From: Jeff Layton <jlayton@kernel.org>
To: ceph-devel@vger.kernel.org
Cc: linux-fsdevel@vger.kernel.org, linux-fscrypt@vger.kernel.org,
lhenriques@suse.de
Subject: [RFC PATCH v6 08/20] ceph: add routine to create fscrypt context prior to RPC
Date: Tue, 13 Apr 2021 13:50:40 -0400 [thread overview]
Message-ID: <20210413175052.163865-9-jlayton@kernel.org> (raw)
In-Reply-To: <20210413175052.163865-1-jlayton@kernel.org>
After pre-creating a new inode, do an fscrypt prepare on it, fetch a
new encryption context and then marshal that into the security context
to be sent along with the RPC. Call the new function from
ceph_new_inode.
Signed-off-by: Jeff Layton <jlayton@kernel.org>
---
fs/ceph/crypto.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++++
fs/ceph/crypto.h | 12 ++++++++++
fs/ceph/inode.c | 9 +++++--
fs/ceph/super.h | 3 +++
4 files changed, 83 insertions(+), 2 deletions(-)
diff --git a/fs/ceph/crypto.c b/fs/ceph/crypto.c
index 879d9a0d3751..f037a4939026 100644
--- a/fs/ceph/crypto.c
+++ b/fs/ceph/crypto.c
@@ -46,3 +46,64 @@ void ceph_fscrypt_set_ops(struct super_block *sb)
{
fscrypt_set_ops(sb, &ceph_fscrypt_ops);
}
+
+int ceph_fscrypt_prepare_context(struct inode *dir, struct inode *inode,
+ struct ceph_acl_sec_ctx *as)
+{
+ int ret, ctxsize;
+ size_t name_len;
+ char *name;
+ struct ceph_pagelist *pagelist = as->pagelist;
+ bool encrypted = false;
+
+ ret = fscrypt_prepare_new_inode(dir, inode, &encrypted);
+ if (ret)
+ return ret;
+ if (!encrypted)
+ return 0;
+
+ inode->i_flags |= S_ENCRYPTED;
+
+ ctxsize = fscrypt_context_for_new_inode(&as->fscrypt, inode);
+ if (ctxsize < 0)
+ return ctxsize;
+
+ /* marshal it in page array */
+ if (!pagelist) {
+ pagelist = ceph_pagelist_alloc(GFP_KERNEL);
+ if (!pagelist)
+ return -ENOMEM;
+ ret = ceph_pagelist_reserve(pagelist, PAGE_SIZE);
+ if (ret)
+ goto out;
+ ceph_pagelist_encode_32(pagelist, 1);
+ }
+
+ name = CEPH_XATTR_NAME_ENCRYPTION_CONTEXT;
+ name_len = strlen(name);
+ ret = ceph_pagelist_reserve(pagelist, 4 * 2 + name_len + ctxsize);
+ if (ret)
+ goto out;
+
+ if (as->pagelist) {
+ BUG_ON(pagelist->length <= sizeof(__le32));
+ if (list_is_singular(&pagelist->head)) {
+ le32_add_cpu((__le32*)pagelist->mapped_tail, 1);
+ } else {
+ struct page *page = list_first_entry(&pagelist->head,
+ struct page, lru);
+ void *addr = kmap_atomic(page);
+ le32_add_cpu((__le32*)addr, 1);
+ kunmap_atomic(addr);
+ }
+ }
+
+ ceph_pagelist_encode_32(pagelist, name_len);
+ ceph_pagelist_append(pagelist, name, name_len);
+ ceph_pagelist_encode_32(pagelist, ctxsize);
+ ceph_pagelist_append(pagelist, as->fscrypt, ctxsize);
+out:
+ if (pagelist && !as->pagelist)
+ ceph_pagelist_release(pagelist);
+ return ret;
+}
diff --git a/fs/ceph/crypto.h b/fs/ceph/crypto.h
index 0dd043b56096..cc4e481bf13a 100644
--- a/fs/ceph/crypto.h
+++ b/fs/ceph/crypto.h
@@ -18,6 +18,9 @@ static inline void ceph_fscrypt_free_dummy_policy(struct ceph_fs_client *fsc)
fscrypt_free_dummy_policy(&fsc->dummy_enc_policy);
}
+int ceph_fscrypt_prepare_context(struct inode *dir, struct inode *inode,
+ struct ceph_acl_sec_ctx *as);
+
#else /* CONFIG_FS_ENCRYPTION */
static inline void ceph_fscrypt_set_ops(struct super_block *sb)
@@ -27,6 +30,15 @@ static inline void ceph_fscrypt_set_ops(struct super_block *sb)
static inline void ceph_fscrypt_free_dummy_policy(struct ceph_fs_client *fsc)
{
}
+
+static inline int ceph_fscrypt_prepare_context(struct inode *dir, struct inode *inode,
+ struct ceph_acl_sec_ctx *as)
+{
+ if (IS_ENCRYPTED(dir))
+ return -EOPNOTSUPP;
+ return 0;
+}
+
#endif /* CONFIG_FS_ENCRYPTION */
#endif
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index 7cf919b530db..e20d1da9fe71 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -83,12 +83,17 @@ struct inode *ceph_new_inode(struct inode *dir, struct dentry *dentry,
