^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * Ioctl to enable verity on a file
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) * Copyright 2019 Google LLC
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) #include "fsverity_private.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #include <crypto/hash.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) #include <linux/backing-dev.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #include <linux/mount.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) #include <linux/pagemap.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include <linux/sched/signal.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/uaccess.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) * Read a file data page for Merkle tree construction. Do aggressive readahead,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) * since we're sequentially reading the entire file.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) static struct page *read_file_data_page(struct file *filp, pgoff_t index,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) struct file_ra_state *ra,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) unsigned long remaining_pages)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) struct page *page;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) page = find_get_page_flags(filp->f_mapping, index, FGP_ACCESSED);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) if (!page || !PageUptodate(page)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) if (page)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) put_page(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) page_cache_sync_readahead(filp->f_mapping, ra, filp,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) index, remaining_pages);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) page = read_mapping_page(filp->f_mapping, index, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) if (IS_ERR(page))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) return page;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) if (PageReadahead(page))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) page_cache_async_readahead(filp->f_mapping, ra, filp, page,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) index, remaining_pages);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) return page;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) static int build_merkle_tree_level(struct file *filp, unsigned int level,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) u64 num_blocks_to_hash,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) const struct merkle_tree_params *params,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) u8 *pending_hashes,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) struct ahash_request *req)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) struct inode *inode = file_inode(filp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) const struct fsverity_operations *vops = inode->i_sb->s_vop;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) struct file_ra_state ra = { 0 };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) unsigned int pending_size = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) u64 dst_block_num;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) u64 i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) if (WARN_ON(params->block_size != PAGE_SIZE)) /* checked earlier too */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) if (level < params->num_levels) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) dst_block_num = params->level_start[level];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) if (WARN_ON(num_blocks_to_hash != 1))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) dst_block_num = 0; /* unused */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) file_ra_state_init(&ra, filp->f_mapping);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) for (i = 0; i < num_blocks_to_hash; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) struct page *src_page;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) if ((pgoff_t)i % 10000 == 0 || i + 1 == num_blocks_to_hash)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) pr_debug("Hashing block %llu of %llu for level %u\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) i + 1, num_blocks_to_hash, level);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) if (level == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) /* Leaf: hashing a data block */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) src_page = read_file_data_page(filp, i, &ra,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) num_blocks_to_hash - i);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) if (IS_ERR(src_page)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) err = PTR_ERR(src_page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) fsverity_err(inode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) "Error %d reading data page %llu",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) err, i);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) unsigned long num_ra_pages =
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) min_t(unsigned long, num_blocks_to_hash - i,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) inode->i_sb->s_bdi->io_pages);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) /* Non-leaf: hashing hash block from level below */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) src_page = vops->read_merkle_tree_page(inode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) params->level_start[level - 1] + i,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97) num_ra_pages);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) if (IS_ERR(src_page)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) err = PTR_ERR(src_page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) fsverity_err(inode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) "Error %d reading Merkle tree page %llu",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) err, params->level_start[level - 1] + i);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) err = fsverity_hash_page(params, inode, req, src_page,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) &pending_hashes[pending_size]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) put_page(src_page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) pending_size += params->digest_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) if (level == params->num_levels) /* Root hash? */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) if (pending_size + params->digest_size > params->block_size ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) i + 1 == num_blocks_to_hash) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) /* Flush the pending hash block */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) memset(&pending_hashes[pending_size], 0,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) params->block_size - pending_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) err = vops->write_merkle_tree_block(inode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) pending_hashes,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) dst_block_num,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) params->log_blocksize);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) if (err) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) fsverity_err(inode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) "Error %d writing Merkle tree block %llu",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) err, dst_block_num);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) dst_block_num++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) pending_size = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) if (fatal_signal_pending(current))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) return -EINTR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) cond_resched();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) * Build the Merkle tree for the given file using the given parameters, and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) * return the root hash in @root_hash.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) * The tree is written to a filesystem-specific location as determined by the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) * ->write_merkle_tree_block() method. However, the blocks that comprise the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) * tree are the same for all filesystems.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) static int build_merkle_tree(struct file *filp,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) const struct merkle_tree_params *params,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) u8 *root_hash)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) struct inode *inode = file_inode(filp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) u8 *pending_hashes;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) struct ahash_request *req;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) u64 blocks;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) unsigned int level;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) int err = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) if (inode->i_size == 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) /* Empty file is a special case; root hash is all 0's */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) memset(root_hash, 0, params->digest_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) /* This allocation never fails, since it's mempool-backed. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) req = fsverity_alloc_hash_request(params->hash_alg, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) pending_hashes = kmalloc(params->block_size, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) if (!pending_hashes)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) * Build each level of the Merkle tree, starting at the leaf level
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) * (level 0) and ascending to the root node (level 'num_levels - 1').
