lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 4 Mar 2022 16:14:03 +0000 From: Luís Henriques <lhenriques@...e.de> To: Jeff Layton <jlayton@...nel.org>, Xiubo Li <xiubli@...hat.com>, Ilya Dryomov <idryomov@...il.com> Cc: ceph-devel@...r.kernel.org, linux-kernel@...r.kernel.org, Luís Henriques <lhenriques@...e.de> Subject: [PATCH 3/3] ceph: add support for encrypted snapshot names Since filenames in encrypted directories are already encrypted and shown as a base64-encoded string when the directory is locked, snapshot names should show a similar behaviour. Signed-off-by: Luís Henriques <lhenriques@...e.de> --- fs/ceph/dir.c | 9 +++++++++ fs/ceph/inode.c | 13 +++++++++++++ 2 files changed, 22 insertions(+) diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c index 934402f5e9e6..17d2f18a1fd1 100644 --- a/fs/ceph/dir.c +++ b/fs/ceph/dir.c @@ -1069,6 +1069,15 @@ static int ceph_mkdir(struct user_namespace *mnt_userns, struct inode *dir, op = CEPH_MDS_OP_MKSNAP; dout("mksnap dir %p snap '%pd' dn %p\n", dir, dentry, dentry); + /* + * Encrypted snapshots require d_revalidate to force a + * LOOKUPSNAP to cleanup dcache + */ + if (IS_ENCRYPTED(dir)) { + spin_lock(&dentry->d_lock); + dentry->d_flags |= DCACHE_NOKEY_NAME; + spin_unlock(&dentry->d_lock); + } } else if (ceph_snap(dir) == CEPH_NOSNAP) { dout("mkdir dir %p dn %p mode 0%ho\n", dir, dentry, mode); op = CEPH_MDS_OP_MKDIR; diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c index 8b0832271fdf..357335a11384 100644 --- a/fs/ceph/inode.c +++ b/fs/ceph/inode.c @@ -182,6 +182,19 @@ struct inode *ceph_get_snapdir(struct inode *parent) ci->i_rbytes = 0; ci->i_btime = ceph_inode(parent)->i_btime; + /* if encrypted, just borrow fscrypt_auth from parent */ + if (IS_ENCRYPTED(parent)) { + struct ceph_inode_info *pci = ceph_inode(parent); + + ci->fscrypt_auth = kmemdup(pci->fscrypt_auth, + pci->fscrypt_auth_len, + GFP_KERNEL); + if (ci->fscrypt_auth) { + inode->i_flags |= S_ENCRYPTED; + ci->fscrypt_auth_len = pci->fscrypt_auth_len; + } else + dout("Failed to alloc memory for fscrypt_auth in snapdir\n"); + } if (inode->i_state & I_NEW) { inode->i_op = &ceph_snapdir_iops; inode->i_fop = &ceph_snapdir_fops;
Powered by blists - more mailing lists