goto out_err;
}
+ inode->i_state = 0;
+ inode->i_mode = *mode;
+
err = ceph_security_init_secctx(dentry, *mode, as_ctx);
if (err < 0)
goto out_err;
- inode->i_state = 0;
- inode->i_mode = *mode;
+ err = ceph_fscrypt_prepare_context(dir, inode, as_ctx);
+ if (err)
+ goto out_err;
+
return inode;
out_err:
iput(inode);
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index fa3a87a4d233..49356f9137ba 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -1055,6 +1055,9 @@ struct ceph_acl_sec_ctx {
#ifdef CONFIG_CEPH_FS_SECURITY_LABEL
void *sec_ctx;
u32 sec_ctxlen;
+#endif
+#ifdef CONFIG_FS_ENCRYPTION
+ u8 fscrypt[FSCRYPT_SET_CONTEXT_MAX_SIZE];
#endif
struct ceph_pagelist *pagelist;
};
--
2.30.2
next prev parent reply other threads:[~2021-04-13 17:51 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-13 17:50 [RFC PATCH v6 00/20] ceph+fscrypt: context, filename and symlink support Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 01/20] vfs: export new_inode_pseudo Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 02/20] fscrypt: export fscrypt_base64_encode and fscrypt_base64_decode Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 03/20] fscrypt: export fscrypt_fname_encrypt and fscrypt_fname_encrypted_size Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 04/20] fscrypt: add fscrypt_context_for_new_inode Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 05/20] ceph: crypto context handling for ceph Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 06/20] ceph: implement -o test_dummy_encryption mount option Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 07/20] ceph: preallocate inode for ops that may create one Jeff Layton
2021-04-13 17:50 ` Jeff Layton [this message]
2021-04-13 17:50 ` [RFC PATCH v6 09/20] ceph: make ceph_msdc_build_path use ref-walk Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 10/20] ceph: add encrypted fname handling to ceph_mdsc_build_path Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 11/20] ceph: decode alternate_name in lease info Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 12/20] ceph: send altname in MClientRequest Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 13/20] ceph: properly set DCACHE_NOKEY_NAME flag in lookup Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 14/20] ceph: make d_revalidate call fscrypt revalidator for encrypted dentries Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 15/20] ceph: add helpers for converting names for userland presentation Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 16/20] ceph: add fscrypt support to ceph_fill_trace Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 17/20] ceph: add support to readdir for encrypted filenames Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 18/20] ceph: create symlinks with encrypted and base64-encoded targets Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 19/20] ceph: make ceph_get_name decrypt filenames Jeff Layton
2021-04-13 17:50 ` [RFC PATCH v6 20/20] ceph: add fscrypt ioctls Jeff Layton
2021-04-19 10:09 ` Luis Henriques
2021-04-19 12:19 ` Jeff Layton
2021-04-19 19:54 ` Eric Biggers
2021-04-20 9:34 ` Luis Henriques
2021-04-20 11:45 ` Jeff Layton
2021-04-19 10:30 ` [RFC PATCH v6 00/20] ceph+fscrypt: context, filename and symlink support Luis Henriques
2021-04-19 12:23 ` Jeff Layton
2021-04-19 16:03 ` Luis Henriques
2021-04-19 16:28 ` Jeff Layton
2021-04-20 10:11 ` Luis Henriques
2021-04-20 15:52 ` Jeff Layton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210413175052.163865-9-jlayton@kernel.org \
--to=jlayton@kernel.org \
--cc=ceph-devel@vger.kernel.org \
--cc=lhenriques@suse.de \
--cc=linux-fscrypt@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).