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) * Then at the end (level 'num_levels'), calculate the root hash.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) blocks = ((u64)inode->i_size + params->block_size - 1) >>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) params->log_blocksize;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) for (level = 0; level <= params->num_levels; level++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) err = build_merkle_tree_level(filp, level, blocks, params,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) pending_hashes, req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) blocks = (blocks + params->hashes_per_block - 1) >>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) params->log_arity;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) memcpy(root_hash, pending_hashes, params->digest_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) err = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) kfree(pending_hashes);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) fsverity_free_hash_request(params->hash_alg, req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) static int enable_verity(struct file *filp,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) const struct fsverity_enable_arg *arg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) struct inode *inode = file_inode(filp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) const struct fsverity_operations *vops = inode->i_sb->s_vop;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) struct merkle_tree_params params = { };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) struct fsverity_descriptor *desc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) size_t desc_size = sizeof(*desc) + arg->sig_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) struct fsverity_info *vi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) /* Start initializing the fsverity_descriptor */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) desc = kzalloc(desc_size, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) if (!desc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) desc->version = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) desc->hash_algorithm = arg->hash_algorithm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) desc->log_blocksize = ilog2(arg->block_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) /* Get the salt if the user provided one */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) if (arg->salt_size &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) copy_from_user(desc->salt, u64_to_user_ptr(arg->salt_ptr),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) arg->salt_size)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221) err = -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) desc->salt_size = arg->salt_size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) /* Get the signature if the user provided one */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) if (arg->sig_size &&
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) copy_from_user(desc->signature, u64_to_user_ptr(arg->sig_ptr),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229) arg->sig_size)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) err = -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) desc->sig_size = cpu_to_le32(arg->sig_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) desc->data_size = cpu_to_le64(inode->i_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) /* Prepare the Merkle tree parameters */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) err = fsverity_init_merkle_tree_params(¶ms, inode,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239) arg->hash_algorithm,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) desc->log_blocksize,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) desc->salt, desc->salt_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) * Start enabling verity on this file, serialized by the inode lock.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) * Fail if verity is already enabled or is already being enabled.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) inode_lock(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) if (IS_VERITY(inode))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) err = -EEXIST;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) err = vops->begin_enable_verity(filp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) inode_unlock(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) * Build the Merkle tree. Don't hold the inode lock during this, since
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) * on huge files this may take a very long time and we don't want to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) * force unrelated syscalls like chown() to block forever. We don't
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) * need the inode lock here because deny_write_access() already prevents
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) * the file from being written to or truncated, and we still serialize
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) * ->begin_enable_verity() and ->end_enable_verity() using the inode
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) * lock and only allow one process to be here at a time on a given file.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) pr_debug("Building Merkle tree...\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) BUILD_BUG_ON(sizeof(desc->root_hash) < FS_VERITY_MAX_DIGEST_SIZE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) err = build_merkle_tree(filp, ¶ms, desc->root_hash);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) if (err) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) fsverity_err(inode, "Error %d building Merkle tree", err);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) goto rollback;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) pr_debug("Done building Merkle tree. Root hash is %s:%*phN\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) params.hash_alg->name, params.digest_size, desc->root_hash);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) * Create the fsverity_info. Don't bother trying to save work by
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) * reusing the merkle_tree_params from above. Instead, just create the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) * fsverity_info from the fsverity_descriptor as if it were just loaded
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) * from disk. This is simpler, and it serves as an extra check that the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) * metadata we're writing is valid before actually enabling verity.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) vi = fsverity_create_info(inode, desc, desc_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) if (IS_ERR(vi)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) err = PTR_ERR(vi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) goto rollback;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) if (arg->sig_size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) pr_debug("Storing a %u-byte PKCS#7 signature alongside the file\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) arg->sig_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) * Tell the filesystem to finish enabling verity on the file.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) * Serialized with ->begin_enable_verity() by the inode lock.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) inode_lock(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) err = vops->end_enable_verity(filp, desc, desc_size, params.tree_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) inode_unlock(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) if (err) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) fsverity_err(inode, "%ps() failed with err %d",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) vops->end_enable_verity, err);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304) fsverity_free_info(vi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) } else if (WARN_ON(!IS_VERITY(inode))) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) err = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) fsverity_free_info(vi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309) /* Successfully enabled verity */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) * Readers can start using ->i_verity_info immediately, so it
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) * can't be rolled back once set. So don't set it until just
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) * after the filesystem has successfully enabled verity.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) fsverity_set_info(inode, vi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) kfree(params.hashstate);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320) kfree(desc);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323) rollback:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) inode_lock(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325) (void)vops->end_enable_verity(filp, NULL, 0, params.tree_size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) inode_unlock(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) /**
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331) * fsverity_ioctl_enable() - enable verity on a file
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) * @filp: file to enable verity on
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) * @uarg: user pointer to fsverity_enable_arg
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) * Enable fs-verity on a file. See the "FS_IOC_ENABLE_VERITY" section of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) * Documentation/filesystems/fsverity.rst for the documentation.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) * Return: 0 on success, -errno on failure
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) int fsverity_ioctl_enable(struct file *filp, const void __user *uarg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342) struct inode *inode = file_inode(filp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) struct fsverity_enable_arg arg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) if (copy_from_user(&arg, uarg, sizeof(arg)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) return -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) if (arg.version != 1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) if (arg.__reserved1 ||
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) memchr_inv(arg.__reserved2, 0, sizeof(arg.__reserved2)))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) if (arg.block_size != PAGE_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) if (arg.salt_size > sizeof_field(struct fsverity_descriptor, salt))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) return -EMSGSIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362) if (arg.sig_size > FS_VERITY_MAX_SIGNATURE_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) return -EMSGSIZE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) * Require a regular file with write access. But the actual fd must
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) * still be readonly so that we can lock out all writers. This is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) * needed to guarantee that no writable fds exist to the file once it
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369) * has verity enabled, and to stabilize the data being hashed.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) err = inode_permission(inode, MAY_WRITE);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) if (IS_APPEND(inode))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) if (S_ISDIR(inode->i_mode))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380) return -EISDIR;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382) if (!S_ISREG(inode->i_mode))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) err = mnt_want_write_file(filp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) if (err) /* -EROFS */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) err = deny_write_access(filp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) if (err) /* -ETXTBSY */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) goto out_drop_write;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393) err = enable_verity(filp, &arg);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) goto out_allow_write_access;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) * Some pages of the file may have been evicted from pagecache after
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) * being used in the Merkle tree construction, then read into pagecache
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) * again by another process reading from the file concurrently. Since
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) * these pages didn't undergo verification against the file digest which
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) * fs-verity now claims to be enforcing, we have to wipe the pagecache
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) * to ensure that all future reads are verified.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) filemap_write_and_wait(inode->i_mapping);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) invalidate_inode_pages2(inode->i_mapping);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) * allow_write_access() is needed to pair with deny_write_access().
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) * Regardless, the filesystem won't allow writing to verity files.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412) out_allow_write_access:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413) allow_write_access(filp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) out_drop_write:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) mnt_drop_write_file(filp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) EXPORT_SYMBOL_GPL(fsverity_ioctl_enable);
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags