc_size = sizeof(*desc); > + struct fsverity_info *vi; > + int err; > + > + /* Start initializing the fsverity_descriptor */ > + desc = kzalloc(desc_size, GFP_KERNEL); > + if (!desc) > + return -ENOMEM; > + desc->version = 1; > + desc->hash_algorithm = arg->hash_algorithm; > + desc->log_blocksize = ilog2(arg->block_size); > + > + /* Get the salt if the user provided one */ > + if (arg->salt_size && > + copy_from_user(desc->salt, > + (const u8 __user *)(uintptr_t)arg->salt_ptr, > + arg->salt_size)) { > + err = -EFAULT; > + goto out; > + } > + desc->salt_size = arg->salt_size; > + > + desc->data_size = cpu_to_le64(inode->i_size); > + > + pr_debug("Building Merkle tree...\n"); > + > + /* Prepare the Merkle tree parameters */ > + err = fsverity_init_merkle_tree_params(¶ms, inode, > + arg->hash_algorithm, > + desc->log_blocksize, > + desc->salt, desc->salt_size); > + if (err) > + goto out; > + > + /* Tell the filesystem that verity is being enabled on the file */ > + err = vops->begin_enable_verity(filp); > + if (err) > + goto out; > + > + /* Build the Merkle tree */ > + BUILD_BUG_ON(sizeof(desc->root_hash) < FS_VERITY_MAX_DIGEST_SIZE); > + err = build_merkle_tree(inode, ¶ms, desc->root_hash); > + if (err) { > + fsverity_err(inode, "Error %d building Merkle tree", err); > + goto rollback; > + } > + pr_debug("Done building Merkle tree. Root hash is %s:%*phN\n", > + params.hash_alg->name, params.digest_size, desc->root_hash); > + > + /* > + * Create the fsverity_info. Don't bother trying to save work by > + * reusing the merkle_tree_params from above. Instead, just create the > + * fsverity_info from the fsverity_descriptor as if it were just loaded > + * from disk. This is simpler, and it serves as an extra check that the > + * metadata we're writing is valid before actually enabling verity. > + */ > + vi = fsverity_create_info(inode, desc, desc_size); > + if (IS_ERR(vi)) { > + err = PTR_ERR(vi); > + goto rollback; > + } > + > + /* Tell the filesystem to finish enabling verity on the file */ > + err = vops->end_enable_verity(filp, desc, desc_size, params.tree_size); > + if (err) { > + fsverity_err(inode, "%ps() failed with err %d", > + vops->end_enable_verity, err); > + fsverity_free_info(vi); > + } else if (WARN_ON(!IS_VERITY(inode))) { > + err = -EINVAL; > + fsverity_free_info(vi); > + } else { > + /* Successfully enabled verity */ > + > + /* > + * Readers can start using ->i_verity_info immediately, so it > + * can't be rolled back once set. So don't set it until just > + * after the filesystem has successfully enabled verity. > + */ > + fsverity_set_info(inode, vi); > + } > +out: > + kfree(params.hashstate); > + kfree(desc); > + return err; > + > +rollback: > + (void)vops->end_enable_verity(filp, NULL, 0, params.tree_size); > + goto out; > +} > + > +/** > + * fsverity_ioctl_enable() - enable verity on a file > + * > + * Enable fs-verity on a file. See the "FS_IOC_ENABLE_VERITY" section of > + * Documentation/filesystems/fsverity.rst for the documentation. > + * > + * Return: 0 on success, -errno on failure > + */ > +int fsverity_ioctl_enable(struct file *filp, const void __user *uarg) > +{ > + struct inode *inode = file_inode(filp); > + struct fsverity_enable_arg arg; > + int err; > + > + if (copy_from_user(&arg, uarg, sizeof(arg))) > + return -EFAULT; > + > + if (arg.version != 1) > + return -EINVAL; > + > + if (arg.__reserved1 || > + memchr_inv(arg.__reserved2, 0, sizeof(arg.__reserved2))) > + return -EINVAL; > + > + if (arg.block_size != PAGE_SIZE) > + return -EINVAL; > + > + if (arg.salt_size > FIELD_SIZEOF(struct fsverity_descriptor, salt)) > + return -EMSGSIZE; > + > + if (arg.sig_size) > + return -EINVAL; > + > + /* > + * Require a regular file with write access. But the actual fd must > + * still be readonly so that we can lock out all writers. This is > + * needed to guarantee that no writable fds exist to the file once it > + * has verity enabled, and to stabilize the data being hashed. > + */ > + > + err = inode_permission(inode, MAY_WRITE); > + if (err) > + return err; > + > + if (IS_APPEND(inode)) > + return -EPERM; > + > + if (S_ISDIR(inode->i_mode)) > + return -EISDIR; > + > + if (!S_ISREG(inode->i_mode)) > + return -EINVAL; > + > + err = mnt_want_write_file(filp); > + if (err) /* -EROFS */ > + return err; > + > + err = deny_write_access(filp); > + if (err) /* -ETXTBSY */ > + goto