linux-toradex.git/fs/ecryptfs/keystore.c, branch v3.0.44

eCryptfs: Unlock keys needed by ecryptfsd

2011-08-05T04:58:39+00:00

commit b2987a5e05ec7a1af7ca42e5d5349d7a22753031 upstream.

Fixes a regression caused by b5695d04634fa4ccca7dcbc05bb4a66522f02e0b

Kernel keyring keys containing eCryptfs authentication tokens should not
be write locked when calling out to ecryptfsd to wrap and unwrap file
encryption keys. The eCryptfs kernel code can not hold the key's write
lock because ecryptfsd needs to request the key after receiving such a
request from the kernel.

Without this fix, all file opens and creates will timeout and fail when
using the eCryptfs PKI infrastructure. This is not an issue when using
passphrase-based mount keys, which is the most widely deployed eCryptfs
configuration.

Signed-off-by: Tyler Hicks 
Acked-by: Roberto Sassu 
Tested-by: Roberto Sassu 
Tested-by: Alexis Hafner1 
Signed-off-by: Greg Kroah-Hartman

eCryptfs: Allow 2 scatterlist entries for encrypted filenames

2011-05-27T16:46:14+00:00

The buffers allocated while encrypting and decrypting long filenames can
sometimes straddle two pages. In this situation, virt_to_scatterlist()
will return -ENOMEM, causing the operation to fail and the user will get
scary error messages in their logs:

kernel: ecryptfs_write_tag_70_packet: Internal error whilst attempting
to convert filename memory to scatterlist; expected rc = 1; got rc =
[-12]. block_aligned_filename_size = [272]
kernel: ecryptfs_encrypt_filename: Error attempting to generate tag 70
packet; rc = [-12]
kernel: ecryptfs_encrypt_and_encode_filename: Error attempting to
encrypt filename; rc = [-12]
kernel: ecryptfs_lookup: Error attempting to encrypt and encode
filename; rc = [-12]

The solution is to allow up to 2 scatterlist entries to be used.

Signed-off-by: Tyler Hicks 
Cc:

eCryptfs: write lock requested keys

2011-03-28T06:49:43+00:00

A requested key is write locked in order to prevent modifications on the
authentication token while it is being used.

Signed-off-by: Roberto Sassu 
Signed-off-by: Tyler Hicks

eCryptfs: move ecryptfs_find_auth_tok_for_sig() call before mutex_lock

2011-03-28T06:49:42+00:00

The ecryptfs_find_auth_tok_for_sig() call is moved before the
mutex_lock(s->tfm_mutex) instruction in order to avoid possible deadlocks
that may occur by holding the lock on the two semaphores 'key->sem' and
's->tfm_mutex' in reverse order.

Signed-off-by: Roberto Sassu 
Signed-off-by: Tyler Hicks

eCryptfs: verify authentication tokens before their use

2011-03-28T06:49:41+00:00

Authentication tokens content may change if another requestor calls the
update() method of the corresponding key. The new function
ecryptfs_verify_auth_tok_from_key() retrieves the authentication token from
the provided key and verifies if it is still valid before being used to
encrypt or decrypt an eCryptfs file.

Signed-off-by: Roberto Sassu 
[tyhicks: Minor formatting changes]
Signed-off-by: Tyler Hicks

eCryptfs: modified size of keysig in the ecryptfs_key_sig structure

2011-03-28T06:49:40+00:00

The size of the 'keysig' array is incremented of one byte in order to make
room for the NULL character. The 'keysig' variable is used, in the function
ecryptfs_generate_key_packet_set(), to find an authentication token with
the given signature and is printed a debug message if it cannot be
retrieved.

Signed-off-by: Roberto Sassu 
Signed-off-by: Tyler Hicks

eCryptfs: removed num_global_auth_toks from ecryptfs_mount_crypt_stat

2011-03-28T06:49:39+00:00

This patch removes the 'num_global_auth_toks' field of the
ecryptfs_mount_crypt_stat structure, used to count the number of items in
the 'global_auth_tok_list' list. This variable is not needed because there
are no checks based upon it.

Signed-off-by: Roberto Sassu 
Signed-off-by: Tyler Hicks

eCryptfs: ecryptfs_keyring_auth_tok_for_sig() bug fix

2011-03-28T06:49:15+00:00

The pointer '(*auth_tok_key)' is set to NULL in case request_key()
fails, in order to prevent its use by functions calling
ecryptfs_keyring_auth_tok_for_sig().

Signed-off-by: Roberto Sassu 
Cc: 
Signed-off-by: Tyler Hicks

ecryptfs: Fix ecryptfs_printk() size_t warnings

2011-01-17T19:01:24+00:00

Commit cb55d21f6fa19d8c6c2680d90317ce88c1f57269 revealed a number of
missing 'z' length modifiers in calls to ecryptfs_printk() when
printing variables of type size_t. This patch fixes those compiler
warnings.

Signed-off-by: Tyler Hicks

fs/ecryptfs: Add printf format/argument verification and fix fallout

2011-01-17T19:01:23+00:00

Add __attribute__((format... to __ecryptfs_printk
Make formats and arguments match.
Add casts to (unsigned long long) for %llu.

Signed-off-by: Joe Perches 
[tyhicks: 80 columns cleanup and fixed typo]
Signed-off-by: Tyler Hicks