out_drop_write; > + > + inode_lock(inode); > + > + if (IS_VERITY(inode)) { > + err = -EEXIST; > + goto out_unlock; > + } > + > + err = enable_verity(filp, &arg); > + if (err) > + goto out_unlock; > + > + /* > + * Some pages of the file may have been evicted from pagecache after > + * being used in the Merkle tree construction, then read into pagecache > + * again by another process reading from the file concurrently. Since > + * these pages didn't undergo verification against the file measurement > + * which fs-verity now claims to be enforcing, we have to wipe the > + * pagecache to ensure that all future reads are verified. > + */ > + filemap_write_and_wait(inode->i_mapping); > + truncate_inode_pages(inode->i_mapping, 0); > + > + /* > + * allow_write_access() is needed to pair with deny_write_access(). > + * Regardless, the filesystem won't allow writing to verity files. > + */ > +out_unlock: > + inode_unlock(inode); > + allow_write_access(filp); > +out_drop_write: > + mnt_drop_write_file(filp); > + return err; > +} > +EXPORT_SYMBOL_GPL(fsverity_ioctl_enable); > diff --git a/include/linux/fsverity.h b/include/linux/fsverity.h > index ecd47e748c7f64..7ef2ef82653409 100644 > --- a/include/linux/fsverity.h > +++ b/include/linux/fsverity.h > @@ -17,6 +17,42 @@ > /* Verity operations for filesystems */ > struct fsverity_operations { > > + /** > + * Begin enabling verity on the given file. > + * > + * @filp: a readonly file descriptor for the file > + * > + * The filesystem must do any needed filesystem-specific preparations > + * for enabling verity, e.g. evicting inline data. > + * > + * i_rwsem is held for write. > + * > + * Return: 0 on success, -errno on failure > + */ > + int (*begin_enable_verity)(struct file *filp); > + > + /** > + * End enabling verity on the given file. > + * > + * @filp: a readonly file descriptor for the file > + * @desc: the verity descriptor to write, or NULL on failure > + * @desc_size: size of verity descriptor, or 0 on failure > + * @merkle_tree_size: total bytes the Merkle tree took up > + * > + * If desc == NULL, then enabling verity failed and the filesystem only > + * must do any necessary cleanups. Else, it must also store the given > + * verity descriptor to a fs-specific location associated with the inode > + * and do any fs-specific actions needed to mark the inode as a verity > + * inode, e.g. setting a bit in the on-disk inode. The filesystem is > + * also responsible for setting the S_VERITY flag in the VFS inode. > + * > + * i_rwsem is held for write. > + * > + * Return: 0 on success, -errno on failure > + */ > + int (*end_enable_verity)(struct file *filp, const void *desc, > + size_t desc_size, u64 merkle_tree_size); > + > /** > * Get the verity descriptor of the given inode. > * > @@ -50,6 +86,22 @@ struct fsverity_operations { > */ > struct page *(*read_merkle_tree_page)(struct inode *inode, > pgoff_t index); > + > + /** > + * Write a Merkle tree block to the given inode. > + * > + * @inode: the inode for which the Merkle tree is being built > + * @buf: block to write > + * @index: 0-based index of the block within the Merkle tree > + * @log_blocksize: log base 2 of the Merkle tree block size > + * > + * This is only called between ->begin_enable_verity() and > + * ->end_enable_verity(). i_rwsem is held for write. > + * > + * Return: 0 on success, -errno on failure > + */ > + int (*write_merkle_tree_block)(struct inode *inode, const void *buf, > + u64 index, int log_blocksize); > }; > > #ifdef CONFIG_FS_VERITY > @@ -60,6 +112,10 @@ static inline struct fsverity_info *fsverity_get_info(const struct inode *inode) > return READ_ONCE(inode->i_verity_info); > } > > +/* enable.c */ > + > +extern int fsverity_ioctl_enable(struct file *filp, const void __user *arg); > + > /* open.c */ > > extern int fsverity_file_open(struct inode *inode, struct file *filp); > @@ -79,6 +135,14 @@ static inline struct fsverity_info *fsverity_get_info(const struct inode *inode) > return NULL; > } > > +/* enable.c */ > + > +static inline int fsverity_ioctl_enable(struct file *filp, > + const void __user *arg) > +{ > + return -EOPNOTSUPP; > +} > + > /* open.c */ > > static inline int fsverity_file_open(struct inode *inode, struct file *filp) > -- > 2.22.0.410.gd8fdbe21b5-goog _______________________________________________ Linux-f2fs-devel mailing list Linux-f2fs-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel